Metasploit modules that can be used to exploit Novell products

Order by Disclosure Date Module Name Module Type
  • Linux Kernel 4.6.3 Netfilter Privilege Escalation
    Disclosure Date: 2016-06-03
    First seen: 2020-04-26
    exploit/linux/local/netfilter_priv_esc_ipv4
    This module attempts to exploit a netfilter bug on Linux Kernels before 4.6.3, and currently only works against Ubuntu 16.04 (not 16.04.1) with kernel 4.4.0-21-generic. Several conditions have to be met for successful exploitation: Ubuntu: 1. ip_tables.ko (ubuntu), iptable_raw (fedora) has to be loaded (root running iptables -L will do such) 2. libc6-dev-i386 (ubuntu), glibc-devel.i686 & libgcc.i686 (fedora) needs to be installed to compile Kernel 4.4.0-31-generic and newer are not vulnerable. This exploit does not bypass SMEP/SMAP. We write the ascii files and compile on target instead of locally since metasm bombs for not having cdefs.h (even if locally installed) Authors: - h00die <mike@stcyrsecurity.com> - vnik - Jesse Hertz - Tim Newsham
  • Novell ServiceDesk Authenticated File Upload
    Disclosure Date: 2016-03-30
    First seen: 2020-04-26
    exploit/multi/http/novell_servicedesk_rce
    This module exploits an authenticated arbitrary file upload via directory traversal to execute code on the target. It has been tested on versions 6.5 and 7.1.0, in Windows and Linux installations of Novell ServiceDesk, as well as the Virtual Appliance provided by Novell. Authors: - Pedro Ribeiro <pedrib@gmail.com>
  • Adobe Flash Player Nellymoser Audio Decoding Buffer Overflow
    Disclosure Date: 2015-06-23
    First seen: 2020-04-26
    exploit/multi/browser/adobe_flash_nellymoser_bof
    This module exploits a buffer overflow on Adobe Flash Player when handling nellymoser encoded audio inside a FLV video, as exploited in the wild on June 2015. This module has been tested successfully on: Windows 7 SP1 (32-bit), IE11 and Adobe Flash 18.0.0.160, Windows 7 SP1 (32-bit), Firefox 38.0.5 and Adobe Flash 18.0.0.160, Windows 8.1, Firefox 38.0.5 and Adobe Flash 18.0.0.160, Linux Mint "Rebecca" (32 bits), Firefox 33.0 and Adobe Flash 11.2.202.466, and Ubuntu 14.04.2 LTS, Firefox 35.01, and Adobe Flash 11.2.202.466. Note that this exploit is effective against both CVE-2015-3113 and the earlier CVE-2015-3043, since CVE-2015-3113 is effectively a regression to the same root cause as CVE-2015-3043. Authors: - Unknown - juan vazquez <juan.vazquez@metasploit.com>
  • Novell ZENworks Configuration Management Arbitrary File Upload
    Disclosure Date: 2015-04-07
    First seen: 2020-04-26
    exploit/multi/http/zenworks_configuration_management_upload
    This module exploits a file upload vulnerability in Novell ZENworks Configuration Management (ZCM, which is part of the ZENworks Suite). The vulnerability exists in the UploadServlet which accepts unauthenticated file uploads and does not check the "uid" parameter for directory traversal characters. This allows an attacker to write anywhere in the file system, and can be abused to deploy a WAR file in the Tomcat webapps directory. ZCM up to (and including) 11.3.1 is vulnerable to this attack. This module has been tested successfully with ZCM 11.3.1 on Windows and Linux. Note that this is a similar vulnerability to ZDI-10-078 / OSVDB-63412 which also has a Metasploit exploit, but it abuses a different parameter of the same servlet. Authors: - Pedro Ribeiro <pedrib@gmail.com>
  • SSL/TLS Version Detection
    Disclosure Date: 2014-10-14
    First seen: 2022-12-23
    auxiliary/scanner/ssl/ssl_version
    Check if a server supports a given version of SSL/TLS and cipher suites. The certificate is stored in loot, and any known vulnerabilities against that SSL version and cipher suite combination are checked. These checks include POODLE, deprecated protocols, expired/not valid certs, low key strength, null cipher suites, certificates signed with MD5, DROWN, RC4 ciphers, exportable ciphers, LOGJAM, and BEAST. Authors: - todb <todb@metasploit.com> - et <et@metasploit.com> - Chris John Riley - Veit Hailperin <hailperv@gmail.com> - h00die
  • Novell Client 2 SP3 nicm.sys Local Privilege Escalation
    Disclosure Date: 2013-05-22
    First seen: 2020-04-26
    exploit/windows/local/novell_client_nicm
    This module exploits a flaw in the nicm.sys driver to execute arbitrary code in kernel space. The vulnerability occurs while handling ioctl requests with code 0x143B6B, where a user provided pointer is used as function pointer. The module has been tested successfully on Windows 7 SP1 with Novell Client 2 SP3. Authors: - Unknown - juan vazquez <juan.vazquez@metasploit.com>
  • Novell ZENworks Configuration Management Remote Execution
    Disclosure Date: 2013-03-22
    First seen: 2020-04-26
    exploit/multi/http/zenworks_control_center_upload
    This module exploits a code execution flaw in Novell ZENworks Configuration Management 10 SP3 and 11 SP2. The vulnerability exists in the ZENworks Control Center application, allowing an unauthenticated attacker to upload a malicious file outside of the TEMP directory and then make a second request that allows for arbitrary code execution. This module has been tested successfully on Novell ZENworks Configuration Management 10 SP3 and 11 SP2 on Windows 2003 SP2 and SUSE Linux Enterprise Server 10 SP3. Authors: - James Burton - juan vazquez <juan.vazquez@metasploit.com>
  • Novell Zenworks Mobile Managment MDM.php Local File Inclusion Vulnerability
    Disclosure Date: 2013-03-13
    First seen: 2020-04-26
    exploit/windows/http/novell_mdm_lfi
    This module exercises a vulnerability in Novel Zenworks Mobile Management's Mobile Device Management component which can allow unauthenticated remote code execution. Due to a flaw in the MDM.php script's input validation, remote attackers can both upload and execute code via a directory traversal flaw exposed in the 'language' parameter of a POST call to DUSAP.php. Authors: - steponequit - Andrea Micalizzi (aka rgod)
  • Novell GroupWise Client gwcls1.dll ActiveX Remote Code Execution
    Disclosure Date: 2013-01-30
    First seen: 2020-04-26
    exploit/windows/browser/novell_groupwise_gwcls1_actvx
    This module exploits a vulnerability in the Novell GroupWise Client gwcls1.dll ActiveX. Several methods in the GWCalServer control use user provided data as a pointer, which allows to read arbitrary memory and execute arbitrary code. This module has been tested successfully with GroupWise Client 2012 on IE6 - IE9. The JRE6 needs to be installed to achieve ASLR bypass. Authors: - rgod <rgod@autistici.org> - juan vazquez <juan.vazquez@metasploit.com>
  • NFR Agent Heap Overflow Vulnerability
    Disclosure Date: 2012-11-16
    First seen: 2020-04-26
    auxiliary/dos/http/novell_file_reporter_heap_bof
    This module exploits a heap overflow in NFRAgent.exe, a component of Novell File Reporter (NFR). The vulnerability occurs when handling requests of name "SRS", where NFRAgent.exe fails to generate a response in a secure way, copying user controlled data into a fixed-length buffer in the heap without bounds checking. This module has been tested against NFR Agent 1.0.4.3 (File Reporter 1.0.2). Authors: - juan vazquez <juan.vazquez@metasploit.com>
  • NFR Agent FSFUI Record File Upload RCE
    Disclosure Date: 2012-11-16
    First seen: 2020-04-26
    exploit/windows/novell/file_reporter_fsfui_upload
    NFRAgent.exe, a component of Novell File Reporter (NFR), allows remote attackers to upload arbitrary files via a directory traversal while handling requests to /FSF/CMD with FSFUI records with UICMD 130. This module has been tested successfully against NFR Agent 1.0.4.3 (File Reporter 1.0.2) and NFR Agent 1.0.3.22 (File Reporter 1.0.1). Authors: - juan vazquez <juan.vazquez@metasploit.com>
  • NFR Agent SRS Record Arbitrary Remote File Access
    Disclosure Date: 2012-11-16
    First seen: 2020-04-26
    auxiliary/scanner/http/novell_file_reporter_srs_fileaccess
    NFRAgent.exe, a component of Novell File Reporter (NFR), allows remote attackers to retrieve arbitrary files via a request to /FSF/CMD with a SRS Record with OPERATION 4 and CMD 103, specifying a full pathname. This module has been tested successfully against NFR Agent 1.0.4.3 (File Reporter 1.0.2) and NFR Agent 1.0.3.22 (File Reporter 1.0.1). Authors: - juan vazquez <juan.vazquez@metasploit.com>
  • NFR Agent FSFUI Record Arbitrary Remote File Access
    Disclosure Date: 2012-11-16
    First seen: 2020-04-26
    auxiliary/scanner/http/novell_file_reporter_fsfui_fileaccess
    NFRAgent.exe, a component of Novell File Reporter (NFR), allows remote attackers to retrieve arbitrary text files via a directory traversal while handling requests to /FSF/CMD with an FSFUI record with UICMD 126. This module has been tested successfully against NFR Agent 1.0.4.3 (File Reporter 1.0.2) and NFR Agent 1.0.3.22 (File Reporter 1.0.1). Authors: - juan vazquez <juan.vazquez@metasploit.com>
  • Novell ZENworks Configuration Management Preboot Service 0x6c Buffer Overflow
    Disclosure Date: 2012-02-22
    First seen: 2020-04-26
    exploit/windows/novell/zenworks_preboot_op6c_bof
    This module exploits a remote buffer overflow in the ZENworks Configuration Management. The vulnerability exists in the Preboot service and can be triggered by sending a specially crafted packet with the opcode 0x6c (PROXY_CMD_GET_NEXT_STEP) to port 998/TCP. The module has been successfully tested on Novell ZENworks Configuration Management 10 SP2 / SP3 and Windows Server 2003 SP2 (DEP bypass). Authors: - Luigi Auriemma - juan vazquez <juan.vazquez@metasploit.com>
  • Novell ZENworks Configuration Management Preboot Service 0x4c Buffer Overflow
    Disclosure Date: 2012-02-22
    First seen: 2020-04-26
    exploit/windows/novell/zenworks_preboot_op4c_bof
    This module exploits a remote buffer overflow in the ZENworks Configuration Management. The vulnerability exists in the Preboot service and can be triggered by sending a specially crafted packet with the opcode 0x4c (PROXY_CMD_PREBOOT_TASK_INFO2) to port 998/TCP. The module has been successfully tested on Novell ZENworks Configuration Management 10 SP2 / SP3 and Windows Server 2003 SP2 (DEP bypass). Authors: - Luigi Auriemma - juan vazquez <juan.vazquez@metasploit.com>
  • Novell ZENworks Asset Management Remote Execution
    Disclosure Date: 2011-11-02
    First seen: 2020-04-26
    exploit/windows/http/zenworks_assetmgmt_uploadservlet
    This module exploits a path traversal flaw in Novell ZENworks Asset Management 7.5. By exploiting the CatchFileServlet, an attacker can upload a malicious file outside of the MalibuUploadDirectory and then make a secondary request that allows for arbitrary code execution. Authors: - Unknown - juan vazquez <juan.vazquez@metasploit.com>
  • AdminStudio LaunchHelp.dll ActiveX Arbitrary Code Execution
    Disclosure Date: 2011-10-19
    First seen: 2020-04-26
    exploit/windows/browser/zenworks_helplauncher_exec
    This module exploits a vulnerability in AdminStudio LaunchHelp.dll ActiveX control. The LaunchProcess function found in LaunchHelp.HelpLauncher.1 allows remote attackers to run arbitrary commands on the victim machine. This module has been successfully tested with the ActiveX installed with AdminStudio 9.5, which also comes with Novell ZENworks Configuration Management 10 SP2, on IE 6 and IE 8 over Windows XP SP 3. Authors: - rgod - juan vazquez <juan.vazquez@metasploit.com>
  • Novell iPrint Client ActiveX Control Buffer Overflow
    Disclosure Date: 2010-11-15
    First seen: 2020-04-26
    exploit/windows/browser/novelliprint_getdriversettings_2
    This module exploits a stack buffer overflow in Novell iPrint Client 5.52. When sending an overly long string to the GetDriverSettings() property of ienipp.ocx an attacker may be able to execute arbitrary code. Authors: - mr_me <steventhomasseeley@gmail.com> - Dr_IDE
  • Novell iPrint Client ActiveX Control call-back-url Buffer Overflow
    Disclosure Date: 2010-08-20
    First seen: 2020-04-26
    exploit/windows/browser/novelliprint_callbackurl
    This module exploits a stack-based buffer overflow in Novell iPrint Client 5.42. When sending an overly long string to the 'call-back-url' parameter in an op-client-interface-version action of ienipp.ocx an attacker may be able to execute arbitrary code. Authors: - Trancer <mtrancer@gmail.com>
  • Novell iPrint Client ActiveX Control ExecuteRequest debug Buffer Overflow
    Disclosure Date: 2010-08-04
    First seen: 2020-04-26
    exploit/windows/browser/novelliprint_executerequest_dbg
    This module exploits a stack-based buffer overflow in Novell iPrint Client 5.40. When sending an overly long string to the 'debug' parameter in ExecuteRequest() property of ienipp.ocx an attacker may be able to execute arbitrary code. Authors: - Trancer <mtrancer@gmail.com>
60 metasploit modules found
1 2 3
Please note: Metasploit modules are only matched by CVE numbers. Visit metasploit web site for more details
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close