Metasploit modules that can be used to exploit Opensuse products

Order by Disclosure Date Module Name Module Type
  • BIND TSIG Badtime Query Denial of Service
    Disclosure Date: 2020-05-19
    First seen: 2020-05-26
    auxiliary/dos/dns/bind_tsig_badtime
    A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c. Authors: - Tobias Klein - Shuto Imai
  • SaltStack Salt Master/Minion Unauthenticated RCE
    Disclosure Date: 2020-04-30
    First seen: 2020-05-14
    exploit/linux/misc/saltstack_salt_unauth_rce
    This module exploits unauthenticated access to the runner() and _send_pub() methods in the SaltStack Salt master's ZeroMQ request server, for versions 2019.2.3 and earlier and 3000.1 and earlier, to execute code as root on either the master or on select minions. VMware vRealize Operations Manager versions 7.5.0 through 8.1.0, as well as Cisco Modeling Labs Corporate Edition (CML) and Cisco Virtual Internet Routing Lab Personal Edition (VIRL-PE), for versions 1.2, 1.3, 1.5, and 1.6 in certain configurations, are known to be affected by the Salt vulnerabilities. Tested against SaltStack Salt 2019.2.3 and 3000.1 on Ubuntu 18.04, as well as Vulhub's Docker image. Authors: - F-Secure - wvu <wvu@metasploit.com>
  • SaltStack Salt Master Server Root Key Disclosure
    Disclosure Date: 2020-04-30
    First seen: 2020-05-14
    auxiliary/gather/saltstack_salt_root_key
    This module exploits unauthenticated access to the _prep_auth_info() method in the SaltStack Salt master's ZeroMQ request server, for versions 2019.2.3 and earlier and 3000.1 and earlier, to disclose the root key used to authenticate administrative commands to the master. VMware vRealize Operations Manager versions 7.5.0 through 8.1.0, as well as Cisco Modeling Labs Corporate Edition (CML) and Cisco Virtual Internet Routing Lab Personal Edition (VIRL-PE), for versions 1.2, 1.3, 1.5, and 1.6 in certain configurations, are known to be affected by the Salt vulnerabilities. Tested against SaltStack Salt 2019.2.3 and 3000.1 on Ubuntu 18.04, as well as Vulhub's Docker image. Authors: - F-Secure - wvu <wvu@metasploit.com>
  • SaltStack Salt Master/Minion Unauthenticated RCE
    Disclosure Date: 2020-04-30
    First seen: 2020-05-14
    exploit/linux/misc/saltstack_salt_unauth_rce
    This module exploits unauthenticated access to the runner() and _send_pub() methods in the SaltStack Salt master's ZeroMQ request server, for versions 2019.2.3 and earlier and 3000.1 and earlier, to execute code as root on either the master or on select minions. VMware vRealize Operations Manager versions 7.5.0 through 8.1.0, as well as Cisco Modeling Labs Corporate Edition (CML) and Cisco Virtual Internet Routing Lab Personal Edition (VIRL-PE), for versions 1.2, 1.3, 1.5, and 1.6 in certain configurations, are known to be affected by the Salt vulnerabilities. Tested against SaltStack Salt 2019.2.3 and 3000.1 on Ubuntu 18.04, as well as Vulhub's Docker image. Authors: - F-Secure - wvu <wvu@metasploit.com>
  • SaltStack Salt Master Server Root Key Disclosure
    Disclosure Date: 2020-04-30
    First seen: 2020-05-14
    auxiliary/gather/saltstack_salt_root_key
    This module exploits unauthenticated access to the _prep_auth_info() method in the SaltStack Salt master's ZeroMQ request server, for versions 2019.2.3 and earlier and 3000.1 and earlier, to disclose the root key used to authenticate administrative commands to the master. VMware vRealize Operations Manager versions 7.5.0 through 8.1.0, as well as Cisco Modeling Labs Corporate Edition (CML) and Cisco Virtual Internet Routing Lab Personal Edition (VIRL-PE), for versions 1.2, 1.3, 1.5, and 1.6 in certain configurations, are known to be affected by the Salt vulnerabilities. Tested against SaltStack Salt 2019.2.3 and 3000.1 on Ubuntu 18.04, as well as Vulhub's Docker image. Authors: - F-Secure - wvu <wvu@metasploit.com>
  • Apache Tomcat AJP File Read
    Disclosure Date: 2020-02-20
    First seen: 2020-11-30
    auxiliary/admin/http/tomcat_ghostcat
    When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP. Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations. Authors: - A Security Researcher of Chaitin Tech - SunCSR Team
  • LibreOffice Macro Python Code Execution
    Disclosure Date: 2019-07-16
    First seen: 2020-04-26
    exploit/multi/fileformat/libreoffice_logo_exec
    LibreOffice comes bundled with sample macros written in Python and allows the ability to bind program events to them. LibreLogo is a macro that allows a program event to execute text as Python code, allowing RCE. This module generates an ODT file with a dom loaded event that, when triggered, will execute arbitrary python code and the metasploit payload. Authors: - Nils Emmerich - Shelby Pace - LoadLow - Gabriel Masei
  • Docker Container Escape Via runC Overwrite
    Disclosure Date: 2019-01-01
    First seen: 2021-06-30
    exploit/linux/local/docker_runc_escape
    This module leverages a flaw in `runc` to escape a Docker container and get command execution on the host as root. This vulnerability is identified as CVE-2019-5736. It overwrites the `runc` binary with the payload and wait for someone to use `docker exec` to get into the container. This will trigger the payload execution. Note that executing this exploit carries important risks regarding the Docker installation integrity on the target and inside the container ('Side Effects' section in the documentation).
  • Reliable Datagram Sockets (RDS) rds_atomic_free_op NULL pointer dereference Privilege Escalation
    Disclosure Date: 2018-11-01
    First seen: 2020-04-26
    exploit/linux/local/rds_atomic_free_op_null_pointer_deref_priv_esc
    This module attempts to gain root privileges on Linux systems by abusing a NULL pointer dereference in the `rds_atomic_free_op` function in the Reliable Datagram Sockets (RDS) kernel module (rds.ko). Successful exploitation requires the RDS kernel module to be loaded. If the RDS module is not blacklisted (default); then it will be loaded automatically. This exploit supports 64-bit Ubuntu Linux systems, including distributions based on Ubuntu, such as Linux Mint and Zorin OS. Target offsets are available for: Ubuntu 16.04 kernels 4.4.0 <= 4.4.0-116-generic; and Ubuntu 16.04 kernels 4.8.0 <= 4.8.0-54-generic. This exploit does not bypass SMAP. Bypasses for SMEP and KASLR are included. Failed exploitation may crash the kernel. This module has been tested successfully on various 4.4 and 4.8 kernels. Authors: - Mohamed Ghannam - Jann Horn - wbowling - bcoles <bcoles@gmail.com> - nstarke
  • Postfixadmin Protected Alias Deletion Vulnerability
    Disclosure Date: 2017-02-03
    First seen: 2020-04-26
    auxiliary/admin/http/pfadmin_set_protected_alias
    Postfixadmin installations between 2.91 and 3.0.1 do not check if an admin is allowed to delete protected aliases. This vulnerability can be used to redirect protected aliases to an other mail address. Eg. rewrite the postmaster@domain alias Authors: - Jan-Frederik Rieckers
  • ImageMagick Delegate Arbitrary Command Execution
    Disclosure Date: 2016-05-03
    First seen: 2020-04-26
    exploit/unix/fileformat/imagemagick_delegate
    This module exploits a shell command injection in the way "delegates" (commands for converting files) are processed in ImageMagick versions <= 7.0.1-0 and <= 6.9.3-9 (legacy). Since ImageMagick uses file magic to detect file format, you can create a .png (for example) which is actually a crafted SVG (for example) that triggers the command injection. The PostScript (PS) target leverages a Ghostscript -dSAFER bypass (discovered by taviso) to achieve RCE in the Ghostscript delegate. Ghostscript versions 9.18 and later are affected. This target is provided as is and will not be updated to track additional vulns. If USE_POPEN is set to true, a |-prefixed command will be used for the exploit. No delegates are involved in this exploitation. Authors: - stewie - Nikolay Ermishkin - Tavis Ormandy - wvu <wvu@metasploit.com> - hdm <x@hdm.io>
  • Adobe Flash opaqueBackground Use After Free
    Disclosure Date: 2015-07-06
    First seen: 2020-04-26
    exploit/multi/browser/adobe_flash_opaque_background_uaf
    This module exploits an use after free on Adobe Flash Player. The vulnerability, discovered by Hacking Team and made public as part of the July 2015 data leak, was described as an Use After Free while handling the opaqueBackground property 7 setter of the flash.display.DisplayObject class. This module is an early release tested on: Windows XP SP3, IE8 and Flash 18.0.0.194, Windows XP SP3, IE 8 and Flash 18.0.0.203, Windows XP SP3, Firefox and Flash 18.0.0.203, Windows Vista SP2 + IE 9 and Flash 18.0.0.203, Windows Vista SP2 + Firefox 39.0 and Flash 18.0.0.203, Windows 7 SP1 (32-bit), IE11 and Adobe Flash 18.0.0.203, Windows 7 SP1 (32-bit), Firefox 38.0.5 and Adobe Flash 18.0.0.194, Windows 7 SP1 (32-bit), IE9 and Adobe Flash 18.0.0.203, Windows 7 SP1 (32-bit), Firefox and Adobe Flash 18.0.0.194, Windows 8.1 (32-bit), IE11 and Adobe Flash 18.0.0.194, windows 8.1 (32-bit), Firefox and Adobe Flash 18.0.0.203, Windows 8.1 (32-bit), Firefox and Adobe Flash 18.0.0.160 and Windows 8.1 (32-bit), Firefox and Adobe Flash 18.0.0.194 Windows 10 Build 10240 (32-bit) IE11, Firefox 39.0 and Adobe Flash 18.0.0.203 Authors: - Unknown - juan vazquez <juan.vazquez@metasploit.com> - sinn3r <sinn3r@metasploit.com>
  • Adobe Flash Player Nellymoser Audio Decoding Buffer Overflow
    Disclosure Date: 2015-06-23
    First seen: 2020-04-26
    exploit/multi/browser/adobe_flash_nellymoser_bof
    This module exploits a buffer overflow on Adobe Flash Player when handling nellymoser encoded audio inside a FLV video, as exploited in the wild on June 2015. This module has been tested successfully on: Windows 7 SP1 (32-bit), IE11 and Adobe Flash 18.0.0.160, Windows 7 SP1 (32-bit), Firefox 38.0.5 and Adobe Flash 18.0.0.160, Windows 8.1, Firefox 38.0.5 and Adobe Flash 18.0.0.160, Linux Mint "Rebecca" (32 bits), Firefox 33.0 and Adobe Flash 11.2.202.466, and Ubuntu 14.04.2 LTS, Firefox 35.01, and Adobe Flash 11.2.202.466. Note that this exploit is effective against both CVE-2015-3113 and the earlier CVE-2015-3043, since CVE-2015-3113 is effectively a regression to the same root cause as CVE-2015-3043. Authors: - Unknown - juan vazquez <juan.vazquez@metasploit.com>
  • Firefox PDF.js Privileged Javascript Injection
    Disclosure Date: 2015-03-31
    First seen: 2020-04-26
    exploit/multi/browser/firefox_pdfjs_privilege_escalation
    This module gains remote code execution on Firefox 35-36 by abusing a privilege escalation bug in resource:// URIs. PDF.js is used to exploit the bug. This exploit requires the user to click anywhere on the page to trigger the vulnerability. Authors: - Unknown - Marius Mlynski - joev <joev@metasploit.com>
  • SSL/TLS Version Detection
    Disclosure Date: 2014-10-14
    First seen: 2022-12-23
    auxiliary/scanner/ssl/ssl_version
    Check if a server supports a given version of SSL/TLS and cipher suites. The certificate is stored in loot, and any known vulnerabilities against that SSL version and cipher suite combination are checked. These checks include POODLE, deprecated protocols, expired/not valid certs, low key strength, null cipher suites, certificates signed with MD5, DROWN, RC4 ciphers, exportable ciphers, LOGJAM, and BEAST. Authors: - todb <todb@metasploit.com> - et <et@metasploit.com> - Chris John Riley - Veit Hailperin <hailperv@gmail.com> - h00die
  • Adobe Flash Player casi32 Integer Overflow
    Disclosure Date: 2014-10-14
    First seen: 2020-04-26
    exploit/windows/browser/adobe_flash_casi32_int_overflow
    This module exploits an integer overflow in Adobe Flash Player. The vulnerability occurs in the casi32 method, where an integer overflow occurs if a ByteArray of length 0 is setup as domainMemory for the current application domain. This module has been tested successfully on Windows 7 SP1 (32-bit), IE 8 to IE 11 and Flash 15.0.0.167. Authors: - bilou - juan vazquez <juan.vazquez@metasploit.com>
  • NTP Mode 7 PEER_LIST DoS Scanner
    Disclosure Date: 2014-08-25
    First seen: 2020-04-26
    auxiliary/scanner/ntp/ntp_peer_list_dos
    This module identifies NTP servers which permit "PEER_LIST" queries and return responses that are larger in size or greater in quantity than the request, allowing remote attackers to cause a distributed, reflected denial of service (aka, "DRDoS" or traffic amplification) via spoofed requests. Authors: - Jon Hart <jon_hart@rapid7.com>
  • NTP Mode 7 PEER_LIST_SUM DoS Scanner
    Disclosure Date: 2014-08-25
    First seen: 2020-04-26
    auxiliary/scanner/ntp/ntp_peer_list_sum_dos
    This module identifies NTP servers which permit "PEER_LIST_SUM" queries and return responses that are larger in size or greater in quantity than the request, allowing remote attackers to cause a distributed, reflected denial of service (aka, "DRDoS" or traffic amplification) via spoofed requests. Authors: - Jon Hart <jon_hart@rapid7.com>
  • NTP Mode 6 REQ_NONCE DRDoS Scanner
    Disclosure Date: 2014-08-25
    First seen: 2020-04-26
    auxiliary/scanner/ntp/ntp_req_nonce_dos
    This module identifies NTP servers which permit mode 6 REQ_NONCE requests that can be used to conduct DRDoS attacks. In some configurations, NTP servers will respond to REQ_NONCE requests with a response larger than the request, allowing remote attackers to cause a distributed, reflected denial of service (aka, "DRDoS" or traffic amplification) via spoofed requests. Authors: - Jon Hart <jon_hart@rapid7.com>
  • NTP Mode 6 UNSETTRAP DRDoS Scanner
    Disclosure Date: 2014-08-25
    First seen: 2020-04-26
    auxiliary/scanner/ntp/ntp_unsettrap_dos
    This module identifies NTP servers which permit mode 6 UNSETTRAP requests that can be used to conduct DRDoS attacks. In some configurations, NTP servers will respond to UNSETTRAP requests with multiple packets, allowing remote attackers to cause a distributed, reflected denial of service (aka, "DRDoS" or traffic amplification) via spoofed requests. Authors: - Jon Hart <jon_hart@rapid7.com>
54 metasploit modules found
1 2 3
Please note: Metasploit modules are only matched by CVE numbers. Visit metasploit web site for more details
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close