Metasploit modules that can be used to exploit Oracle products

Order by Disclosure Date Module Name Module Type
  • Linux Kernel 4.6.3 Netfilter Privilege Escalation
    Disclosure Date: 2016-06-03
    First seen: 2020-04-26
    exploit/linux/local/netfilter_priv_esc_ipv4
    This module attempts to exploit a netfilter bug on Linux Kernels before 4.6.3, and currently only works against Ubuntu 16.04 (not 16.04.1) with kernel 4.4.0-21-generic. Several conditions have to be met for successful exploitation: Ubuntu: 1. ip_tables.ko (ubuntu), iptable_raw (fedora) has to be loaded (root running iptables -L will do such) 2. libc6-dev-i386 (ubuntu), glibc-devel.i686 & libgcc.i686 (fedora) needs to be installed to compile Kernel 4.4.0-31-generic and newer are not vulnerable. This exploit does not bypass SMEP/SMAP. We write the ascii files and compile on target instead of locally since metasm bombs for not having cdefs.h (even if locally installed) Authors: - h00die <mike@stcyrsecurity.com> - vnik - Jesse Hertz - Tim Newsham
  • Linux Kernel 4.6.3 Netfilter Privilege Escalation
    Disclosure Date: 2016-06-03
    First seen: 2020-04-26
    exploit/linux/local/netfilter_priv_esc_ipv4
    This module attempts to exploit a netfilter bug on Linux Kernels before 4.6.3, and currently only works against Ubuntu 16.04 (not 16.04.1) with kernel 4.4.0-21-generic. Several conditions have to be met for successful exploitation: Ubuntu: 1. ip_tables.ko (ubuntu), iptable_raw (fedora) has to be loaded (root running iptables -L will do such) 2. libc6-dev-i386 (ubuntu), glibc-devel.i686 & libgcc.i686 (fedora) needs to be installed to compile Kernel 4.4.0-31-generic and newer are not vulnerable. This exploit does not bypass SMEP/SMAP. We write the ascii files and compile on target instead of locally since metasm bombs for not having cdefs.h (even if locally installed) Authors: - h00die <mike@stcyrsecurity.com> - vnik - Jesse Hertz - Tim Newsham
  • Apache Struts Dynamic Method Invocation Remote Code Execution
    Disclosure Date: 2016-04-27
    First seen: 2020-04-26
    exploit/multi/http/struts_dmi_exec
    This module exploits a remote command execution vulnerability in Apache Struts version between 2.3.20 and 2.3.28 (except 2.3.20.2 and 2.3.24.2). Remote Code Execution can be performed via method: prefix when Dynamic Method Invocation is enabled. Authors: - Nixawk - rungobier
  • Oracle ATS Arbitrary File Upload
    Disclosure Date: 2016-01-20
    First seen: 2020-04-26
    exploit/multi/http/oracle_ats_file_upload
    This module exploits an authentication bypass and arbitrary file upload in Oracle Application Testing Suite (OATS), version 12.4.0.2.0 and unknown earlier versions, to upload and execute a JSP shell. Authors: - Zhou Yu - wvu <wvu@metasploit.com>
  • Oracle ATS Arbitrary File Upload
    Disclosure Date: 2016-01-20
    First seen: 2020-04-26
    exploit/multi/http/oracle_ats_file_upload
    This module exploits an authentication bypass and arbitrary file upload in Oracle Application Testing Suite (OATS), version 12.4.0.2.0 and unknown earlier versions, to upload and execute a JSP shell. Authors: - Zhou Yu - wvu <wvu@metasploit.com>
  • Path Traversal in Oracle GlassFish Server Open Source Edition
    Disclosure Date: 2015-08-08
    First seen: 2020-04-26
    auxiliary/scanner/http/glassfish_traversal
    This module exploits an unauthenticated directory traversal vulnerability which exists in administration console of Oracle GlassFish Server 4.1, which is listening by default on port 4848/TCP. Authors: - Trustwave SpiderLabs - Dhiraj Mishra
  • OpenSSL Alternative Chains Certificate Forgery MITM Proxy
    Disclosure Date: 2015-07-09
    First seen: 2020-04-26
    auxiliary/server/openssl_altchainsforgery_mitm_proxy
    This module exploits a logic error in OpenSSL by impersonating the server and sending a specially-crafted chain of certificates, resulting in certain checks on untrusted certificates to be bypassed on the client, allowing it to use a valid leaf certificate as a CA certificate to sign a fake certificate. The SSL/TLS session is then proxied to the server allowing the session to continue normally and application data transmitted between the peers to be saved. The valid leaf certificate must not contain the keyUsage extension or it must have at least the keyCertSign bit set (see X509_check_issued function in crypto/x509v3/v3_purp.c); otherwise; X509_verify_cert fails with X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY. This module requires an active man-in-the-middle attack. Authors: - David Benjamin - Adam Langley - Ramon de C Valle <rcvalle@metasploit.com>
  • Oracle Weblogic Server Deserialization RCE - Raw Object
    Disclosure Date: 2015-01-28
    First seen: 2020-04-26
    exploit/multi/misc/weblogic_deserialize_rawobject
    An unauthenticated attacker with network access to the Oracle Weblogic Server T3 interface can send a serialized object (weblogic.jms.common.StreamMessageImpl) to the interface to execute code on vulnerable hosts. Authors: - Andres Rodriguez - Stephen Breen - Aaron Soto - Steve Embling
  • Exim GHOST (glibc gethostbyname) Buffer Overflow
    Disclosure Date: 2015-01-27
    First seen: 2020-04-26
    exploit/linux/smtp/exim_gethostbyname_bof
    This module remotely exploits CVE-2015-0235, aka GHOST, a heap-based buffer overflow in the GNU C Library's gethostbyname functions on x86 and x86_64 GNU/Linux systems that run the Exim mail server. Authors: - Unknown
  • Java Secure Socket Extension (JSSE) SKIP-TLS MITM Proxy
    Disclosure Date: 2015-01-20
    First seen: 2020-04-26
    auxiliary/server/jsse_skiptls_mitm_proxy
    This module exploits an incomplete internal state distinction in Java Secure Socket Extension (JSSE) by impersonating the server and finishing the handshake before the peers have authenticated themselves and instantiated negotiated security parameters, resulting in a plaintext SSL/TLS session with the client. This plaintext SSL/TLS session is then proxied to the server using a second SSL/TLS session from the proxy to the server (or an alternate fake server) allowing the session to continue normally and plaintext application data transmitted between the peers to be saved. This module requires an active man-in-the-middle attack. Authors: - Ramon de C Valle <rcvalle@metasploit.com>
  • SSL/TLS Version Detection
    Disclosure Date: 2014-10-14
    First seen: 2022-12-23
    auxiliary/scanner/ssl/ssl_version
    Check if a server supports a given version of SSL/TLS and cipher suites. The certificate is stored in loot, and any known vulnerabilities against that SSL version and cipher suite combination are checked. These checks include POODLE, deprecated protocols, expired/not valid certs, low key strength, null cipher suites, certificates signed with MD5, DROWN, RC4 ciphers, exportable ciphers, LOGJAM, and BEAST. Authors: - todb <todb@metasploit.com> - et <et@metasploit.com> - Chris John Riley - Veit Hailperin <hailperv@gmail.com> - h00die
  • SSL/TLS Version Detection
    Disclosure Date: 2014-10-14
    First seen: 2022-12-23
    auxiliary/scanner/ssl/ssl_version
    Check if a server supports a given version of SSL/TLS and cipher suites. The certificate is stored in loot, and any known vulnerabilities against that SSL version and cipher suite combination are checked. These checks include POODLE, deprecated protocols, expired/not valid certs, low key strength, null cipher suites, certificates signed with MD5, DROWN, RC4 ciphers, exportable ciphers, LOGJAM, and BEAST. Authors: - todb <todb@metasploit.com> - et <et@metasploit.com> - Chris John Riley - Veit Hailperin <hailperv@gmail.com> - h00die
  • SSL/TLS Version Detection
    Disclosure Date: 2014-10-14
    First seen: 2022-12-23
    auxiliary/scanner/ssl/ssl_version
    Check if a server supports a given version of SSL/TLS and cipher suites. The certificate is stored in loot, and any known vulnerabilities against that SSL version and cipher suite combination are checked. These checks include POODLE, deprecated protocols, expired/not valid certs, low key strength, null cipher suites, certificates signed with MD5, DROWN, RC4 ciphers, exportable ciphers, LOGJAM, and BEAST. Authors: - todb <todb@metasploit.com> - et <et@metasploit.com> - Chris John Riley - Veit Hailperin <hailperv@gmail.com> - h00die
  • NTP Mode 7 PEER_LIST DoS Scanner
    Disclosure Date: 2014-08-25
    First seen: 2020-04-26
    auxiliary/scanner/ntp/ntp_peer_list_dos
    This module identifies NTP servers which permit "PEER_LIST" queries and return responses that are larger in size or greater in quantity than the request, allowing remote attackers to cause a distributed, reflected denial of service (aka, "DRDoS" or traffic amplification) via spoofed requests. Authors: - Jon Hart <jon_hart@rapid7.com>
  • NTP Mode 7 PEER_LIST_SUM DoS Scanner
    Disclosure Date: 2014-08-25
    First seen: 2020-04-26
    auxiliary/scanner/ntp/ntp_peer_list_sum_dos
    This module identifies NTP servers which permit "PEER_LIST_SUM" queries and return responses that are larger in size or greater in quantity than the request, allowing remote attackers to cause a distributed, reflected denial of service (aka, "DRDoS" or traffic amplification) via spoofed requests. Authors: - Jon Hart <jon_hart@rapid7.com>
  • NTP Mode 6 REQ_NONCE DRDoS Scanner
    Disclosure Date: 2014-08-25
    First seen: 2020-04-26
    auxiliary/scanner/ntp/ntp_req_nonce_dos
    This module identifies NTP servers which permit mode 6 REQ_NONCE requests that can be used to conduct DRDoS attacks. In some configurations, NTP servers will respond to REQ_NONCE requests with a response larger than the request, allowing remote attackers to cause a distributed, reflected denial of service (aka, "DRDoS" or traffic amplification) via spoofed requests. Authors: - Jon Hart <jon_hart@rapid7.com>
  • NTP Mode 6 UNSETTRAP DRDoS Scanner
    Disclosure Date: 2014-08-25
    First seen: 2020-04-26
    auxiliary/scanner/ntp/ntp_unsettrap_dos
    This module identifies NTP servers which permit mode 6 UNSETTRAP requests that can be used to conduct DRDoS attacks. In some configurations, NTP servers will respond to UNSETTRAP requests with multiple packets, allowing remote attackers to cause a distributed, reflected denial of service (aka, "DRDoS" or traffic amplification) via spoofed requests. Authors: - Jon Hart <jon_hart@rapid7.com>
  • NTP Mode 7 GET_RESTRICT DRDoS Scanner
    Disclosure Date: 2014-08-25
    First seen: 2020-04-26
    auxiliary/scanner/ntp/ntp_reslist_dos
    This module identifies NTP servers which permit "reslist" queries and obtains the list of restrictions placed on various network interfaces, networks or hosts. The reslist feature allows remote attackers to cause a distributed, reflected denial of service (aka, "DRDoS" or traffic amplification) via spoofed requests. The more interfaces, networks or hosts with specific restrictions, the greater the amplification. requests. Authors: - Jon Hart <jon_hart@rapid7.com>
  • VirtualBox Guest Additions VBoxGuest.sys Privilege Escalation
    Disclosure Date: 2014-07-15
    First seen: 2020-04-26
    exploit/windows/local/virtual_box_guest_additions
    A vulnerability within the VBoxGuest driver allows an attacker to inject memory they control into an arbitrary location they define. This can be used by an attacker to overwrite HalDispatchTable+0x4 and execute arbitrary code by subsequently calling NtQueryIntervalProfile on Windows XP SP3 systems. This has been tested with VBoxGuest Additions up to 4.3.10r93012. Authors: - Matt Bergin <level@korelogic.com> - Jay Smith <jsmith@korelogic.com>
  • Oracle Event Processing FileUploadServlet Arbitrary File Upload
    Disclosure Date: 2014-04-21
    First seen: 2020-04-26
    exploit/windows/http/oracle_event_processing_upload
    This module exploits an arbitrary file upload vulnerability in Oracle Event Processing 11.1.1.7.0. The FileUploadServlet component, which requires no authentication, can be abused to upload a malicious file onto an arbitrary location due to a directory traversal flaw, and compromise the server. By default Oracle Event Processing uses a Jetty Application Server without JSP support, which limits the attack to WbemExec. The current WbemExec technique only requires arbitrary write to the file system, but at the moment the module only supports Windows 2003 SP2 or older. Authors: - rgod <rgod@autistici.org> - juan vazquez <juan.vazquez@metasploit.com>
80 metasploit modules found
1 2 3 4
Please note: Metasploit modules are only matched by CVE numbers. Visit metasploit web site for more details
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close