Metasploit modules that can be used to exploit Microsoft » Windows Server 2008 » N/A gold itanium

Order by Disclosure Date Module Name Module Type
  • Microsoft Windows Shell LNK Code Execution
    Disclosure Date: 2010-07-16
    First seen: 2020-04-26
    exploit/windows/smb/ms10_046_shortcut_icon_dllloader
    This module exploits a vulnerability in the handling of Windows Shortcut files (.LNK) that contain an icon resource pointing to a malicious DLL. This creates an SMB resource to provide the payload inside a DLL, and generates a LNK file which must be sent to the target. Authors: - hdm <x@hdm.io> - jduck <jduck@metasploit.com> - B_H
  • Microsoft Windows Shell LNK Code Execution
    Disclosure Date: 2010-07-16
    First seen: 2020-04-26
    exploit/windows/browser/ms10_046_shortcut_icon_dllloader
    This module exploits a vulnerability in the handling of Windows Shortcut files (.LNK) that contain an icon resource pointing to a malicious DLL. This module creates a WebDAV service that can be used to run an arbitrary payload when accessed as a UNC path. Authors: - hdm <x@hdm.io> - jduck <jduck@metasploit.com> - B_H
  • Microsoft Windows EOT Font Table Directory Integer Overflow
    Disclosure Date: 2009-11-10
    First seen: 2020-04-26
    auxiliary/dos/windows/browser/ms09_065_eot_integer
    This module exploits an integer overflow flaw in the Microsoft Windows Embedded OpenType font parsing code located in win32k.sys. Since the kernel itself parses embedded web fonts, it is possible to trigger a BSoD from a normal web page when viewed with Internet Explorer. Authors: - hdm <x@hdm.io>
  • MS08-068 Microsoft Windows SMB Relay Code Execution
    Disclosure Date: 2001-03-31
    First seen: 2020-04-26
    exploit/windows/smb/smb_relay
    This module will relay SMB authentication requests to another host, gaining access to an authenticated SMB session if successful. If the connecting user is an administrator and network logins are allowed to the target machine, this module will execute an arbitrary payload. To exploit this, the target system must try to authenticate to this module. The easiest way to force a SMB authentication attempt is by embedding a UNC path (\SERVER\SHARE) into a web page or email message. When the victim views the web page or email, their system will automatically connect to the server specified in the UNC share (the IP address of the system running this module) and attempt to authenticate. Unfortunately, this module is not able to clean up after itself. The service and payload file listed in the output will need to be manually removed after access has been gained. The service created by this tool uses a randomly chosen name and description, so the services list can become cluttered after repeated exploitation. The SMB authentication relay attack was first reported by Sir Dystic on March 31st, 2001 at @lanta.con in Atlanta, Georgia. On November 11th 2008 Microsoft released bulletin MS08-068. This bulletin includes a patch which prevents the relaying of challenge keys back to the host which issued them, preventing this exploit from working in the default configuration. It is still possible to set the SMBHOST parameter to a third-party host that the victim is authorized to access, but the "reflection" attack has been effectively broken. As of Feb 2022 - this module does not support SMB 1. Authors: - hdm <x@hdm.io> - juan vazquez <juan.vazquez@metasploit.com> - agalway-r7 - alanfoster - Spencer McIntyre
4 metasploit modules found
Please note: Metasploit modules are only matched by CVE numbers. Visit metasploit web site for more details
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close