Library of expert validated exploits for safe and effective pen tests
Exploit development can be an advanced penetration testing skill that takes time to master. Additionally, when on a job, pen testers often don’t have the resources to create a new exploit. Many resort to searching for and using pre-written exploits that have not been tested and must go through the timely effort of quality assurance testing in order to ensure they are secure and effective.
Core Impact users can save time by finding all the up-to-date exploits they need in one place. We provide a robust library of exploits designed to enable pen testers to safely and efficiently conduct successful penetration tests. Whether written by our own internal team or by a third party like ExCraft, you can trust they have been thoroughly tested and validated by our experts.
The universe of vulnerabilities is huge and not all of them represent the same risk for the customers. Vulnerabilities do not all have the same level of criticality. Some may be easily exploitable by a low-level user, while others may not be exploitable at all. To increase the efficiency of the attacks and the quality of the exploits provided, the Core Impact team has developed selection criteria to prioritize its analysis and implementation. We determine which exploits warrant creation based on the following questions:
What are the most critical attacks from the attacker’s perspective?
What new vulnerabilities are more likely to be exploited in real attacks?
What exploits are the most valuable for Core Impact?
Once an exploit is approved, its priority order considers the following variables:
Vulnerability Properties: CVE, disclosure date, access mechanism and privileges needed.
Target Environment Setup: OS, application prevalence, version and special configurations needed.
Value Provided to Core Impact: Customer request, usage in multiple attacks, allows the installation of an agent, etc.
Technical Cost vs. Benefit: An analysis weighing the resources needed to build an exploit with the internal and external knowledge gained in its creation.
Each one of these variables has a different weight and provides a ranking of the potential exploits to be developed. Following those criteria, the top of the list would contain, for example, a vulnerability on Windows (most popular OS) that can be exploited remotely, without authentication and that provides super user privileges.
Correspondingly, a vulnerability on an application that is rarely installed, needs special configurations, and requires User Interaction, would be at the bottom.
Stay Informed of New Core Certified Exploits
Subscribe to receive regular email updates on new exploits available for Core Impact
Browse the Core Certified Exploit Library
We provide pen testers with real-time updates for a wide range of exploits for different platforms, operating systems, and applications.
Search our continuously growing library to discover an exploit that will allow you to gain and retain access on the target host or application.
Title
Description
Date Added
CVE Link
Exploit Platform
Exploit Type
Product Name
ERDAS ER Viewer ERM_convert_to_correct_webpath Buffer Overflow Exploit
A Buffer Overflow exists within ERDAS ER Viewer due to a boundary error within the ERM_convert_to_correct_webpath() function in (ermapper_u.dll) when parsing file paths via a specially crafted ERS file.
Enterasys NetSight nssyslogd PRI Buffer Overflow Exploit
A vulnerability exists within the nssyslogd.exe component, when parsing a syslog message. The process does not properly validate the size of the destination buffer and copies user supplied data into a fixed-length buffer on the stack.
This module exploits a vulnerability in the kwedit.dll control included in the EnjoySAP application. The exploit is triggered when the PrepareToPostHTML() method processes a long string argument resulting in a stack-based buffer overflow. This module runs a malicious web site on the CORE IMPACT Console and waits for an unsuspecting user to trigger the exploit by connecting to the web site.
Emerson ROCLINK800 arpro2.dll ActiveX Control Remote Code Execution Vulnerability
This module will receive HTTP requests from vulnerable clients and install agents on them.
Exploits / Client Side
SCADA
EMC RepliStor Server rep_serv Remote DoS
EMC RepliStor Server is prone to a remote denial-of-service vulnerability. The vulnerability is caused due to an error in rep_srv.exe when processing network packets.
The best practice for installations of EMC Replication Manager is to register a Replication Manager Client (irccd.exe) instance with the appropiate Replication Manager Server (ird.exe) as soon as the client software is installed on a host. Registration is performed by Replication Manager administrators from within the Replication Manager Server.
Windows
Exploits/Remote Code Execution
Impact
EMC NetWorker nsrd RPC Service Format String Exploit Update
A Format string vulnerability in the nsrd RPC service within EMC NetWorker? allows remote attackers to execute arbitrary code via format string specifiers in a crafted message. This update adds Linux Support.
EMC NetWorker nsrd RPC Service Format String Exploit
A Format string vulnerability in the nsrd RPC service within EMC NetWorker? allows remote attackers to execute arbitrary code via format string specifiers in a crafted message.
This module exploits a remote code execution vulnerability in EMC Data Protection Advisor (DAP). Vulnerable installations of EMC DPA exposes the EJBInvokerServlet invoker servlet which does not require any type of authentication by default on certain profiles and allow remote attackers to invoke MBean methods and execute arbitrary code.
This module exploits a vulnerability in the keyhelp.ocx control included in EMC Captiva QuickScan application. The vulnerability is triggered when the JumpURL() method processes a long string argument resulting in a stack-based buffer overflow.
Windows
Exploits/Client Side
Impact
EMC AutoStart Domain Name Logging Buffer Overflow Exploit
A remote user can send specially crafted data via TCP to trigger a buffer overflow and execute arbitrary code on the target system.
EMC AlphaStor Server Agent Buffer Overflow Exploit
Multiple stack-based buffer overflows in the Command Line Interface process in the Server Agent in EMC AlphaStor 3.1 for Windows allow remote attackers to execute arbitrary code via crafted TCP packets to port 41025.
EMC AlphaStor Library Control Program Buffer Overflow Exploit
The vulnerability is caused due to an error in the AlphaStor Library Control Program when processing commands and can be exploited to cause a buffer overflow.
The Device Manager service (rrobotd.exe) in EMC AlphaStor is prone to an OS command injection vulnerability when processing DCP commands. A remote unauthenticated attacker can exploit this in order to execute arbitrary code with SYSTEM privileges on the vulnerable machine.
Remote Denial Of Service in Embedthis Goahead Webserver.
Windows
Denial of Service / Remote
SCADA
Embarcadero ERStudio Data Architect TSVisualization ActiveX loadExtensionFactory Buffer Overflow Exploit
The vulnerability lies in the failure to validate the size of the input buffer before copying it into a fixed-size buffer on the stack within the handling of the loadExtensionFactory method.
This module will receive HTTP requests from vulnerable clients and install agents on them.
Exploits / Client Side
SCADA
Elipse Mobile Server Directory Traversal
Elipse Mobile Server Directory Traversal
Windows
Exploits / Remote File Disclosure
SCADA
Elipse E3 E3Server Denial of Service
Elipse E3 E3Server Denial Of Service
Windows
Denial of Service / Remote
SCADA
Elecard MPEG Player SEH Buffer Overflow Exploit
Elecard MPEG Player contains a buffer prone to exploitation via an overly long string. The vulnerability is caused due to a boundary error in Elecard MPEG Player when handling .m3u files, situation that leads to a buffer overflow and the possibility to overwrite an SEH Pointer. This can be exploited via a specially crafted .m3u file.
Windows
Exploits/Client Side
Impact
ElbyCDIO IO Driver Privilege Escalation Exploit
This module exploits a vulnerability in ElbyCDIO.SYS driver when handling a specially crafted IOCTL request. The vulnerability allows local users to overwrite memory and execute arbitrary code via malformed Interrupt Request Packet (Irp) parameters.
This module exploits a remote PHP code injection vulnerability in Elastix PBX by uploading a renamed PHP file and leveraging a local file inclusion vulnerability to execute the PHP file. It also exploits a bad configuration in the /etc/sudoers file to elevate privileges from 'asterisk' user to 'root'.
A vulnerability in ElasticSearch versions 1.4.0 to 1.4.2 allows execution of unsandboxed Groovy code. This module installs an OS agent in vulnerable targets.