There is a directory traversal flaw in the fileserver upload/download functionality used for blob messages in Apache ActiveMQ. The vulnerability allows writing files anywhere in the filesystem as long as the user running the process has permissions to do so. It also allows to copy local files to local or remote destinations, the later by means of abusing UNC paths. This module first uses the vulnerability to upload the credentials for the web administration application to a SMB server and parses the credentials. It then uploads a "Java Server Pages" file, which remains accessible only with appropriate credentials. It then uses the previously retrieved credentials to access the page and achieve remote code execution. The upload of content from the server is done using a MOVE HTTP verb against a REST service. Due to its semantics, the file retrieved is also deleted. This module uses the vulnerability to restore the web application passwords file once it's been retrieved. Because something might stop the process at this point, this module is marked as potentially leaving the service unavailable.

The default Jenkins configuration allows to execute groovy scripts without being authenticated.

Oracle WebLogic Server is prone to a remote vulnerability that allows attackers to take advantage of a deserialization vulnerability present in the commons-collections Java library. By exploiting known methods, it is possible to remotely load a InvokerTransformer Java class, wich allows the execution of system commands.

Jenkins is prone to a remote vulnerability that allows attackers to take advantage of a deserialization vulnerability present in the commons-collections Java library. By exploiting known methods, it is possible to remotely load a InvokerTransformer Java class, which allows the execution of system commands.

JBoss Application Server is prone to a remote vulnerability that allows attackers to take advantage of a deserialization vulnerability present in the commons-collections java library. By exploiting known methods, it is possible to remotely load a InvokerTransformer java class, wich allows the execution of system commands.

IBM WebSphere Application Server is prone to a remote vulnerability that allows attackers to take advantage of a deserialization vulnerability present in the commons-collections java library. By exploiting known methods, it is possible to remotely load a InvokerTransformer java class, wich allows the execution of system commands.

This module exploits a command injection vulnerability in HP Client Automation. The flaw exists within the radexecd.exe component which listens by default on TCP port 3465. When handling a remote execution request the process does not properly authenticate the user issuing the request. The command to be executed is also not properly sanitized. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of SYSTEM. Authentication is not required to exploit this vulnerability.

Elasticsearch allows limited execution of Groovy code during search operations. A vulnerability exists in versions below 1.4.3, by which a sandbox escape is possible. This module installs an OS agent against vulnerable installations.

This module exploit three different vulnerabilities in Symantec Endpoint Protection Manager (SEPM) in order to install an agent on a vunlerable target machine. CVE-2015-1486 allows unauthenticated attackers access to SEPM. CVE-2015-1487 allows reading and writing arbitrary files, resulting in the execution of arbitrary commands with 'NT Service\semsrv' privileges. CVE-2015-1489 allows the execution of arbitrary OS commands with 'NT Authority\SYSTEM' privileges.

This module exploits an integer overflow in "srvnet.sys" Windows driver by sending a crafted "Session Setup Request" SMBv2 packet to the Windows SMB Server logging mechanism.