This module uses an unauthenticated file upload vulnerability via uploadova plugin in VMware vCenter Server to upload and extract a TAR file. This TAR file contains a path traversal that allows writing files at arbitraries locations. In the vulnerable 6.5.X and 6.7.X (build 13010631 and lower) versions of VMware vCenter Server, a JSP file is deployed to gain arbitrary code execution. In the vulnerable 6.7.X (build 13643870 and greater) and 7.X versions, a file with public keys are uploaded to the vsphere-ui user home directory and then used to deploy an agent via SSH. Notice that in 6.7.X versions SSH access is disabled by default.
SolarWinds Orion is prone to a remote vulnerability that allows unauthenticated attackers to execute system commands. Using the lack of permissions that the Collector Service set on its private queues, it is possible to remotely send messages that will be deserialized allowing to execute commands as SYSTEM.
This module exploits a file disclosure vulnerability in Pulse Connect Secure SSL VPN which allows an unauthenticated attacker to download system files through specially crafted HTTP resource requests.
A remote code execution vulnerability exists in Windows when the DNS Server component fails to properly handle certain types of request.
This module first exploits a server side request forgery vulnerability present in Microsoft.Exchange.HttpProxy of Microsoft Exchange Server to bypass authentication. Then an arbitrary file write vulnerability present in WriteFileActivity of Microsoft.Exchange.Management.ControlPanel.DIService is used to deploy a .aspx file and execute commands. The deployed agent will run with the SYSTEM privileges.
This module exploits a path traversal vulnerability in the FortiOS SSL VPN web portal which allows an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource requests.
An attacker who successfully exploited the vulnerability could execute code with elevated permissions.
An attacker who successfully exploited the vulnerability could execute code with elevated permissions.
Sudo before 1.9.5p2 has a Heap-based Buffer Overflow, allowing privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.
This module exploits a vulnerability in SaferVPN loading a malicious OpenSSL engine.