The vulnerability exists in HP LoadRunner Controller when handling a specially crafted LRS file. This module runs a malicious web server on the Core Impact Console and waits for an unsuspecting user to trigger the exploit by connecting to it.

The 'fusermount' binary, part of the FUSE system in Linux, executes the /bin/mount binary with ruid set to 0 without clearing the environment variables provided by unprivileged users. This flaw can be leveraged by local unprivileged users to gain root privileges by leveraging the functionality provided by the LIBMOUNT_MTAB environment variable to overwrite an arbitrary file on the affected system. This module will try to overwrite the /etc/bash.bashrc file, which is executed every time any user spawns an interactive Bash shell. That means that a new agent will be deployed every time any user opens a new interactive shell (either login or non-login ones) on the vulnerable machine. Note that this also means that installed agents will run with the privileges of the users that have launched interactive shells. Unlike other privilege escalation exploits, this module will not stop after installing the first agent; it will stay running until a new agent with root permissions is installed (that is, if the root user happens to run an interactive shell on the vulnerable machine), or until the user-specified time limit is reached, whatever happens first. Note that non-root agents will be kept, since they still can be valuable despite not having superuser privileges.

This module exploits a command injection vulnerability in HP Client Automation. The flaw exists within the radexecd.exe component which listens by default on TCP port 3465. When handling a remote execution request the process does not properly authenticate the user issuing the request. The command to be executed is also not properly sanitized. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of SYSTEM. Authentication is not required to exploit this vulnerability.

Elasticsearch allows limited execution of Groovy code during search operations. A vulnerability exists in versions below 1.4.3, by which a sandbox escape is possible. This module installs an OS agent against vulnerable installations.

An elevation of privilege vulnerability exists when Windows kernel does not properly constrain impersonation levels. The vulnerability occurs because a user can place symlinks for the system drives in the per-login session device map and the kernel will follow them during impersonation. An attacker who successfully exploited this vulnerability may, for example, redirect a call to LoadLibrary, from a system service (when impersonating), to an arbitrary location.

This module exploits when sending specially crafted argument to makeMeasurement leaving objects in an inconsistent state. This produces a leak via a call to dumpMeasureData storing a file to a share folder with importante addresses and can later be retrieved .Finally using NSendApprovalToAuthorEnabled method it is possible to bypass the Javascript API restrictions and resend a new crafted PDF to the browser to produce buffer overflow and complete exploitation. This module runs a malicious web site on the CORE IMPACT Console and waits for an unsuspecting user to trigger the exploit by connecting to the web site.

This module exploit three different vulnerabilities in Symantec Endpoint Protection Manager (SEPM) in order to install an agent on a vunlerable target machine. CVE-2015-1486 allows unauthenticated attackers access to SEPM. CVE-2015-1487 allows reading and writing arbitrary files, resulting in the execution of arbitrary commands with 'NT Service\semsrv' privileges. CVE-2015-1489 allows the execution of arbitrary OS commands with 'NT Authority\SYSTEM' privileges.

This module exploits an integer overflow in "srvnet.sys" Windows driver by sending a crafted "Session Setup Request" SMBv2 packet to the Windows SMB Server logging mechanism.

This module exploits an integer overflow vulnerability in Adobe Flash Player. The signed integer overflow exists inside the AS3 Function.apply() method and allows an attacker to take control of a vulnerable target and execute arbitrary code.

Buffer overflow in Microsoft Office allows remote attackers to execute arbitrary code via crafted EPS file in an Office document, leading to improper memory allocation.