This module uses an unauthenticated file upload vulnerability via uploadova plugin in VMware vCenter Server to upload and extract a TAR file. This TAR file contains a path traversal that allows writing files at arbitraries locations. In the vulnerable 6.5.X and 6.7.X (build 13010631 and lower) versions of VMware vCenter Server, a JSP file is deployed to gain arbitrary code execution. In the vulnerable 6.7.X (build 13643870 and greater) and 7.X versions, a file with public keys are uploaded to the vsphere-ui user home directory and then used to deploy an agent via SSH. Notice that in 6.7.X versions SSH access is disabled by default.

This module exploits a file disclosure vulnerability in Pulse Connect Secure SSL VPN which allows an unauthenticated attacker to download system files through specially crafted HTTP resource requests.

This module exploits a path traversal vulnerability in the FortiOS SSL VPN web portal which allows an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource requests.

Sudo before 1.9.5p2 has a Heap-based Buffer Overflow, allowing privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.

This module uses an unauthenticated java deserialization vulnerability via T3 protocol in Oracle Weblogic Server to upload and execute a java class file to gain arbitrary code execution on the affected system.

Oracle WebLogic Server is prone to a remote vulnerability that allows unauthenticated attackers to execute system commands. By exploiting known methods, it is possible to remotely instantiate several java classes that allows to execute system commands.

This module exploits an OS command injection vulnerability in Pydio Cells. The lack of sanitisation for the input of the mailer configuration could be exploited to allow an authenticated attacker to run remote code on the underlying operating system an deploy an agent.

This module exploits a directory traversal vulnerability in F5 BIG-IP Traffic Management User Interface (TMUI). The failure in URL parsing between Apache and Java (Tomcat) allows to perform a directory traversal to access the tmshCmd.jsp page. This page allows an authenticated user to execute commands. But, using the mentioned vulnerability, an unauthenticated attacker can run remote code on the underlying operating system an deploy an agent.

Open-AudIT is vulnerable to an authenticated php file upload, allowing attackers to execute arbitrary php code in the system.

The 'recentVersion' explude_ip parameter in the discoveries endpoint is vulnerable to OS Command Injection, this module exploits this vulneravility in order to install an agent