{“lastseen”:”2026-05-21T19:28:01″,”description”:”This module identifies ollama instances and enumerates the LLM models which have been loaded and are running. Module Options msf use auxiliary\/scanner\/http\/ollamainfo msf auxiliaryollamainfo show actions …actions… msf auxiliaryollamainfo set ACTION…”,”published”:”2026-05-21T19:01:01″,”modified”:”2026-05-21T19:01:01″,”type”:”metasploit”,”title”:”Ollama Scanner”,”source”:””,”references”:””,”id”:”MSF:AUXILIARY-SCANNER-HTTP-OLLAMA_INFO-“,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”##\\n# This module requires Metasploit: https:\/\/metasploit.com\/download\\n# Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n##\\n\\nclass MetasploitModule \\u003c Msf::Auxiliary\\n include Msf::Exploit::Remote::HttpClient\\n include Msf::Auxiliary::Scanner\\n\\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘Ollama Scanner’,\\n ‘Description’ =\\u003e %q{\\n This module identifies ollama instances and enumerates the LLM\\n models which have been loaded and are running.\\n },\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘Author’ =\\u003e [\\n ‘h00die’\\n ],\\n ‘References’ =\\u003e [\\n [‘URL’, ‘https:\/\/ollama.readthedocs.io\/en\/api\/’]\\n ],\\n ‘Notes’ =\\u003e {\\n ‘Stability’ =\\u003e [CRASH_SAFE],\\n ‘Reliability’ =\\u003e [],\\n ‘SideEffects’ =\\u003e []\\n }\\n )\\n )\\n\\n register_options(\\n [\\n Opt::RPORT(11434),\\n OptString.new(‘TARGETURI’, [true, ‘Base URI’, ‘\/’]),\\n ]\\n )\\n end\\n\\n def humanize(bytes)\\n return ‘0 B’ if bytes \\u003c= 0\\n\\n units = [‘B’, ‘KB’, ‘MB’, ‘GB’, ‘TB’]\\n i = [(Math.log2(bytes) \/ 10).to_i, units.length – 1].min\\n ‘%.2f %s’ % [bytes.to_f \/ (1024**i), units[i]]\\n end\\n\\n def ollama?\\n res = send_request_cgi({ ‘uri’ =\\u003e normalize_uri(datastore[‘TARGETURI’]) })\\n\\n return res.body == ‘Ollama is running’ if res \\u0026\\u0026 res.code == 200\\n\\n nil\\n end\\n\\n # documenting that this is here, but nunused\\n # def generate\\n # res = send_request_cgi({ ‘uri’ =\\u003e normalize_uri(datastore[‘TARGETURI’], ‘api’, ‘generate’) })\\n #\\n # return res.get_json_document if res \\u0026\\u0026 res.code == 200\\n #\\n # nil\\n # end\\n\\n def list_local_models\\n res = send_request_cgi({ ‘uri’ =\\u003e normalize_uri(datastore[‘TARGETURI’], ‘api’, ‘tags’) })\\n\\n return res.get_json_document if res \\u0026\\u0026 res.code == 200\\n\\n nil\\n end\\n\\n def list_running_models\\n res = send_request_cgi({ ‘uri’ =\\u003e normalize_uri(datastore[‘TARGETURI’], ‘api’, ‘ps’) })\\n\\n return res.get_json_document if res \\u0026\\u0026 res.code == 200\\n\\n nil\\n end\\n\\n def get_model_info(model)\\n post_data = {\\n ‘model’ =\\u003e model\\n }\\n post_json = JSON.generate(post_data)\\n res = send_request_cgi({\\n ‘method’ =\\u003e ‘POST’,\\n ‘ctype’ =\\u003e ‘application\/json’,\\n ‘data’ =\\u003e post_json,\\n ‘uri’ =\\u003e normalize_uri(target_uri.path, ‘api’, ‘show’)\\n })\\n\\n return res.get_json_document if res \\u0026\\u0026 res.code == 200\\n\\n nil\\n end\\n\\n def get_temperature(details)\\n unless details.nil? || details[‘parameters’].nil?\\n details[‘parameters’].each_line do |line|\\n next unless line.start_with?(‘temperature’)\\n\\n return line.split[1]\\n end\\n end\\n ‘N\/A’\\n end\\n\\n def get_system_prompt(details)\\n unless details.nil? || details[‘modelfile’].nil?\\n details[‘modelfile’].each_line do |line|\\n next unless line.start_with?(‘SYSTEM ‘)\\n\\n return line.split(‘SYSTEM ‘)[1]\\n end\\n end\\n ‘N\/A’\\n end\\n\\n def run_host(ip)\\n vprint_status(\\”Checking #{ip}\\”)\\n unless ollama?\\n vprint_error(‘Ollama instance not found’)\\n return\\n end\\n models_table = Rex::Text::Table.new(\\n ‘Header’ =\\u003e \\”#{ip} Ollama Models\\”,\\n ‘Indent’ =\\u003e 2,\\n ‘Columns’ =\\u003e [\\n ‘Name’,\\n ‘Release’,\\n ‘Status’,\\n ‘Size’,\\n ‘Parameter Size’,\\n ‘Temperature’,\\n ‘System Prompt’\\n ]\\n )\\n running_names = []\\n running_models_res = list_running_models\\n if running_models_res.nil?\\n vprint_error(‘Could not retrieve running models (endpoint unreachable or returned non-200)’)\\n end\\n (running_models_res\\u0026.fetch(‘models’, nil) || []).each do |model|\\n vprint_status(\\” Found model: #{model[‘name’]}\\”)\\n details = get_model_info(model[‘name’])\\n temperature = get_temperature(details)\\n system_prompt = get_system_prompt(details)\\n\\n models_table \\u003c\\u003c [\\n model[‘name’].split(‘:’)[0],\\n model[‘name’].split(‘:’)[1],\\n ‘Running’,\\n humanize(model[‘size’]),\\n details.dig(‘details’, ‘parameter_size’),\\n temperature,\\n system_prompt\\n ]\\n running_names \\u003c\\u003c model[‘name’]\\n end\\n installed_models_res = list_local_models\\n if installed_models_res.nil?\\n vprint_error(‘Could not retrieve local models (endpoint unreachable or returned non-200)’)\\n return\\n end\\n (installed_models_res[‘models’] || []).each do |model|\\n next if running_names.include?(model[‘name’])\\n\\n vprint_status(\\” Found model: #{model[‘name’]}\\”)\\n details = get_model_info(model[‘name’])\\n temperature = get_temperature(details)\\n system_prompt = get_system_prompt(details)\\n\\n models_table \\u003c\\u003c [\\n model[‘name’].split(‘:’)[0],\\n model[‘name’].split(‘:’)[1],\\n ‘Installed’,\\n humanize(model[‘size’]),\\n details.dig(‘details’, ‘parameter_size’),\\n temperature,\\n system_prompt\\n ]\\n end\\n\\n print_status(models_table.to_s)\\n end\\nend\\n”,”sourceHref”:”https:\/\/github.com\/rapid7\/metasploit-framework\/blob\/master\/modules\/auxiliary\/scanner\/http\/ollama_info.rb”,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.rapid7.com\/db\/modules\/auxiliary\/scanner\/http\/ollama_info\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-05-21T19:28:01″,”description”:”This module identifies ollama instances and enumerates the LLM models which have been loaded and are running. Module Options msf use auxiliary\/scanner\/http\/ollamainfo msf auxiliaryollamainfo show…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,169,13,33,7,11,5],"class_list":["post-56159","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-metasploit","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n