adam/metasploit-gs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
79,925 Commits 27 Branches 1,043 Tags
06eba2245ecffbcacacd36ef2e4d02e6f4048b4d
Commit Graph

4584 Commits

Author SHA1 Message Date
LucasCsmt 78f4b8f97d Merge branch 'master' into multi/http/churchcrm_unauth_rce 2026-02-13 08:50:23 +01:00
Spencer McIntyre 35b52df28a Merge pull request #20849 from haicenhacks/haicen_xerte 
Add three modules for exploiting Xerte Online Toolkits
 2026-02-12 15:01:42 -05:00
Spencer McIntyre 41414b896b Tweak whitespacing in the docs for the renderer 2026-02-12 14:43:47 -05:00
haicen 7204c64b6b Improves documentation 2026-02-12 12:05:29 -05:00
haicen 66139795e5 Fixes problems with module documentation 2026-02-11 18:20:06 -05:00
jheysel-r7 4adf87ac18 Merge pull request #20929 from jheysel-r7/feat/mod/cve-2026-24061 
GNU Inetutils Telnet Auth Bypass (CVE-2026-24061)
 2026-02-11 11:12:29 -08:00
sfewer-r7 f632cf34bf add in a module and docs fo rteh EPMM exploit 2026-02-05 12:26:38 +00:00
LucasCsmt eb5507844b Testing the module on different version 
The module have been tested on different version of ChurchCRM (6.8.0 and
6.2.0) prooving it's vulnerability to this exploit. This commit contains
modification of the dockerfile/docker-compose in order to support
multi-version installation.
 2026-02-05 12:36:26 +01:00
LucasCsmt 4d65f15884 Adding a link to the CVE 2026-02-04 16:17:15 +01:00
LucasCsmt ca5ceae1b3 Adding documentation to the churchcrm module 
The documentation of the module is addedd.
 2026-02-04 16:04:42 +01:00
Valentin Lobstein 628c5ee7af Update Gladinet modules: fix AutoCheck in auxiliary modules and update documentation with real outputs 2026-02-04 08:38:32 +01:00
Valentin Lobstein 478345506e Add Gladinet CentreStack/Triofox auxiliary modules and exploit 2026-02-04 08:38:31 +01:00
Jack Heysel bd049dcba4 doc update 2026-02-03 18:41:51 -08:00
Jack Heysel a868bc95b2 GNU Inetutils Telnet Auth Bypass 2026-02-03 17:45:59 -08:00
jheysel-r7 641ab527aa Merge pull request #20857 from msutovsky-r7/exploit/freepbx/sql_to_rce_chain 
Adds exploit module for FreePBX (CVE-2025-66039, CVE-2025-61675)
 2026-01-28 20:03:17 -08:00
Jack Heysel 63a66ee162 Improved CVE version range info in description 2026-01-28 20:15:25 -07:00
jheysel-r7 7d931c960c Merge pull request #20858 from msutovsky-r7/exploit/freepbx/unrestricted_file_upload 
Adds exploit module for FreePBX (CVE-2025-66039, CVE-2025-61678)
 2026-01-28 06:23:43 -08:00
Martin Sutovsky e6b97a79a4 Addresses comments 2026-01-28 11:33:54 +01:00
jheysel-r7 f31776caf0 Merge pull request #20778 from h00die/ssh_keys 
Update and combine ssh key persistence with mixin
 2026-01-27 06:39:10 -08:00
Martin Sutovsky c5ffa557a7 Adds UID in documentation 2026-01-26 13:44:09 +01:00
Spencer McIntyre c0e9288ac5 Merge pull request #20799 from jheysel-r7/feat/cacti_graph_template_rce 
Cacti Graph Template Authenticated RCE [CVE-2025-24367]
 2026-01-22 14:26:38 -05:00
Jack Heysel 2e484d552e Finishing touches 2026-01-22 15:03:31 +01:00
Jack Heysel 99e032f4af SmarterTools SmarterMail Unauth File Upload RCE [CVE-2025-52691] 2026-01-22 15:03:30 +01:00
msutovsky-r7 537a1c5395 Land #19821, adds Burpsuite persistence module 
Burp extension persistence
 2026-01-22 11:03:08 +01:00
jheysel-r7 719874a7f4 Merge pull request #20750 from MatDupas/add-exploit-oracle-ebs-cve-2025-61882-module 
Add exploit oracle ebs CVE 2025 61882 module
 2026-01-21 16:08:09 -08:00
jheysel-r7 b6da204725 Apply suggestions from code review 
Co-authored-by: Spencer McIntyre <58950994+smcintyre-r7@users.noreply.github.com>
 2026-01-21 10:09:12 -08:00
haicen c3830f6987 adds documentation 2026-01-20 22:29:29 -05:00
jheysel-r7 c47a74d0dd Merge pull request #20770 from vognik/Splunk_2022-43571_CVE-2024-36985 
Add Splunk RCE Exploits (CVE-2022-43571 & CVE-2024-36985)
 2026-01-20 12:36:51 -08:00
Martin Sutovsky d2af23a4a6 Adds additional installation step 2026-01-19 11:25:39 +01:00
Martin Sutovsky 4e36ff99ac Adds additional installation step 2026-01-19 11:24:45 +01:00
MatDupas 54c6e18505 Update documentation/modules/exploit/multi/http/oracle_ebs_cve_2025_61882_exploit_rce.md 
Co-authored-by: jheysel-r7 <Jack_Heysel@rapid7.com>
 2026-01-17 12:26:18 +01:00
h00die 7ccf574e99 burp extension all working 2026-01-16 08:44:27 -05:00
Brendan ade984aead Merge pull request #20793 from Chocapikk/avideo-v2 
Add AVideo notify.ffmpeg.json.php unauthenticated RCE exploit (CVE-2025-34433)
 2026-01-15 17:36:07 -06:00
Martin Sutovsky b01353cc07 Code cleanup, removes line from documentation 2026-01-15 15:26:30 +01:00
Martin Sutovsky 85221800a4 Removes line from documentation, code cleanup 2026-01-15 15:23:54 +01:00
jheysel-r7 bb473b6019 Merge pull request #20797 from h00die/remove_persistence_exe 
persistence modules cleanup
 2026-01-14 14:43:33 -08:00
h00die f4a195b88a persistence modules cleanup 2026-01-14 13:49:29 -05:00
msutovsky-r7 7b092aeedb Land #20806, adds module for unauthenticated command injection in Control Web Panel API (CVE-2025-67888) 
Adds module for Control Web Panel API Command Injection (CVE-2025-67888)
 2026-01-14 15:44:25 +01:00
Diego Ledda e4f8d4fb13 Merge pull request #20706 from h00die/windows_wmi_persistence 
Update windows wmi to persistence mixin
 2026-01-14 09:37:20 -05:00
Valentin Lobstein b2abdb21de Fix AVideo lab documentation: update file editing instructions 
Updated the note to provide a working method to edit configuration.php. Users can enter the container shell or copy the file out for editing.
 2026-01-14 00:35:39 +01:00
Valentin Lobstein ae4babbcf1 Fix AVideo lab documentation: remove broken sed command 
Removed the broken sed command that doesn't work correctly. Updated note to specify editing /var/www/html/AVideo/videos/configuration.php manually with an editor instead.
 2026-01-14 00:34:35 +01:00
Valentin Lobstein 37f9802b83 Update AVideo lab documentation: remove automatic sed fix, specify file to edit 
Removed mention of automatic sed fix in docker-entrypoint. Updated note to specify that users should manually edit /var/www/html/AVideo/videos/configuration.php if they encounter redirect issues with webSiteRootURL.
 2026-01-14 00:34:10 +01:00
Valentin Lobstein 733455eb53 Change port to 80 in AVideo lab documentation 
Changed HTTP_PORT from 9999 to 80 in the documentation to use the correct URL directly. This fixes the webSiteRootURL issue where AVideo was generating incorrect URLs with the mapped port instead of the container's internal port.
 2026-01-14 00:32:43 +01:00
Valentin Lobstein f6430ee093 Fix MariaDB tc.log corruption issue in AVideo lab setup 
The MariaDB container fails to start with 'Bad magic header in tc log' error
when the data directory has incorrect permissions or was previously corrupted.
This occurs during first-time setup of the AVideo lab environment.

The fix:
- Creates a custom entrypoint script that detects and removes corrupted tc.log
  files by checking the magic header (should be 01 00 00 00)
- Modifies Dockerfile.mariadb to integrate the fix script into the original
  MariaDB entrypoint using sed
- Ensures the fix runs automatically before MariaDB initialization

This allows the lab to start successfully on first run without manual intervention.

Co-authored-by: bwatters-r7 <bwatters-r7@users.noreply.github.com>
 2026-01-13 22:31:38 +01:00
msutovsky-r7 eae97b314a Land #20810, adds module for authenticated RCE in n8n (CVE-2025-68613) 
Adds module for n8n workflow expression RCE (CVE-2025-68613)
 2026-01-13 16:51:06 +01:00
Brendan 10d12570c0 Merge pull request #20791 from Chocapikk/webcheck 
Add Web-Check screenshot API command injection RCE exploit (CVE-2025-32778)
 2026-01-12 17:14:04 -06:00
h00die 6491f74d9d wmi persistence improvements 2026-01-11 07:25:13 -05:00
Jack Heysel cdebe41d6c Revert unintended change 2026-01-09 09:55:22 -08:00
JohannesLks d45e91b130 typo 2026-01-09 10:48:30 -05:00
msutovsky-r7 472016b753 Land #20796, moves udev module into persistence category 
update udev to persistence mixin
 2026-01-09 16:14:08 +01:00