adam/metasploit-gs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
76,366 Commits 27 Branches 1,043 Tags
11818c2812626be6b6eaeb63c8cc2342eaf38ff2
Commit Graph

345 Commits

Author SHA1 Message Date
jheysel-r7 2d1af7d809 Land #19648 Add exploit module for FortiManager (CVE-2024-47575) 2024-12-02 18:31:25 -08:00
jheysel-r7 5a837d1ef6 fix a typo 2024-12-02 18:16:43 -08:00
h00die d13bccca05 peer review 2024-11-28 20:24:25 -05:00
sfewer-r7 68e9b39ffa register teh Rex socket we create via add_socket. This lets teh frameowkr close the socket after we get a session, and will wait up to WfsDelay for that to happen. This lets us remove the other timeout we had, and teh user can always adjust WfsDelay if needed. (Thanks Spencer) 2024-11-22 12:42:08 +00:00
sfewer-r7 e5cdf6097d favor File.binread over File.read 2024-11-22 12:40:19 +00:00
sfewer-r7 f59bfe98a3 remove the default payload and the default fetch command, and let the framework choose them for us. 2024-11-22 12:39:34 +00:00
sfewer-r7 2ba112a5a4 We can use OptPath here instead of OptString. Also are these are optional, and we dont specify a default, we can omit the nil default value. 2024-11-22 12:38:46 +00:00
sfewer-r7 000ffb2406 make the check routine return a message for Detected. 2024-11-22 12:37:50 +00:00
sfewer-r7 4856817131 fix a typo 2024-11-18 09:44:53 +00:00
sfewer-r7 feb1ac79da add in a suitable certificate and private key to use by default. 2024-11-15 17:41:31 +00:00
sfewer-r7 e520ca7ee9 comment the intent of this code block 2024-11-15 12:29:31 +00:00
sfewer-r7 2ec5778405 get_cert_subject_item may return nil, so test for that here 2024-11-15 12:28:25 +00:00
sfewer-r7 51ad7ad0bf improve the send_packet logic to fail gracefully if bad data is recieved 2024-11-15 12:27:33 +00:00
sfewer-r7 c3bd4792ec rename SSLClientCert and SSLClientKey to ClientCert and ClientKey. This then matcheds up with ClientSerialNumber and ClientPlatform, which is clearer IMHO. Also, we explicitly create a Rex TCP socket, so these param names no longer collide with what a mixin would use 2024-11-15 09:44:50 +00:00
sfewer-r7 6eb15d5b66 add a helper method get_cert_subject_item 2024-11-15 09:42:59 +00:00
sfewer-r7 91587ce30b this message can be on a single line 2024-11-15 09:42:06 +00:00
sfewer-r7 e89c27fa3b fix some typos. Make msftidy happy. Add comments to the external references. 2024-11-15 08:54:32 +00:00
sfewer-r7 47f924bb8f add in the initial work on the FortiManager exploit. 2024-11-14 18:53:12 +00:00
h00die 4ebc6f1ff1 peer review 2024-11-11 17:37:33 -05:00
h00die 594c3a82ea peer review 2024-11-11 17:32:49 -05:00
h00die 0de93eedb7 asterisk ami auth rce 2024-11-04 16:27:58 -05:00
h00die 9cba5dad59 WIP for asterisk rce 2024-11-01 16:28:45 -04:00
adfoster-r7 62a3f73e70 Update rubocop target ruby version 2024-07-24 16:47:17 +01:00
Christophe De La Fuente 8fc6e20cec Update other modules to use java_class_loader_start_service and cmdstager_start_service 2024-06-14 12:57:42 +02:00
fanqiaojun 6b2bdc893b chore: remove repetitive words 
Signed-off-by: fanqiaojun <fanqiaojun@yeah.net>
 2024-04-15 11:06:50 +08:00
sfewer-r7 2a56c3f28b remove redundant \d in check regex 2023-11-07 09:21:04 +00:00
sfewer-r7 25ef7d1272 add the RCE exploit 2023-11-06 17:12:40 +00:00
Spencer McIntyre 8e8b8ad191 Update nimbus_gettopologyhistory_cmd_exec 2023-09-12 12:21:10 -04:00
Spencer McIntyre ba84c0484c Update the Nimbus module to use the Thrift client 2023-09-11 14:42:54 -04:00
sfewer-r7 27f5a789c9 rework the exploit to use the new MIPS64 fetch payload adapters. Removed the seperate command and dropper targets in favor of a single default target which can do both thanks to fetch payloads. Removed the redundant IO select() call which was bad copy pasta on my part. 2023-06-09 09:47:57 +01:00
sfewer-r7 0205bb36d3 change ranking to GreatRanking as stability is CRASH_SERVICE_RESTARTS 2023-05-22 20:09:11 +01:00
sfewer-r7 6b101b5a4d make rubocop happy 2023-05-22 18:03:58 +01:00
Jacob Baines ec5858c198 Added newly assigned CVE identifier 2023-04-27 09:54:48 -04:00
Ron Bowes 7dc1faa689 Better error handling, and fix version detection 2023-04-11 09:34:24 -07:00
Ron Bowes 1a8671311d Move the offsets into a field separate from 'targets' 2023-04-07 10:26:56 -07:00
Ron Bowes 02072418f0 Expand the comment about why we're checking for \xff (since it can't appear in the payload) 2023-04-07 10:10:13 -07:00
Ron Bowes ce111f158a Better error handling 2023-04-06 10:35:33 -07:00
Ron Bowes 523931aa4c Change target options for stack overflow exploit 2023-04-05 15:24:49 -07:00
Ron Bowes c345fe78b8 Fix up error handling and other comments from the PR 2023-04-05 15:13:35 -07:00
Ron Bowes c07ca83d6c Fix the metadata and add an in-memory target 2023-04-05 14:07:12 -07:00
Ron Bowes 04a9ae7335 Add check methods 2023-04-05 10:55:28 -07:00
Ron Bowes 7cb6213334 Fix an msftidy error 2023-03-29 09:56:04 -07:00
Ron Bowes 54ed192401 Add URLs 2023-03-29 08:10:52 -07:00
Ron Bowes 41fe44ef1a Merge branch 'master' into unirpc-auth-bypass 2023-03-29 08:03:05 -07:00
Ron Bowes 6897be4b01 Add two Metasploit modules for UniData vulnerabilities 2023-03-29 08:01:50 -07:00
Jack Heysel 1f2a889d0c Land #17388, Zyxel router RCE 
This module adds a new exploit module for a buffer
overflow in roughly 45 different Zyxel router and VPN models.
 2023-03-21 15:07:04 -04:00
Jack Heysel f5d1aab01a Changed send_request_cgi to raw 2023-03-21 14:26:05 -04:00
Jack Heysel 31a32ccd9b linting and srvhost check fix 2023-03-17 14:39:02 -04:00
jheysel-r7 56761a2f6d Update modules/exploits/linux/misc/zyxel_multiple_devices_zhttp_lan_rce.rb 
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
 2023-03-17 13:01:02 -04:00
jheysel-r7 6b853b57c6 Update modules/exploits/linux/misc/zyxel_multiple_devices_zhttp_lan_rce.rb 
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
 2023-03-17 13:00:15 -04:00