61afe1449e
Landing #1275 , bash cmdstager
...
Conflicts:
lib/rex/exploitation/cmdstager.rb
Conflict was just the $Id$ tag, which is no longer used anyway.
2013-05-15 10:44:05 -05:00
5cfc306466
Land @1785, @wchen-r7's API addition for the mstime ie8 technique
2013-05-02 00:00:49 -05:00
69f8103ffe
Make animatecolor element optional by using innerHTML
2013-05-01 14:21:52 -05:00
3d2cb9ec3f
Uses rand_text_hex for RGB values, and correcting exception handling
2013-05-01 13:41:36 -05:00
71afd762a9
According to MSFG, I can use RGB, so here goes
2013-04-30 18:48:21 -05:00
ae94fbdf6c
Updates documentation
2013-04-30 17:11:19 -05:00
9cc624456a
Adds function js_mstime_malloc
...
This function takes advantage of MSTIME's CTIMEAnimationBase::put_values
function that's suitable for a no-spray technique (based on wtfuzz's
PoC for MS13-008)
2013-04-30 16:40:10 -05:00
906863676e
Fix a logic error in HttpServer
...
When a module is configured to listen on the INADDR_ANY interface, with
a payload that does not have an LHOST option, it attempts to determine
the srvhost from a client socket which would only be available when the
module has included the TcpClient mixin (i.e., it is both passive and
aggressive stance), causing a NameError for the undefined +sock+.
This commit fixes the problem in two ways:
1. It changes the default cli in get_uri to be the module's self.cli,
which should always be set when passive modules would need it (e.g., in
the on_request_uri method).
2. It adds a check to make sure that the calling module has a sock
before trying to get its peerhost. This was @marthieubean's suggested
solution in #1775 .
[Closes #1775 ]
2013-04-29 13:44:58 -05:00
b1e49e7116
Merge branch 'master' of github.com:rapid7/metasploit-framework into upstream-master
2013-04-25 20:54:28 -05:00
5b0ae1476b
Let's word this a little differently
2013-04-25 20:52:51 -05:00
b58a775af5
Added opt delay to file_dropper
2013-04-25 20:52:51 -05:00
008266a581
Corrects documentation. Thanks Meatballs1
2013-04-25 19:13:16 -05:00
ff87e3622b
Changes made according to feedback from Juan and James
2013-04-25 15:19:44 -05:00
6642545551
Adds new JavaScript function "js_download"
...
"js_download" is a JavaScript function used to download data (text
or binary) from the web server.
2013-04-24 17:36:45 -05:00
25fcbd4e70
Landing #1733 , setting a sensible heapsray offset
...
@wchen-r7 says that nobody's using it today, much less relying on the
default, so this should make no functional difference to any browser
exploits.
2013-04-15 16:32:48 -05:00
d28db8a2a3
Forgot the comment
2013-04-12 20:21:10 -05:00
f2cbbf43e8
Changes default offset
...
Points to the beginning of the block
2013-04-12 20:19:47 -05:00
6a0b240d10
Add some better docs for Rex::Socket
2013-04-10 12:41:41 -05:00
809969b49f
Merge branch 'master' into feature/patchable-web-vuln-import
2013-04-02 22:38:54 -05:00
c210260845
Fix Undocumentable method, missing name YARD warning
...
[#46491831 ]
Comments at the start of the file with ## caused YARD to think the
comment was documenting the require call. By removing the ##, the
warning disappeared. I did not determine what is special about ## in
file comments.
2013-03-30 15:32:38 -05:00
a87e414274
fix winrm poke method
2013-03-26 13:05:33 -05:00
0634cb9892
Need to avoid badchar 0x00
...
0x00 becomes double null, which functions like a terminator
2013-03-22 13:18:32 -05:00
566806487c
Randomize the "div_container" var because it's global
...
It's best to randomize this variable name because it's global.
2013-03-22 13:16:14 -05:00
8b5a83c7f5
Remove the DECODER option
2013-03-08 15:25:16 -05:00
aceba9fc8a
Revert "escape ticks and spaces in paths"
...
This reverts commit 4c87b1ba36
2013-03-08 14:37:28 -05:00
db676f1a88
Whitespace at EOL
2013-03-07 18:20:08 -06:00
27727df415
Merge branch 'R3dy-psexec-mixin2' into rapid7
2013-03-05 14:36:55 -06:00
c0689a7d43
Merge branch 'master' of github.com:rapid7/metasploit-framework into rapid7
2013-03-04 12:14:33 -06:00
6dcca7df78
Remove duplicated header issues
...
Headers were getting duped back into client config, causing invalid
requests to be sent out
2013-03-04 11:24:26 -06:00
4212c36566
Fix up basic auth madness
2013-03-01 11:59:02 -06:00
c290bc565e
Merge branch 'master' into feature/http/authv2
2013-02-28 14:33:44 -06:00
18c0bb0ac8
Updates description again
2013-02-28 11:34:48 -06:00
8cb5da0794
One size rules them all.
2013-02-28 11:21:23 -06:00
722e077029
Update generic target
2013-02-28 11:09:52 -06:00
2c013cada8
Update documentation for default values
2013-02-28 11:05:18 -06:00
86d78939ad
Make objId optional
2013-02-28 11:01:15 -06:00
9f35452d73
Beef up the default values for precise alloc size and consistency
2013-02-28 10:35:40 -06:00
bb02dc43b3
Documentation
2013-02-27 15:34:21 -06:00
312638d6a5
Correct allocation size for IE10
2013-02-27 14:32:39 -06:00
e3f0757304
Improved version thanks to corelanc0d3r
2013-02-27 14:08:57 -06:00
2a7b4ee3d8
Merge branch 'master' into setstringproperty_spray
2013-02-27 11:15:52 -06:00
38af8ba866
Merge branch 'feature/sqli-exploitation-mssql' of github.com:tasos-r7/metasploit-framework into tasos-r7-feature/sqli-exploitation-mssql
2013-02-26 13:41:32 -06:00
0421cff913
Exploit::Remote::Web#perform_request: timeout set to 10
2013-02-25 19:49:39 +02:00
aa007b9e0a
Updates
2013-02-22 20:07:16 -06:00
56fa5ead37
Initial version of js_property_spray
2013-02-22 10:21:20 -06:00
ac6fdf24a2
Fix winrm mixin from revert merge
2013-02-19 22:01:43 -06:00
b2563dd6c2
trying to clean up the mess from the revert
2013-02-19 21:25:37 -06:00
4703278183
Move SMB mixins into their own directory
2013-02-19 12:55:06 -06:00
ede804e6af
Make psexec mixin a bit better
...
* Removes copy-pasted code from psexec_command module and uses the mixin
instead
* Uses the SMB protocol to delete files rather than psexec'ing to call
cmd.exe and del
* Replaces several instances of "rescue StandardError" with better
exception handling so we don't accidentally swallow things like
NoMethodError
* Moves file reading and existence checking into the Exploit::SMB mixin
2013-02-19 12:33:19 -06:00
b72d2b59f8
Add logging in case of exceptions during rm
2013-02-18 18:02:51 -06:00
James Lee