795c38c524
Combine the 7.x and 6.x targets together, as Linux payloads work on 7.x also, so this target is Unix and Linux. This leaves the 8.x target Unix only due to IMA appraisal.
2025-11-28 10:12:02 +00:00
014312873c
get both unix and linux payloads working on 6.x. Add a note to the docs about setting a gateway.
2025-11-27 20:28:44 +00:00
f5e8aa83be
add in exploit support for FortiWeb versions 6.x which are vulnerable, but no longer under support from the vendor.
2025-11-27 12:43:19 +00:00
e998b91aee
Merge pull request #20717 from sfewer-r7/fortiweb-exploit-rce
...
Add exploit module for Fortinet FortiWeb (CVE-2025-64446 + CVE-2025-58034)
2025-11-25 14:14:31 -06:00
fa03ac8b66
on 7.4.8 the command nohup is not available. we must execute our payload in a new session, so we use a python stub to essentially call setsid. This has been tested to work on both 8.0.1 and 7.4.8. Teh payload cmd/unix/reverse_python isnot working as it previously was, so I am removing from the list of confirmed paylaods. The other two, cmd/unix/reverse_bash and cmd/unix/reverse_openssl work fine on both versions
2025-11-25 11:25:41 +00:00
8a054b74db
improve check logic to actualy parse JSON result for expected reply, tested against 8.0.1 and 7.4.8
2025-11-25 11:22:43 +00:00
b8cefb1af9
add nohup when bootstraping the payload to avoid the scenario when the parent dies it tears down our payload child process
2025-11-21 15:54:41 +00:00
aff76622fa
add in the unauth RCE exploit module for CVE-2025-64446 + CVE-2025-58034
2025-11-21 12:22:25 +00:00
bb728c44d7
Merge pull request #20560 from cdelafuente-r7/feat/mitre/T1021
...
Add T1021 "Remote Services" MITRE technique and sub-technique references
2025-11-20 11:19:31 -06:00
179a545312
Remove false positive references
2025-11-19 17:34:15 +01:00
110cb837aa
Merge pull request #20672 from h00die-gr3y/centreon_auth_rce
...
Centreon authenticated command injection leading to RCE via broker engine "reload" parameter [CVE-2025-5946]
2025-11-05 16:29:29 +01:00
34c424f473
update based on dledda-r7 comments
2025-11-05 09:20:13 +00:00
61dfc293d9
update based on dledda-r7 comments
2025-11-03 14:37:23 +00:00
85b4233345
updated module based on review comments and added documentation
2025-11-03 10:21:31 +00:00
83e7fc2667
update attackerkb reference
2025-11-02 18:26:34 +00:00
e01456bcf4
init commit module
2025-11-02 17:45:22 +00:00
0a755ea03a
Add references to MITRE ATT&CK T1021 - Remote Services
2025-10-14 16:25:30 +02:00
91c0adb17f
Merge pull request #20585 from vognik/CVE_2025_60787
...
Add MotionEye Authenticated RCE (CVE-2025-60787)
2025-10-09 13:50:25 -05:00
267a26b763
code review changes from smcintyre-r7@
2025-10-09 21:51:31 +04:00
9dc5696cc4
Update dash characters in module references
2025-10-07 14:03:32 -04:00
fd21209e4d
Add missing CVEs from VulnCheck
2025-10-07 13:59:13 -04:00
cf3abc280e
Merge pull request #20533 from cdelafuente-r7/feat/mitre/add_ref
...
Add T1003 "OS credential dumping" MITRE technique reference
2025-09-18 11:56:33 -04:00
1314f5d0bb
Merge pull request #20455 from Chocapikk/aitemi_m300_time_rce
...
Add unauthenticated RCE on Shenzhen Aitemi M300 MT02 (CVE-2025-34152)
2025-09-10 10:12:41 +02:00
7ce2bdc979
Add T1003 "OS credential dumping" MITRE technique
2025-09-09 10:45:46 +02:00
f1dffd3ad6
Merge pull request #20480 from msutovsky-r7/exploit/pretalx/file-rw
...
Adds modules for Pretalx File Read/Limited File Write (CVE-2023-28459, CVE-2023-28458)
2025-08-27 15:46:39 -05:00
d49870211b
Adding exceptions to exploit module, bug fix for aux module, adds documentation for exploit module
2025-08-22 15:26:46 +02:00
4e113b1768
Addresses comments, adds exception for Pretalx, modifies aux module
2025-08-22 13:59:50 +02:00
2e9b5453ec
Adds description
2025-08-21 15:29:08 +02:00
fb062075e3
Adds target, adds side effects
2025-08-21 15:21:16 +02:00
408f7575e4
Fixing write primitive for exploit module, library update
2025-08-21 15:17:32 +02:00
01c09bcfed
Library fixes, refactoring exploit module
2025-08-21 09:22:21 +02:00
72dcc5a301
Library fix
2025-08-21 07:21:56 +02:00
f4e71c1e93
Replace Rank
2025-08-14 16:37:13 +02:00
3022513652
Add CRASH_SERVICE_DOWN and "`" badchar
2025-08-14 16:16:21 +02:00
46bbec2470
Update modules/exploits/linux/http/aitemi_m300_time_rce.rb
...
Co-authored-by: Spencer McIntyre <58950994+smcintyre-r7@users.noreply.github.com >
2025-08-14 16:11:27 +02:00
bd9c2bf231
Update modules/exploits/linux/http/aitemi_m300_time_rce.rb
...
Co-authored-by: msutovsky-r7 <martin_sutovsky@rapid7.com >
2025-08-14 16:01:59 +02:00
8251d89e92
Merge pull request #20400 from msutovsky-r7/exploit/pivotx-rce
...
Adds module for PivotX RCE (CVE-2025-52367)
2025-08-12 12:28:28 -07:00
0273f1474f
Added incorrect creds check
2025-08-12 10:42:46 -07:00
e59a24823b
Merge pull request #20387 from h00die-gr3y/wazuh-auth-rce
...
Wazuh Server authenticated RCE [CVE-2025-24016]
2025-08-12 09:22:22 -07:00
ff4ede95cc
Remove useless headers
2025-08-07 21:53:14 +02:00
87eb063460
Add unauthenticated RCE on Shenzhen Aitemi M300 MT02 (CVE-2025-34152)
2025-08-07 18:34:49 +02:00
9caa2be9a2
Land #20399 , adds module for Pandora ITSM authenticated RCE (CVE-2025-4653)
...
Pandora ITSM auth RCE [CVE-2025-4653]
2025-08-07 08:37:45 +02:00
70f2cbe055
simplified cleaning procedure
2025-08-06 08:22:06 +00:00
c99702c8bf
Land #20446 , adds module for ICTBroadcast Unauthenticated RCE (CVE-2025-2611)
...
Add ICTBroadcast Unauthenticated Remote Code Execution (CVE-2025-2611)
2025-08-05 09:29:36 +02:00
a81884fb9e
Update metadata
2025-08-04 17:53:29 +02:00
2c9053c45e
Refactor fingerprint detection, cookie handling and per-cookie injection
...
- Centralize JS fingerprint checks in `check`
- Memoize `get_valid_cookies` correctly and reuse a single `cookie_jar`
- Update `inject_command` to test payload on each cookie separately
2025-08-04 17:49:34 +02:00
26099da7a2
Update modules/exploits/linux/http/ictbroadcast_unauth_cookie.rb
...
Co-authored-by: msutovsky-r7 <martin_sutovsky@rapid7.com >
2025-08-04 17:03:04 +02:00
46b3012cda
Update modules/exploits/linux/http/ictbroadcast_unauth_cookie.rb
...
Co-authored-by: msutovsky-r7 <martin_sutovsky@rapid7.com >
2025-08-04 17:02:47 +02:00
a6d86fbe59
Update modules/exploits/linux/http/ictbroadcast_unauth_cookie.rb
...
Co-authored-by: msutovsky-r7 <martin_sutovsky@rapid7.com >
2025-08-04 17:02:35 +02:00
50ef5edd90
Add Unauthenticated ICTBroadcast Remote Code Execution (CVE-2025-2611)
2025-08-02 19:46:14 +02:00
sfewer-r7