 msutovsky-r7
|
bdac31037a
|
Land #20028, pgAdmin modules refactor
Refactor pgAdmin modules to use new lib
|
2025-04-21 16:03:35 +02:00 |
|
|
msutovsky-r7
|
140b93e802
|
Land #20022, Langflow RCE module
Add Langflow unauth RCE module (CVE-2025-3248)
|
2025-04-14 08:24:44 +02:00 |
|
|
Takah1ro
|
1f6d5f36d2
|
Rubocop formatting and update check
|
2025-04-12 09:33:54 +09:00 |
|
|
Takahiro Yokoyama
|
4b588e130e
|
Update modules/exploits/multi/http/langflow_unauth_rce_cve_2025_3248.rb
Co-authored-by: msutovsky-r7 <martin_sutovsky@rapid7.com>
|
2025-04-12 09:16:55 +09:00 |
|
|
Jack Heysel
|
4c5e0203dd
|
Refactor pgAdmin modules to use new lib
|
2025-04-11 15:55:46 -07:00 |
|
|
Takah1ro
|
f67dfe6a62
|
Update check
|
2025-04-11 21:51:45 +09:00 |
|
|
msutovsky-r7
|
0b4e133001
|
Land #20018, pgAdmin Authenticated RCE (CVE-2025-2945)
pgAdmin Query Tool Authenticated RCE (CVE-2025-2945)
|
2025-04-11 10:34:02 +02:00 |
|
|
Takah1ro
|
718a0bc5c7
|
Change directory from linux to multi
|
2025-04-11 14:45:10 +09:00 |
|
|
Jack Heysel
|
4cec129e1c
|
Responded to comments
|
2025-04-10 10:53:05 -07:00 |
|
|
Jack Heysel
|
ddb29d6181
|
Removed unnecessary method
|
2025-04-10 07:18:42 -07:00 |
|
|
Jack Heysel
|
290a35b0f6
|
pgAdmin Query Tool Authenticated RCE (CVE-2025-2945)
|
2025-04-09 17:32:10 -07:00 |
|
|
Brendan
|
4da78bd550
|
Merge pull request #19994 from sfewer-r7/CVE-2021-35587
Adds exploit module for CVE-2021-35587, an unauthenticated deserialization vulnerability affecting Oracle Access Manager (OAM).
|
2025-04-08 08:59:18 -05:00 |
|
|
jheysel-r7
|
d16eeab32c
|
Merge pull request #19995 from chutton-r7/cve-2025-24813
Module for CVE-2025-24813
|
2025-04-02 14:20:52 -07:00 |
|
|
Jack Heysel
|
b85faf9440
|
Update documentation
|
2025-04-02 14:10:46 -07:00 |
|
|
Jack Heysel
|
3fa7fe68a1
|
Consolidated Platform check
|
2025-04-02 13:57:56 -07:00 |
|
|
Jack Heysel
|
c32a34112f
|
Updated register_file_for_clean to account for windows
|
2025-04-02 13:52:04 -07:00 |
|
|
Jack Heysel
|
6816589378
|
Added FileDropper for cleanup
|
2025-04-02 13:37:39 -07:00 |
|
|
Jack Heysel
|
4058173a1c
|
Correct spelling
|
2025-04-02 12:57:20 -07:00 |
|
|
sfewer-r7
|
59b0860ea1
|
add in Peterjson as the co-finder with Jang
|
2025-04-02 20:50:57 +01:00 |
|
|
Jack Heysel
|
8cd0449550
|
Responded to comments
|
2025-04-02 12:50:26 -07:00 |
|
|
sfewer-r7
|
998d0a78c2
|
based on the OAM version, pick the prebuilt gadget chain for that version (to account for the serialVersionUID changes)
|
2025-04-02 15:31:37 +01:00 |
|
|
sfewer-r7
|
f6bcf19b91
|
add a helper get_version and use it in the check
|
2025-04-02 15:30:32 +01:00 |
|
|
sfewer-r7
|
3f46bfe0ad
|
add in a seperate Unix target, as OAM can run on other things like HP-UX, IBM AIX, and Solaris
|
2025-04-02 15:29:29 +01:00 |
|
|
chutton-r7
|
63a86109f6
|
Better error handling, set default Python Meterpreter (seems most reliable). Fix switch
|
2025-04-02 10:04:33 +01:00 |
|
|
chutton-r7
|
e1310f4f89
|
Simplify logic
|
2025-04-01 15:50:23 +01:00 |
|
|
chutton-r7
|
b77489587a
|
Remove CmdStager, add version tested, credit
|
2025-04-01 15:15:30 +01:00 |
|
|
chutton-r7
|
c34c627e18
|
Support Linux, clean DefaultOptions
|
2025-04-01 15:05:56 +01:00 |
|
|
sfewer-r7
|
acafd884b5
|
add in the initial exploit for CVE-2021-35587, only tested on 12.2.1.4.0 so far.
|
2025-04-01 12:56:38 +01:00 |
|
|
tastyrce
|
43c929d56e
|
Update checking for authentication
Co-authored-by: msutovsky-r7 <martin_sutovsky@rapid7.com>
|
2025-03-27 22:13:04 +11:00 |
|
|
tastyrce
|
10ea4f7f9f
|
use keep_cookies to store cookies
|
2025-03-27 03:22:11 -04:00 |
|
|
tastyrce
|
e62038cfe5
|
improve version parsing
|
2025-03-27 02:01:03 -04:00 |
|
|
tastyrce
|
cbfcc5bd13
|
add condition for http code
|
2025-03-27 00:40:13 -04:00 |
|
|
tastyrce
|
f1175420f8
|
remove get and post wrappers
|
2025-03-27 00:37:40 -04:00 |
|
|
tastyrce
|
e70c8aa921
|
RuboCop Fixes
|
2025-03-22 02:37:41 -04:00 |
|
|
tastyrce
|
d0bd559602
|
add cmsms exploit module
|
2025-03-22 02:35:27 -04:00 |
|
|
chutton-r7
|
c003c3d630
|
Advanced check method
|
2025-03-20 18:19:14 +00:00 |
|
|
chutton-r7
|
54a8717c2d
|
Basic check method
|
2025-03-20 17:50:21 +00:00 |
|
|
chutton-r7
|
df8c0b465e
|
Simplified targets, confirmed working with CommonsCollections6
|
2025-03-19 18:02:11 +00:00 |
|
|
chutton-r7
|
20e51b44bc
|
Initial commit
|
2025-03-19 13:52:45 +00:00 |
|
|
cgranleese-r7
|
0017fbdf56
|
Updates more dead links
|
2025-02-28 10:30:14 +00:00 |
|
|
cgranleese-r7
|
810e7c4518
|
Adds scripts to find and replace dead module reference links
|
2025-02-28 09:20:48 +00:00 |
|
|
0xAryan
|
ddf07a3d60
|
Link fix for exploit/multi/http/nibbleblog_file_upload
|
2025-01-26 19:20:12 +05:30 |
|
|
Brendan
|
9bd8590b99
|
Merge pull request #19793 from sfewer-r7/CVE-2024-55956
Cleo LexiCom, VLTrader, and Harmony Unauthenticated Remote Code Execution (CVE-2024-55956)
|
2025-01-15 15:04:45 -06:00 |
|
|
h00die
|
1aba53274f
|
move acronis_cyber_protect_unauth_rce_cve_2022_3405 inside the http folder
|
2025-01-09 16:32:42 -05:00 |
|
|
h00die
|
1a839c0b33
|
move acronis_cyber_protect_unauth_rce_cve_2022_3405 inside the http folder
|
2025-01-09 16:30:51 -05:00 |
|
|
sfewer-r7
|
4d42c7878e
|
improve the regex by removing the unnecessary word boundrys, and add a non matching group for the product name. Thanks jvoisin
|
2025-01-09 11:43:58 +00:00 |
|
|
sfewer-r7
|
e340e3ea6c
|
favor a case statement over the if/elsif blocks (thanks jvoisin).
|
2025-01-09 11:34:13 +00:00 |
|
|
Stephen Fewer
|
98f9045e54
|
improve comment (thanks jvoisin)
Co-authored-by: Julien Voisin <jvoisin@users.noreply.github.com>
|
2025-01-09 11:29:04 +00:00 |
|
|
Stephen Fewer
|
43792457e5
|
improve comment (thanks jvoisin)
Co-authored-by: Julien Voisin <jvoisin@users.noreply.github.com>
|
2025-01-09 11:28:48 +00:00 |
|
|
sfewer-r7
|
0df004cee7
|
check for nil here, before we check for the end cdata tag (resolves a linting warning)
|
2025-01-06 10:41:02 +00:00 |
|