5fbf46ba7f
Land #19472 , adds exploits/linux/local/udev_persistence
...
Add modules/exploits/linux/local/udev_persistence.rb
2025-06-04 13:21:04 +02:00
76471731f9
Merge pull request #20112 from cdelafuente-r7/mod/ivanti/rce/cve_2025_22457
...
Ivanti Connect Secure Unauthenticated RCE via Stack-based Buffer Overflow CVE-2025-22457
2025-05-15 11:44:49 -05:00
365caab8fc
Update the error message in case of Broken pipe error and update the documentation
2025-05-15 12:10:53 +02:00
4b9032a487
Merge pull request #20060 from mekhalleh/rce_cve-2025-21293
...
Added exploit module for CVE-2025-32433 (Erlang/OTP)
2025-05-02 07:05:30 -07:00
d83e6072ef
Add the module and documentation for Ivanti RCE CVE-2025-22457
2025-04-30 22:02:16 +02:00
39a5d710aa
Refactor module: modularization, session-path leak, randomized key, improved check
...
- Centralized fetch_cookies_and_csrf and execute_via_session methods for clarity
- Added leak_session_path() to call send_transform("phpinfo") and parse session.save_path via XPath
- In check(): first try to leak the PHP session directory (report vulnerable if successful), then perform a simple RCE check by summing two 4-digit random numbers with print_r()
- Stub injection now happens once in fetch_cookies_and_csrf; execute_via_session only needs the payload
- Randomized the "as hack" key in send_transform
- Simplified exploit() to reuse execute_via_session with a Base64-encoded payload
- Big thanks to @jvoisin for the suggestions!
2025-04-30 00:24:25 +02:00
f24801a4a4
Update doc
2025-04-29 20:06:40 +02:00
32a8e6797e
fixes review
...
Signed-off-by: RAMELLA Sebastien <sebastien.ramella@pirates.re >
2025-04-27 20:31:13 +04:00
89404c28e1
Fix markdown
2025-04-26 23:55:00 +02:00
b8d2681335
Remove useless config suggestions
2025-04-26 23:53:59 +02:00
c4e621f3cf
Add new exploit for CVE-2025-32432: Craft CMS Preauth RCE
2025-04-26 05:43:13 +02:00
740a8130d4
combine modules
...
Signed-off-by: RAMELLA Sebastien <sebastien.ramella@pirates.re >
2025-04-25 10:35:16 +04:00
0a428b8d03
add scanner capability + code review
...
Signed-off-by: RAMELLA Sebastien <sebastien.ramella@pirates.re >
2025-04-20 18:02:52 +04:00
59ed219775
Added exploit module for CVE-2025-21293 (Erlang/OTP)
...
Signed-off-by: RAMELLA Sebastien <sebastien.ramella@pirates.re >
2025-04-19 00:18:46 +04:00
e1b5109c70
Add BentoML RCE module (CVE-2025-32375)
2025-04-17 20:46:43 +09:00
edcc30699a
Make user be able to specify a particular endpoint
2025-04-16 21:47:31 +09:00
8dc4beba7f
Update documentation/modules/exploit/linux/http/bentoml_rce_cve_2025_27520.md
...
Co-authored-by: Julien Voisin <jvoisin@users.noreply.github.com >
2025-04-16 20:48:34 +09:00
a33a8d91fe
Update the document
2025-04-16 12:52:15 +09:00
e51cd24383
Add BentoML RCE module (CVE-2025-27520)
2025-04-15 22:46:42 +09:00
fe9a0ad25b
Land #20008 , PandoraFMS Auth RCE module
...
Pandora FMS authenticated RCE [CVE-2024-12971]
2025-04-08 07:50:28 +02:00
76fb34a5db
small update in description of the module and documentation
2025-04-06 10:49:03 +00:00
8a72fd6861
init module and documentation
2025-04-06 10:33:56 +00:00
139dd50333
Add Appsmith RCE module (CVE-2024-55964)
2025-04-05 14:56:04 +09:00
08e227faca
Merge pull request #19934 from sfewer-r7/bugfix-cisco-iosxe-rce
...
Improve exploit/linux/misc/cisco_ios_xe_rce (CVE-2023-20198 + CVE-2023-20273)
2025-03-27 16:51:16 -07:00
bf1f919d9f
Merge pull request #19957 from msutovsky-r7/auxmodule-eramba-update
...
Auxmodule eramba update
2025-03-25 13:54:24 -04:00
d922976ea4
Adding more clear installation steps
2025-03-20 19:54:57 +01:00
df027f3fdd
Update documentation, adding more precise check, removing unnecessary characters
2025-03-20 15:18:55 +01:00
9886f78575
Upgrade Eramba RCE module
2025-03-13 12:34:50 +01:00
e341398871
small update on module and documentation
2025-03-10 19:35:37 +00:00
44bdc5b44f
Update documentation/modules/exploit/linux/http/invoiceshelf_unauth_rce_cve_2024_55556.md
...
Co-authored-by: msutovsky-r7 <martin_sutovsky@rapid7.com >
2025-03-10 19:29:12 +01:00
281b728000
initial module and documentation
2025-03-07 17:34:22 +00:00
efb0d5da4c
fix typo, C1000v should be CSR1000v. Be consistant with IOS XE and not IOS-XE.
2025-03-04 09:09:32 +00:00
edd36a8182
update the docs for exploit/linux/misc/cisco_ios_xe_rce after retesting the changes
2025-03-03 20:39:53 +00:00
e71a851e3f
mention that the C8000v series appliance version 17.6.5 was observed to not be vulnerable to CVE-2023-20273. Inspecting the Lua code shows this appliance has additional command injection filtering in place (see pexec_setsid in /usr/binos/openresty/nginx/conf/pexec.lua) which prevents the injection from working
2025-03-03 20:22:46 +00:00
3c4d0aae2f
Land #19899 , D-Tale remote code execution module
...
Add D-Tale RCE module (CVE-2024-3408, CVE-2025-0655)
2025-03-03 13:04:45 +01:00
47351e4959
Use FETCH_DELETE as default
2025-03-03 20:52:55 +09:00
65d2b6380b
Update vulnerable version
2025-03-02 12:14:25 +09:00
77c3ce52e0
Improve:
...
* Support the prior to 3.13.0 versions
* CVE-2024-3408 bypass for authentication
2025-03-01 11:58:28 +09:00
8dd032e529
Land #19897 , Invoice Ninja unauthenticated RCE (CVE-2024-55555) and Laravel Crypto Killer mixin
...
Land #19897 , Invoice Ninja unauthenticated RCE (CVE-2024-55555) and Laravel Crypto Killer mixin
2025-02-25 13:14:18 +01:00
1c27e2a958
docs: update docs for rubocop
2025-02-25 12:15:52 +01:00
2d55f5c16e
Update documentation/modules/exploit/linux/http/invoiceninja_unauth_rce_cve_2024_55555.md
...
Co-authored-by: Diego Ledda <diego_ledda@rapid7.com >
2025-02-24 15:51:06 +01:00
41e690445e
simplified some code sections
2025-02-23 12:59:52 +00:00
ece33ee8ec
added documentation
2025-02-23 09:54:26 +00:00
4d4b88c94e
Add D-Tale unauth RCE module (CVE-2025-0655)
2025-02-23 09:33:42 +09:00
215957465c
added default options and updated documentation
2025-02-20 13:19:41 -06:00
15c20272ea
removed linux dropper code and tested with PR 19850
2025-02-20 13:19:41 -06:00
fcc929e228
updated documentation with Linux Dropper (x86_64) target scenario
2025-02-20 13:19:41 -06:00
f857e5fe67
fixed code review and updated documentation
2025-02-20 13:19:41 -06:00
682be79920
first release module and documentation
2025-02-20 13:19:41 -06:00
bd42b23ef0
Land #19883 , module for unauthenticated RCE in InvokeAI
2025-02-18 14:01:11 +01:00
msutovsky-r7