 bwatters
|
3a6293357e
|
Land #14190, Add the DOMAIN option to the CVE-2020-0688 Exploit
Merge branch 'land-14190' into upstream-master
|
2020-10-05 12:12:21 -05:00 |
|
|
bwatters
|
3aeeede4a6
|
Land #14187, Added CVE-2020-3433 module
Merge branch 'land-14187' into upstream-master
|
2020-09-29 13:41:33 -05:00 |
|
|
bwatters
|
81fd2ea8a8
|
rubocop changes
|
2020-09-29 13:38:31 -05:00 |
|
|
Spencer McIntyre
|
e7d2b73600
|
Add a DOMAIN option to CVE-2020-0688 for consistency with other modules
|
2020-09-28 09:24:39 -04:00 |
|
|
Shelby Pace
|
f0f4da2b1e
|
Land #14157, Windows update orchestrator privesc
|
2020-09-25 16:07:27 -05:00 |
|
|
Antoine GOICHOT
|
fef88f27eb
|
Added CVE-2020-3433 module
|
2020-09-25 23:04:58 +02:00 |
|
|
bwatters
|
2ed72007e0
|
Typos and cleanup
|
2020-09-25 12:27:55 -05:00 |
|
|
bwatters
|
7e68c42876
|
Rubocop, fix check method, clean up c code
|
2020-09-22 07:45:02 -05:00 |
|
|
bwatters
|
534e945cd0
|
First attempt at CVE-2020-1313
|
2020-09-18 15:39:12 -05:00 |
|
|
Shelby Pace
|
c04e8d73c3
|
Land #14023, spooler svc privesc (PrinterDemon)
|
2020-09-17 16:06:29 -05:00 |
|
|
Shelby Pace
|
8b75401fcf
|
remove requires
|
2020-09-17 16:04:56 -05:00 |
|
|
William Vu
|
5bda3b4b9d
|
Revert "Make User-Agent consistent across requests"
This reverts commit 0ec97aa447.
|
2020-09-16 13:24:18 -05:00 |
|
|
William Vu
|
da4e960eb0
|
Revert "Fix HttpUserAgent to UserAgent"
This reverts commit 3c8390a1c7.
|
2020-09-16 13:24:14 -05:00 |
|
|
William Vu
|
3c8390a1c7
|
Fix HttpUserAgent to UserAgent
Payload vs. HttpClient. Whoops.
|
2020-09-16 13:03:55 -05:00 |
|
|
William Vu
|
0ec97aa447
|
Make User-Agent consistent across requests
|
2020-09-16 12:59:17 -05:00 |
|
|
William Vu
|
03e0b9098c
|
Add more words about Exchange role groups
|
2020-09-16 12:55:08 -05:00 |
|
|
bwatters
|
d8df8a3422
|
Change description and fix typo
|
2020-09-16 11:17:39 -05:00 |
|
|
bwatters
|
dcd0918694
|
Fixed cleanup and check
|
2020-09-16 11:17:39 -05:00 |
|
|
bwatters
|
198f3905ae
|
Logic errors and typos
|
2020-09-16 11:17:39 -05:00 |
|
|
bwatters
|
fe59099678
|
Clean up C code, add support for x86 targets
|
2020-09-16 11:17:39 -05:00 |
|
|
bwatters
|
ce8033714d
|
remove copy/pasta code and fix version check
|
2020-09-16 11:17:39 -05:00 |
|
|
bwatters
|
c2e2a4fe2c
|
More Rubocop, add documentation, and typo fix
|
2020-09-16 11:17:39 -05:00 |
|
|
bwatters
|
f14d6ffe13
|
Rubocop and modularization
|
2020-09-16 11:17:39 -05:00 |
|
|
bwatters
|
a72769909b
|
Change exe to take destination and source files for copy
|
2020-09-16 11:17:39 -05:00 |
|
|
bwatters
|
17272209cc
|
First try at CVE-2020-1048, needs lots of work
|
2020-09-16 11:17:38 -05:00 |
|
|
William Vu
|
e118ff1509
|
Add Microsoft Exchange Server DLP Policy RCE
CVE-2020-16875
|
2020-09-16 02:41:08 -05:00 |
|
|
gwillcox-r7
|
593945ee61
|
Update module documentation with more detail r.e affected versions and the fact that the use of UNC paths could cause an issue if they are not typed in correctly. Also update the module documentation to use the output from recent tests to reflect recent changes. Shortern the module description and update its stability rating. Finally add in a reliability rating for the exploit module.
|
2020-09-10 11:32:45 -05:00 |
|
|
gwillcox-r7
|
16b27ae270
|
Add in version checking to ensure we only check if the target has the 'Enable insecure guest logons' enabled if their build number is greater than or equal to 10.0.16299.0, which was the build where this change first was implemented.
|
2020-09-10 11:32:45 -05:00 |
|
|
gwillcox-r7
|
45480373a9
|
Fix up the exploit module so that it will not wait for AV if a UNC path is used, as there is no chance the AV on the host can remove the file on the UNC share, and the UNC share won't be accessed until the exact moment it is needed
|
2020-09-10 11:32:45 -05:00 |
|
|
gwillcox-r7
|
7e1560ff26
|
Update documentation with the installation instructions I mentioned in the GitHub comments. Also RuboCop the exploit module code.
|
2020-09-10 11:32:18 -05:00 |
|
|
gwillcox-r7
|
0d493bbc54
|
Add in extra code to handle cases where the loops may enter a infinte loop state. New code should prevent this from happening
|
2020-09-10 11:32:18 -05:00 |
|
|
gwillcox-r7
|
a94d36248b
|
Add in the AVTIMEOUT option to allow the module to check if any AV or other processes deleted the uploaded DLL file, thereby preventing a situation where the DNS server is unable to restart. Also add in some warning's r.e when we enter the danger section and when we exit it so that users at more aware of when this is happening.
|
2020-09-10 11:32:18 -05:00 |
|
|
gwillcox-r7
|
78dc43efa5
|
Fix up incorrect regex within the check method to fix a logic bug
|
2020-09-10 11:32:18 -05:00 |
|
|
ide0x90
|
c4d463e921
|
Added option to generate standalone DLL.
|
2020-09-10 11:32:18 -05:00 |
|
|
ide0x90
|
53f3b70b33
|
Changed DLL so that it doesn't block the DNS service from stopping after the module executes.
Added OS check (>= Server 2003 is vulnerable so far).
Now cleans up dropped DLL and modified registry value.
|
2020-09-10 11:32:18 -05:00 |
|
|
ide0x90
|
7701ea1bc8
|
Compile DLL so that the DNS service doesn't crash when the module is run.
|
2020-09-10 11:32:18 -05:00 |
|
|
ide0x90
|
151fdb7ea5
|
Reduced exploit ranking and added check to see if session is elevated.
|
2020-09-10 11:32:18 -05:00 |
|
|
ide0x90
|
d1e9039af4
|
Initial module and documentation for Microsoft Windows DNS ServerLevelPluginDll abuse
|
2020-09-10 11:31:51 -05:00 |
|
|
Shelby Pace
|
6e2a7001a9
|
Land #13994, add Dlink Wifi manager rce
|
2020-08-18 09:34:19 -05:00 |
|
|
Shelby Pace
|
d79ad5efca
|
minor rubocop fix
|
2020-08-18 09:33:32 -05:00 |
|
|
Niboucha Redouane
|
0a20a217dc
|
Fix description of the vulnerability
Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com>
|
2020-08-17 21:06:46 +02:00 |
|
|
Niboucha Redouane
|
602865ef70
|
refactor if in check method
Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com>
|
2020-08-17 21:01:34 +02:00 |
|
|
William Vu
|
a6f7c0c0de
|
Backport miscellaneous fixes to my modules
|
2020-08-14 13:40:23 -05:00 |
|
|
Niboucha Redouane
|
1a468fa210
|
remove unneeded include, left from an attempt to execute native payloads
|
2020-08-13 15:51:09 +02:00 |
|
|
Niboucha Redouane
|
66d3b1cd59
|
Add exploit for CVE-2019-13372
|
2020-08-13 15:07:11 +02:00 |
|
|
Jeffrey Martin
|
35017886b8
|
Land #13935, Preliminary Version 6
|
2020-08-06 10:19:34 -05:00 |
|
|
bwatters
|
ba7f1ea486
|
Land #13897, Fix dangling reference issue in cve_2020_0688_service_tracing.rb
and filesystem.rb
Merge branch 'land-13897' into upstream-master
|
2020-08-05 17:04:15 -05:00 |
|
|
gwillcox-r7
|
6ed05df308
|
Land #13517, Documalis Free PDF Editor and Free PDF Scanner JPEG PDF Stack Buffer Overflow
|
2020-08-03 14:11:50 -05:00 |
|
|
gwillcox-r7
|
b64e843d9f
|
Remove CVE reference for now until we can add in a proper CVE reference, fix some alignment issues for Notes section
|
2020-08-03 13:06:45 -05:00 |
|
|
Jeffrey Martin
|
9aa26d1208
|
Merge upstream into 6.x
|
2020-08-03 11:43:47 -05:00 |
|