339c1941ef
Add in myworkspace.id patch for the other missing modules
2020-10-07 17:08:00 -05:00
fb73be7e35
Land #14199 , Fix SecureCRT missing registry key bug
2020-09-30 13:17:06 -05:00
b0bad9fc85
Fix up small issue with one of the checks and update the documentation with the new SESSION_PATH option
2020-09-30 12:26:32 -05:00
dce8bdc19a
Check that the folder does not exist
2020-09-30 07:39:33 +08:00
bb04041c93
Land #14172 , Fix #14170 , Add option to disable autorun in persistence_exe
2020-09-25 13:16:51 +08:00
77b7cf4f65
make RUN_NOW a non-advanced option
2020-09-25 13:15:34 +08:00
72111a9677
don't start service unless RUN_NOW is true
2020-09-25 13:15:30 +08:00
62481f0159
Changed DisableExec with RUN_NOW for consistency
2020-09-23 09:12:31 +00:00
13bf1b7711
Land #14118 , SecureCRT Session Credential Grabber, try 2
2020-09-22 15:38:25 -05:00
a96827a823
Land #14118 , SecureCRT Session Credential Grabber
2020-09-22 15:17:04 -05:00
b9fa36c89b
Add in option to decrypt Login Script V3 within session files and also update some of the existing regex to fix some minor mistakes
2020-09-22 14:47:28 -05:00
e6978d7ef9
Added option to spik execution
2020-09-22 12:21:27 +00:00
67d43bcc15
Add in RuboCop fixes
2020-09-21 13:49:05 -05:00
9b1fec069f
Add in final touch up fixes to make sure that securecrt_store_config checks its input correctly, and to fix up some further mistakes found whilst reviewing the code for nil errors that could be fixed
2020-09-21 13:15:03 -05:00
ba76eabc72
Fix potential nil error with filling in the protocol field in enum_session_file
2020-09-21 12:23:23 -05:00
966ae4a6a3
Fix up the logic for calling securecrt_store_config
2020-09-21 12:10:12 -05:00
dadd0fef89
Simplify the code
2020-09-19 10:09:42 +08:00
85ef2b602e
Fix up regex in module to address changes noted in review. Also update documentation to remove an extra line and to address review recommendtations
2020-09-16 16:02:54 -05:00
6ba06f2e74
add protocols
2020-09-12 15:29:02 +08:00
03c410215e
Add HyperSine as an author since he discovered the decryption keys, update some of the logic to use ternary operators to be more explicit in nature, update securecrt_crypto to fix a bug where it could end up with a defined return value, update the warnings to be a bit more explicit, and fix a logic bug in the run function due to how expand_path and registry_getvaldata interact with one another
2020-09-11 16:55:16 -05:00
2a520606f7
Apply fixes to module and documentation so that the output is easier to understand, contains better installation instructions, and also reflects the fact that this module really gathers SecureCRT sessions and decrypts the password if it is available, aka its still useful even if we don't decrypt the password
2020-09-11 13:41:56 -05:00
b3d386bdb4
Apply msftidy_docs.rb fixes and RuboCop the module
2020-09-11 09:40:37 -05:00
2a50368591
remove comment
2020-09-11 11:54:12 +08:00
7267c504c3
add Gather_Securecrt_Password module
2020-09-11 11:40:52 +08:00
905fb73b7a
Add in initial copy of module and documentation
2020-09-10 18:52:13 -05:00
a870b1df71
Fix user path on newer Windows
2020-09-05 10:43:41 -05:00
b2bd40ef03
Updated module description
...
Changed string description to call out the modified WMI query that now also pulls in the InstalledOn metadata for a given KB.
2020-09-02 11:33:50 -07:00
ca846fa8c1
Changing print statements to follow Ruby style
...
In response to PR feedback
2020-09-02 10:59:15 -07:00
fb4acd53b5
Include KB installation date in enum_patches
...
Currently, the output of this module only lists the KB packages installed on a Windows PC.
This change improves the module by also having it output when a given patch package was installed (this information can also be retrieved from the WMI query); this will provide insight into how regularly and reliably a PC (and by extension, environment) patches - for example, are they late in installing patches by months, when did they last patch etc.
2020-08-31 17:38:02 -07:00
35017886b8
Land #13935 , Preliminary Version 6
2020-08-06 10:19:34 -05:00
0ca7581b67
disk write method success
2020-08-03 13:08:39 -04:00
2dc04709e7
less privs needed
2020-08-03 13:08:39 -04:00
dac3cbcbcd
more options, more optimizations
2020-08-03 13:08:39 -04:00
498a94a9c0
bloodhound cleanup
2020-08-03 13:08:39 -04:00
65039a5091
Merge upstream into 6.x
2020-07-15 09:58:07 -05:00
8627cb2c35
Land #13626 , checkvm post module cleanup
2020-07-10 13:31:03 -05:00
00d0d2cf15
Use service_exists? method
2020-07-10 18:10:26 +00:00
4622fecf73
Use helper method to retrieve services and processes
2020-06-25 12:39:22 +00:00
1a2bf98222
creates standard elog & updates exisiting usages
2020-06-22 12:48:39 +01:00
e95d6b5b7e
post/windows/gather/checkvm: cleanup, increase efficiency, fix style
...
Ensure `registry_enumkeys('HKLM\SYSTEM\ControlSet001\Services')` and
`session.sys.process.get_processes` are called only once.
Update style in line with Rubocop rules
2020-06-13 22:47:22 +00:00
dc2e68631a
Simplify code
2020-06-03 20:22:50 +08:00
4deba1994e
add status
2020-05-30 16:57:29 +08:00
f87594baf1
add email
2020-05-29 01:16:56 +08:00
4d57f52565
Remove the mimikatz extension
2020-05-28 12:34:44 +10:00
c4cafeea4c
Modify description
2020-05-27 20:13:46 +08:00
18d1290bb8
Modify description
2020-05-27 20:09:31 +08:00
2158484617
add xshell_xftp_password module
2020-05-27 19:55:44 +08:00
33e35bae7c
Add descriptions to auxiliary modules Actions
...
And a little formatting
Closes #13403
Update modules/auxiliary/admin/android/google_play_store_uxss_xframe_rce.rb
Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com >
Update modules/auxiliary/admin/backupexec/dump.rb
Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com >
Update modules/auxiliary/admin/http/arris_motorola_surfboard_backdoor_xss.rb
Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com >
Update modules/auxiliary/dos/android/android_stock_browser_iframe.rb
Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com >
Update modules/auxiliary/admin/tikiwiki/tikidblib.rb
Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com >
Update modules/auxiliary/server/capture/smb.rb
Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com >
Update modules/auxiliary/server/capture/telnet.rb
Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com >
Update modules/auxiliary/server/capture/vnc.rb
Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com >
Update modules/auxiliary/server/fakedns.rb
Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com >
Update modules/auxiliary/server/tftp.rb
Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com >
Update modules/auxiliary/dos/http/gzip_bomb_dos.rb
Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com >
Update modules/auxiliary/dos/http/ibm_lotus_notes.rb
Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com >
Update modules/auxiliary/dos/http/ibm_lotus_notes2.rb
Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com >
Update modules/auxiliary/dos/http/webkitplus.rb
Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com >
Update modules/auxiliary/dos/windows/browser/ms09_065_eot_integer.rb
Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com >
Update modules/auxiliary/example.rb
Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com >
Update modules/auxiliary/gather/android_browser_file_theft.rb
Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com >
Update modules/auxiliary/gather/apple_safari_ftp_url_cookie_theft.rb
Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com >
Update modules/auxiliary/gather/android_browser_new_tab_cookie_theft.rb
Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com >
Update modules/auxiliary/gather/apple_safari_webarchive_uxss.rb
Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com >
Update modules/auxiliary/gather/browser_lanipleak.rb
Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com >
Update modules/auxiliary/gather/firefox_pdfjs_file_theft.rb
Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com >
Update modules/auxiliary/gather/flash_rosetta_jsonp_url_disclosure.rb
Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com >
Update modules/auxiliary/gather/samsung_browser_sop_bypass.rb
Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com >
Update modules/auxiliary/server/capture/http.rb
Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com >
Update modules/auxiliary/server/capture/http_basic.rb
Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com >
Update modules/auxiliary/server/capture/http_ntlm.rb
Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com >
Update modules/auxiliary/server/http_ntlmrelay.rb
Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com >
Update modules/auxiliary/server/socks4a.rb
Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com >
Update modules/auxiliary/server/socks5.rb
Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com >
Update modules/auxiliary/server/capture/sip.rb
Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com >
Update modules/auxiliary/server/capture/postgresql.rb
Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com >
Update modules/auxiliary/server/local_hwbridge.rb
Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com >
Update modules/auxiliary/server/webkit_xslt_dropper.rb
Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com >
Update modules/auxiliary/server/socks_unc.rb
Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com >
Update modules/auxiliary/client/iec104/iec104.rb
Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com >
Update modules/auxiliary/gather/browser_info.rb
Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com >
Update modules/auxiliary/server/capture/drda.rb
Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com >
Update modules/auxiliary/server/capture/ftp.rb
Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com >
Update modules/auxiliary/server/capture/mssql.rb
Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com >
Update modules/auxiliary/server/capture/mysql.rb
Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com >
Update modules/auxiliary/server/capture/pop3.rb
Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com >
Update modules/auxiliary/server/dns/spoofhelper.rb
Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com >
Update modules/auxiliary/server/capture/printjob_capture.rb
Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com >
Update description following Actions removal
Update modules/auxiliary/gather/browser_info.rb
Update modules/auxiliary/gather/browser_info.rb
Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com >
Update modules/auxiliary/gather/browser_info.rb
Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com >
2020-05-17 14:51:14 -05:00
ec656ea68c
Minor code and document cleanup
2020-05-01 13:47:17 -05:00
6e931f23d6
Some rubocop fix
2020-04-17 23:08:50 +02:00
Grant Willcox