adam/metasploit-gs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
73,452 Commits 27 Branches 1,043 Tags
3da170a43c7f288fe9bc88fe325da488733acac3
Commit Graph

6278 Commits

Author SHA1 Message Date
William Vu 78ba617aef Add module doc 2021-10-06 16:43:57 -05:00
RAMELLA Sébastien 92a0f9034d add modules docs 2021-10-06 23:51:31 +04:00
Matthew Dunn 43d9e311e7 update documentation 2021-10-06 13:56:08 -04:00
Matthew Dunn 1d0c8cdc0c Add Azure AD Login Module 2021-10-06 13:34:46 -04:00
bwatters ff2a65976e Land #15698, Add PoC for CVE-2021-22555 Netfilter Priv Escalation 
Merge branch 'land-15698' into upstream-master
 2021-10-06 12:00:32 -05:00
adfoster-r7 50ad2f13e1 Land #15739, Add Diagnostic State Module for hwbridge 2021-10-04 17:49:24 +01:00
sjanusz 2c7aa022d4 Add PoC for CVE-2021-22555 Netfilter Priv Escalation 2021-10-04 16:48:23 +01:00
Jay Turla f5edbffb74 Update diagnostic_state.md 2021-10-04 07:30:45 +08:00
h00die 43d77d63ce ghostcat meta updates 2021-10-03 16:30:12 -04:00
Jay Turla 3e3cbb5c4e Update diagnostic_state.md 2021-10-04 01:38:15 +08:00
Jay Turla 8bdbf99c80 Add Diagnostic State Module 
## Introduction
This module will keep the vehicle in a diagnostic state on rounds by sending tester present packet.

## Verification Steps

Fire up virtual CAN bus:

1. `sudo modprobe can`
2. `sudo modprobe vcan`
3. `sudo ip link add dev vcan0 type vcan`
4. `sudo ip link set up vcan0`

Launch msf:

5. Start `msfconsole`
6. `use auxiliary/server/local_hwbridge`
7. `set uripath testbus`
8. `run`
9. `use auxiliary/client/hwbridge/connect`
10. `set targeturi testbus`

## Options

```
Module options (post/hardware/automotive/diagnostic_state):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   ARBID    0x7DF            no        CAN ID to perform ECU Hard Reset
   CANBUS                    no        CAN Bus to perform scan on, defaults to connected bus
   ROUNDS   500              yes       Number of executed rounds
   SESSION                   yes       The session to run this module on.
```

## Scenarios
You can test this module doing a candump and you should receive a response for each can frame in a loop at 0x7E8 when running UDS Simulator.

```
msf5 auxiliary(client/hwbridge/connect) > run
[*] Running module against 127.0.0.1

[*] Attempting to connect to 127.0.0.1...
[*] Hardware bridge interface session 1 opened (127.0.0.1 -> 127.0.0.1) at 2019-09-11 04:59:40 -0700
[+] HWBridge session established
[*] HW Specialty: {"automotive"=>true}  Capabilities: {"can"=>true, "custom_methods"=>true}
[!] NOTICE:  You are about to leave the matrix.  All actions performed on this hardware bridge
[!]          could have real world consequences.  Use this module in a controlled testing
[!]          environment and with equipment you are authorized to perform testing on.
[*] Auxiliary module execution completed
msf5 auxiliary(client/hwbridge/connect) > sessions

Active sessions
===============

  Id  Name  Type                   Information  Connection
  --  ----  ----                   -----------  ----------
  1         hwbridge cmd/hardware  automotive   127.0.0.1 -> 127.0.0.1 (127.0.0.1)

msf5 auxiliary(client/hwbridge/connect) > sessions -i 1
[*] Starting interaction with 1...

hwbridge > run post/hardware/automotive/diagnostic_state canbus=vcan0

[*] Putting the vehicle in a diagnostic state...
[*] In order to keep the vehicle in this state, you need to continuously send a packet to let the vehicle know that a diagnostic technician is present.
hwbridge >
```

You can use candump to verify the CAN messages being sent:

```
─$ candump vcan0
└─$ candump vcan0
  vcan0  7DF   [2]  01 3E
  vcan0  7E8   [4]  03 7E 00 00
  vcan0  7DF   [2]  01 3E
  vcan0  7E8   [4]  03 7E 00 00
  vcan0  7DF   [2]  01 3E
  vcan0  7E8   [4]  03 7E 00 00
  vcan0  7DF   [2]  01 3E
  vcan0  7E8   [4]  03 7E 00 00
  vcan0  7DF   [2]  01 3E
  vcan0  7E8   [4]  03 7E 00 00
  vcan0  7DF   [2]  01 3E
  vcan0  7E8   [4]  03 7E 00 00
  vcan0  7DF   [2]  01 3E
  vcan0  7E8   [4]  03 7E 00 00
  vcan0  7DF   [2]  01 3E
  vcan0  7E8   [4]  03 7E 00 00
  vcan0  7DF   [2]  01 3E
  vcan0  7E8   [4]  03 7E 00 00
  vcan0  7DF   [2]  01 3E
  vcan0  7E8   [4]  03 7E 00 00
  vcan0  7DF   [2]  01 3E
  vcan0  7E8   [4]  03 7E 00 00
  vcan0  7DF   [2]  01 3E
  vcan0  7E8   [4]  03 7E 00 00
  vcan0  7DF   [2]  01 3E
  vcan0  7E8   [4]  03 7E 00 00
  vcan0  7DF   [2]  01 3E
  vcan0  7E8   [4]  03 7E 00 00
  vcan0  7DF   [2]  01 3E
  vcan0  7E8   [4]  03 7E 00 00
  vcan0  7DF   [2]  01 3E
  vcan0  7E8   [4]  03 7E 00 00
  vcan0  7DF   [2]  01 3E

-- snippet --
```

UDS Server Output
```
└─$ ./uds-server -v -V "PWN3D" vcan0
Using CAN interface vcan0
Fuzz level set to: 0
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E

-- snippet --
```
 2021-10-04 01:35:31 +08:00
Spencer McIntyre d8f2b18649 Implement review feedback 2021-10-01 14:44:13 -04:00
Spencer McIntyre 8d82bebc3c Add the kubernetes/exec module docs 2021-10-01 10:32:12 -04:00
adfoster-r7 26e317d093 Land #15707, Add ECU Hard Reset for hwbridge 2021-09-28 19:18:46 +01:00
Kazuyoshi Maruta 32d45c07fe Add xchat.md 2021-09-27 12:26:53 -05:00
Kazuyoshi Maruta 09ed5b671e Add xchat.rb, Add kmeleon.md 2021-09-27 12:26:53 -05:00
Kazuyoshi Maruta 37cc6e540e Add modules, Rename a module 2021-09-27 12:26:52 -05:00
Kazuyoshi Maruta c1742a23b9 Update wording on Module documentation. Replace EXTRACT_CREDENTIALS_FROM_FILE with EXTRACT_DATA 2021-09-27 12:26:52 -05:00
Kazuyoshi Maruta 6a8782f388 Update module documentation. 2021-09-27 12:26:52 -05:00
Kazuyoshi Maruta cc50f75a09 Update line.md 2021-09-27 12:26:52 -05:00
KazuCyber 858c05b476 Update documentation/modules/post/windows/gather/credentials/aim.md 
Co-authored-by: Brendan <bwatters@rapid7.com>
 2021-09-27 12:26:52 -05:00
Kazuyoshi Maruta dc6f6a8f25 Packrat: 29 post exploitation modules 2021-09-27 12:26:52 -05:00
Jay Turla 05703c1918 Update ecu_hard_reset.md 2021-09-27 19:19:46 +08:00
Jay Turla f60c492cf1 Add ECU Hard Reset for hwbridge 2021-09-27 18:58:39 +08:00
Jack Heysel b7f7c30f2b Land #15594, a wordpress scanner enhancement 
This adds options to the wordpress scanner to allow the user
to only scan for plugins or themes that metasploit has
modules for.
 2021-09-24 15:51:07 -04:00
space-r7 756fac4921 Land #15677, add Netgear auth bypass 2021-09-24 14:44:34 -05:00
h00die 7df1aa1429 update doc 2021-09-23 21:44:53 -04:00
kalba-security 6b4aa25490 Add Meterpreter support via Linux target with ARCH_ARMLE and cmdstager 2021-09-23 18:26:13 -04:00
Grant Willcox 9deffb1848 Fix up a bug and resolve Christophe's review comments 2021-09-23 16:45:15 -05:00
Grant Willcox 061240367d Push up changes to support saving WiFi credentials captured to the database, as well as to fix issues noticed during the review process 2021-09-23 13:31:27 -05:00
Tim W 30f1a0cd7b add documentation 2021-09-23 13:02:17 +01:00
kalba-security 0d42c36655 Specify that newer versions may still be vulnerable as no patch has been confirmed by the vendor 2021-09-23 05:19:07 -04:00
kalba-security b81d44020a Add Aerohive NetConfig 10.0r8a LFI and log poisoning to RCE module and docs 2021-09-23 04:57:48 -04:00
Grant Willcox 1ca075fb4f Fix up RuboCop issues 2021-09-22 14:06:06 -05:00
Grant Willcox d4474b0706 Add in refined XPATH searches to module, ability to automatically get a session, improved error handling, documenation for module, and general improvements 2021-09-22 14:01:49 -05:00
Spencer McIntyre 6acdced3f0 Land #15506, Add evasion module syscall_inject 2021-09-22 10:17:13 -04:00
Spencer McIntyre ca6f957de0 Land #15632, Winrm improvements 2021-09-21 16:43:24 -04:00
space-r7 fee037ac18 Land #15670, add opmanager sumpdu deser module 2021-09-20 12:15:26 -05:00
space-r7 327aefd3f5 add older path, fix typo 2021-09-20 12:14:42 -05:00
Spencer McIntyre fd0f565095 Add automatic targeting for the CVEs 2021-09-16 15:15:52 -04:00
space-r7 12af64c4d8 Land #15604, add buffer overflow G-Cam module 2021-09-16 13:02:57 -05:00
Spencer McIntyre 56cd43a8b8 Land #15624, Add module for CVE-2020-27955 2021-09-15 14:54:19 -04:00
space-r7 c491687b78 Land #14631, add Jira user enum module 2021-09-15 12:37:17 -05:00
space-r7 c151937226 Update versions tested and vulnerable versions 2021-09-15 12:35:34 -05:00
Spencer McIntyre 480dec9a1e Land #15658, Add module for CVE-2021-32682 2021-09-14 14:09:27 -04:00
Grant Willcox cec3a4bc46 Land #15601, Add Geutebruck Post Exploitation Module 2021-09-14 10:03:21 -05:00
Spencer McIntyre d82ed7d4a2 Write up the module docs 2021-09-14 09:10:44 -04:00
space-r7 91ae50eb27 escapeshellcmd -> escapeshellarg 2021-09-09 17:28:05 -05:00
space-r7 0095613a94 add completed module and documentation 2021-09-09 16:58:40 -05:00
Grant Willcox 7d3d57817f Add in final changes so that we verify what we insert into the database more and only insert valid formats of data, and then also update the documentation accordingly 2021-09-08 17:27:53 -05:00