Commit Graph

11360 Commits

Author SHA1 Message Date
Jack Heysel 44ce4d422e Land #16610, New Print Nightmare Exploit
Updates existing Print Nightmare module to use the
new SMB Server added in #16481.
2022-05-24 16:24:47 -04:00
NikitaKovaljov 3eb8f8cf2e fix of improper NA filtering. 2022-05-24 19:01:36 +03:00
Christophe De La Fuente 63dea932ad Land #16481, Update Msf::Exploit::Remote::SMB::Server::Share 2022-05-24 11:50:06 +02:00
Jack Heysel 19abce7045 Land #16505, Fix Lotus Domino Hash Parsing
This fixes an issue with the regex that was parsing
Lotus Domino hashes. The fix also changes the
regex to xml parsing
2022-05-19 10:00:36 -04:00
adfoster-r7 2cbd64b759 Land #16487, fix deprecation warning in auxiliary/capture/server/mssql as well as updating johntheripper format 2022-05-19 00:40:03 +01:00
Spencer McIntyre 02e7a65b93 Just move the auxiliary module into an exploit 2022-05-16 17:44:31 -04:00
Alexandre Bezroutchko 71acc02c96 fix race condition when scanning short ranges 2022-05-16 20:08:41 +00:00
Spencer McIntyre 36921a00f6 Merge branch 'feat/mod/cve-2021-1675-retry' into feat/mod/cve-2021-1675 2022-05-16 14:59:32 -04:00
Spencer McIntyre d278ad9be1 Add the printnightmare exploit 2022-05-16 14:56:46 -04:00
Spencer McIntyre 75d137fce5 Rubocop and add todo to printnightmare 2022-05-16 14:56:46 -04:00
Spencer McIntyre edd977165c Revert option changes for the capture NTLM provider 2022-05-16 14:39:45 -04:00
Spencer McIntyre 7c15b144c4 Update the SMB capture server 2022-05-16 14:39:44 -04:00
Spencer McIntyre 906fdd6a05 Update the MSSQL capture module
Remove the apparently unused reference to the SMB server mixin.
2022-05-16 14:39:44 -04:00
Spencer McIntyre 475f6eee8c Capture hash when serving files over SMB 2022-05-16 14:39:44 -04:00
Spencer McIntyre f9a5d8285a Use the retry mixin for printnightmare
This module gets disconnected from the named pipe. Use the new retry
mixin to avoid waiting for a standard delay.
2022-05-16 09:53:57 -04:00
adfoster-r7 db694efd36 Improve relative redirect handling 2022-05-16 12:03:24 +01:00
npm-cesium137-io 8b502d074f vcenter_offline_mdb_extract aux module
Add new aux module vcenter_offline_mdb_extract for extracting IdP
credentials, certificates and keys from a vCenter backup file.

Added module documentation.
2022-05-13 15:57:59 -04:00
npm-cesium137-io ecec8a5993 Clean up unrelated files. 2022-05-13 15:53:40 -04:00
adfoster-r7 739c0fcad1 Specify peer hostname for ssl connections 2022-05-13 13:55:43 +01:00
dwelch-r7 c0c02e56ba Land #16430, Improve kerberos user enum module 2022-05-13 12:17:26 +01:00
bwatters 934f193dc0 Land #16484, Add vcenter_forge_saml_token aux module
Merge branch 'land-16484' into upstream-master
2022-05-12 17:36:20 -05:00
h00die 978dfe9b74 nfs mount more intelligent 2022-05-08 08:48:53 -04:00
Redouane NIBOUCHA 90937e6daa Address feedback from space-r7 2022-05-06 00:31:20 +02:00
adfoster-r7 53052af988 Fix login crash for pihole modules 2022-05-04 19:42:39 +01:00
Adrian Vollmer d6547c0bc1 Use XML parser instead of regex 2022-04-29 16:19:58 +02:00
Adrian Vollmer 267f7a541d Update modules/auxiliary/scanner/lotus/lotus_domino_hashes.rb
Co-authored-by: jheysel-r7 <Jack_Heysel@rapid7.com>
2022-04-28 08:25:32 +02:00
Redouane NIBOUCHA f6ff5dde75 Fix hash format (make it compatible with john the ripper) 2022-04-28 06:05:59 +02:00
Redouane NIBOUCHA 247ae89c43 Use constants for JTR formats instead of strings 2022-04-27 03:25:26 +02:00
Adrian Vollmer dfdd57e8a3 Improve regex parsing in lotus_domino_hashes
* The closing quotes after the `VALUE` attribute were not escaped. This
  commit adds them
* The regex assumed that the short name does not contain whitespace.
  I am looking at a Domino instance where the short name DOES contain
  whitespace. This commit changes the regex such that the value is
  assumed to not contain a quote before the closing quote. Of course,
  there could be an escaped quote inside quotes in the HTML source, but
  if we want to do it properly, we'd need an HTML parser which exceeds
  my modest ruby skills.
* The fields `$dspHTTPPassword` and `dspHTTPPassword` (without the
  dollar sign) can both contain the hash. The code assumed that only up
  to one of those fields contain a hash. This leads to the hash being
  printed twice in the output in my case.
2022-04-26 15:46:56 +02:00
npm-cesium137-io 7190a967ce Refactor MKII vcenter_forge_saml_token 2022-04-25 11:44:39 -04:00
npm-cesium137-io 3e07b8c99b Refactor MKI vcenter_forge_saml_token.rb
Extensive refactoring to move away from directly manipulating datastore
options and use local variables instead.

The initial template generation method has been redesigned to use an
external file via Erubi::Engine which is much cleaner vs. jamming a
multiline string into the module.

Response HTML from vCenter is now parsed with Nokogiri HTML vs. pulling
it out with regex.

Registered options have been reworked, following suggestions and
feedback. The use of VHOST in particular eliminates the need to pass
RHOSTS to the template and makes the module behave more closely to "real"
vCenter (i.e., always uses FQDN for the destination).

Added advanced datastore options to control the token lifetime
NOT_BEFORE and NOT_AFTER skew, in seconds. This also uncovered a bug with
the way I was deriving Zulu time which skewed based on the local system
time zone offset from Zulu; this has been fixed.

Corrected a stupid typo in the validate_fqdn method (don't need to check
for capital letters if the test string is always downcase...)

validate_idp_options now uses File.binread and can process certs in keys
in DER or PEM instead of just PEM.

Code optimization, particularly around error handling; other minor
tweaks based on improved understanding of the Framework's capabilities.

Many style changes and modifications based on suggestions and feedback.

Documentation was updated to reflect reality.
2022-04-23 19:42:24 -04:00
h00die 3b5719ec88 nfs mount more intelligent 2022-04-23 07:11:00 -04:00
h00die 44ab99c89f nfs mount more intelligent 2022-04-23 07:02:37 -04:00
Redouane NIBOUCHA 2043d96ae9 Update service_name 2022-04-22 07:22:33 +02:00
Redouane NIBOUCHA 87a21bd117 Add the MSSQL injection library 2022-04-22 06:19:36 +02:00
Redouane NIBOUCHA f21f786c06 Use #create_credential_login instead of the deprecated #report_auth_info 2022-04-22 06:06:05 +02:00
npm-cesium137-io 2e7ae40fcb Revise vcenter_secrets_dump 2022-04-21 09:51:51 -04:00
npm-cesium137-io 30aaea9350 Add vcenter_forge_saml_token aux module 2022-04-21 09:25:35 -04:00
adfoster-r7 104071e816 Land #16483, fix typo 'MetaSploit' in readme and comment 2022-04-21 10:13:14 +01:00
Jack Heysel d3c9648af0 Land #16438, Fix smtp server auth prompt
Some smtp servers only give out creds when promted.
Now there exists a mondule option 'AUTHPROMPT' to indicate
whether or not the auth prompt is required by the server.
2022-04-20 22:21:55 -07:00
Anton Panteleev 9297c0e058 FIX: typo 'MetaSploit' in readme and comment 2022-04-21 14:44:57 +10:00
Jack Heysel 4417a335ff Land #16379, Make SSH defaults widely used
Refactored a number of modules to use ssh_client_defaults
2022-04-19 22:08:45 -07:00
Brendan Coles 94ed9ae28b Modules: Prefer CVE references over cve.mitre.org URL references 2022-04-19 20:42:23 +00:00
Brendan Coles e34201ce48 fortios_vpnssl_traversal_creds_leak: Add authors, notes, and references 2022-04-16 06:52:59 +00:00
Heyder Andrade bf849eb2a2 Making SSH defaults widely used 2022-04-14 17:27:19 +02:00
Heyder Andrade 64eccf5578 Rollback changes used for test 2022-04-14 14:48:26 +02:00
Heyder Andrade d3c8119e25 Removed string from the command input 2022-04-13 18:55:17 +02:00
Heyder Andrade 1305baf6f6 Module should use ssh_defaults 2022-04-13 18:51:43 +02:00
h00die ab382cddf0 change requireauth to authprompt 2022-04-11 14:26:25 -04:00
h00die f7b58e243c smtp server can prompt for auth 2022-04-10 11:55:07 -04:00