336a1feaf7
Fix up naming of module and documentation and fix most of the RuboCop and formatting errors
2022-07-19 15:44:52 -05:00
d2769ef82b
Add Roxy-WI exec
2022-07-19 21:08:45 +03:00
e3e6afbaa3
Land #16753 , ms03_007_ntdll_webdav: Cleanup and add additional offsets
...
Merge branch 'land-16753' into upstream-master
2022-07-19 08:48:06 -05:00
cf54762191
Initial commit of CVE-2022-30526 LPE
2022-07-19 03:29:11 -07:00
2af8042bfa
Land #16761 , clean up ms01_023_printer
...
Adds additional offsets for various Windows 2000 targets.
Replaces raw socket TCP with HttpClient. This works fine in testing.
Fixes default payload, adds docs and notes.
2022-07-16 17:56:59 -04:00
adecb0d94b
Merge branch 'master' into ms02_065_msadc
2022-07-16 17:26:23 -04:00
77be219bc2
Land #16754 , add offsets to ms02_065
...
Adds additional offsets for various Windows 2000
Professional targets, adds docs, fixes default
payload and resolves rubocop violations.
2022-07-16 16:43:47 -04:00
304d717757
Make the path-traversal depth configurable
2022-07-15 15:41:27 -07:00
7468f6ecd8
Remove JAVA Arch
2022-07-15 15:35:14 -07:00
6f33ddd867
Remove a broken error check
2022-07-15 13:49:56 -07:00
5f3268eae7
Fix the Arch
2022-07-15 13:46:49 -07:00
5257de67f9
Style fixes
2022-07-15 13:43:46 -07:00
59685f82f8
ms02_065_msadc: Cleanup and add additional offsets
2022-07-15 00:15:56 +10:00
819d1fa2dd
Land #16762 , Sourcegraph RCE module
...
This module exploits a vuln in the gitserver
component of sourcegraph that results in OS
command execution in the context of gitserver.
2022-07-13 10:09:06 -04:00
ccef129807
Land #16727 , set tftphost option
2022-07-12 15:29:42 -05:00
fdd7a863c8
Land #16736 , fix confluence_widget_connector crash
...
This change fixes a bug in the confluence_widget_connector
exploit module to prevent it from crashing when the HTTP
response body received in the get_java_property method is
empty or does not match expected regex.
2022-07-12 12:27:40 -04:00
52fd45b7ab
Land #16744 Jboss EAP/AS RCE module
...
This module exploits a Java deserialization vulnerability
in JBOSS EAP/AS Remoting Unified Invoker interface for
versions 6.1.0 and prior.
2022-07-12 10:49:22 -04:00
7df6d73741
Added new line to end of file
2022-07-12 09:08:19 -04:00
44abcfcb28
Added flavour to fix linux_dropper
2022-07-12 09:06:06 -04:00
439606b2ac
Use a more reliable check method
...
The check method will not work regardless of whether or not there is a
cloned repository. The response can be analyzed using a random,
non-existant repo.
2022-07-11 09:48:08 -04:00
48cefee585
Cleanup the module based on feedback
2022-07-11 09:09:25 -04:00
3e66fc8f4e
Fix crash in ms04-007-killbill
2022-07-10 00:07:26 +01:00
9d979fdf4f
Finish up the sourcegraph RCE module
2022-07-08 17:27:22 -04:00
27ad62c964
Add a decent check method
2022-07-08 16:40:42 -04:00
56dd61027f
Rubocop
2022-07-08 10:38:42 -07:00
8090fdb273
Re-order authors
2022-07-08 10:27:41 -07:00
67c60c9c5f
Specify the vulnerable version
2022-07-08 10:27:25 -07:00
bcd4b6e49f
Better name
2022-07-08 10:26:09 -07:00
9685bc4bc3
Use flat_map instead of map().flatten
2022-07-08 10:25:10 -07:00
134ce0d7bd
Make the FTP server more realistic, and remove Timeout
2022-07-08 10:21:58 -07:00
83bc954e9d
ms01_023_printer: cleanup; use HttpClient; add additional targets
2022-07-09 01:36:10 +10:00
728cf97f6e
Land #16718 , Fix run_as module on x64 systems
2022-07-08 09:22:22 -04:00
2f7cf90b7f
mixin didn't work with linux_dropper payload
...
- Fixed exception handling variable attribution
- Tried to change JavaDeserialization Util to JavaDeserialization mixin
instead
- Changed the fail reason when the connection is unsuccessful
2022-07-08 02:30:26 +02:00
f958b0a053
Land #16738 , correct CVE/lint for weblogic module
2022-07-07 18:08:13 -05:00
46b5092be4
Make Rubocop happy, and improve error handling
2022-07-07 16:07:10 -07:00
52ac281991
change wording in fail_with()
2022-07-07 18:05:56 -05:00
3a9feac1cf
Finish up the first draft of the module, which seems to work decently
2022-07-07 14:22:37 -07:00
4da72a9b01
Land #16735 , Fix defaults for aerohive module
...
This change sets the MeterpreterTryToFork advanced
payload option to true by default for the Linux target
in the aerohive_netconfig_lfi_log_poison_rce module.
2022-07-07 16:21:56 -04:00
966d469aa5
Continuing cleanup
2022-07-07 12:57:34 -07:00
f9664575c5
Working payload
2022-07-07 10:57:41 -07:00
d785e90bd9
Get the full exploit working, except for a hardcoded payload
2022-07-07 09:58:07 -07:00
3f63f9fcd1
ms02_065_msadc: Cleanup and add additional offsets
2022-07-08 00:26:02 +10:00
7d32338702
remove ARTIFACTS_ON_DISK from weblogic_deserialize_asyncresponseservice notes
2022-07-07 05:26:59 -07:00
7d111938d5
ms03_007_ntdll_webdav: Cleanup and add additional offsets
2022-07-07 20:31:57 +10:00
fa8d109f65
Add the incomplete version of CVE-2022-28219 module to msf
2022-07-06 15:57:13 -07:00
3d13dab11e
Update jenkins_script_console.rb
2022-07-06 19:08:38 +02:00
5db741550b
Update jenkins_script_console.rb
...
Modern Java disabled the sun.misc.BASE64Decoder class so exploit will fail on any newer version of Jenkins.
The java.util.Base64 class should be used now; the change has been confirmed to work with the latest version of Jenkins (the current exploit silently fails).
2022-07-06 15:16:01 +02:00
a8c2b3bdff
Initial exploit for CVE-2022-23642
2022-07-05 16:58:22 -04:00
f7209bfc75
Land #16724 , Modernize ms01_026_dbldecode
...
Use HttpClient; remove meterpreter code; fix stager
2022-07-05 09:36:58 -04:00
50ca5f0ce2
Add description
2022-07-05 00:25:07 +02:00
Grant Willcox