 sfewer-r7
|
5d05754d9b
|
update the AKB URL to reference the changed CVE
|
2023-04-14 17:44:38 +01:00 |
|
|
sfewer-r7
|
e6211175b3
|
rename the files to the correct CVE
|
2023-04-14 15:52:13 +01:00 |
|
|
sfewer-r7
|
b5ea420760
|
On April 12 Adobe reclassified CVE-2023-26360 from an Improper Access Controll vuln to a Deserialization of Untrusted Data vuln. A private report has confirmed that CVE-2023-26359 is a similar yet seperate vuln, so I am changing the CVE associated with these two modules from CVE-2023-26359 to CVE-2023-26360 as we now beliee this is the correct CVE.
|
2023-04-14 15:49:10 +01:00 |
|
|
h00die-gr3y
|
e0926890ab
|
init commit module
|
2023-04-14 13:07:12 +00:00 |
|
|
h00die-gr3y
|
5584685f24
|
init commit module
|
2023-04-14 13:05:42 +00:00 |
|
|
Jack Heysel
|
08788d3d82
|
Update logging with rc script info
|
2023-04-13 14:28:15 -04:00 |
|
|
sfewer-r7
|
b7f46aab99
|
split the CFC_METHOD_PARAMETERS by comma and not amperstand
|
2023-04-13 16:55:34 +01:00 |
|
|
dwelch-r7
|
f9d5459a9c
|
Land #17872, Ensure identify hashes helper is accessible to modules
|
2023-04-13 16:20:20 +01:00 |
|
|
sfewer-r7
|
90dacd00ab
|
favor a staged meterpreter payload over the non staged payload as a default
|
2023-04-13 16:11:19 +01:00 |
|
|
sfewer-r7
|
8377cb7d6d
|
group multiple suffixes with one call to end_with?
|
2023-04-13 16:00:30 +01:00 |
|
|
adfoster-r7
|
aef2b8d314
|
Land #17804, Fix incorrect module metadata CI and add validation automation
|
2023-04-13 15:11:46 +01:00 |
|
|
Grant Willcox
|
d19c9e7732
|
Land #17867, fix always vulnerable in Auxiliary module surgenews_user_creds
|
2023-04-12 19:32:39 -05:00 |
|
|
Grant Willcox
|
0ed25cd2cc
|
Fix RuboCop issues
|
2023-04-12 19:05:30 -05:00 |
|
|
Grant Willcox
|
0e3a341ac9
|
Land #17864, Correct incorrect log format
|
2023-04-12 17:05:35 -05:00 |
|
|
Jack Heysel
|
30cf40a4f1
|
VMware Workspace One Acces LPE
|
2023-04-12 15:36:17 -04:00 |
|
|
Jack Heysel
|
bc57131b73
|
Moving LPE to separate PR
|
2023-04-12 15:23:51 -04:00 |
|
|
Zach Goldman
|
87c0faa73a
|
Add ensure disconnect to ftp login module, ftp timeout configuration
|
2023-04-12 11:18:50 -05:00 |
|
|
adfoster-r7
|
8e2169ed47
|
Ensure identify hashes helper is accessible to modules
|
2023-04-12 13:28:56 +01:00 |
|
|
adfoster-r7
|
e8365aba85
|
Land #17870, Fixes linting errors on SCTP payloads
|
2023-04-12 13:24:01 +01:00 |
|
|
sfewer-r7
|
43bfdcd6b4
|
improve the aux file read module; add a default CFC endpoint option and support servers configured with the non-default setting 'Enable Request Debugging Output' enabled.
|
2023-04-12 12:39:00 +01:00 |
|
|
Christophe De La Fuente
|
a6b478e046
|
Land #17832, Two modules for UniRPC - CVE-2023-28502 and CVE-2023-28503
|
2023-04-12 11:43:13 +02:00 |
|
|
cgranleese-r7
|
a313e36c1d
|
Fixes linting errors on SCTP payloads
|
2023-04-12 10:24:19 +01:00 |
|
|
cgranleese-r7
|
e6c1aecd26
|
Land #17502, Adds SCTP Sessions
|
2023-04-12 10:15:43 +01:00 |
|
|
Ryuuuuu
|
585479474b
|
fix bug which prints always vulnerable (change code suggested code by @bcoles)
|
2023-04-12 08:25:34 +00:00 |
|
|
Ryuuuuu
|
e3983eac1f
|
Correct incorrect log format
|
2023-04-12 13:04:13 +09:00 |
|
|
Ryuuuuu
|
29c24438a6
|
Correct incorrect log format when no files found
|
2023-04-12 13:01:49 +09:00 |
|
|
Ron Bowes
|
7dc1faa689
|
Better error handling, and fix version detection
|
2023-04-11 09:34:24 -07:00 |
|
|
sfewer-r7
|
375d9b34f1
|
make on_request_uri compatible with both command staget and teh generic java target
|
2023-04-11 14:25:07 +01:00 |
|
|
sfewer-r7
|
0022d0b8c3
|
Merge branch 'CVE-2023-26359-java-payload' into CVE-2023-26359
|
2023-04-11 13:59:37 +01:00 |
|
|
sfewer-r7
|
0af2f00ca0
|
URI decode the (optional) CFC_METHOD_PARAMETER param names and values, as they will be encoded again during send_request_cgi.
|
2023-04-11 12:42:29 +01:00 |
|
|
sfewer-r7
|
1dc8eb2802
|
remove linemax option from execute_cmdstager as it was artifact from testing and is not needed here
|
2023-04-11 12:14:28 +01:00 |
|
|
sfewer-r7
|
296fd6fec7
|
add in bourne and printf command stager flavors for Linux target
|
2023-04-11 12:07:49 +01:00 |
|
|
sfewer-r7
|
70018f7543
|
add psh_invokewebrequest as a command stager flavor for Windows
|
2023-04-11 11:57:39 +01:00 |
|
|
sfewer-r7
|
5c1057dd58
|
use the rails method blank? here to check for both nil and empty
|
2023-04-11 11:48:27 +01:00 |
|
|
sfewer-r7
|
657c1446c4
|
dont check these datastore options for empty? as the default values will either be set or an empty value will be detected during configuration validation
|
2023-04-11 11:41:55 +01:00 |
|
|
sfewer-r7
|
fa1e7ae016
|
close all CMFL tags and chain the getRuntime and exec calls for berevity
|
2023-04-11 11:22:13 +01:00 |
|
|
Jack Heysel
|
a2d2946007
|
Rubocop
|
2023-04-07 13:53:12 -04:00 |
|
|
Jack Heysel
|
18170babc2
|
Fix RCE payloads and add autorunscript
|
2023-04-07 13:35:16 -04:00 |
|
|
Ron Bowes
|
1a8671311d
|
Move the offsets into a field separate from 'targets'
|
2023-04-07 10:26:56 -07:00 |
|
|
Ron Bowes
|
02072418f0
|
Expand the comment about why we're checking for \xff (since it can't appear in the payload)
|
2023-04-07 10:10:13 -07:00 |
|
|
Jack Heysel
|
056b0a0e8b
|
LPE and doc updates
|
2023-04-07 10:41:10 -04:00 |
|
|
adfoster-r7
|
42902bb5e5
|
Land #17851, fix check function which always prints vulnerable
|
2023-04-07 14:24:45 +01:00 |
|
|
Jack Heysel
|
665ba4aece
|
Add additional target
|
2023-04-06 23:41:36 -04:00 |
|
|
Ryuuuuu
|
9985538846
|
Update modules/exploits/linux/http/apache_couchdb_cmd_exec.rb
fix nil exception
Co-authored-by: adfoster-r7 <60357436+adfoster-r7@users.noreply.github.com>
|
2023-04-07 09:55:00 +09:00 |
|
|
Jack Heysel
|
79d4021f31
|
Replaced janky XML building
|
2023-04-06 14:58:05 -04:00 |
|
|
Jack Heysel
|
544fb8ead6
|
Removed unecessary start_service proc
|
2023-04-06 14:26:02 -04:00 |
|
|
Ron Bowes
|
ce111f158a
|
Better error handling
|
2023-04-06 10:35:33 -07:00 |
|
|
Jack Heysel
|
d92fc41d29
|
Print out what command fails when attempting RCE
|
2023-04-06 13:31:17 -04:00 |
|
|
Jack Heysel
|
4984a3e2d3
|
Edit check method to raise errors instead of returning boolean
|
2023-04-06 13:25:20 -04:00 |
|
|
sfewer-r7
|
b05c9c6303
|
add a generic java target
|
2023-04-06 17:29:50 +01:00 |
|