Commit Graph

35981 Commits

Author SHA1 Message Date
space-r7 65906bbb87 add curl cmd stager flavor 2022-09-07 12:45:13 -05:00
space-r7 1a9e33265a fix typos 2022-09-07 11:27:56 -05:00
Jan Rude 0fb289aa7b Update syncovery_linux_rce_2022_36534.rb 2022-09-07 16:31:54 +02:00
bwatters a289cf9759 Land #16968, Update deprecated parameter in enum_system.rb
Merge branch 'land-16968' into upstream-master
2022-09-07 08:17:04 -05:00
jrude 01556b22d5 Syncovery For Linux - Auth. RCE (CVE-2022-36534) 2022-09-07 13:34:48 +02:00
jrude 8cf9af812b Syncovery Insecure Session Token Generation (CVE-2022-36536) 2022-09-07 13:17:22 +02:00
jrude 1757a5dedf Syncovery login brute-force utility 2022-09-07 12:46:32 +02:00
h00die-gr3y 6c1f7c2d8c removed unnecessary code 2022-09-07 09:40:11 +00:00
h00die c7b8ec7511 unified_remote exploit 2022-09-06 21:44:59 -04:00
Spencer McIntyre f1a7be6c49 Fix how REG_MULTI_SZ is handled 2022-09-06 16:53:30 -04:00
h00die-gr3y 797e450f4a updated timer code 2022-09-06 19:08:27 +00:00
npm-cesium137-io 8eed4fb617 thycotic_secretserver_dump refinements
Significant refactor of exception handling: less 'fail_with', more
'return false'.

Optimized interactions with SQL for less code redundancy.

Removed references to LOOT_ONLY in the module info.

Various tweaks and bug fixes.
2022-09-05 11:00:12 -04:00
h00die 3f7e0667f6 wifi mouse rce 2022-09-05 08:16:49 -04:00
bcoles a7d2145e8d firefox_xpi_bootstrapped_addon: Add notes, description, references, docs 2022-09-05 02:23:37 +10:00
h00die 8c4f151c73 update idrac login scanner to work with v8 and v9 2022-09-04 09:59:15 -04:00
h00die 69cff0cb03 print_error and return over fail_with when possible 2022-09-03 15:46:51 -04:00
H00die.Gr3y 19a396304d Update modules/exploits/linux/http/apache_spark_rce_cve_2022_33891.rb
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>
2022-09-03 20:28:49 +04:00
Christophe De La Fuente 8ba621a291 Land #16923, Cisco ASA-X with FirePOWER Services Authenticated Command Injection (CVE-2022-20828) 2022-09-02 18:37:37 +02:00
Jake Baines 320bd944f0 Updated default creds. Properly used fail_with. Set meterpreter to fork. Some wording and code cleanup. 2022-09-02 08:44:04 -07:00
space-r7 53b25d7d69 Land #16934, support dumping mem by process name 2022-09-01 12:58:01 -05:00
luisfso 3ddf761f4b Update enum_system.rb
the command "find / -xdev -type f -perm +6000 -perm -1 2> /dev/null" don't work in new linux systems

-perm +mode
       Deprecated,  old  way  of  searching  for  files with any of the permission bits in mode set.  You
       should use -perm /mode instead. Trying to use the  `+'  syntax  with  symbolic  modes  will  yield
       surprising results.  For example, `+u+x' is a valid symbolic mode (equivalent to +u,+x, i.e. 0111)
       and will therefore not be evaluated as -perm +mode but instead as the exact mode  specifier  -perm
       mode  and  so  it  matches files with exact permissions 0111 instead of files with any execute bit
       set.  If you found this paragraph confusing, you're not alone - just use -perm /mode.   This  form
       of  the  -perm test is deprecated because the POSIX specification requires the interpretation of a
       leading `+' as being part of a symbolic mode, and so we switched to using `/' instead.
2022-09-01 14:56:28 -03:00
dwelch-r7 5f85175f56 Add module for golden/silver ticket forging 2022-09-01 16:12:07 +01:00
Grant Willcox a41ec9388f Land #16725, Add ManageEngine ADAudit Plus and DataSecurity Plus Xnode enum modules, docs and mixin (CVE-2020–11532) 2022-09-01 08:46:36 -05:00
space-r7 fb28f81700 Land #16750, update jenkins_script_console 2022-08-31 16:59:33 -05:00
Spencer McIntyre 35c2a2cc7a Land #16903, enum_shares Cleanup and shell support
enum_shares: Cleanup and support non-meterpreter sessions
2022-08-31 13:21:31 -04:00
Spencer McIntyre 9960fe1393 Fix the constant definition 2022-08-31 12:31:09 -04:00
Spencer McIntyre d545ff0c6d Land #16955, Handle binary data 2022-08-31 08:56:00 -04:00
Spencer McIntyre 6965115c8e Land #16786, Zyxel Firewall LPE (CVE-2022-30526) 2022-08-31 08:40:23 -04:00
Grant Willcox 6b3d3913e7 Update to fix sanitization code due to improper logic 2022-08-30 16:59:30 -05:00
Grant Willcox 76eaa76fb3 Switch over to using Rex::Text.to_hex_ascii to sanitize nonprintable data 2022-08-30 10:32:22 -05:00
space-r7 1e18013a9b update payload cached sizes 2022-08-30 10:15:36 -05:00
Spencer McIntyre b0fe5e1620 Cleanup the code a bit 2022-08-30 11:12:36 -04:00
Spencer McIntyre 69cc144e04 Add module docs 2022-08-30 11:12:36 -04:00
Spencer McIntyre 86804ce5b8 Add specific UPN and DNS support; switch to pipes 2022-08-30 11:12:36 -04:00
Spencer McIntyre cd13039aae Add the initial MS-ICPR module 2022-08-30 11:12:36 -04:00
space-r7 90c220a39f fix failing hash checks 2022-08-29 17:50:49 -05:00
Grant Willcox 1b1341a55f Rubocop code again 2022-08-29 15:50:18 -05:00
Grant Willcox 2261499142 Remove extra debug statement 2022-08-29 15:43:27 -05:00
Grant Willcox 9dcbf55ea8 Update ldap_query logic to handle binary data 2022-08-29 15:34:18 -05:00
npm-cesium137-io da43f9c069 Refactor thycotic_secretserver_dump MKII
Removed all logic around the isSalted column since I have no idea what
that flag is actually supposed to represent.

Further optimized Thycotic decryption method for efficiency.

Fixed where the revision digit was being truncated after converting
ss_build to float.

Removed the offline 'decrypt' action as it required setting a reserved
value for session in order to operate.

Minor tweaks & correct typos and formatting.

Updated documentation.
2022-08-29 11:45:18 -04:00
h00die-gr3y d38494498a added linux dropper and code review suggestions 2022-08-27 17:45:47 +00:00
npm-cesium137-io dbbccf43ef thycotic_secretserver_dump offline support
Added support for sessionless execution if the SESSION is set to -1.

Misc cleanup.
2022-08-27 13:12:31 -04:00
npm-cesium137-io be2a8e564f Refine thycotic_secretserver_dump
Added much-needed support for SQL integrated authentication.

Significant improvement to the decryption routine: better version
detection and less churning through faulty decryption attempts.

Various tweaks and optimizations based on feedback.

Lots of bug fixes.
2022-08-27 09:05:16 -04:00
H00die.Gr3y b8a514bb55 Update modules/exploits/linux/http/apache_spark_rce_cve_2022_33891.rb
Co-authored-by: bcoles <bcoles@gmail.com>
2022-08-27 11:08:32 +04:00
H00die.Gr3y 3164967e07 Update modules/exploits/linux/http/apache_spark_rce_cve_2022_33891.rb
Co-authored-by: bcoles <bcoles@gmail.com>
2022-08-27 10:39:43 +04:00
h00die-gr3y 21c4e3ce3d commit module and documentation 2022-08-26 15:05:39 +00:00
Grant Willcox 6a71daac44 Land #16918, End the session when an HTTP/200 is received 2022-08-25 16:55:54 -05:00
Spencer McIntyre ae5a9bd41b Land #16734, Add rtf support to cve-2022-30190
Add rtf support to cve-2022-30190 AKA Follina
2022-08-25 17:26:46 -04:00
Spencer McIntyre 68eae1664e Tweak the follina docs 2022-08-25 17:10:59 -04:00
bwatters 683132242c fix up the uri_space maths 2022-08-25 16:08:26 -05:00