9e41825e51
Finish up the exploit
...
Tested on Linux (versions 4.1.1, 4.3.0, and 4.4.0) and Windows (version
4.4.0).
2024-01-26 17:20:54 -05:00
acc15c23fe
Add code review changes to opennms auth rce
2024-01-27 00:10:45 +02:00
d05b85de50
Land #18680 , Shared SMB Service
...
Merge branch 'land-18680' into upstream-master
2024-01-26 14:42:11 -06:00
97a3e0291e
Bump ruby_smb to 3.3.2
...
This pulls in the changes from rapid7/ruby_smb#260 which adds the
#remove_share method that is needed for cleanup.
2024-01-26 14:56:57 -05:00
530d58de49
Initial commit of NextGen Connect RCEs
2024-01-26 14:50:33 -05:00
38c9185564
Add reviewed changes
2024-01-26 22:58:00 +05:30
9391e11202
Fix typo in alloc_and_write_wstring calling non-existent method
...
`str_to_uniz_a` does not exist, updated to `str_to_uni_z`. Looking at cross-references, only two modules use this method to convert from ruby strings to null-terminated WCHARs. Updated the comments to clarify usage of this method and fixed the typo.
2024-01-27 00:01:03 +08:00
7a7c7eb177
Land #18750 , Update payload to_handler command to support option overrides
2024-01-26 15:15:02 +00:00
94eeba3521
Update payload to_handler command to support option overrides
2024-01-26 12:37:36 +00:00
5ea35c9ffb
Bump version of framework to 6.3.54
2024-01-26 04:36:49 -06:00
3cbbfe65f1
Land #18744 , Fix flakey opt address local spec
2024-01-26 10:33:47 +00:00
2f97f86f49
Land #18746 , ensure the generate command does not update the module database
2024-01-25 19:40:28 +00:00
251305d26b
automatic module_metadata_base.json update
2024-01-25 13:33:17 -06:00
fe84c0dff7
Land #18734 , Add exploit for CVE-2023-22527
...
This adds an exploit for CVE-2023-22527 which is an
unauthenticated RCE in Atlassian Confluence. The
vulnerability is due to an SSTI flaw that allows an
OGNL expression to be evaluated.
2024-01-25 14:15:10 -05:00
96241b3a6e
Keep version detection consistent
2024-01-25 13:50:34 -05:00
6ad359ee96
Don't change the main modules datastore options
2024-01-25 13:47:09 -05:00
4cb18483d6
cleanup LDAP NTLM type2 response
2024-01-25 10:56:25 -06:00
7a385431cb
automatic module_metadata_base.json update
2024-01-25 09:18:19 -06:00
44bf6867c6
Land #18737 , Update metasploit-payloads gem to 2.0.165
2024-01-25 15:49:25 +01:00
49532613e5
Implement some feedback from the review
2024-01-25 09:20:17 -05:00
5c25bfd908
Fix flakey opt address local spec
2024-01-25 12:33:21 +00:00
502511a71a
memory_search module improvements
2024-01-24 19:55:53 +00:00
f496a71cf0
Make mimipenguin work with updated memory search API
2024-01-24 19:53:57 +00:00
aac74778b9
Move memory search method to Meterpreter stdapi
2024-01-24 19:53:30 +00:00
deabf9b1d8
Add module docs
2024-01-24 12:49:27 -05:00
995c806d81
Land #18740 , Remove invalid modification time test
2024-01-24 13:27:29 +00:00
4784afae6a
Land #18741 , add ntpath tests
2024-01-24 12:48:47 +00:00
56f6020ff5
Assert that the caches modification time is in fact a time
2024-01-24 12:10:22 +00:00
3a076d6cdb
Verify ntpath works as expected
2024-01-24 12:01:09 +00:00
f2a1d16fbc
Verify ntpath works as expected
2024-01-24 11:59:31 +00:00
057facea90
Remove invalid modification time test
2024-01-24 11:43:04 +00:00
288d4b8c20
automatic module_metadata_base.json update
2024-01-24 05:09:51 -06:00
15d0d4f0df
Land #18663 , Add new PostgreSQL Session Type
2024-01-24 10:46:26 +00:00
4f04f91b71
automatic module_metadata_base.json update
2024-01-23 14:39:21 -06:00
4c525dad66
Land #18648 , Add enhancement to Asan check method
...
Before this PR when running asan_suid_executable_priv_esc
if the user did not set the SUID_EXECUTABLE option the
module would fail with an undescriptive error message.
This PR removes the default value of an empty string from
SUID_EXECUTABLE so now if it's not set the user is informed.
2024-01-23 15:22:33 -05:00
7bff3042db
automatic module_metadata_base.json update
2024-01-23 14:16:11 -06:00
c278ef9b73
Land #18648 , Add Module for GL.iNet products
...
This PR adds an exploit module for a number of
different GL.iNet network products. The module combines
an auth by-pass CVE-2023-50919 with an RCE CVE-2023-50445.
2024-01-23 14:57:29 -05:00
d20ef7a08b
add LDAP to capture plugin
2024-01-23 13:52:35 -06:00
08f6da7b33
Removed default empty string for SUID_EXECUTABLE
2024-01-23 14:21:58 -05:00
bcefde29c3
correct metadata for Actions usage
2024-01-23 12:13:24 -06:00
13d2968fad
Capitalize remaining references to Meterpreter
2024-01-23 13:11:03 -05:00
21b49be380
automatic module_metadata_base.json update
2024-01-23 11:17:05 -06:00
73dbe2e89d
Add PostgreSQL multi-line query transform tests
2024-01-23 17:03:16 +00:00
904e34434e
Land #18626 , SaltStack Minion Deployer
...
This PR adds an exploit module which allows for
a user who has compromised a host acting as a
SaltStack Master to deploy payloads to the Minions
attached to that Master.
2024-01-23 11:58:38 -05:00
15652bc29c
automatic module_metadata_base.json update
2024-01-23 10:16:14 -06:00
8c5628826f
Land #18735 , update iis_webdav_scstoragepathfromurl module metadata
2024-01-23 15:56:01 +00:00
583d39b038
Land #18720 , Mark unix encoders as compatible with linux
...
Merge branch 'land-18720' into upstream-master
2024-01-23 09:45:42 -06:00
dd3d1a9397
Update metasploit-payloads gem to 2.0.165
...
Includes changes from:
* rapid7/metasploit-payloads#694
2024-01-23 10:42:14 -05:00
2b938d12e2
automatic module_metadata_base.json update
2024-01-23 07:25:19 -06:00
a25b0ee5e0
Land #18713 , Add generic memory search post/multi module
2024-01-23 12:57:24 +00:00
Spencer McIntyre