Commit Graph

5147 Commits

Author SHA1 Message Date
Christian Mehlmauer d6e60453d6 Added Wordpress XMLRPC DoS 2014-08-07 11:38:44 +02:00
Tom Sellers 693e744da4 Hide icon flash on taskbar during cmd_psh_payload
When 'cmd_psh_payload' is run via 'cmd_exec' on a windows shell that is running in the context of an interactive user an icon will flash very quickly on the user's task bar.  This can be avoided (verified) by adding the /b switch to the start section of the command launcher text.  I have verified that this switch exists from Windows 2000 through Windows 2012 R2.
2014-08-02 15:52:52 -05:00
Tod Beardsley c31fc61617 Land #3270, @jlee-r7 deprecation ipv6 payloads
These are not needed, since you can just config the regular handler now
and pick either.

This resolves the conflict (rm'ed the old modules)

Conflicts:
	modules/payloads/stagers/windows/reverse_ipv6_http.rb
	modules/payloads/stagers/windows/reverse_ipv6_https.rb
2014-08-01 16:27:59 -05:00
Meatballs 902cf4bc1e Fix var name 2014-07-31 23:16:53 +01:00
Meatballs 90c0f587bf Fix for newer powershell 2014-07-31 23:11:51 +01:00
Meatballs 15c1ab64cd Quick rubocop 2014-07-31 23:11:00 +01:00
Meatballs d336c56b99 Merge remote-tracking branch 'upstream/master' into land_2551 2014-07-31 23:06:37 +01:00
William Vu 0546282441 Land #3590, #3574 reversion 2014-07-31 09:59:04 -05:00
Meatballs 53b66f3b4a Land #2075, Powershell Improvements 2014-07-31 00:49:39 +01:00
Tod Beardsley 3320a1ef77 Revert PR #3574
This reverts commit 96945442ff.

With this PR, the following now appears in framework.log:

````
[07/30/2014 14:01:37] [e(0)] core: Error updating module details for
auxiliary/fuzzers/http/http_form_field: NoMethodError undefined method
`name' for []:Array
````
2014-07-30 14:06:46 -05:00
Christian Mehlmauer d334797116 Updated foxpress module 2014-07-28 22:23:22 +02:00
William Vu ba7d8efb07 Land #3574, has_actions.rb cleanup 2014-07-28 12:59:33 -05:00
jvazquez-r7 79fe342688 Land #3558, @FireFart's improvements to wordpress mixin 2014-07-28 09:52:20 -05:00
jvazquez-r7 2d5fd5e0d5 Use constant for WORDPRESS_VERSION_PATTERN 2014-07-28 09:22:50 -05:00
jvazquez-r7 b061d24b84 Favor & over and 2014-07-28 09:05:53 -05:00
Joshua Smith 96945442ff removes unnec. retruns & uses of 'not' - has_actions.rb 2014-07-27 18:20:12 -05:00
Tod Beardsley 3e304536ea Land #3554, Typo3 mixin specs 2014-07-25 16:06:40 -05:00
James Lee a0a2fddee8 Land #3562, yardoc cleanup 2014-07-24 17:25:12 -05:00
Christian Mehlmauer 57839e0f4b Fix some yardoc issues 2014-07-22 23:26:50 +02:00
Christian Mehlmauer c1a0f707ef typos 2014-07-22 22:29:01 +02:00
Christian Mehlmauer 073a8c5233 redirection returns an URI 2014-07-22 19:55:26 +02:00
Christian Mehlmauer a6479a77d6 Implented feedback from @jhart-r7 2014-07-22 19:49:58 +02:00
Christian Mehlmauer baff003ecc extracted check version to module
also added some wordpress specs and applied
rubocop
2014-07-22 17:02:35 +02:00
jvazquez-r7 47d9a30af0 Add specs for Typo3 mixin 2014-07-21 17:39:07 -05:00
Tod Beardsley a62ee99d1d Actually require NetAPI 2014-07-21 12:48:34 -05:00
Meatballs 5f0533677e Cheat/Rubycop all the things 2014-07-20 21:07:59 +01:00
Meatballs 474ee81807 Merge remote-tracking branch 'upstream/master' into pr2075 2014-07-20 21:01:54 +01:00
scriptjunkie 8fe508207c Merge Meatballs' gpp_again pull into new branch 2014-07-19 11:10:14 -05:00
William Vu 25f74b79b8 Land #3484, bad pack/unpack specifier fix 2014-07-16 14:52:23 -05:00
Meatballs 7583ed4950 Merge remote-tracking branch 'upstream/master' into pr2075 2014-07-16 20:34:34 +01:00
Christian Mehlmauer 29bb788d96 Better login detection for wordpress 2014-07-15 07:04:14 +02:00
Christian Mehlmauer 144c6aecba Added WPTouch fileupload exploit 2014-07-14 21:35:18 +02:00
William Vu 79603c9a73 Land #3505, a bunch o' Linux post module fixes 2014-07-11 12:39:31 -05:00
Joshua Smith dbe9b47937 lands 3469, fixes handler deadlock in corner cases
May affect the following RM issues which need to be retested:
  https://dev.metasploit.com/redmine/issues/8407
  https://dev.metasploit.com/redmine/issues/4314
  https://dev.metasploit.com/redmine/issues/6829
2014-07-10 16:20:33 -05:00
Tod Beardsley 688c31cc44 Switch to a space. It gets eaten anyway. 2014-07-10 13:59:30 -05:00
Tod Beardsley 5bb3c8a581 Make merged module descriptions more grammar. 2014-07-10 13:31:57 -05:00
jvazquez-r7 c19deddfb1 Delete debug messages 2014-07-08 16:24:45 -05:00
jvazquez-r7 c25c5f6806 Make linux gather post modules compatible with meterpreter 2014-07-08 16:23:57 -05:00
HD Moore ab7848a895 Merge master for testing of #2809 2014-07-06 22:27:58 -05:00
jvazquez-r7 405de05e4b Add specs for module_flavors 2014-07-03 10:31:39 -05:00
Spencer McIntyre d93bf55435 Add a module_flavors method for all available flavors 2014-07-03 11:01:21 -04:00
HD Moore 84c0504b1b MSI sections actually need to be signed after all 2014-06-30 13:08:28 -05:00
HD Moore c9b6c05eab Fix improper use of host-endian or signed pack/unpack
Note that there are some cases of host-endian left, these
are intentional because they operate on host-local memory
or services.

When in doubt, please use:

```
ri pack
```
2014-06-30 02:50:10 -05:00
HD Moore 255e792ed3 Fix host-endian related pack errors. See below for details.
Ruby treats endianess in pack operators in the opposite way
of python. For example, using pack('<I') actually ignores the
endianess specifier. These need to be 'I<' or better yet, 'V'.
The endian specify must occur after the pack specifier and
multiple instances in meterpreter and exe generation were
broken in thier usage.

The summary:

Instead of I/L or I< use V
Instead of I/L or I> use N
For Q, you need to always use Q< (LE) or Q> (BE)
For c/s/l/i and other lowercase variants, you probably dont
need or want a *signed* value, so stick with vV nN and cC.
2014-06-30 02:46:36 -05:00
Spencer McIntyre ea077b2f12 Improve the guess_flavor logic to pull from module info 2014-06-27 08:34:57 -04:00
Spencer McIntyre 952c935730 Use a semi-intelligent OptEnum for CMDSTAGER::FLAVOR 2014-06-27 08:34:57 -04:00
Spencer McIntyre 219153c887 Raise NotImplementedError and let :flavor be guessed 2014-06-27 08:34:56 -04:00
jvazquez-r7 dcd0e77f9e Change #compatible? method name because it's used by Module 2014-06-27 08:34:56 -04:00
jvazquez-r7 31acc4a528 Fix #compatible? method 2014-06-27 08:34:56 -04:00
jvazquez-r7 ddd1dd5155 The check for required decoder hasn't a lot of sense 2014-06-27 08:34:56 -04:00