Commit Graph

38478 Commits

Author SHA1 Message Date
Chocapikk fdc28080c9 Update disclosure date 2024-09-06 22:14:27 +02:00
Chocapikk 8608e7021d Add spip_bigup_unauth_rce module 2024-09-06 22:10:18 +02:00
Takah1ro fd7321dd3f Strip_comments 2024-09-06 22:58:31 +09:00
Takah1ro b34e807277 Remove unnecessary directory existing check 2024-09-06 22:05:34 +09:00
Takah1ro a40fbb2a7b Remove unnecessary check 2024-09-06 22:04:51 +09:00
Takah1ro d4ac300d73 Fix typo 2024-09-06 21:59:16 +09:00
Takahiro Yokoyama 7a921bbeff Update modules/exploits/linux/local/cve_2023_0386_overlayfs_priv_esc.rb
Use kernel_version.btween

Co-authored-by: Julien Voisin <jvoisin@users.noreply.github.com>
2024-09-06 21:45:32 +09:00
Takah1ro cd97b08c62 Move C code to separate file 2024-09-06 21:09:39 +09:00
Takah1ro 1cc562c863 Use mkdir function 2024-09-06 12:55:51 +09:00
Takah1ro 920ef70105 Exploit dir existing check 2024-09-06 12:53:18 +09:00
Takahiro Yokoyama b243b86157 Update modules/exploits/linux/local/cve_2023_0386_overlayfs_priv_esc.rb
use linux/x64/meterpreter_reverse_tcp

Co-authored-by: Brendan <bwatters@rapid7.com>
2024-09-06 08:51:20 +09:00
Takah1ro dc81711301 Make timeout user configurable 2024-09-06 08:24:14 +09:00
Jack Heysel 93ddceb929 Land #19419, Remove unneeded code in php/base64
This remove some useless code in modules/encoders/php/base64.rb
2024-09-05 11:00:56 -07:00
Jack Heysel 9fad484029 Land #19439, Update bypassuac_comhijack supported arch
This explicitly defines x86 and x64 as supported architectures for the
bypassuac_comhijack module. Prior to this change there were no defined
architectures and if you tried to use an x64 based payload the module
would fail.
2024-09-05 09:41:41 -07:00
Jack Heysel 152710403d Land #19330, Add SSL opt in start_service
The start_service method now allows users to specify their SSL
preferences directly through the opts parameter. If the ssl option is
not provided in opts, it will default to the value in datastore["SSL"]
2024-09-05 09:08:07 -07:00
Jack Heysel 434593dcb4 Suggestion and rubocop fixes 2024-09-05 08:49:32 -07:00
Takah1ro afb8c6c27c Strip comments 2024-09-05 23:13:08 +09:00
Takah1ro 3d20dd6ddf Add module:
Linux Priv Esc (OverlayFS copying bug) CVE-2023-0386
2024-09-05 22:54:55 +09:00
Jack Heysel 05c3c9ac65 Updated reliability comment 2024-09-04 14:09:04 -07:00
Jack Heysel 2da95ebc6a Remove SLEEP datastore option 2024-09-04 13:39:01 -07:00
Chocapikk 37042d837e Add spip_plugin_version function to retrieve plugin version from config.txt or Composed-By header 2024-09-04 22:17:06 +02:00
Chocapikk b8a1d40f46 Rename execute_command to send_payload in line with its actual function (avoiding confusion with cmdstager) 2024-09-04 21:14:39 +02:00
Chocapikk 8024533ab4 More readable check functions 2024-09-04 21:09:49 +02:00
sjanusz-r7 10dee226c6 Replace Readline with Reline 2024-09-04 16:39:41 +01:00
bcoles b1ec86ebc5 bypassuac_comhijack: Specify x86/x64 as supported payload architectures 2024-09-04 23:49:33 +10:00
h4x-x0r 75627ccba7 Update whatsup_gold_sqli.rb 2024-09-02 15:45:45 +01:00
h4x-x0r fdd740b235 cleanup
cleanup
2024-09-02 15:44:27 +01:00
h4x-x0r 64f595c431 cleanup, version check, documentation
cleanup, version check, documentation
2024-09-02 15:41:08 +01:00
h4x-x0r 686da13ff5 WhatsUp Gold SQL Injection (CVE-2024-6670)
WhatsUp Gold SQL Injection (CVE-2024-6670)
2024-09-02 16:09:10 +01:00
h4x-x0r c82b8217a8 CVE-2024-6670
CVE-2024-6670
2024-09-01 23:26:11 +01:00
jvoisin 5b94c7e2d4 Add an encoder to minify php payloads
```console
$ ./msfvenom --platform php -a php -p php/reverse_php | ./msfvenom -e php/base64 --platform php -a php | php -l
Attempting to read payload from STDIN...
No encoder specified, outputting raw payload
Payload size: 3010 bytes
Found 1 compatible encoders
Attempting to encode payload with 1 iterations of php/base64
php/base64 succeeded with size 4052 (iteration=0)
php/base64 chosen with final size 4052
Payload size: 4052 bytes

No syntax errors detected in Standard input code
$ ./msfvenom --platform php -a php -p php/reverse_php -e php/minify | ./msfvenom -e php/base64 --platform php -a php | php -l
Attempting to read payload from STDIN...
Found 1 compatible encoders
Attempting to encode payload with 1 iterations of php/minify
php/minify succeeded with size 2109 (iteration=0)
php/minify chosen with final size 2109
Payload size: 2109 bytes

Found 1 compatible encoders
Attempting to encode payload with 1 iterations of php/base64
php/base64 succeeded with size 2839 (iteration=0)
php/base64 chosen with final size 2839
Payload size: 2839 bytes

No syntax errors detected in Standard input code
$
```
2024-09-01 23:09:47 +02:00
gardnerapp d676bedc0f Update modules/exploits/osx/local/persistence.rb
Co-authored-by: dwelch-r7 <Dean_Welch@rapid7.com>
2024-08-30 18:25:02 -04:00
Chocapikk 28ac6f5e07 add CheckCode:Safe 2024-08-30 21:58:30 +02:00
Jack Heysel 9ad5b41064 Rubocop 2024-08-30 12:56:10 -07:00
Chocapikk 4994ebbef5 fix: right versions in spip_porte_plume_previsu.rb 2024-08-30 21:53:47 +02:00
Jack Heysel 7bfd814297 Removed memory polling 2024-08-30 12:52:18 -07:00
Chocapikk effbfac806 fix: right versions in spip_rce_form.rb .... 2024-08-30 21:50:11 +02:00
Chocapikk 53f0bc398c fix: correct version handling error in SPIP check 2024-08-30 21:46:35 +02:00
Chocapikk 586cf482ce Refactoring SPIP Modules for Windows Compatibility and Incorporating SPIP Mixin 2024-08-30 20:37:32 +02:00
Jack Heysel f951f250f8 Land #19381, Fix gitlab_login scanner
This fixes the gitlab_login scanner so that it uses the proper datastore
options Username and Password which are the standard for login scanners.
Before this fix the scanner was using HttpUsername and HttpPassword and
ignoring the datastore options Username and Password
2024-08-30 08:36:08 -07:00
dwelch-r7 05cfe7c795 Land #19401, Add a mixin to get SPIP version and make use of it 2024-08-30 13:07:02 +01:00
h00die-gr3y 6b640d0506 some small final changes 2024-08-29 11:23:58 -05:00
h00die-gr3y 003769f1d7 Added POC reference 2024-08-29 11:23:58 -05:00
h00die-gr3y 1d60705516 dynamic feature type enhancement 2024-08-29 11:23:58 -05:00
h4x-x0r 64123ab599 placeholder for CVE-2024-43425
placeholder for CVE-2024-43425
2024-08-29 17:17:10 +01:00
h4x-x0r a39c4076e4 cleanup
cleanup
2024-08-29 13:36:54 +01:00
bwatters 6b83f09312 Land #19421, Updates to adobe_pdf_embedded_exe
Merge branch 'land-19421' into upstream-master
2024-08-28 18:40:55 -05:00
Spencer McIntyre 0b0f9cdce9 Land #19409, Add additional Linux VM fingerprints
Improve a bit modules/post/linux/gather/checkvm.rb
2024-08-28 16:10:54 -04:00
adfoster-r7 84ffa524e5 Land #19424, WordPress GiveWP Plugin RCE 2024-08-28 21:09:42 +01:00
adfoster-r7 71ee987079 Add additional documentation steps, and use 0 for the payload http timeout 2024-08-28 19:21:27 +01:00