59d026acd3
Land #19544 , Magento Arbitrary File Read (CVE-2024-34102) + PHP Buffer Overflow iconv() of GLIBC (CVE-2024-2961)
2024-10-18 14:39:54 +02:00
7b400f18fe
Fix metabase rce to support older versions
2024-10-17 10:10:50 +01:00
ee68e47521
Added http_server cleanup
2024-10-15 10:28:39 -07:00
7a89db5080
Updated print statements
2024-10-15 09:21:07 -07:00
3635dd1c23
Merge branch 'magento_xxe_to_rce'
2024-10-15 09:17:40 -07:00
3f6f060933
Updated check method
2024-10-15 09:17:02 -07:00
3be4eae2f5
Update modules/exploits/linux/http/magento_xxe_to_glibc_buf_overflow.rb
...
Co-authored-by: Julien Voisin <jvoisin@users.noreply.github.com >
2024-10-10 15:20:06 -04:00
44b33b8010
Fixed multiple sessions and instability
2024-10-10 11:36:16 -07:00
65936d181e
Update libc region on sucess print
2024-10-09 23:04:44 -07:00
dab5d66e37
Test and respond to comments
2024-10-09 22:52:55 -07:00
b72f70cbac
Apply suggestions from code review
...
Co-authored-by: Julien Voisin <jvoisin@users.noreply.github.com >
2024-10-10 00:40:54 -04:00
7a78c0d724
Updated authors
2024-10-09 13:14:09 -07:00
b94b2f3c72
Merge conflicts and rubocop
2024-10-09 12:59:59 -07:00
e8711c5b20
Magento XXE to GLIBC buffer overflow
2024-10-09 12:53:29 -07:00
9536eaae2d
Magento XXE to GLIBC buffer overflow
2024-10-09 12:36:53 -07:00
1cdaeac843
Land #19463 Add Acronis Cyber Default Password RCE
...
This adds an RCE module Acronis Cyber Infrastructure Default Password [CVE-2023-45249]
2024-10-02 16:02:50 -04:00
c43a4f4b0b
Fixed cluster ID issue
2024-09-26 21:53:27 +00:00
8e2dbbbd56
Land #19416 , Add Traccar RCE module
...
This module exploits two vulnerabilities in Traccar v5.1 - v5.12 to
obtain remote code execution: A path traversal vulnerability
CVE-2024-24809 and an unrestricted file upload vulnerability
CVE-2024-31214.
2024-09-23 15:25:02 -07:00
e0e7c67ff7
Remove jsessionid parsing now that keep_cookies is being used
2024-09-23 18:12:01 -04:00
8e62f22315
fifth release with the option to use your own SSH private key
2024-09-20 09:50:13 +00:00
8b197a60f9
fourth release addressing review comments of jheysel-r7
2024-09-19 20:54:55 +00:00
9971aed96f
third release addressing majority of the review comments
2024-09-17 19:23:38 +00:00
d7fa23f30f
Apply suggestions from code review
...
Co-authored-by: bcoles <bcoles@gmail.com >
Co-authored-by: Julien Voisin <jvoisin@users.noreply.github.com >
2024-09-17 19:00:48 +02:00
455c5b2391
second release module
2024-09-15 20:01:27 +00:00
1ba05ac88a
first release module
2024-09-15 19:47:32 +00:00
30e6af7791
cleanup
...
Code cleanup and better handling of different use cases.
2024-09-12 14:34:45 +01:00
152710403d
Land #19330 , Add SSL opt in start_service
...
The start_service method now allows users to specify their SSL
preferences directly through the opts parameter. If the ssl option is
not provided in opts, it will default to the value in datastore["SSL"]
2024-09-05 09:08:07 -07:00
434593dcb4
Suggestion and rubocop fixes
2024-09-05 08:49:32 -07:00
a39c4076e4
cleanup
...
cleanup
2024-08-29 13:36:54 +01:00
018b041335
cleanup
...
cleanup
2024-08-28 15:40:35 +01:00
6532255600
PoC & Documentation
...
PoC & Documentation
2024-08-23 23:21:49 +01:00
ec5892ff1f
Land #19363 , Ray Modules CVE-2023-6019 CVE-2023-6020 CVE-2023-48022
2024-08-23 04:55:17 -04:00
39f81e0a45
Update check function
2024-08-21 22:32:53 +09:00
ee58313d64
Update check function
2024-08-21 22:09:56 +09:00
c66540ef2f
Update modules/exploits/linux/http/ray_agent_job_rce.rb
...
use MeterpreterTryToFork to avoid a meterpreter session get killed
Co-authored-by: Diego Ledda <diego_ledda@rapid7.com >
2024-08-21 21:38:37 +09:00
91167fc85f
Remove unnecessary option
2024-08-20 21:44:11 +09:00
4d1782640b
Update sideeffects
2024-08-20 19:12:18 +09:00
01b2a1c55c
Enable fetch payload
2024-08-20 13:20:42 +09:00
45677898a8
Add TARGET_URI
2024-08-20 13:08:01 +09:00
52852cea72
Add cve ref
2024-08-20 12:59:52 +09:00
99c81d7821
Set default fetch_command to wget
2024-08-20 08:59:39 +09:00
64bdf54bb0
Use Fetch Payload (Not tested)
2024-08-20 08:56:05 +09:00
a5b9d553fa
Update check to use version info
2024-08-20 08:25:27 +09:00
5be7e09ff0
Update check to use version info
2024-08-20 08:21:48 +09:00
e30232d2ca
CVE-2024-31214 & CVE-2024-24809
...
CVE-2024-31214 & CVE-2024-24809
2024-08-19 23:03:36 +01:00
7258ca4fb1
Remove unnecessary option for simplicity
2024-08-16 08:49:34 +09:00
eeab7ce2a2
Proceed when user specified cmd fails
2024-08-16 08:23:50 +09:00
ea1b9e925e
Delete old three exploits in one module
2024-08-15 08:17:36 +09:00
dbc51d1cd4
Land #19347 , OpenMetadata authentication bypass and SpEL injection exploit chain[CVE-2024-28255 and CVE-2024-28254]
2024-08-14 16:06:10 +01:00
36322ff274
Land #19348 , Apache HugeGraph Gremlin RCE (CVE-2024-27348)
2024-08-14 10:06:21 +01:00
Diego Ledda