955a5af8cf
Adding OSVDB ref
2012-08-07 12:56:29 -05:00
54ed27c1b3
add osvdb ref
2012-08-05 09:02:54 -05:00
2bf0899d09
minor improvements to Zenoss showdaemonxmlconfig exploit
2012-08-01 20:15:45 +09:30
bdf8f1a543
Clean up Zenoss exploit + minor improvements
...
Changed send_request_raw() to send_request_cgi()
- Removed redundant request headers 'Content-Length'
Added rescue error message for connection failures
Changed username to the default 'admin' account
2012-07-30 18:04:14 +09:30
8d3700cc3c
Add Zenoss <= 3.2.1 exploit and Python payload
...
- modules/exploits/linux/http/zenoss_3.2.1_showdaemonxmlconfig_exec.rb
- modules/payloads/singles/cmd/unix/reverse_python.rb
2012-07-30 01:24:27 +09:30
e483af64e4
Random text
2012-07-26 15:14:02 -05:00
6c3b05f1c4
Add CVE-2012-2953 Symantec Web Gateway proxy_file() cmd exec bug
2012-07-26 13:11:05 -05:00
3cb60fb42a
Fix 1.8-specific regexp syntax bug
...
The bug was:
line 343: warning: regexp has invalid interval
line 343: warning: regexp has '}' without escape
2012-07-26 02:19:13 -05:00
b662881613
Enforce a check before firing the exploit
2012-07-19 16:43:52 -05:00
d238debb2f
Add disclo date, discoverers, and better description
2012-07-18 16:14:32 -06:00
ebe48ecf16
Add Rank for schelevator, update sock_sendpage's
2012-07-18 11:16:29 -06:00
7091d1c65b
Add an exploit for sock_sendpage
...
Unfortunately, adds a dep on bionic for runtime compilation.
Gets ring0, sets the (res)uid to 0 and jumps to the payload. Still some
payload issues because linux stagers don't mprotect(2) the buffer they
read(2) into. Single payloads work fine, though.
Also cleans up and improves local exploits' ability to compile C.
[SEERM #3038 ]
2012-07-15 20:29:48 -06:00
6d6b4bfa92
Merge remote branch 'rapid7/master' into omg-post-exploits
2012-07-08 17:32:39 -06:00
e5dd6fc672
Update milw0rm references.
...
milw0rm.com is long gone, so all milw0rm references are just
a bunch of broken links. Change to exploit-db instead.
2012-06-28 14:27:12 -05:00
6913440d67
More progress on syscall wrappers
...
Something is still broken, my socket() is returning EAFNOSUPPORT whereas
what looks like the same syscall in wunderbar_emporium's exploit.c is
returning a socket. Similarly, my __mmap2() is returning EFAULT when
trying to map anything, not just NULL.
2012-06-22 17:45:49 -06:00
fd8b1636b9
Add the first bits of a sock_sendpage exploit
...
This can currently build an executable that creates a socket, opens a
temporary file, truncates that file with ftruncate(2) and calls
sendfile. Still needs to mmap NULL and figure out ring0 shellcode.
Baby steps.
2012-06-22 00:03:29 -06:00
d40e39b71b
Additional exploit fail_with() changes to remove raise calls
2012-06-19 19:43:41 -05:00
fb7f6b49f0
This mega-diff adds better error classification to existing modules
2012-06-19 12:59:15 -05:00
7eebc671ba
Put the curly braces back and drop a comma
...
The curly braces make extra commas at the end ok in 1.8. So fe39642e
2012-06-16 01:17:33 -06:00
fe39642e27
Dropping extra curly braces on f5 module
...
Also dropping extra whitespace.
2012-06-15 12:23:34 -05:00
45eb531c23
Add Jun as an author for the initial discovery
2012-06-13 15:50:45 -05:00
ae59f03ac9
Fixing print message in snort module
2012-06-13 14:04:05 -05:00
1138290a64
Return nil when an error occurred
...
Avoids anti-pattern of testing for a specific class.
2012-06-13 09:41:20 -06:00
a2aaca5e85
Correct a fp with this exploit module (would always print success)
2012-06-13 10:38:05 -05:00
00aa8c0452
Add missing ExploitRank
2012-06-12 15:35:53 -05:00
4ea5712140
Add a timeout for wonky systems that hang during negotiation
2012-06-12 15:24:13 -05:00
5775fa9e67
add osvdb ref
2012-06-12 14:53:55 -05:00
a91085d6cd
Add a disclosure date and more detailed desc
2012-06-12 13:07:53 -06:00
11df90c98e
Call update_info
...
Not sure why all modules don't do this. Or none of them.
2012-06-12 13:01:36 -06:00
c564e9dcc4
Fix 1.8 compat error
...
Net::SSH expects +key_data+ to be an array of strings. Giving it just a
string works in 1.9 but not 1.8, presumably due to some errant use of
+each+.
2012-06-12 12:50:46 -06:00
539deabef5
Clean up title, options
2012-06-12 12:08:58 -06:00
85e1555e13
Payload compat to work with unix/interact
2012-06-12 11:46:21 -06:00
3d5417e574
Initial commit of F5 exploit
2012-06-12 11:37:22 -06:00
b908ccff0f
Added module for CVE-2012-0297
2012-06-10 22:38:58 +02:00
8f6457661d
Change description
2012-06-10 01:52:26 -05:00
f0082ba38f
Added module for CVE-2012-0299
2012-06-09 22:27:27 +02:00
d9c39d3798
Fix the rest of nil res from get_once
2012-06-04 17:26:15 -05:00
3752c10ccf
Adding FireFart's RPORT(80) cleanup
...
This was tested by creating a resource script to load every changed
module and displaying the options, like so:
````
use auxiliary/admin/2wire/xslt_password_reset
show options
use auxiliary/admin/http/contentkeeper_fileaccess
show options
````
...etc. This was run in both the master branch and FireFart's branch
while spooling out the results of msfconsole, then diffing those
results. All modules loaded successfully, and there were no changes to
the option sets, so it looks like a successful fix.
Thanks FireFart!
Squashed commit of the following:
commit 7c1eea53fe3743f59402e445cf34fab84cf5a4b7
Author: Christian Mehlmauer <FireFart@gmail.com >
Date: Fri May 25 22:09:42 2012 +0200
Cleanup Opt::RPORT(80) since it is already registered by Msf::Exploit::Remote::HttpClient
2012-06-02 09:53:19 -05:00
4681ed1c1e
Whitespace, thanks msftidy.rb!
2012-05-31 18:18:27 -06:00
fe86ab9914
=Add osvdb ref
2012-05-29 13:31:20 -05:00
d615e3bcb8
Print target IP/Port when restoring currencies.php
2012-05-28 01:33:45 -05:00
712a21717a
Totally forgot about disclosure date, damn it
2012-05-28 01:31:13 -05:00
7c1442c4b4
Merge pull request #421 from wchen-r7/symantec_web_gateway
...
Add CVE-2012-0297 Symantec Web Gateway
2012-05-27 23:28:59 -07:00
34c93d8e44
Fix check
2012-05-28 00:51:46 -05:00
96d70e5fb6
Add CVE-2012-0297 Symantec Web Gateway
2012-05-27 22:47:39 -05:00
e774df5c32
target info plus relocation
2012-05-25 20:16:13 +02:00
f9bcb95952
Correct EDB references
2012-05-19 02:24:29 -05:00
f6c88377f4
Fixes #362 by changing the exitfunction arguments to be the correct type
2012-05-07 02:41:08 -05:00
92e07aab12
Add osvdb ref
2012-05-05 10:13:18 -05:00
43d730d564
Squashed commit of minor cosmetic fixes:
...
commit eed15ea9ecc88683c8d922fe155d4777a7ce1286
Author: Tod Beardsley <todb@metasploit.com >
Date: Wed May 2 21:55:56 2012 -0500
Whitespace at EOL. Dangit.
commit 8159b27728d1a4fd0ad94ff56c4b4f2b995646f8
Author: Tod Beardsley <todb@metasploit.com >
Date: Wed May 2 16:38:01 2012 -0500
Disambiguating 'WebCalendar'
2012-05-02 21:57:41 -05:00
Tod Beardsley