Commit Graph

6361 Commits

Author SHA1 Message Date
OJ 44f8cf4124 Add more size to stagers, adjust psexec payloads
This psexec payload size should be evaluated to make sure I'm not doing
anything stupid. i can't see a reason why increasing these sizes would
be bad. They seem to work fine.
2015-05-20 17:07:56 +10:00
OJ a93565b5d1 Add 'Payload' section with 'Size' to psexec_psh
This missing parameter was causing the payload 'Size' to come through to
the encoders as `nil`. This meant that all the stagers that were
looking at the payload sizes were being told there was no size. In the
case of the meterpreter payloads, this was causing issues with the proxy
settings because the proxy configuration detail isn't added to the
payload unless there's enough space.

This fix adds a default size of 2048 (the same as the plain psexec
module). This makes the proxy settings work as expected.
2015-05-19 22:11:29 +10:00
Hans-Martin Münch (h0ng10) d99eedb1e4 Adding begin...ensure block 2015-05-17 20:48:11 +02:00
Hans-Martin Münch (h0ng10) acb053a2a7 CloseHandle cleanup 2015-05-17 20:39:10 +02:00
Hans-Martin Münch (h0ng10) e075495a5b string concatenation, clear \ handling 2015-05-15 06:51:42 +02:00
Hans-Martin Münch (h0ng10) 94d39c5c75 remove hard coded pipe name 2015-05-15 06:35:55 +02:00
Hans-Martin Münch (h0ng10) bb4f5da6d9 replace client.sys.config.getenv with get_env 2015-05-15 06:33:57 +02:00
Hans-Martin Münch (h0ng10) bba261a1cf Initial version 2015-05-15 00:36:03 +02:00
jvazquez-r7 51bb4b5a9b Add module for CVE-2015-0359 2015-05-07 17:00:00 -05:00
William Vu 134a674ef3 Land #5312, @todb-r7's release fixes 2015-05-07 15:34:31 -05:00
Tod Beardsley f423306b6f Various post-commit fixups
Edited modules/auxiliary/dos/http/ms15_034_ulonglongadd.rb first landed
in #5150, @wchen-r7's DOS module for CVE-2015-1635 HTTP.sys

Edited modules/auxiliary/gather/apple_safari_ftp_url_cookie_theft.rb
first landed in #5192, @joevennix's module for Safari CVE-2015-1126

Edited modules/auxiliary/gather/java_rmi_registry.rb first landed in

Edited modules/auxiliary/gather/ssllabs_scan.rb first landed in #5016,
add SSL Labs scanner

Edited modules/auxiliary/scanner/http/goahead_traversal.rb first landed
in #5101, Add Directory Traversal for GoAhead Web Server

Edited modules/auxiliary/scanner/http/owa_iis_internal_ip.rb first
landed in #5158, OWA internal IP disclosure scanner

Edited modules/auxiliary/scanner/http/wp_mobileedition_file_read.rb
first landed in #5159, WordPress Mobile Edition Plugin File Read Vuln

Edited modules/exploits/linux/http/multi_ncc_ping_exec.rb first landed
in #4924, @m-1-k-3's DLink CVE-2015-1187 exploit

Edited modules/exploits/unix/webapp/wp_slideshowgallery_upload.rb first
landed in #5131, WordPress Slideshow Upload

Edited modules/exploits/windows/local/run_as.rb first landed in #4649,
improve post/windows/manage/run_as and as an exploit

(These results courtesy of a delightful git alias, here:

```
  cleanup-prs = !"for i in `git status | grep modules | sed
s/#.*modules/modules/`; do echo -n \"Edited $i first landed in \" && git
log --oneline --first-parent $i | tail -1 | sed 's/.*Land //' && echo
''; done"

```

So that's kind of fun.
2015-05-06 11:39:15 -05:00
William Vu b8c7161819 Fix up NameError'd payload_exe 2015-05-06 11:34:05 -05:00
William Vu 59ffe5d98f Land #5306, payload_exe NameError fix 2015-05-06 11:29:29 -05:00
wchen-r7 4b0f54f0aa Land #5305, CVE-2015-0336 Flash NetConnection Type Confusion 2015-05-06 11:26:22 -05:00
wchen-r7 97807e09ca Lad #5125, Group Policy startup exploit 2015-05-06 11:17:01 -05:00
wchen-r7 5b57e4e9ca Add info about the waiting time 2015-05-06 11:15:11 -05:00
Sam Roth 5cb8b9a20a Fix #5304 2015-05-05 22:25:06 -04:00
jvazquez-r7 582919acac Add module for CVE-2015-0336 2015-05-05 17:25:19 -05:00
Darius Freamon c988447c18 title enhancement, OSVDB ref
touch up title and add OSVDB reference
2015-05-05 13:21:36 -06:00
jvazquez-r7 b95be1b25f Support information to include logon scripts 2015-05-04 15:49:19 -05:00
Darius Freamon dc42a3ee1a add OSVDB ref
add OSVDB ref
2015-05-04 14:27:44 -06:00
Darius Freamon a5c10b7f10 Fix product name
Product name missing a letter in two locations
2015-05-03 13:11:22 -06:00
Darius Freamon aa59b3acc6 title enhancement, description touch-up
Expanded title to be more precise and standardized use of vendor name
2015-04-30 17:23:15 -06:00
wchen-r7 89d026c900 Fix merge conflict 2015-04-30 12:33:45 -05:00
jvazquez-r7 d773f85dca Add reference to malware 2015-04-29 17:53:29 -05:00
jvazquez-r7 dbba466b5b Add module for CVE-2014-8440 2015-04-29 17:52:04 -05:00
William Vu 5defb50252 Fix #5267, references fixes 2015-04-29 14:21:23 -05:00
William Vu a4531e62a0 Clean up references 2015-04-29 14:21:08 -05:00
William Vu b2d08251e4 Move reference 2015-04-29 14:18:45 -05:00
William Vu fd567195e3 Fix punctuation and missing comma 2015-04-29 14:12:44 -05:00
Darius Freamon 5f0736fa4c enhance title and description, add OSVDB reference, standardized JBoss 2015-04-29 11:39:40 -06:00
Darius Freamon c01fc829ab Title enhancement, OSVDB refs 2015-04-28 15:56:34 -06:00
jvazquez-r7 ab94f15a60 Take care of modules using the 'DEBUG' option 2015-04-21 12:13:40 -05:00
jvazquez-r7 4224008709 Delete print_debug/vprint_debug 2015-04-21 11:14:03 -05:00
wchen-r7 4f903a604c Fix #5103, Revert unwanted URI encoding
Fix #5103. By default, Httpclient will encode the URI but
we don't necessarily want that. These modules originally
didn't use URI encoding when they were written so we should
just keep them that way.
2015-04-17 13:59:49 -05:00
wchen-r7 3927024f79 Land #5154, CVE-2015-0556 (Flash copyPixelsToByteArray int overflow)
sage aborts
2015-04-16 21:21:09 -05:00
Christian Mehlmauer 352e170624 more failure reasons 2015-04-16 22:04:11 +02:00
Christian Mehlmauer ba6548db75 be consistent about naming 2015-04-16 21:44:56 +02:00
jvazquez-r7 c1753672bf Delete file_contents initialization 2015-04-15 17:58:32 -05:00
jvazquez-r7 28fac60c81 Add module for CVE-2015-0556 2015-04-15 14:08:16 -05:00
jvazquez-r7 656abac13c Use keyword arguments 2015-04-10 18:03:45 -05:00
jvazquez-r7 1720d4cd83 Introduce get_file_contents 2015-04-10 17:34:00 -05:00
jvazquez-r7 ca6a5cad17 support changing files 2015-04-10 16:53:12 -05:00
jvazquez-r7 b2e17a61a9 Fix disclosure date 2015-04-10 13:09:24 -05:00
jvazquez-r7 ab944b1897 Add module to exploit dangerous group policy startup scripts 2015-04-10 13:01:50 -05:00
jvazquez-r7 91f5d0af5a Add module for CVE-2014-0569
* Adobe flash, Integer overflow on casi32
2015-04-09 19:37:26 -05:00
William Vu e1af495d21 Add extra release fixes 2015-04-06 13:08:40 -05:00
Tod Beardsley b62011121b Minor word choice fix on Solarwinds exploit
Removing the second person pronoun usage.

[See #5050]
2015-04-06 12:40:22 -05:00
Tod Beardsley 5be5b6097c Minor grammar on #5030, Adobe Flash
[See #5030]
2015-04-06 12:36:25 -05:00
William Vu 56dc7afea6 Land #5068, @todb-r7's module author cleanup 2015-04-03 16:00:36 -05:00