Commit Graph

23791 Commits

Author SHA1 Message Date
bwatters-r7 ba92d42b57 Updated version check per @bcoles 2017-07-17 15:52:50 -05:00
Jon Hart e93e524c3b Merge branch 'upstream-master' into feature/rdp-scanner 2017-07-17 13:46:59 -07:00
Jon Hart 43e04c8894 Improve RDP probe packet 2017-07-17 13:14:47 -07:00
David Maloney 2a1c661c79 Land #8723, Razr Synapse local exploit
lands ZeroSteiner's Razr Synapse local priv esc module
2017-07-17 13:34:17 -05:00
tkmru 6c5d8279ca change to generate payload from metasm 2017-07-16 19:21:09 +09:00
Spencer McIntyre b4813ce2c7 Update the pre-exploit check conditions 2017-07-15 14:48:54 -04:00
Pearce Barry 9775df1f6e Land #8586, Easy Chat Server 2 to 3.1 - Buffer overflow (SEH) exploit 2017-07-14 15:20:01 -05:00
David Maloney ee1c87b868 Land #8172, example modules
lands several example modules
2017-07-14 15:17:20 -05:00
Jon Hart e3e5c33b9b WIP commit of RDP scanner 2017-07-14 13:02:43 -07:00
David Maloney 8f6cac9c37 Land #8652, rpc console write exploit
lands pr for the metasploit rpc console write exploit
2017-07-14 14:47:35 -05:00
David Maloney 0fde6c6b42 Land #8650, igss9 launch path
land pr to fix launch path in the igss9 exploit
2017-07-14 14:39:38 -05:00
Spencer McIntyre 833b2a67d4 Fix the architecture check for only x64 2017-07-14 07:06:54 -04:00
g0tmi1k 4720d1a31e OCD fixes - Spaces 2017-07-14 08:46:59 +01:00
g0tmi1k 9309115627 OCD - Banner clean up 2017-07-14 08:19:50 +01:00
g0tmi1k fd843f364b Removed extra lines 2017-07-14 08:17:16 +01:00
g0tmi1k a79692aac1 Typo 2017-07-14 08:16:30 +01:00
tkmru 5d45680bc1 Merge branch 'master' of https://github.com/rapid7/metasploit-framework into feature/linux_reverse_tcp_x86_retry 2017-07-14 13:53:53 +09:00
tkmru f66021c8a2 update CachedSize 2017-07-14 13:53:43 +09:00
g0tmi1k 67310fa96c print_status -> print_good. [When it is successful, show it!] 2017-07-14 00:09:35 +01:00
g0tmi1k 424522147e OCD fixes - Start of *.rb files 2017-07-13 23:53:59 +01:00
bwatters-r7 de230478eb Land #8566, Add ye olde NNTP Login Utility scanner module 2017-07-13 13:19:34 -05:00
Spencer McIntyre 5470670223 Change the hook for windows 10 compatibility 2017-07-13 11:49:06 -04:00
Jon Hart e52e9c147d First commit for Cisco Smart Install Scanner 2017-07-12 19:12:06 -07:00
Pearce Barry 59de7d3635 Land #8671, Add a module for CVE-2017-7615 2017-07-12 14:58:02 -05:00
Pearce Barry 580219695a Oof, missed the parens... 2017-07-12 13:52:59 -05:00
Pearce Barry aa22651340 Few style/spelling tweaks, nothing to see here... 2017-07-12 13:41:20 -05:00
James Barnett e43adf0223 Land #8710, explicitly use Rex::Encoder::XDR
The previous use of XDR in these modules allowed for namespace collisions
with similar gems.
2017-07-12 12:01:24 -05:00
Brent Cook 345407b0a4 Rex::Encoder::XDR conflicts with the XDR gem 2017-07-12 11:52:10 -05:00
Pearce Barry e69460a529 Land #8683, Remove duplicate setting of suhosin.simulation in php_cgi_arg_injection 2017-07-12 09:34:35 -05:00
h00die b7d082fe06 land #8679 update to credits for rfpwnon 2017-07-11 19:36:41 -04:00
William Webb aa0fca9dd1 Land #8631, Add railgun support to Python Meterpreter for the OSX
platform
2017-07-11 16:05:16 -05:00
RageLtMan 5473b2132d Implement :request_url for Msf HttpClient mixin
To round out implementation of a simple path for users to access
HttpClient like Open or Net::HTTP, create :request_url method which
takes a single URL parameter, uses :request_opts_from_url to build
the request configuration for Rex::Proto::Http::Client, executes
a GET request with it, and disconnects the client unless keepalive
is specified as the second parameter to :request_url.

Example usage of functionality is implemented in http_pdf_authors.
2017-07-11 16:07:13 -04:00
Adam Cammack 14b37c2101 Land #8691, Improve php reverse_tcp stager logic 2017-07-11 13:50:27 -05:00
Tim db8698e82b Land #8655, add error handling to mipsle linux reverse tcp stager 2017-07-11 22:33:54 +08:00
Matt Robinson 55cbd9b6a9 Add headers to php_eval 2017-07-10 21:25:27 -04:00
David Maloney 6d7a066477 fixes oracle_hashdump and jtr_oracle_fast modules
fixes functionality in the oracle database hashdumper
and the oracle hash cracker modules
2017-07-10 16:57:57 -05:00
wchen-r7 50b1ec4044 Fix #8675, Add Cache-Control header, also meta tag for BAP2
Hopefully that browsers will respect this.

Fix #8675
2017-07-10 16:05:09 -05:00
Spencer McIntyre 53d5060fbd Add the LPE for CVE-2017-9769 2017-07-10 16:57:23 -04:00
wchen-r7 fe360e3e2a Fix #8685, Check nil condition for #wordlist_file in jtr modules
JTR modules should never assume there is always a database
connected while using #wordlist_file, considering a database is
an optional component for Framework.

Fix #8685
2017-07-10 11:18:20 -05:00
David Maloney 2ee6df66cf Land #8514, wmi persistence module 2017-07-10 09:53:55 -05:00
NickTyrer f4c739c190 check if running as system 2017-07-10 10:05:57 +01:00
RageLtMan df697aa23c Implement HttpClient options generation from URL
To address the complexity which comes with the flexibility offered
by Rex::Proto::Http::Client and its Msf mixin descendant, a simple
process needs to be implemented for issuing a request using only
the URL string in order to provide ease of access to users who may
not have the time to study how these clients work in detail.

Implement :request_opts_from_url in Msf's HttpClient mixin such as
to extract the options required for :send_request_* from a URL
string passed into the method. This approach reduces HTTP requests
in the mixin to `send_request_raw(request_opts_from_url(url))` when
`url` is just a string.

Implement this approach in the http_pdf_authors gather module to
further reduce infrastructure complexity around the simple need to
acquire PDF files via HTTP/S.

Testing:
  Local to this module only, and in Pry of course. Seems to work...
2017-07-10 04:19:26 -04:00
RageLtMan 997150a215 Use Msf::Exploit::Remote::HttpClient
Replace Net::HTTP usage with proper Rex::Proto::Http::Client via
the Msf module mixin. Generate the request opts from the same URI
parsed URL string, execute a one shot GET request, disconencting
after reciept of results. Depending on the response code, either
pass back an empty StringIO or if its 200, a StringIO(res.body).
2017-07-10 03:37:41 -04:00
Dave Farrow 653890f9d4 fixed unit tests 2017-07-09 16:08:32 -07:00
Emanuel Bronshtein df024bb594 Remove duplicate setting of suhosin.simulation 2017-07-10 00:46:05 +03:00
jvoisin 263a42707e Fix a typo 2017-07-09 16:34:51 +02:00
jvoisin 8510cda5ae Implement @bcoles advices 2017-07-09 16:34:10 +02:00
Tim 75c571de83 Land #8653, add error handling to mipsbe linux reverse tcp stager 2017-07-09 19:36:15 +08:00
Tim cd0c2c213f pedantic tweaks 2017-07-09 19:36:03 +08:00
Corey Harding 50339289a7 Update rfpwnon.rb 2017-07-09 05:12:35 -04:00