adam/metasploit-gs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
46,626 Commits 27 Branches 1,043 Tags
96cd65a205ed83e83eb8905c19b4ee2e6426af4e
Commit Graph

198 Commits

Author SHA1 Message Date
William Vu 436e414b93 Land #7815, CVE-2016-9299 exploit 2018-05-16 05:29:41 -05:00
William Vu 959cbde6eb Clean up module 2018-05-16 05:29:25 -05:00
bwatters-r7 37a844bef0 Land # 9247, Add ASUS infosvr Auth Bypass Command Execution exploit 
Merge branch 'land-9247' into upstream-master
 2018-04-20 11:24:47 -05:00
Brendan Coles d078ab8033 Use 'exit' CommandShellCleanupCommand 2018-02-06 13:36:36 +00:00
Brendan Coles 686689afc0 Rename asus_infosvr_exec to asus_infosvr_auth_bypass_exec 2018-02-02 07:53:50 +00:00
Brent Cook c288dab338 fixup RHOST/RPORT expectations if only URI is set 2017-11-30 10:51:02 -06:00
Brent Cook d689b33d7e more error handling, deal with user error 2017-11-30 08:31:13 -06:00
Brent Cook 87e683c763 add back kill syscall for trap method 2017-11-30 08:12:15 -06:00
Brent Cook a0e0e1db15 allow manual targeting, handle errors better 2017-11-30 07:51:12 -06:00
Brent Cook eea72663b3 warn on method failure instead of error 2017-11-30 06:37:21 -06:00
Brent Cook 9f12b794da cleanup comments 2017-11-30 06:37:04 -06:00
Brent Cook 5da34e8f2b support RHOST/RPORT 2017-11-30 06:36:42 -06:00
Brent Cook 59580195b4 resurrect old methods, try all 3 2017-11-30 06:16:05 -06:00
Brendan Coles f8ebd65449 Add ASUS infosvr Unauthenticated Command Execution exploit 2017-11-28 12:58:52 +00:00
Patrick Webster 2f6da89674 Change author name to nick. 2017-11-09 03:00:24 +11:00
h00die 5abdfe3e59 ueb9 style cleanup 2017-10-20 19:59:24 -04:00
caleBot 8f622a5003 Update ueb9_bpserverd.rb 2017-10-20 14:35:03 -06:00
caleBot cce7bf3e19 Update ueb9_bpserverd.rb 2017-10-20 14:33:46 -06:00
caleBot 85152b5f1e added check function 2017-10-20 14:28:52 -06:00
caleBot 16b6248943 Update ueb9_bpserverd.rb 2017-10-20 13:58:12 -06:00
caleBot 5c0bcd8f0a Update ueb9_bpserverd.rb 2017-10-20 13:56:25 -06:00
caleBot 63e3892392 fixed issues identified by msftidy 2017-10-06 10:16:01 -06:00
caleBot 36610b185b initial commit for UEB9 exploits - CVE-2017-12477, CVE-2017-12478 2017-10-06 09:38:33 -06:00
h00die a40429158f 40% done 2017-08-28 20:17:58 -04:00
William Vu 4c285c0129 Land #8827, QNAP Transcode Server RCE 2017-08-22 23:07:01 -05:00
William Vu d659cdc8f6 Convert quest_pmmasterd_bof to cmd_interact/find 2017-08-18 00:19:09 -05:00
Brendan Coles ac976eee8e Add author 2017-08-15 03:27:40 +00:00
Brendan Coles 0a374b1a88 Add QNAP Transcode Server Command Execution exploit module 2017-08-13 09:13:56 +00:00
Brent Cook 6300758c46 use https for metaploit.com links 2017-07-24 06:26:21 -07:00
g0tmi1k b8d80d87f1 Remove last newline after class - Make @wvu-r7 happy 2017-07-19 11:19:49 +01:00
g0tmi1k 4720d1a31e OCD fixes - Spaces 2017-07-14 08:46:59 +01:00
g0tmi1k fd843f364b Removed extra lines 2017-07-14 08:17:16 +01:00
Brent Cook e414bdb876 don't try to guess intent for specified default targets, leave auto-auto targeting to unspecified modules 2017-05-11 15:19:11 -05:00
Brent Cook 30c48deeab msftidy and misc. fixups for Quest BoF module 2017-05-11 08:07:39 -05:00
William Webb e8aed42ecd Land #8223, Quest Privilege Manager pmmasterd Buffer Overflow 2017-05-11 00:44:19 -05:00
m0t ab245b5042 added note to description 2017-05-07 13:56:50 +01:00
m0t 4f12a1e271 added note to description 2017-05-07 13:54:28 +01:00
William Vu 64452de06d Fix msf/core and self.class msftidy warnings 
Also fixed rex requires.
 2017-05-03 15:44:51 -05:00
m0t 5e42dde6b6 msftidy clean up 2017-04-12 16:25:21 +01:00
m0t 374d7809b5 last fixes and tests 2017-04-11 09:48:57 +01:00
m0t 9a0789f839 Exploit for pmmasterd Buffer Overflow (CVE-2017-6553) 2017-04-05 17:59:54 +01:00
notivan 6764bdb36f Fix Jenkins Ldap Deserialization Remote Use 
It appears the original exploit had been deliberately sabotaged to not work remotely. We have fixed this egregious error.
 2017-02-14 17:05:25 +00:00
Brent Cook 836da6177f Cipher::Cipher is deprecated 2017-01-22 10:20:03 -06:00
notivan 6c0450fe95 add check for jenkins ldap exploit 
we just check for X-Jenkins <= 2.31. this is not completely correct because the exploit probably doesn't work on some earlier versions.
 2017-01-13 12:40:33 +00:00
notivan 036328df5c Fix msftidy issue 2017-01-12 13:26:41 +00:00
notivan e09b7a96f1 Add YSOSerial command options 2017-01-12 13:21:58 +00:00
notivan 0b32af8d43 Remove duplicate validation 2017-01-12 09:59:55 +00:00
notivan 0a30e775d1 Fix msftidy issues 2017-01-11 23:43:01 +00:00
notivan 08690e5e11 Exploit for CVE-2016-9299 (Jenkins CLI Ldap Deser) 
This is based on Matthias Kaiser's presentation at deepsec. We build a chain that connects back to our LDAP server and trigger it over the CLI HTTP interface. The LDAP server then serves a second chain based on YSOSerial commons-collection which triggers Runtime.exec. The second chain doesn't run with Jenkin's class filtering so succeeds.
 2017-01-11 23:23:02 +00:00
William Vu cfca4b121c Clean up module 2016-12-28 06:10:46 -06:00