Commit Graph

30253 Commits

Author SHA1 Message Date
Robin Wood 89f4d3e2d7 Fix for issue #14678
Stops the printing of a rogue nil when exploit completes.

See https://github.com/rapid7/metasploit-framework/issues/14678
2021-01-29 11:17:38 +00:00
bwatters 9174958489 Land #14627, Add PRTG Network Monitor RCE (CVE-2018-9276)
Merge branch 'land-14627' into upstream-master
2021-01-27 15:48:27 -06:00
Grant Willcox bcb9b7171c Land #14664, Hide negative/missed results behind vprint_error within auxiliary/scanner/ssh/ssh_enumusers 2021-01-27 10:15:23 -06:00
Grant Willcox cd1f0780de Fix up a minor typo. 2021-01-27 10:14:52 -06:00
Spencer McIntyre 74898461b4 Land #14654, Add exploit for Micro Focus UCMDB unauthenticated RCE 2021-01-27 10:00:22 -05:00
Sebastian Tauchert edde3b8fa2 Hide negative results as default 2021-01-27 15:16:55 +01:00
Spencer McIntyre 20590e91fb Land #14541, Create fanny_bmp_check.rb 2021-01-25 15:08:22 -05:00
Spencer McIntyre 3cd65606ee Update the fanny_bmp_check module and documentation 2021-01-25 14:54:44 -05:00
William Martens 4445812b60 Create fanny_bmp_check.rb
Update modules/post/windows/gather/forensics/fanny_bmp_check.rb

Thanks, I thought the comments on it would be needed/ (this is my first module)

Co-authored-by: bcoles <bcoles@gmail.com>

Update modules/post/windows/gather/forensics/fanny_bmp_check.rb

[+] thanks!

Co-authored-by: bcoles <bcoles@gmail.com>

Update modules/post/windows/gather/forensics/fanny_bmp_check.rb

Co-authored-by: bcoles <bcoles@gmail.com>

Update modules/post/windows/gather/forensics/fanny_bmp_check.rb

Co-authored-by: bcoles <bcoles@gmail.com>

Update modules/post/windows/gather/forensics/fanny_bmp_check.rb

[+] thanks for the sharp eye! It certainly does. I tried at my side to make it look as a "flow" but never really succeeded with it. Again, thanks!

Co-authored-by: bcoles <bcoles@gmail.com>

Update modules/post/windows/gather/forensics/fanny_bmp_check.rb

Co-authored-by: bcoles <bcoles@gmail.com>

Update modules/post/windows/gather/forensics/fanny_bmp_check.rb

Of course, this is my first module - I'm sorry, thanks for pointing it out!

Co-authored-by: Spencer McIntyre <58950994+smcintyre-r7@users.noreply.github.com>

Update fanny_bmp_check.rb

Changed
 ...on #{sysinfo['Computer']} for...
to
"Target #{match} result(s) found in
And as well as the + 'shell'  in the session types.
And, as well as  commented some stuff I will remove (the comments, that is) when this is done.
The URL (ref) at the Desc. of the module needs to be a bit more short. Will do this too.

Changed (if not already?) the src link.

Create fanny_bmp_check_Docs.md

Rename fanny_bmp_check_Docs.md to fanny_bmp_check.md

Docs ready to go, (msftidy_docs done[x])

 ./tools/dev/msftidy_docs.rb documentation/modules/post/windows/gather/forensics/fanny_bmp_check.md
(no results) - so It's ready to go

msftidy.rb Done [no errors)

msftidy.rb Done [no errors)

Update fanny_bmp_check.md

Update fanny_bmp_check.md

Removed References since they were not (really) meant for being included,  It was more of my own Notes/Comments that accidentally came with it. 👍

Indentation (2 spaces, + the 33 to 44 lineblock fixed[x])

Update modules/post/windows/gather/forensics/fanny_bmp_check.rb

Co-authored-by: bcoles <bcoles@gmail.com>

fanny_bmp_check.rb

Updated fanny_bmp_check.rb to use arrays instead.

Update fanny_bmp_check.rb

Rubocop fixed

Update fanny_bmp_check.rb

Added report_vuln()  as Jmartin suggested

Update fanny_bmp_check.rb

Update v2

Update modules/post/windows/gather/forensics/fanny_bmp_check.rb

Oh,  yes -  Thank you,  again - sorry

Co-authored-by: Jeffrey Martin <jeffrey_martin@rapid7.com>

Sorry for confusion; 2 problems(line 66+line 61) (work arounded for now)

2 Problems, first; it did not work with the info line (line 66, 61)
If It's still wrong ( the loop , which I have tried to fix)

I am not entirely sue what the problem is, because If I had the end there it was (commented out, line 61) - then it gets, unexpected 'end'  expecting end-of-input,

Coming back again, sorry for the confusion.

Update modules/post/windows/gather/forensics/fanny_bmp_check.rb

Ah, tried it over here - and it worked,  Thanks!

Co-authored-by: Jeffrey Martin <jeffrey_martin@rapid7.com>

Update documentation/modules/post/windows/gather/forensics/fanny_bmp_check.md

Of course,  thanks, committing this suggestion.

Regards

Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com>

Update modules/post/windows/gather/forensics/fanny_bmp_check.rb

Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com>
2021-01-25 14:54:37 -05:00
Pedro Ribeiro 191e772f06 fix issues highlighted by smcintyre-r7 2021-01-25 22:25:07 +07:00
adfoster-r7 f3ac5a9718 Land #14650, local_exploit_suggester: Use session.session_host rather than rhost 2021-01-25 12:25:24 +00:00
adfoster-r7 ba730d5c3c Land #14618, Add exploit for CVE-2020-28949: Archive_Tar PEAR plugin arbitrary file write 2021-01-25 12:12:12 +00:00
adfoster-r7 ffd59c3254 Land #14651, msftidy: Add check for module description 2021-01-25 11:17:39 +00:00
Pedro Ribeiro fc0e221f5a add comment for self removal 2021-01-24 22:47:47 +07:00
Pedro Ribeiro 7220dc3ff6 add new note on broken payloads 2021-01-24 22:39:01 +07:00
Pedro Ribeiro 12157163f7 Merge branch 'obm_deser' into ucmdb 2021-01-24 22:25:57 +07:00
Pedro Ribeiro bf4ac7b1a8 add UCMDB sploit 2021-01-24 22:25:45 +07:00
Brendan Coles b5d746cc44 msftidy: Add check for module description 2021-01-22 23:29:16 +00:00
Spencer McIntyre 17b99983d9 Land #14645, Add MobileIron CVE-2020-15505 exploit 2021-01-22 17:56:35 -05:00
William Vu 39b7ba584e Randomize strings
Spencer tells me not to signature-bait, at least not so obviously. ;)
2021-01-22 16:15:16 -06:00
Brendan Coles f45ca6d045 local_exploit_suggester: Use session.session_host rather than rhost 2021-01-22 22:00:30 +00:00
Grant Willcox 72ef81d8aa Land #14640, rubocop -a modules/exploits/unix/local/ 2021-01-22 15:13:58 -06:00
Grant Willcox 57bb3fbc1c Land #14383, Add exploit and auxiliary Python module examples and update executable loader accordingly 2021-01-22 13:03:57 -06:00
Grant Willcox 7473d0ca56 Add in missing command parameter to exploit.py, should be good to land now 2021-01-22 12:33:03 -06:00
adfoster-r7 ff6a1f135c Land #14629, migrate msf folder to Zeitwerk 2021-01-22 14:21:26 +00:00
William Vu 0d410f32c3 Add MobileIron CVE-2020-15505 exploit 2021-01-22 00:37:07 -06:00
Brendan Coles abb0decc7a wordpress_ghost_scanner: Update reference URLs 2021-01-21 20:51:29 +00:00
Brendan Coles 70bb693660 rubocop -a modules/exploits/unix/local/ 2021-01-21 19:59:29 +00:00
bwatters 1ad7ae2707 Land #14621, Refactor (reduce) linux/x64/shell_bind_tcp_random_port
Merge branch 'land-14621' into upstream-master
2021-01-21 12:38:53 -06:00
Julien Bedel b9800b087f Change notification name
From "Exploit" to a random alphanumeric String in order to make it less fingerprintable.

Co-authored-by: acammack-r7 <adam_cammack@rapid7.com>
2021-01-21 18:32:05 +01:00
William Vu 7ce10f68ae RuboCop for great justice
And update docs.
2021-01-21 10:44:18 -06:00
Spencer McIntyre df8c7829af Land #14632, Fix opensmtpd mail from RCE payload failing to trigger 2021-01-21 09:10:14 -05:00
Spencer McIntyre 131bf632bd Update the OpenSMTPD target versions and add the EDB reference 2021-01-21 09:09:42 -05:00
William Vu a336ee483a Update exploit/unix/smtp/opensmtpd_mail_from_rce
Failure was caused by POSIX read requiring an argument.
2021-01-21 03:56:19 -06:00
Grant Willcox 6e326d6a60 Fix up confusing variable name and a typo as pointed out during review 2021-01-19 09:25:56 -06:00
Spencer McIntyre 3ee642a589 Land #14597, gather/external_ip: set Host header 2021-01-19 09:19:48 -05:00
zomfg-zombie 364591069c Fix payload failing to trigger
For whatever reason,  `;for #{rand_text_alpha(1)} in #{iter};do read;done;sh;exit 0;` causes an issue with the payload triggering.

Editing `do read` to `do read r`, as taken from the PoC script at https://www.exploit-db.com/exploits/48051, causes the `MAIL_FROM` field to exceed 64 characters.

However, this seems to make 0 difference to the payload, so I commented out the length check.

Reliably working on OpenSMTPd 6.6.0 on an Ubuntu 20.04 host.
2021-01-19 18:31:35 +10:00
dwelch-r7 d6896dadc0 remove msf folder requires 2021-01-18 14:21:54 +00:00
dwelch-r7 d437a32374 remove msf/util requires 2021-01-18 14:21:54 +00:00
adfoster-r7 da7a51fbca Land #14584, implement the zeitwerk autoloader within lib/msf/base 2021-01-18 13:11:08 +00:00
JulienBedel 14f24b258d Add PRTG Network Monitor RCE (CVE-2018-9276) 2021-01-18 12:01:44 +01:00
Geyslan G. Bem d0cf0ef0e9 get rid of tabs
Signed-off-by: Geyslan G. Bem <geyslan@gmail.com>
2021-01-17 11:18:59 -03:00
Geyslan G. Bem 5edb4cd135 reduce to 53 bytes and refactor to embed nasm
Signed-off-by: Geyslan G. Bem <geyslan@gmail.com>
2021-01-17 11:11:07 -03:00
Grant Willcox 95d3bd98ac Do msftidy_docs and rubocop changes 2021-01-15 18:10:23 -06:00
Grant Willcox 2f0abe4900 Add in documentation and fix up small issues with module 2021-01-15 18:06:07 -06:00
Grant Willcox 65370a6b47 Initial module code 2021-01-15 16:20:06 -06:00
Christophe De La Fuente c8819259ae Land #14414, CVE-2020-1337 - patch bypass for CVE-2020-1048 2021-01-15 19:13:14 +01:00
bwatters 9beb570ca3 Remove unnecessary require that broke things 2021-01-15 08:32:05 -06:00
Spencer McIntyre 1e633276e4 Land #14615, Update the metasploit-payloads and mettle gems 2021-01-14 12:14:47 -05:00
Spencer McIntyre 65dfaf9453 Update the metasploit-payloads and mettle gems 2021-01-14 10:16:17 -05:00