Commit Graph

3893 Commits

Author SHA1 Message Date
Spencer McIntyre 20590e91fb Land #14541, Create fanny_bmp_check.rb 2021-01-25 15:08:22 -05:00
Spencer McIntyre 3cd65606ee Update the fanny_bmp_check module and documentation 2021-01-25 14:54:44 -05:00
William Martens 4445812b60 Create fanny_bmp_check.rb
Update modules/post/windows/gather/forensics/fanny_bmp_check.rb

Thanks, I thought the comments on it would be needed/ (this is my first module)

Co-authored-by: bcoles <bcoles@gmail.com>

Update modules/post/windows/gather/forensics/fanny_bmp_check.rb

[+] thanks!

Co-authored-by: bcoles <bcoles@gmail.com>

Update modules/post/windows/gather/forensics/fanny_bmp_check.rb

Co-authored-by: bcoles <bcoles@gmail.com>

Update modules/post/windows/gather/forensics/fanny_bmp_check.rb

Co-authored-by: bcoles <bcoles@gmail.com>

Update modules/post/windows/gather/forensics/fanny_bmp_check.rb

[+] thanks for the sharp eye! It certainly does. I tried at my side to make it look as a "flow" but never really succeeded with it. Again, thanks!

Co-authored-by: bcoles <bcoles@gmail.com>

Update modules/post/windows/gather/forensics/fanny_bmp_check.rb

Co-authored-by: bcoles <bcoles@gmail.com>

Update modules/post/windows/gather/forensics/fanny_bmp_check.rb

Of course, this is my first module - I'm sorry, thanks for pointing it out!

Co-authored-by: Spencer McIntyre <58950994+smcintyre-r7@users.noreply.github.com>

Update fanny_bmp_check.rb

Changed
 ...on #{sysinfo['Computer']} for...
to
"Target #{match} result(s) found in
And as well as the + 'shell'  in the session types.
And, as well as  commented some stuff I will remove (the comments, that is) when this is done.
The URL (ref) at the Desc. of the module needs to be a bit more short. Will do this too.

Changed (if not already?) the src link.

Create fanny_bmp_check_Docs.md

Rename fanny_bmp_check_Docs.md to fanny_bmp_check.md

Docs ready to go, (msftidy_docs done[x])

 ./tools/dev/msftidy_docs.rb documentation/modules/post/windows/gather/forensics/fanny_bmp_check.md
(no results) - so It's ready to go

msftidy.rb Done [no errors)

msftidy.rb Done [no errors)

Update fanny_bmp_check.md

Update fanny_bmp_check.md

Removed References since they were not (really) meant for being included,  It was more of my own Notes/Comments that accidentally came with it. 👍

Indentation (2 spaces, + the 33 to 44 lineblock fixed[x])

Update modules/post/windows/gather/forensics/fanny_bmp_check.rb

Co-authored-by: bcoles <bcoles@gmail.com>

fanny_bmp_check.rb

Updated fanny_bmp_check.rb to use arrays instead.

Update fanny_bmp_check.rb

Rubocop fixed

Update fanny_bmp_check.rb

Added report_vuln()  as Jmartin suggested

Update fanny_bmp_check.rb

Update v2

Update modules/post/windows/gather/forensics/fanny_bmp_check.rb

Oh,  yes -  Thank you,  again - sorry

Co-authored-by: Jeffrey Martin <jeffrey_martin@rapid7.com>

Sorry for confusion; 2 problems(line 66+line 61) (work arounded for now)

2 Problems, first; it did not work with the info line (line 66, 61)
If It's still wrong ( the loop , which I have tried to fix)

I am not entirely sue what the problem is, because If I had the end there it was (commented out, line 61) - then it gets, unexpected 'end'  expecting end-of-input,

Coming back again, sorry for the confusion.

Update modules/post/windows/gather/forensics/fanny_bmp_check.rb

Ah, tried it over here - and it worked,  Thanks!

Co-authored-by: Jeffrey Martin <jeffrey_martin@rapid7.com>

Update documentation/modules/post/windows/gather/forensics/fanny_bmp_check.md

Of course,  thanks, committing this suggestion.

Regards

Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com>

Update modules/post/windows/gather/forensics/fanny_bmp_check.rb

Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com>
2021-01-25 14:54:37 -05:00
Brendan Coles f45ca6d045 local_exploit_suggester: Use session.session_host rather than rhost 2021-01-22 22:00:30 +00:00
Spencer McIntyre 829bacbef6 Refactor and document some of the FileSystem mixin methods 2021-01-08 16:10:36 -05:00
Spencer McIntyre 104a9575d8 Use a regex to perform a check on the DEVICE option 2021-01-07 15:02:46 -05:00
Spencer McIntyre 6ac9cb7c0e Apply rubocop changes for the new VSS module 2021-01-04 12:26:36 -05:00
Spencer McIntyre 2f58d246e7 Add documentation for the new VSS module 2021-01-04 12:25:41 -05:00
Spencer McIntyre 2b1ac98eba Deprecate all of the old vss_* modules in favor of the new unified one 2021-01-04 10:54:42 -05:00
Spencer McIntyre fd2a752052 Add the VSS_UNMOUNT action and use the win32 API instead of a command 2021-01-04 10:45:41 -05:00
Spencer McIntyre 88f5fada50 Initial unified VSS module 2020-12-29 17:48:17 -05:00
CSharperMantle d99c2ac783 linguistic fixes of 'does not exists' 2020-12-23 11:36:38 +08:00
Brendan Coles 87a80afeb7 post/android/capture/screen: Use Msf::Post::Common mixin 2020-12-20 11:17:39 +00:00
dwelch-r7 49a6b1b257 Remove requires that sneaked in while the PR was up 2020-12-07 11:02:10 +00:00
dwelch-r7 1617b3ec9b Use zeitwerk for lib/msf/core folder 2020-12-07 10:31:45 +00:00
Grant Willcox 5961bf700d Land #14314, Pulse Secure Connect Client Credentials Gatherer 2020-12-04 10:04:43 -06:00
Quentin Kaiser e8ea9e56ee Print a status message when no credentials are found. 2020-12-03 10:19:56 +01:00
Quentin Kaiser c8f534e420 Merge branch 'enum_pulsesecure' of github.com:QKaiser/metasploit-framework into enum_pulsesecure 2020-12-03 10:12:54 +01:00
Quentin Kaiser 4f947ac2cb Properly close files that we open and properly capture file open error in get_username. 2020-12-03 10:12:33 +01:00
Quentin Kaiser 585bc99903 Proper return values
Co-authored-by: Grant Willcox <63261883+gwillcox-r7@users.noreply.github.com>
2020-12-02 21:34:56 +01:00
Quentin Kaiser f4bb5f7e10 Uniform error handling applied to all functions interacting with 'session' object. 2020-12-02 20:51:29 +01:00
Quentin Kaiser 94af390649 Document Ruby construct that might be unclear to newcomers. 2020-12-02 20:43:39 +01:00
Quentin Kaiser dbd3f2e1bf Revert back on AutoCheck. 2020-12-02 20:42:05 +01:00
bwatters 5d7014bf39 Land #14298, Windows post-exploitation gather module - Memory dumping via Avast AvDump utility
Merge branch 'land-14298' into upstream-master
2020-12-02 08:30:38 -06:00
Quentin Kaiser bf0d4b4c3f Better regular expression for version line. 2020-12-02 10:05:17 +01:00
Quentin Kaiser 5d89b32f58 prepend class rather than import it 2020-12-02 10:03:38 +01:00
Quentin Kaiser 8edcae4bb7 Handle a case where Pulse Secure is installed but no saved entry exists in the registry. Handle a case where the session runs as system on an affected version. 2020-12-02 09:57:28 +01:00
Quentin Kaiser 7842d746d3 Wrong return code when Pulse is not installed. 2020-11-27 16:19:52 +01:00
Quentin Kaiser 0ed2b0d253 Fix active record issue when realm is blank due to empty path. 2020-11-27 16:18:21 +01:00
Quentin Kaiser 013a1e4312 Username was not found when running the module just after the connection creation. Turns out it was saved in .tmp rather than .dat or .bak. 2020-11-27 15:11:14 +01:00
Quentin Kaiser 54e836e797 Add guard clause to gather_creds function to remove conditional block. 2020-11-25 15:36:37 +01:00
Quentin Kaiser 15bdffdee1 Remove redundant else after return.
Co-authored-by: bcoles <bcoles@gmail.com>
2020-11-25 15:31:13 +01:00
Quentin Kaiser 7f130b4414 Switch to idiomatic next guard clause.
Co-authored-by: bcoles <bcoles@gmail.com>
2020-11-25 15:30:38 +01:00
Quentin Kaiser c4b0253d93 Switch to idiomatic guard clause.
Co-authored-by: bcoles <bcoles@gmail.com>
2020-11-25 15:29:44 +01:00
Quentin Kaiser 53a1f2f19b conditional next call style update 1
Co-authored-by: bcoles <bcoles@gmail.com>
2020-11-25 15:27:22 +01:00
Quentin Kaiser e069b0d607 Execute data conversion using built-in methods rather than custom encoders. 2020-11-25 14:41:21 +01:00
Quentin Kaiser 8024c08882 Do not save entry to service data if we can't resolve the host. 2020-11-25 13:52:42 +01:00
Quentin Kaiser a0265e0d6c Remove unnecessary second argument to registry_enumvals. 2020-11-25 13:39:37 +01:00
Quentin Kaiser fc083d197a Finally found how to encode entropy to UTF-16LE representation in Ruby. 2020-11-25 12:58:19 +01:00
Quentin Kaiser cf405879d6 Fix hash wording. 2020-11-25 12:46:23 +01:00
Quentin Kaiser 6a4237f4e3 Uniform error handling. 2020-11-25 12:40:42 +01:00
Quentin Kaiser debaa44733 Safer connection store file reading by handling the case where user does not have permissions to read the file. 2020-11-25 12:33:28 +01:00
Quentin Kaiser 26a3342a3d Move version verification to a check function using Msf::Exploit::Remote::AutoCheck. Safer version file reading by handling the case where user does not have permissions to read the file. Cleaner status messages in check function. 2020-11-25 12:12:34 +01:00
Quentin Kaiser 50b25989fa Safer handling of registry access operation when executing from unprivileged process. 2020-11-25 11:41:34 +01:00
Grant Willcox e648a055fc Add in RuboCop fixes to the module 2020-11-24 12:31:05 -06:00
Grant Willcox bd00ce9177 Add in fixes from review 2020-11-24 12:08:51 -06:00
A Galway 3fcea08cb8 Land #14405, presents new error message on attempted meterpreter upgrade 2020-11-23 14:09:42 +00:00
DLL_Cool_J 0ec6d4c142 Update modules/post/windows/gather/avast_memory_dump.rb
Co-authored-by: bcoles <bcoles@gmail.com>
2020-11-21 22:16:55 -05:00
Tim W 634a2f3c61 prevent upgrading of meterpreter sessions with shell_to_meterpreter 2020-11-20 17:26:21 +00:00
dwelch-r7 c7b5616319 Land #14341, Fix NIL Dereference Issues
Fix NIL Dereference Issues, Missing fail_with Statements, and Update Regex Inside SecureCRT Password Gatherer
2020-11-18 16:17:25 +00:00