Commit Graph

2325 Commits

Author SHA1 Message Date
Spencer McIntyre 20590e91fb Land #14541, Create fanny_bmp_check.rb 2021-01-25 15:08:22 -05:00
Spencer McIntyre 3cd65606ee Update the fanny_bmp_check module and documentation 2021-01-25 14:54:44 -05:00
William Martens 4445812b60 Create fanny_bmp_check.rb
Update modules/post/windows/gather/forensics/fanny_bmp_check.rb

Thanks, I thought the comments on it would be needed/ (this is my first module)

Co-authored-by: bcoles <bcoles@gmail.com>

Update modules/post/windows/gather/forensics/fanny_bmp_check.rb

[+] thanks!

Co-authored-by: bcoles <bcoles@gmail.com>

Update modules/post/windows/gather/forensics/fanny_bmp_check.rb

Co-authored-by: bcoles <bcoles@gmail.com>

Update modules/post/windows/gather/forensics/fanny_bmp_check.rb

Co-authored-by: bcoles <bcoles@gmail.com>

Update modules/post/windows/gather/forensics/fanny_bmp_check.rb

[+] thanks for the sharp eye! It certainly does. I tried at my side to make it look as a "flow" but never really succeeded with it. Again, thanks!

Co-authored-by: bcoles <bcoles@gmail.com>

Update modules/post/windows/gather/forensics/fanny_bmp_check.rb

Co-authored-by: bcoles <bcoles@gmail.com>

Update modules/post/windows/gather/forensics/fanny_bmp_check.rb

Of course, this is my first module - I'm sorry, thanks for pointing it out!

Co-authored-by: Spencer McIntyre <58950994+smcintyre-r7@users.noreply.github.com>

Update fanny_bmp_check.rb

Changed
 ...on #{sysinfo['Computer']} for...
to
"Target #{match} result(s) found in
And as well as the + 'shell'  in the session types.
And, as well as  commented some stuff I will remove (the comments, that is) when this is done.
The URL (ref) at the Desc. of the module needs to be a bit more short. Will do this too.

Changed (if not already?) the src link.

Create fanny_bmp_check_Docs.md

Rename fanny_bmp_check_Docs.md to fanny_bmp_check.md

Docs ready to go, (msftidy_docs done[x])

 ./tools/dev/msftidy_docs.rb documentation/modules/post/windows/gather/forensics/fanny_bmp_check.md
(no results) - so It's ready to go

msftidy.rb Done [no errors)

msftidy.rb Done [no errors)

Update fanny_bmp_check.md

Update fanny_bmp_check.md

Removed References since they were not (really) meant for being included,  It was more of my own Notes/Comments that accidentally came with it. 👍

Indentation (2 spaces, + the 33 to 44 lineblock fixed[x])

Update modules/post/windows/gather/forensics/fanny_bmp_check.rb

Co-authored-by: bcoles <bcoles@gmail.com>

fanny_bmp_check.rb

Updated fanny_bmp_check.rb to use arrays instead.

Update fanny_bmp_check.rb

Rubocop fixed

Update fanny_bmp_check.rb

Added report_vuln()  as Jmartin suggested

Update fanny_bmp_check.rb

Update v2

Update modules/post/windows/gather/forensics/fanny_bmp_check.rb

Oh,  yes -  Thank you,  again - sorry

Co-authored-by: Jeffrey Martin <jeffrey_martin@rapid7.com>

Sorry for confusion; 2 problems(line 66+line 61) (work arounded for now)

2 Problems, first; it did not work with the info line (line 66, 61)
If It's still wrong ( the loop , which I have tried to fix)

I am not entirely sue what the problem is, because If I had the end there it was (commented out, line 61) - then it gets, unexpected 'end'  expecting end-of-input,

Coming back again, sorry for the confusion.

Update modules/post/windows/gather/forensics/fanny_bmp_check.rb

Ah, tried it over here - and it worked,  Thanks!

Co-authored-by: Jeffrey Martin <jeffrey_martin@rapid7.com>

Update documentation/modules/post/windows/gather/forensics/fanny_bmp_check.md

Of course,  thanks, committing this suggestion.

Regards

Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com>

Update modules/post/windows/gather/forensics/fanny_bmp_check.rb

Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com>
2021-01-25 14:54:37 -05:00
Spencer McIntyre 829bacbef6 Refactor and document some of the FileSystem mixin methods 2021-01-08 16:10:36 -05:00
Spencer McIntyre 104a9575d8 Use a regex to perform a check on the DEVICE option 2021-01-07 15:02:46 -05:00
Spencer McIntyre 6ac9cb7c0e Apply rubocop changes for the new VSS module 2021-01-04 12:26:36 -05:00
Spencer McIntyre 2f58d246e7 Add documentation for the new VSS module 2021-01-04 12:25:41 -05:00
Spencer McIntyre 2b1ac98eba Deprecate all of the old vss_* modules in favor of the new unified one 2021-01-04 10:54:42 -05:00
Spencer McIntyre fd2a752052 Add the VSS_UNMOUNT action and use the win32 API instead of a command 2021-01-04 10:45:41 -05:00
Spencer McIntyre 88f5fada50 Initial unified VSS module 2020-12-29 17:48:17 -05:00
CSharperMantle d99c2ac783 linguistic fixes of 'does not exists' 2020-12-23 11:36:38 +08:00
dwelch-r7 1617b3ec9b Use zeitwerk for lib/msf/core folder 2020-12-07 10:31:45 +00:00
Grant Willcox 5961bf700d Land #14314, Pulse Secure Connect Client Credentials Gatherer 2020-12-04 10:04:43 -06:00
Quentin Kaiser e8ea9e56ee Print a status message when no credentials are found. 2020-12-03 10:19:56 +01:00
Quentin Kaiser c8f534e420 Merge branch 'enum_pulsesecure' of github.com:QKaiser/metasploit-framework into enum_pulsesecure 2020-12-03 10:12:54 +01:00
Quentin Kaiser 4f947ac2cb Properly close files that we open and properly capture file open error in get_username. 2020-12-03 10:12:33 +01:00
Quentin Kaiser 585bc99903 Proper return values
Co-authored-by: Grant Willcox <63261883+gwillcox-r7@users.noreply.github.com>
2020-12-02 21:34:56 +01:00
Quentin Kaiser f4bb5f7e10 Uniform error handling applied to all functions interacting with 'session' object. 2020-12-02 20:51:29 +01:00
Quentin Kaiser 94af390649 Document Ruby construct that might be unclear to newcomers. 2020-12-02 20:43:39 +01:00
Quentin Kaiser dbd3f2e1bf Revert back on AutoCheck. 2020-12-02 20:42:05 +01:00
bwatters 5d7014bf39 Land #14298, Windows post-exploitation gather module - Memory dumping via Avast AvDump utility
Merge branch 'land-14298' into upstream-master
2020-12-02 08:30:38 -06:00
Quentin Kaiser bf0d4b4c3f Better regular expression for version line. 2020-12-02 10:05:17 +01:00
Quentin Kaiser 5d89b32f58 prepend class rather than import it 2020-12-02 10:03:38 +01:00
Quentin Kaiser 8edcae4bb7 Handle a case where Pulse Secure is installed but no saved entry exists in the registry. Handle a case where the session runs as system on an affected version. 2020-12-02 09:57:28 +01:00
Quentin Kaiser 7842d746d3 Wrong return code when Pulse is not installed. 2020-11-27 16:19:52 +01:00
Quentin Kaiser 0ed2b0d253 Fix active record issue when realm is blank due to empty path. 2020-11-27 16:18:21 +01:00
Quentin Kaiser 013a1e4312 Username was not found when running the module just after the connection creation. Turns out it was saved in .tmp rather than .dat or .bak. 2020-11-27 15:11:14 +01:00
Quentin Kaiser 54e836e797 Add guard clause to gather_creds function to remove conditional block. 2020-11-25 15:36:37 +01:00
Quentin Kaiser 15bdffdee1 Remove redundant else after return.
Co-authored-by: bcoles <bcoles@gmail.com>
2020-11-25 15:31:13 +01:00
Quentin Kaiser 7f130b4414 Switch to idiomatic next guard clause.
Co-authored-by: bcoles <bcoles@gmail.com>
2020-11-25 15:30:38 +01:00
Quentin Kaiser c4b0253d93 Switch to idiomatic guard clause.
Co-authored-by: bcoles <bcoles@gmail.com>
2020-11-25 15:29:44 +01:00
Quentin Kaiser 53a1f2f19b conditional next call style update 1
Co-authored-by: bcoles <bcoles@gmail.com>
2020-11-25 15:27:22 +01:00
Quentin Kaiser e069b0d607 Execute data conversion using built-in methods rather than custom encoders. 2020-11-25 14:41:21 +01:00
Quentin Kaiser 8024c08882 Do not save entry to service data if we can't resolve the host. 2020-11-25 13:52:42 +01:00
Quentin Kaiser a0265e0d6c Remove unnecessary second argument to registry_enumvals. 2020-11-25 13:39:37 +01:00
Quentin Kaiser fc083d197a Finally found how to encode entropy to UTF-16LE representation in Ruby. 2020-11-25 12:58:19 +01:00
Quentin Kaiser cf405879d6 Fix hash wording. 2020-11-25 12:46:23 +01:00
Quentin Kaiser 6a4237f4e3 Uniform error handling. 2020-11-25 12:40:42 +01:00
Quentin Kaiser debaa44733 Safer connection store file reading by handling the case where user does not have permissions to read the file. 2020-11-25 12:33:28 +01:00
Quentin Kaiser 26a3342a3d Move version verification to a check function using Msf::Exploit::Remote::AutoCheck. Safer version file reading by handling the case where user does not have permissions to read the file. Cleaner status messages in check function. 2020-11-25 12:12:34 +01:00
Quentin Kaiser 50b25989fa Safer handling of registry access operation when executing from unprivileged process. 2020-11-25 11:41:34 +01:00
Grant Willcox e648a055fc Add in RuboCop fixes to the module 2020-11-24 12:31:05 -06:00
Grant Willcox bd00ce9177 Add in fixes from review 2020-11-24 12:08:51 -06:00
DLL_Cool_J 0ec6d4c142 Update modules/post/windows/gather/avast_memory_dump.rb
Co-authored-by: bcoles <bcoles@gmail.com>
2020-11-21 22:16:55 -05:00
dwelch-r7 c7b5616319 Land #14341, Fix NIL Dereference Issues
Fix NIL Dereference Issues, Missing fail_with Statements, and Update Regex Inside SecureCRT Password Gatherer
2020-11-18 16:17:25 +00:00
Grant Willcox d96f257842 Fix up mistake where I thought .to_s on an empty string would return an empty string 2020-11-18 09:54:50 -06:00
Grant Willcox ef108eae4c Add in Dean's suggested fix to make the check a little neater 2020-11-17 10:02:02 -06:00
Grant Willcox dab01ea179 Add in fixes to use string capture group functionality and also improve the regex so that we get extra info such as port numbers and protocol info from logins other than SSH 2020-11-13 14:14:45 -06:00
Spencer McIntyre 76ab0ee849 Land #14304, execute_dotnet_assembly fix parameters management 2020-11-10 09:56:18 -05:00
Quentin Kaiser 26f39b5819 Checks if Pulse Secure Connect client is actually installed. Raise an exception if it's not. 2020-11-10 13:54:22 +01:00