Commit Graph

30304 Commits

Author SHA1 Message Date
Brendan Coles bdc2041c83 Add Klog Server authenticate.php user Unauthenticated Command Injection 2021-02-12 17:07:52 +00:00
Christophe De La Fuente 85b7e85d0b Land #14671, Micro Focus Multiple Products Authenticated RCE (CVE-2020-11853) 2021-02-09 18:24:57 +01:00
Pedro Ribeiro 9881512833 Update modules/exploits/multi/http/microfocus_obm_auth_rce.rb
Co-authored-by: cdelafuente-r7 <56716719+cdelafuente-r7@users.noreply.github.com>
2021-02-09 14:18:47 +07:00
Spencer McIntyre b4dd46a8de Land #14721, sudo_baron_samedit: Add target: Debian 10 x64, sudo v1.8.27, libc v2.28 2021-02-05 16:01:58 -05:00
Shelby Pace fc8ed5ba4e Land #14154, use prepend autocheck 2021-02-05 12:22:38 -06:00
Shelby Pace 606c6561a0 remove manual ForceExploit check in emacs_movemail 2021-02-05 12:15:44 -06:00
Tim W f3eafc22a2 Land #14685, linux/x64/shell_bind_tcp_random_port improvements 2021-02-05 17:14:50 +00:00
adfoster-r7 b3da14e66b Land #14669, ensure selected cracker is available and viable 2021-02-05 16:24:59 +00:00
Brendan Coles cfda83df99 sudo_baron_samedit: Add target: Debian 10 x64, sudo v1.8.27, libc v2.28 2021-02-05 07:54:34 +00:00
bwatters 434c54da33 Land #14715, CVE-2021-3156 Sudo LPE (AKA: Baron Samedit)
Merge branch 'land-14715' into upstream-master
2021-02-04 11:06:30 -06:00
Shelby Pace 87af571107 Land #14578, add wp abandoned cart sqli 2021-02-04 10:56:12 -06:00
Shelby Pace 4c4df29f25 change vulnerable version number 2021-02-04 10:50:13 -06:00
Spencer McIntyre 504865d507 Add a target for Ubuntu 18.04 and setgid and setuid by default 2021-02-04 10:45:00 -05:00
Spencer McIntyre 7281d00938 Implement feedback from PR review 2021-02-04 09:25:40 -05:00
Spencer McIntyre c33c08bae9 Add a check method using the version information 2021-02-03 18:16:13 -05:00
Spencer McIntyre c590d7b1bb Add module docs and be more permissive with Length formatting 2021-02-03 18:16:13 -05:00
Spencer McIntyre 117cdc4fd7 Populate module metadata and cleanup files 2021-02-03 18:16:13 -05:00
Spencer McIntyre b9413b4103 Update the exploit C code to allocate it's own PTY 2021-02-03 18:16:13 -05:00
Spencer McIntyre 13dd9ac10e Initial work on CVE-2021-3156 2021-02-03 18:16:13 -05:00
cgranleese-r7 3a2932b798 Migrate old uses of manual autocheck to use the new prepend autocheck 2021-02-02 10:15:46 +00:00
Jeffrey Martin 2db217aac8 remove action set no longer required 2021-02-01 14:16:13 -06:00
Tim W 4a68ef17fd update mettle payload cached sizes 2021-02-01 11:50:35 -05:00
Geyslan G. Bem ab307fbd87 payload/x64: shell_bind_tcp_random_port improvement
This patch reduces the payload to 52 bytes while preserving its functionality
using coordinated xchg instructions.
It also guarantees dup2 call without garbage in rax.

Signed-off-by: Geyslan G. Bem <geyslan@gmail.com>
2021-01-29 16:58:14 -03:00
Grant Willcox 90d9a5dcff Land #14682, Fix msftidy warnings 2021-01-29 11:30:52 -06:00
Grant Willcox a8b1bf17d0 Land #14593, OneDrive Sync Targets Enumeration Module 2021-01-29 10:20:01 -06:00
Alan Foster 91febcb194 Fix msftidy warnings 2021-01-29 16:19:13 +00:00
Grant Willcox fce3cf2ba2 Add in documentation updates and improve some areas of the module to remove false statements and clean up output and code styling 2021-01-29 10:17:48 -06:00
Jeffrey Martin 50b3a4c73a Land #14679, Remove < character from Archive_Tar exploit module 2021-01-29 08:49:00 -06:00
Alan Foster e0ab259880 Remove < character from Archive_Tar exploit module 2021-01-29 11:20:50 +00:00
Robin Wood 89f4d3e2d7 Fix for issue #14678
Stops the printing of a rogue nil when exploit completes.

See https://github.com/rapid7/metasploit-framework/issues/14678
2021-01-29 11:17:38 +00:00
Stuart.Morgan 58f5fba22d Run rubocop 2021-01-28 15:56:48 +00:00
Stuart.Morgan 8e0bcabaa8 Added more verbose account checks as per gwilcox's request 2021-01-28 15:54:06 +00:00
Pedro Ribeiro 7d9eb1e88b fix typo on LWSSO_COOKIE_KEY 2021-01-28 22:45:04 +07:00
Pedro Ribeiro c73fa70543 do the rubocop thing and add docs 2021-01-28 18:21:51 +07:00
Pedro Ribeiro a5725b823a add sploit 2021-01-28 17:41:06 +07:00
Grant Willcox 760e4f6880 Add in first round of fixes for review comments 2021-01-27 16:54:24 -06:00
bwatters 9174958489 Land #14627, Add PRTG Network Monitor RCE (CVE-2018-9276)
Merge branch 'land-14627' into upstream-master
2021-01-27 15:48:27 -06:00
Jeffrey Martin 6f7f1db6f9 ensure selected cracker is available and viable
When no password cracker is installed `cracker_version` returns `nil`.
Guard against `nil` in the version check and consolidate detection of
a viable environment and application as a responsibility of the factory
that provides the instance.
2021-01-27 14:28:08 -06:00
Grant Willcox bcb9b7171c Land #14664, Hide negative/missed results behind vprint_error within auxiliary/scanner/ssh/ssh_enumusers 2021-01-27 10:15:23 -06:00
Grant Willcox cd1f0780de Fix up a minor typo. 2021-01-27 10:14:52 -06:00
Spencer McIntyre 74898461b4 Land #14654, Add exploit for Micro Focus UCMDB unauthenticated RCE 2021-01-27 10:00:22 -05:00
Sebastian Tauchert edde3b8fa2 Hide negative results as default 2021-01-27 15:16:55 +01:00
Spencer McIntyre 20590e91fb Land #14541, Create fanny_bmp_check.rb 2021-01-25 15:08:22 -05:00
Spencer McIntyre 3cd65606ee Update the fanny_bmp_check module and documentation 2021-01-25 14:54:44 -05:00
William Martens 4445812b60 Create fanny_bmp_check.rb
Update modules/post/windows/gather/forensics/fanny_bmp_check.rb

Thanks, I thought the comments on it would be needed/ (this is my first module)

Co-authored-by: bcoles <bcoles@gmail.com>

Update modules/post/windows/gather/forensics/fanny_bmp_check.rb

[+] thanks!

Co-authored-by: bcoles <bcoles@gmail.com>

Update modules/post/windows/gather/forensics/fanny_bmp_check.rb

Co-authored-by: bcoles <bcoles@gmail.com>

Update modules/post/windows/gather/forensics/fanny_bmp_check.rb

Co-authored-by: bcoles <bcoles@gmail.com>

Update modules/post/windows/gather/forensics/fanny_bmp_check.rb

[+] thanks for the sharp eye! It certainly does. I tried at my side to make it look as a "flow" but never really succeeded with it. Again, thanks!

Co-authored-by: bcoles <bcoles@gmail.com>

Update modules/post/windows/gather/forensics/fanny_bmp_check.rb

Co-authored-by: bcoles <bcoles@gmail.com>

Update modules/post/windows/gather/forensics/fanny_bmp_check.rb

Of course, this is my first module - I'm sorry, thanks for pointing it out!

Co-authored-by: Spencer McIntyre <58950994+smcintyre-r7@users.noreply.github.com>

Update fanny_bmp_check.rb

Changed
 ...on #{sysinfo['Computer']} for...
to
"Target #{match} result(s) found in
And as well as the + 'shell'  in the session types.
And, as well as  commented some stuff I will remove (the comments, that is) when this is done.
The URL (ref) at the Desc. of the module needs to be a bit more short. Will do this too.

Changed (if not already?) the src link.

Create fanny_bmp_check_Docs.md

Rename fanny_bmp_check_Docs.md to fanny_bmp_check.md

Docs ready to go, (msftidy_docs done[x])

 ./tools/dev/msftidy_docs.rb documentation/modules/post/windows/gather/forensics/fanny_bmp_check.md
(no results) - so It's ready to go

msftidy.rb Done [no errors)

msftidy.rb Done [no errors)

Update fanny_bmp_check.md

Update fanny_bmp_check.md

Removed References since they were not (really) meant for being included,  It was more of my own Notes/Comments that accidentally came with it. 👍

Indentation (2 spaces, + the 33 to 44 lineblock fixed[x])

Update modules/post/windows/gather/forensics/fanny_bmp_check.rb

Co-authored-by: bcoles <bcoles@gmail.com>

fanny_bmp_check.rb

Updated fanny_bmp_check.rb to use arrays instead.

Update fanny_bmp_check.rb

Rubocop fixed

Update fanny_bmp_check.rb

Added report_vuln()  as Jmartin suggested

Update fanny_bmp_check.rb

Update v2

Update modules/post/windows/gather/forensics/fanny_bmp_check.rb

Oh,  yes -  Thank you,  again - sorry

Co-authored-by: Jeffrey Martin <jeffrey_martin@rapid7.com>

Sorry for confusion; 2 problems(line 66+line 61) (work arounded for now)

2 Problems, first; it did not work with the info line (line 66, 61)
If It's still wrong ( the loop , which I have tried to fix)

I am not entirely sue what the problem is, because If I had the end there it was (commented out, line 61) - then it gets, unexpected 'end'  expecting end-of-input,

Coming back again, sorry for the confusion.

Update modules/post/windows/gather/forensics/fanny_bmp_check.rb

Ah, tried it over here - and it worked,  Thanks!

Co-authored-by: Jeffrey Martin <jeffrey_martin@rapid7.com>

Update documentation/modules/post/windows/gather/forensics/fanny_bmp_check.md

Of course,  thanks, committing this suggestion.

Regards

Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com>

Update modules/post/windows/gather/forensics/fanny_bmp_check.rb

Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com>
2021-01-25 14:54:37 -05:00
Pedro Ribeiro 191e772f06 fix issues highlighted by smcintyre-r7 2021-01-25 22:25:07 +07:00
adfoster-r7 f3ac5a9718 Land #14650, local_exploit_suggester: Use session.session_host rather than rhost 2021-01-25 12:25:24 +00:00
adfoster-r7 ba730d5c3c Land #14618, Add exploit for CVE-2020-28949: Archive_Tar PEAR plugin arbitrary file write 2021-01-25 12:12:12 +00:00
adfoster-r7 ffd59c3254 Land #14651, msftidy: Add check for module description 2021-01-25 11:17:39 +00:00
Pedro Ribeiro fc0e221f5a add comment for self removal 2021-01-24 22:47:47 +07:00