cf497a8d6e
Merge pull request #20938 from Chocapikk/fix-beyondtrust-mech-list-fallback
...
Fix BeyondTrust PRA/RS exploit failing on older instances
2026-02-20 17:38:40 -06:00
c6f7d03d03
Merge pull request #20919 from h00die/emacs
...
emacs extension persistence
2026-02-18 10:58:13 -05:00
f369cac6d7
Apply suggestion from @jvoisin
...
Co-authored-by: Julien Voisin <jvoisin@users.noreply.github.com >
2026-02-18 12:24:09 +01:00
4adf87ac18
Merge pull request #20929 from jheysel-r7/feat/mod/cve-2026-24061
...
GNU Inetutils Telnet Auth Bypass (CVE-2026-24061)
2026-02-11 11:12:29 -08:00
8f1e16d2a6
Update modules/exploits/linux/telnet/gnu_inetutils_auth_bypass.rb
...
Co-authored-by: msutovsky-r7 <martin_sutovsky@rapid7.com >
2026-02-11 08:54:09 -08:00
d330de16c8
Merge pull request #20932 from sfewer-r7/ivanti-epmm-rce
...
Add exploit module for Ivant EPMM/MobileIron (CVE-2026-1281)
2026-02-10 11:07:39 -06:00
3f6d228954
Update modules/exploits/linux/http/beyondtrust_pra_rs_unauth_rce.rb
...
Co-authored-by: Julien Voisin <jvoisin@users.noreply.github.com >
2026-02-10 18:06:20 +01:00
defeb14ef4
Update modules/exploits/linux/http/beyondtrust_pra_rs_unauth_rce.rb
...
Co-authored-by: Julien Voisin <jvoisin@users.noreply.github.com >
2026-02-10 18:02:22 +01:00
47d4cd7601
Update modules/exploits/linux/http/beyondtrust_pra_rs_unauth_rce.rb
...
Co-authored-by: Julien Voisin <jvoisin@users.noreply.github.com >
2026-02-10 18:02:12 +01:00
f41eda1128
Add GHSA and OSV reference type support
...
Add support for GHSA (GitHub Security Advisories) and OSV (Open Source
Vulnerabilities) as structured reference types in Metasploit modules.
Convert 49 hardcoded GHSA URLs to structured ['GHSA', 'GHSA-xxxx'] format
across existing modules, and add support for repository-specific GHSA
references with an optional third parameter ['GHSA', 'GHSA-xxxx', 'repo'].
Update reference validation, module validator, and info_fixups to handle
the new reference types correctly.
2026-02-09 15:17:23 +01:00
296cb5ff22
Fix BeyondTrust exploit failing on older instances (22.x)
...
The /get_mech_list?version=3 endpoint returns HTTP 500 on older
BeyondTrust versions that do not support the JSON API. Add a
fallback to version=2 which returns semicolon-separated key=value
pairs (e.g. "company=sewtest;product=ingredi").
Also remove the "Thank you for using BeyondTrust" check in the
BRDF validation, as PRA instances do not contain this string,
causing the check method to incorrectly report Unknown for PRA
targets.
2026-02-08 22:57:47 +01:00
51d2a18ade
remove the extra + operator. add a comment as to why we ljust the value.
2026-02-06 14:52:00 +00:00
95da6bd70d
use Rex::Stopwatch.elapsed_time to time this operation
2026-02-05 16:17:33 +00:00
22e5981a95
add back tick to BadChars
2026-02-05 16:16:57 +00:00
85604307fa
Update ranking
2026-02-05 06:47:31 -08:00
f632cf34bf
add in a module and docs fo rteh EPMM exploit
2026-02-05 12:26:38 +00:00
bd049dcba4
doc update
2026-02-03 18:41:51 -08:00
a868bc95b2
GNU Inetutils Telnet Auth Bypass
2026-02-03 17:45:59 -08:00
75ff7b6af1
emacs extension persistence
2026-01-31 22:54:18 -05:00
2f2fea7f6b
add CVE reference to Continuum exploit
2026-01-26 12:36:12 +01:00
c47a74d0dd
Merge pull request #20770 from vognik/Splunk_2022-43571_CVE-2024-36985
...
Add Splunk RCE Exploits (CVE-2022-43571 & CVE-2024-36985)
2026-01-20 12:36:51 -08:00
9e320dd168
add suggestions from @jheysel-r7
2026-01-19 18:45:01 -08:00
7b092aeedb
Land #20806 , adds module for unauthenticated command injection in Control Web Panel API (CVE-2025-67888)
...
Adds module for Control Web Panel API Command Injection (CVE-2025-67888)
2026-01-14 15:44:25 +01:00
2809ff8235
Fix archs
2026-01-13 14:24:04 +01:00
4678d82c6d
fix: architecture specification
2026-01-12 17:03:08 +01:00
19f5970c61
add udev mitre ref
2026-01-09 16:22:24 -05:00
52ad17690f
add arch to windows modules and triggered execution attck to most persistence
2026-01-09 16:21:07 -05:00
472016b753
Land #20796 , moves udev module into persistence category
...
update udev to persistence mixin
2026-01-09 16:14:08 +01:00
ae4a5ac986
Merge pull request #20786 from zeroSteiner/feat/lib/mod-merge-target-info
...
Merge target info into the module info
2026-01-08 18:01:14 -08:00
8bd24f4ecf
Fix:n- Use Rex::Stopwatch for time-based checkn- Change CheckCode::Appears to CheckCode::Vulnerable - Add cmd/base64 encoder in Payload hash for Unix Command target - Simplify execute_command by removing manual base64 encoding
2026-01-08 12:38:20 -05:00
c859f18557
fix: - Hardcode endpoint path in send_request_cgi - Use idiomatic Ruby single-line conditional - Remove unnecessary return keyword
2026-01-08 15:34:11 +01:00
2030d19438
Update modules/exploits/linux/http/prison_management_rce.rb
...
Co-authored-by: msutovsky-r7 <martin_sutovsky@rapid7.com >
2026-01-07 14:45:03 +02:00
2ef1b9fbae
Update modules/exploits/linux/http/prison_management_rce.rb
...
Co-authored-by: msutovsky-r7 <martin_sutovsky@rapid7.com >
2026-01-07 14:44:51 +02:00
a676b05928
Update modules/exploits/linux/http/prison_management_rce.rb
...
Co-authored-by: msutovsky-r7 <martin_sutovsky@rapid7.com >
2026-01-06 12:35:32 +02:00
236d94ee54
Update modules/exploits/linux/http/prison_management_rce.rb
...
Co-authored-by: msutovsky-r7 <martin_sutovsky@rapid7.com >
2026-01-06 12:35:17 +02:00
b35d74b305
Update modules/exploits/linux/http/prison_management_rce.rb
...
Co-authored-by: msutovsky-r7 <martin_sutovsky@rapid7.com >
2026-01-06 12:35:01 +02:00
982f5e0e28
control_web_panel_api_cmd_exec.rb aktualisieren
...
Co-authored-by: Julien Voisin <jvoisin@users.noreply.github.com >
2025-12-26 16:04:42 +01:00
0bfb77d74f
control_web_panel_api_cmd_exec.rb aktualisieren
...
Co-authored-by: Julien Voisin <jvoisin@users.noreply.github.com >
2025-12-26 16:04:12 +01:00
2448429502
Add Prison Management System 1.0 auth RCE (CVE-2024-48594)
2025-12-26 08:08:49 +02:00
5329e1472e
fix: PR and Lint
2025-12-24 06:39:13 -05:00
455275d087
add module for CVE-2025-67888
2025-12-23 19:21:34 -05:00
3ea866c41d
udev persistence
2025-12-21 07:50:48 -05:00
0c947d05ab
add in the AKB analysis
2025-12-19 15:38:43 +00:00
5c6c8a3956
better check result given we have the version string
2025-12-19 15:38:27 +00:00
a4dba96712
add in the HPE OneView exploit
2025-12-19 15:30:53 +00:00
cd8f1593e4
fix version check
2025-12-18 09:12:36 -08:00
8fdb4ab43a
add delay to sudobash drop file
2025-12-18 08:49:24 -08:00
602adeb4c5
Mass rubocop changes
2025-12-18 10:08:31 -05:00
d4b196b309
Update exploits to note target authors
...
Target authors were selected based on comments that indicated that the
author was only responsible for a set of descrete targets. Authors that
were noted as assisting with target testing, check module development,
etc. were left at the module level.
2025-12-17 17:30:16 -05:00
8945267db6
Remove redundant Platform and Arch definitions
2025-12-17 16:12:31 -05:00
Brendan