f41eda1128
Add GHSA and OSV reference type support
...
Add support for GHSA (GitHub Security Advisories) and OSV (Open Source
Vulnerabilities) as structured reference types in Metasploit modules.
Convert 49 hardcoded GHSA URLs to structured ['GHSA', 'GHSA-xxxx'] format
across existing modules, and add support for repository-specific GHSA
references with an optional third parameter ['GHSA', 'GHSA-xxxx', 'repo'].
Update reference validation, module validator, and info_fixups to handle
the new reference types correctly.
2026-02-09 15:17:23 +01:00
8945267db6
Remove redundant Platform and Arch definitions
2025-12-17 16:12:31 -05:00
fd21209e4d
Add missing CVEs from VulnCheck
2025-10-07 13:59:13 -04:00
a454217bd4
Update info -d markdown
2025-06-24 11:21:49 +01:00
37388ca1be
Adds sentinel values to modules missing notes
2025-06-23 12:24:58 +01:00
a4b14d8b64
Runs Rubocop to fix layout in modules
2025-06-20 15:18:01 +01:00
943c94774a
Modules: Resolve Rubocop Lint/Syntax violations
2025-05-21 18:27:24 +10:00
08e227faca
Merge pull request #19934 from sfewer-r7/bugfix-cisco-iosxe-rce
...
Improve exploit/linux/misc/cisco_ios_xe_rce (CVE-2023-20198 + CVE-2023-20273)
2025-03-27 16:51:16 -07:00
4c5137846c
call fail_with upon failure rather than passing around Failure's as variables.
2025-03-13 09:41:58 +00:00
2f5758b8ed
improve the logic here
2025-03-04 09:22:11 +00:00
efb0d5da4c
fix typo, C1000v should be CSR1000v. Be consistant with IOS XE and not IOS-XE.
2025-03-04 09:09:32 +00:00
94606036bd
typos in comments
2025-03-03 20:45:37 +00:00
9c075c7cce
Previously the check routine only leveraged the first vuln in the chain, CVE-2023-20198, to perform a version based check. However the second vuln in the chain, CVE-2023-20273, was not verified as to working, so a return code of CheckCode::Vulnerable may no have been acurate if the target was vulnerable to CVE-2023-20198 but not CVE-2023-20273. Now we leverage both CVE-2023-20198 and CVE-2023-20273 to ensure the target is actually vulnerable. For example, it has been observed that the C8000v series appliance version 17.6.5 is vulnerable to CVE-2023-20198, but not vulnerable to CVE-2023-20273, even though the IOS-XE version indicates they should be vulnerable to CVE-2023-20273. As this exploit chains both CVE-2023-20198 and CVE-2023-20273 together, the check routine must verify both CVEs work as expected in order to return CheckCode::Vulnerable (i.e. we cannot solely rely on a version based check via CVE-2023-20198).
2025-03-03 20:29:20 +00:00
4a38605576
bugfix the check routine, to get a suitable response from a targets webui path, we must have the trailing slash (seen in a C8000v target, verified to work in both C8000v and C1000v targets)
2025-03-03 20:25:31 +00:00
e71a851e3f
mention that the C8000v series appliance version 17.6.5 was observed to not be vulnerable to CVE-2023-20273. Inspecting the Lua code shows this appliance has additional command injection filtering in place (see pexec_setsid in /usr/binos/openresty/nginx/conf/pexec.lua) which prevents the injection from working
2025-03-03 20:22:46 +00:00
0017fbdf56
Updates more dead links
2025-02-28 10:30:14 +00:00
2d1af7d809
Land #19648 Add exploit module for FortiManager (CVE-2024-47575)
2024-12-02 18:31:25 -08:00
5a837d1ef6
fix a typo
2024-12-02 18:16:43 -08:00
d13bccca05
peer review
2024-11-28 20:24:25 -05:00
68e9b39ffa
register teh Rex socket we create via add_socket. This lets teh frameowkr close the socket after we get a session, and will wait up to WfsDelay for that to happen. This lets us remove the other timeout we had, and teh user can always adjust WfsDelay if needed. (Thanks Spencer)
2024-11-22 12:42:08 +00:00
e5cdf6097d
favor File.binread over File.read
2024-11-22 12:40:19 +00:00
f59bfe98a3
remove the default payload and the default fetch command, and let the framework choose them for us.
2024-11-22 12:39:34 +00:00
2ba112a5a4
We can use OptPath here instead of OptString. Also are these are optional, and we dont specify a default, we can omit the nil default value.
2024-11-22 12:38:46 +00:00
000ffb2406
make the check routine return a message for Detected.
2024-11-22 12:37:50 +00:00
4856817131
fix a typo
2024-11-18 09:44:53 +00:00
feb1ac79da
add in a suitable certificate and private key to use by default.
2024-11-15 17:41:31 +00:00
e520ca7ee9
comment the intent of this code block
2024-11-15 12:29:31 +00:00
2ec5778405
get_cert_subject_item may return nil, so test for that here
2024-11-15 12:28:25 +00:00
51ad7ad0bf
improve the send_packet logic to fail gracefully if bad data is recieved
2024-11-15 12:27:33 +00:00
c3bd4792ec
rename SSLClientCert and SSLClientKey to ClientCert and ClientKey. This then matcheds up with ClientSerialNumber and ClientPlatform, which is clearer IMHO. Also, we explicitly create a Rex TCP socket, so these param names no longer collide with what a mixin would use
2024-11-15 09:44:50 +00:00
6eb15d5b66
add a helper method get_cert_subject_item
2024-11-15 09:42:59 +00:00
91587ce30b
this message can be on a single line
2024-11-15 09:42:06 +00:00
e89c27fa3b
fix some typos. Make msftidy happy. Add comments to the external references.
2024-11-15 08:54:32 +00:00
47f924bb8f
add in the initial work on the FortiManager exploit.
2024-11-14 18:53:12 +00:00
4ebc6f1ff1
peer review
2024-11-11 17:37:33 -05:00
594c3a82ea
peer review
2024-11-11 17:32:49 -05:00
0de93eedb7
asterisk ami auth rce
2024-11-04 16:27:58 -05:00
9cba5dad59
WIP for asterisk rce
2024-11-01 16:28:45 -04:00
62a3f73e70
Update rubocop target ruby version
2024-07-24 16:47:17 +01:00
8fc6e20cec
Update other modules to use java_class_loader_start_service and cmdstager_start_service
2024-06-14 12:57:42 +02:00
6b2bdc893b
chore: remove repetitive words
...
Signed-off-by: fanqiaojun <fanqiaojun@yeah.net >
2024-04-15 11:06:50 +08:00
2a56c3f28b
remove redundant \d in check regex
2023-11-07 09:21:04 +00:00
25ef7d1272
add the RCE exploit
2023-11-06 17:12:40 +00:00
8e8b8ad191
Update nimbus_gettopologyhistory_cmd_exec
2023-09-12 12:21:10 -04:00
ba84c0484c
Update the Nimbus module to use the Thrift client
2023-09-11 14:42:54 -04:00
27f5a789c9
rework the exploit to use the new MIPS64 fetch payload adapters. Removed the seperate command and dropper targets in favor of a single default target which can do both thanks to fetch payloads. Removed the redundant IO select() call which was bad copy pasta on my part.
2023-06-09 09:47:57 +01:00
0205bb36d3
change ranking to GreatRanking as stability is CRASH_SERVICE_RESTARTS
2023-05-22 20:09:11 +01:00
6b101b5a4d
make rubocop happy
2023-05-22 18:03:58 +01:00
ec5858c198
Added newly assigned CVE identifier
2023-04-27 09:54:48 -04:00
7dc1faa689
Better error handling, and fix version detection
2023-04-11 09:34:24 -07:00
Valentin Lobstein