f2262a84cc
Land #20841 , adds persistence module for Windows feature active setup
...
active setup persistence
2026-02-20 10:46:45 +01:00
993017d045
Rubocopes
2026-02-20 09:51:10 +01:00
855b436235
Update modules/exploits/windows/persistence/registry_active_setup.rb
...
Co-authored-by: msutovsky-r7 <martin_sutovsky@rapid7.com >
2026-02-19 15:46:33 -05:00
8af82dc7eb
Merge pull request #20844 from 6a6f656c/userinit
...
Windows Userinit persistence
2026-02-18 06:05:04 -05:00
1c6fb0d11d
fix compatibility with session.sys
2026-02-17 16:37:05 -05:00
c24c58709d
Apply suggestion from @dledda-r7
2026-02-17 14:09:02 +01:00
236fb33b6b
Apply suggestion from @dledda-r7
...
Co-authored-by: Diego Ledda <diego_ledda@rapid7.com >
2026-02-17 07:17:42 -05:00
ab30bd15f0
Apply suggestion from @dledda-r7
...
Co-authored-by: Diego Ledda <diego_ledda@rapid7.com >
2026-02-17 07:17:17 -05:00
65d37019ad
Fix false positives on lg simple editor check methods
2026-02-16 10:51:28 +00:00
7776588577
Address PR #20768 review feedback
...
- gladinet.rb: Fix machineKey regex to match decryptionKey then validationKey explicitly
- gladinet.rb: Remove DEFAULT_WEB_CONFIG_PATH constant, inline in each module's datastore option
- gladinet_storage_access_ticket_forge.rb: Inline version check
- gladinet_storage_access_ticket_forge.rb: Inline FILEPATH default value (with C:\ for absolute path)
- gladinet_storage_lfi_cve_2025_11371.rb: Inline version check
- gladinet_storage_lfi_cve_2025_11371.rb: Inline valid_response? method (removed)
- gladinet_storage_lfi_cve_2025_11371.rb: Inline FILEPATH default value (without C:\, stripped by build_lfi_path)
- gladinet_storage_lfi_cve_2025_11371.rb: Use vars_get with encode_params instead of manual URL building
- gladinet_viewstate_deserialization: Remove nil fallback (mandatory option with default)
- gladinet_viewstate_deserialization: Remove DEFAULT_MACHINE_KEY constant, inline in datastore option
- gladinet_viewstate_deserialization: Remove duplicate detect_app_type/extract_build_version (already in shared lib)
Note: Suggestion to rename gladinet? to is_gladinet? was NOT applied.
msftidy enforces Naming/PredicatePrefix convention which requires predicate
methods to NOT have 'is_' prefix (gladinet? is correct, is_gladinet? is not).
Co-authored-by: msutovsky-r7 <martin_sutovsky@rapid7.com >
2026-02-04 08:38:35 +01:00
628c5ee7af
Update Gladinet modules: fix AutoCheck in auxiliary modules and update documentation with real outputs
2026-02-04 08:38:32 +01:00
478345506e
Add Gladinet CentreStack/Triofox auxiliary modules and exploit
2026-02-04 08:38:31 +01:00
e55d22a7cd
Merge pull request #20739 from cdelafuente-r7/add_mitre_tech_kerb_unconst_deleg
...
Add MITRE ATT&CK techniques to Kerberos and unconstrained delegation modules
2026-02-03 16:11:37 -05:00
0c0e290cc2
Code review 2
2026-02-03 21:53:05 +01:00
b85b2d4528
Add comments and remove T1077_WINDOWS_ADMIN_SHARES (deprecated)
2026-02-02 12:03:17 +01:00
f4a195b88a
persistence modules cleanup
2026-01-14 13:49:29 -05:00
e4f8d4fb13
Merge pull request #20706 from h00die/windows_wmi_persistence
...
Update windows wmi to persistence mixin
2026-01-14 09:37:20 -05:00
6731992ddd
fix ci pipeline
2026-01-14 08:26:11 -05:00
1d9ecc89c6
add attck ref
2026-01-11 07:47:03 -05:00
6491f74d9d
wmi persistence improvements
2026-01-11 07:25:13 -05:00
aa5fd40a19
add arch to windows modules and triggered execution attck to most persistence
2026-01-09 16:21:08 -05:00
52ad17690f
add arch to windows modules and triggered execution attck to most persistence
2026-01-09 16:21:07 -05:00
ae4a5ac986
Merge pull request #20786 from zeroSteiner/feat/lib/mod-merge-target-info
...
Merge target info into the module info
2026-01-08 18:01:14 -08:00
bb98e855e1
Merge pull request #20751 from h00die/sticky_keys
...
update windows sticky keys to persistence mixin
2026-01-08 16:44:04 -08:00
428f31fdd3
review for wmi persistence
2026-01-06 16:36:05 -05:00
2f4db3bd5f
review for wmi persistence
2026-01-05 17:06:17 -05:00
d7d7a318ed
Add docs and tidy to userinit persistence
2026-01-03 16:27:54 -05:00
d2c192e9bf
windows persistence userinit v6
2026-01-03 15:37:44 -05:00
cb7dd50731
windows persistence userinit v5
2026-01-03 15:21:20 -05:00
f6fdbc4fbd
windows persistence userinit v4
2026-01-03 14:43:50 -05:00
beff06b9a4
windows persistence userinit v3
2026-01-03 11:09:14 -05:00
c485d9a822
active setup persistence
2026-01-03 10:39:45 -05:00
4a3a26e9d9
windows persistence userinit v2
2026-01-02 09:33:21 -05:00
9d120c1eeb
windows persistence userinit
2026-01-02 07:21:05 -05:00
2b85112a36
fix panda local privesc refs
2025-12-27 09:09:19 -05:00
5ac586a788
Update modules/exploits/windows/persistence/assistive_technology.rb
...
Co-authored-by: Brendan <bwatters@rapid7.com >
2025-12-19 14:52:34 -05:00
d15d4ca5dc
.exe guard clause for assistive_tech persistence
2025-12-18 16:17:50 -05:00
76b7c82092
Fix a CI failure
2025-12-18 10:33:35 -05:00
602adeb4c5
Mass rubocop changes
2025-12-18 10:08:31 -05:00
d4b196b309
Update exploits to note target authors
...
Target authors were selected based on comments that indicated that the
author was only responsible for a set of descrete targets. Authors that
were noted as assisting with target testing, check module development,
etc. were left at the module level.
2025-12-17 17:30:16 -05:00
8945267db6
Remove redundant Platform and Arch definitions
2025-12-17 16:12:31 -05:00
f18bdb12b2
remove writabledir from wmi persistence
2025-12-08 15:41:16 -05:00
54d47e72ab
sticky keys description update
2025-12-07 07:40:54 -05:00
bd48eda8b2
rename sticky keys module
2025-12-07 07:38:41 -05:00
a2f266068b
assistive technology persistence
2025-12-06 13:05:32 -05:00
54718c7a12
sticky keys as persistence
2025-12-05 07:07:30 -05:00
98dd33a3cd
Remove CAIN
2025-12-03 15:42:57 -05:00
d3ae3e5556
wmi persistence docs
2025-11-30 10:51:45 -05:00
a392283b1e
Add techniques related to unconstrained delegation modules
2025-11-28 19:17:03 +01:00
45250497d5
wmi uptime persistence
2025-11-22 09:13:01 -05:00
msutovsky-r7