d7fa23f30f
Apply suggestions from code review
...
Co-authored-by: bcoles <bcoles@gmail.com >
Co-authored-by: Julien Voisin <jvoisin@users.noreply.github.com >
2024-09-17 19:00:48 +02:00
86c8879270
Added documentation
2024-09-16 19:54:59 +00:00
5e2bf5aaca
fix(modules): spip_bigup_unauth_rce minor fix
2024-09-11 11:46:52 -04:00
62e852176d
Land #19444 , SPIP BigUp Plugin Unauthenticated RCE
2024-09-11 10:29:12 -04:00
c75ffb4d43
Update documentation
2024-09-08 07:19:35 +02:00
43fabb07e5
Update doc + module + (mixin see #19444 )
2024-09-08 06:56:13 +02:00
f8675026ec
Update documentation again
2024-09-08 06:32:05 +02:00
289f47fac1
Update documentation with docker setup, working mixin now, update module
2024-09-08 05:59:11 +02:00
48f8e248a6
Update documentation/modules/exploit/multi/http/spip_bigup_unauth_rce.md
...
Co-authored-by: Julien Voisin <jvoisin@users.noreply.github.com >
2024-09-07 01:49:57 +02:00
8608e7021d
Add spip_bigup_unauth_rce module
2024-09-06 22:10:18 +02:00
7458a2dba3
Remove useless documentation
2024-09-03 20:29:45 +02:00
36621c05d9
del documentation/modules/exploit/unix/webapp/spip_rce_form.md
2024-08-30 22:22:41 +02:00
586cf482ce
Refactoring SPIP Modules for Windows Compatibility and Incorporating SPIP Mixin
2024-08-30 20:37:32 +02:00
84ffa524e5
Land #19424 , WordPress GiveWP Plugin RCE
2024-08-28 21:09:42 +01:00
71ee987079
Add additional documentation steps, and use 0 for the payload http timeout
2024-08-28 19:21:27 +01:00
fabb5d1f78
Land #19422 , pgAdmin 8.4 RCE / CVE-2024-3116
2024-08-28 18:54:53 +01:00
aaf95f9134
Apply suggestions from code review
2024-08-28 18:46:08 +01:00
2900d45e9f
Update documentation/modules/exploit/multi/http/wp_givewp_rce.md
...
Co-authored-by: Julien Voisin <jvoisin@users.noreply.github.com >
2024-08-28 13:00:32 +02:00
06a9583cfd
Fix typo
2024-08-27 22:16:11 +02:00
1d7cffbdac
Refactored exploit module based on RCESecurity's analysis of CVE-2024-5932
...
- Completely overhauled the method for exploiting the GiveWP plugin by removing dependency on the REST API, which may require authentication.
- Instead, we now use the admin-ajax.php endpoint for retrieving form lists and nonce values, ensuring compatibility even when REST API authentication is required.
- The exploit now works with all form types; however, the give_price_id and give_amount must be set to '0' and '0.00', respectively, as attempts to randomize these values caused the exploit to fail.
2024-08-27 22:15:12 +02:00
8bf354cad2
Land #19417 , Improve wp_backup_migration_php exploit
...
The new PHP filter chain evaluates a POST parameter, which simplifies
the process and reduces the payload size enabling the module to send the
entire paylaod in one POST request instead of writing the payload to a
file character by character over many POST requests. Support for both
Windows and Linux Meterpreter payloads, not just PHP Meterpreter, has
also been added.
2024-08-27 15:17:00 -04:00
d249711480
Update doc
2024-08-27 20:27:46 +02:00
61fa0c40b8
Update documentation/modules/exploit/multi/http/wp_backup_migration_php_filter.md
2024-08-27 14:14:28 -04:00
bc7840ea7f
Add wp_givewp_rce exploit module
2024-08-27 19:50:35 +02:00
6c24e0a952
Land #19393 , Update OFBiz ProgramExport RCE for Patch Bypass
...
Merge branch 'land-19393' into upstream-master
2024-08-27 11:48:38 -05:00
7e9f52dd0b
Github release
2024-08-26 23:02:53 +02:00
b3605bd951
Documentation
2024-08-26 19:59:17 +02:00
c32c1e3a66
Update doc
2024-08-24 17:31:09 +02:00
4ee30b24cb
Rewrite wp_backup_migration_php_filter
2024-08-24 17:16:58 +02:00
ec5892ff1f
Land #19363 , Ray Modules CVE-2023-6019 CVE-2023-6020 CVE-2023-48022
2024-08-23 04:55:17 -04:00
35da4662ed
Land #19351 , DIAEnergie SQL Injection
2024-08-21 09:44:15 -04:00
f3a220518a
Land #19394 , SPIP Unauthenticated RCE Exploit
2024-08-21 13:58:26 +01:00
62ab17b14d
Update documentation and Docker Compose for SPIP, remove Rex.sleep() in Metasploit module due to stable payload.
2024-08-20 19:41:05 +02:00
52852cea72
Add cve ref
2024-08-20 12:59:52 +09:00
c7d20853d6
Update documentation
2024-08-19 19:51:36 +02:00
3d90eb0f43
Add spip_porte_plume_previsu_rce
2024-08-16 10:50:23 +02:00
209f172aa1
Update document
2024-08-16 08:56:01 +09:00
7258ca4fb1
Remove unnecessary option for simplicity
2024-08-16 08:49:34 +09:00
ea10360c81
Update OFBiz ProgramExport RCE for Patch Bypass
2024-08-15 09:18:15 -07:00
ea1b9e925e
Delete old three exploits in one module
2024-08-15 08:17:36 +09:00
dbc51d1cd4
Land #19347 , OpenMetadata authentication bypass and SpEL injection exploit chain[CVE-2024-28255 and CVE-2024-28254]
2024-08-14 16:06:10 +01:00
f211fcb6a6
Land #19370 , LG Simple Editor Command Injection
2024-08-14 10:22:29 -04:00
36322ff274
Land #19348 , Apache HugeGraph Gremlin RCE (CVE-2024-27348)
2024-08-14 10:06:21 +01:00
0ffe335660
Add module docs
2024-08-10 10:59:00 +09:00
064d463c37
Formatting doc
2024-08-08 07:45:16 +09:00
35354c8407
Update document
2024-08-07 21:20:09 +09:00
a92b51904a
Update document
2024-08-07 21:16:32 +09:00
8732d7cd58
LG Simple Editor Command Injection (CVE-2023-40504) Module
...
Exploit Module and Documentation for the LG Simple Editor Command Injection (CVE-2023-40504)
2024-08-07 05:16:25 +01:00
b7e4247d22
Avoid using CVE as option
2024-08-07 08:43:57 +09:00
b487dadf8c
Remove explicit return
2024-08-05 13:01:11 +09:00
H00die.Gr3y