9283562ee5
Land #20493 , adds XWiki unauthenticated exploit module (CVE-2025-24893)
...
Add XWiki Unauthenticated RCE (CVE-2025-24893)
2025-09-01 13:37:31 +02:00
5d59fbd333
Land #19903 , adds module for periodic script persistence
...
Add OSX Periodic Script Peristence
2025-08-29 20:12:12 +02:00
2681e7cfed
Update docs
2025-08-29 17:53:07 +02:00
57f14339d9
Adds x64 to BSD target
2025-08-29 14:47:11 +02:00
071a4a34fc
fix tests
2025-08-29 08:41:43 +04:00
9b1d07dea8
removed unnecessary fail_with from check function
...
Co-authored-by: msutovsky-r7 <martin_sutovsky@rapid7.com >
2025-08-29 06:55:59 +03:00
ae64436441
Fixes payload delivery, updates targets
2025-08-28 15:47:24 +02:00
bdad398541
Update Payload Generation
2025-08-25 15:49:30 +03:00
92ddf5646a
Code Review Edits from @msutovsky-r7
2025-08-24 19:13:16 +04:00
7289c25faa
Fix Tests
2025-08-24 12:12:22 +04:00
2b01ba6200
Add XWiki Unauthenticated RCE (CVE-2025-24893)
2025-08-23 18:56:24 +04:00
baa5469a21
Fix legacy method override in torchserver_cve_2023_43654
...
I think `Msf::Exploit::Remote::Java::HTTP::ClassLoader` module had `on_request_uri` method, that was later renamed to `java_class_loader_on_request_uri`.
2025-08-22 17:01:41 +03:00
88d7a1ab04
fix coonflicts and rubocop
2025-08-19 12:37:53 -04:00
df917720eb
Remove payload file
2025-08-19 12:33:56 -04:00
a7ab23d083
Add Malicious XDG Desktop File module
2025-08-04 19:23:02 +10:00
a0d03c0638
Update modules/exploits/multi/local/periodic_script_persistence.rb
...
Co-authored-by: msutovsky-r7 <martin_sutovsky@rapid7.com >
2025-07-29 13:20:20 -04:00
a413e78689
Update modules/exploits/multi/local/periodic_script_persistence.rb
...
Co-authored-by: msutovsky-r7 <martin_sutovsky@rapid7.com >
2025-07-29 13:19:28 -04:00
d87787df69
Update modules/exploits/multi/local/periodic_script_persistence.rb
...
Co-authored-by: msutovsky-r7 <martin_sutovsky@rapid7.com >
2025-07-29 13:18:48 -04:00
0f7aafa48e
Add session platform, apply Rubocop changes
2025-07-10 14:09:44 -04:00
0f0ca54e6c
Remove get_python method
2025-07-10 11:57:06 -04:00
2351a6a9bc
Minor changes to options, add documentation
2025-07-08 13:30:22 -04:00
8a8e3a3047
Rubocop changes
2025-07-08 13:01:09 -04:00
c9d41be766
Add authors, print cleanup, rename vars
2025-07-08 13:00:15 -04:00
d694c27119
Update modules/exploits/multi/local/periodic_script_persistence.rb
...
Co-authored-by: msutovsky-r7 <martin_sutovsky@rapid7.com >
2025-07-08 10:54:08 -04:00
d2c7ac8d51
Update modules/exploits/multi/local/periodic_script_persistence.rb
...
Co-authored-by: msutovsky-r7 <martin_sutovsky@rapid7.com >
2025-07-08 10:53:47 -04:00
52acc15a51
Update modules/exploits/multi/local/periodic_script_persistence.rb
...
Co-authored-by: msutovsky-r7 <martin_sutovsky@rapid7.com >
2025-07-08 10:53:28 -04:00
b3e16e9c47
Update modules/exploits/multi/local/periodic_script_persistence.rb
...
Co-authored-by: msutovsky-r7 <martin_sutovsky@rapid7.com >
2025-07-08 10:52:58 -04:00
7629dd7518
DRY code, grab wingftp version in check method
2025-07-05 22:25:45 +02:00
6edbfb32ec
Update modules/exploits/multi/http/wingftp_null_byte_rce.rb
...
Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com >
2025-07-03 19:42:01 +02:00
d79810a7e3
Update modules/exploits/multi/http/wingftp_null_byte_rce.rb
...
Co-authored-by: msutovsky-r7 <martin_sutovsky@rapid7.com >
2025-07-03 13:54:11 +02:00
d625ab5fbc
Update modules/exploits/multi/http/wingftp_null_byte_rce.rb
...
Co-authored-by: msutovsky-r7 <martin_sutovsky@rapid7.com >
2025-07-03 13:54:01 +02:00
32f7754774
Update modules/exploits/multi/http/wingftp_null_byte_rce.rb
...
Co-authored-by: Julien Voisin <jvoisin@users.noreply.github.com >
2025-07-02 14:42:34 +02:00
5b268bd4b4
Fix documentation and typos
2025-07-01 22:50:01 +02:00
e465720a3c
Rubocop changes
2025-07-01 14:36:20 -04:00
a66d60bf76
Move module to multi, add get_python method
2025-07-01 14:34:51 -04:00
f7a649c121
Remove php mixin and arch
2025-07-01 19:43:21 +02:00
5d9eb58848
Remove useless mixin
2025-07-01 19:39:26 +02:00
1a4a15e83b
Add WingFTP unauthenticated RCE (CVE-2025-47812)
2025-07-01 19:15:15 +02:00
126bff18a1
Land #20346 , fixes payload encoding and substitutes for smaller base64 encoder
...
Use the smaller base64 encoder
2025-06-27 17:15:05 +02:00
a0bb2d8c89
Merge pull request #20298 from bcoles/modules-SSL
...
Modules: Convert SSL default option to Boolean in several modules
2025-06-26 15:00:59 +01:00
00c88caffb
Updates incorrect arch values in modules
2025-06-25 16:57:27 +01:00
04a18fb3ca
Updates modules to remove non-printable chars
2025-06-25 14:19:56 +01:00
6d843385ec
Merge pull request #20301 from msutovsky-r7/exploit/cve-2021-25094
...
Adds module for Tatsu WP plugin (CVE-2021-25094)
2025-06-25 10:58:22 +02:00
40ca2b3b1b
Adds sentinel notes to modules that are missing stability, reliability or side effects
2025-06-25 09:32:01 +01:00
6334996e60
Use the smaller base64 encoder
2025-06-24 15:58:17 -04:00
a454217bd4
Update info -d markdown
2025-06-24 11:21:49 +01:00
37388ca1be
Adds sentinel values to modules missing notes
2025-06-23 12:24:58 +01:00
b483312eca
Modules: Convert SSL default option to Boolean in several modules
2025-06-23 19:38:36 +10:00
ade9b54d94
Runs Style/TrailingCommaInArguments Rubocop against modules
2025-06-23 09:30:35 +01:00
a4b14d8b64
Runs Rubocop to fix layout in modules
2025-06-20 15:18:01 +01:00
msutovsky-r7