1349a7c486
More redundant cleanup calls
2022-03-11 12:22:27 +11:00
d5373a7278
Removed redundant cleanup calls which exploit_driver will call anyway
2022-03-11 12:08:51 +11:00
9761d68c19
Rename stop_service to cleanup_service for services that use reference counting
2022-03-10 10:28:25 +11:00
42e0c027ab
Land #16248 , Added Apache APISIX RCE module
2022-03-07 09:47:04 -05:00
422f96fbbe
Fix a plugin name reference
...
The plugin is actually "batch-requests", change the reference to be more
clear.
2022-03-07 09:46:15 -05:00
d7c992f402
Need to use POST to check whether the batch request is enabled or not
2022-03-04 21:00:32 +01:00
9ef50a2d23
Fixup typos
2022-03-04 12:34:14 -05:00
ca4ed9affe
Added logic to treat the two ways of execute command
...
If we have the API token we can execute command using the parameter
`filter_func` or `script`, and if there is an IP restriction
enabled by the plugin ip-restriction we can bypass this restiction if
the plugin batch-request is also enabled.
2022-03-04 02:13:09 +01:00
460584b079
Improved server header validation
2022-03-03 12:48:37 +01:00
a0afba45aa
Remove unnecessary stuffs
2022-03-03 02:00:51 +01:00
0d8933d162
Removed else statements from check in favor of implicit return
2022-03-02 22:42:08 +01:00
41236232e2
WIP - add clean up function
2022-03-02 17:47:58 +01:00
7aa9547e05
WIP - improvements on the request body
2022-03-02 01:43:04 +01:00
abd03d592e
WIP - adding bypass the IP restriction (CVE-2022-24112)
2022-03-01 19:00:59 +01:00
ea2b29661f
Fix typo
2022-03-01 17:13:20 +01:00
ad7bd6d623
Added Apache APISIX default API Token RCE module
...
Added module that laverage the default admin API token for Apache APISIX
to add malicious route which leads to the remote LUA code execution
through the script parameter added in the 2.x version.
2022-02-28 18:09:18 +01:00
d5ba1afbec
fix URLs not resolving
...
fix URLs not resolving
add csv export to references
fix URLs not resolving
pdf not pd
missed a url change
remove extra recirectedfrom fields
remove extra file
fix ovftool url accidental replacement
2022-02-16 17:22:40 -06:00
0239ef1cc6
Land #16117 , Updates for Log4Shell
2022-02-15 16:39:00 -06:00
e2c91ebf30
Land #16010 , zabbix_script_exec improvements
...
This updates the zabbix_script_exec module to work with versions 5.0 and
newer as well as adds a new item-based execution technique.
2022-02-04 15:13:13 -05:00
ae278d0568
Cleanup some minor typos
2022-02-04 15:12:57 -05:00
8838d9cb66
Added timeout system, fixed a bug with TLS_PSK, linted
2022-02-04 04:01:23 -08:00
965493191f
Add and use a Log4Shell mixin
2022-02-03 16:09:49 -05:00
645ef5e71f
Fixed few bugs
2022-02-02 14:30:02 -08:00
7bf08a28ea
Modified default stager
2022-02-02 12:34:07 -08:00
de32cc0e97
Linted with Rubocop, factorized API call, fixed some grammmar
2022-02-01 13:29:30 -08:00
d46822184f
Updates for Log4Shell
2022-01-28 14:56:44 -05:00
458d584f83
Add details to check codes and PR feedback
2022-01-21 09:40:23 -05:00
579627f5c7
Update docs, note OS X support
2022-01-20 10:47:11 -05:00
ba469a4b2c
Add version detection to the Unifi exploit
2022-01-20 09:26:48 -05:00
3d80a46e67
Check the HTTP response from the trigger
2022-01-19 17:51:31 -05:00
ef344d9d12
Add the Unifi Log4Shell RCE exploit
2022-01-19 17:51:31 -05:00
4cf3ae352c
Land #16050 , Log4Shell: vCenter RCE
...
Merge branch 'land-16050' into upstream-master
2022-01-19 16:30:33 -06:00
96a5d656bd
Final cleanups and reference updates
2022-01-14 08:41:37 -05:00
3f04b80d8b
Add vCenter Log4Shell docs
2022-01-13 14:50:28 -05:00
053fbe2a28
fix cisco advisory links
2022-01-13 18:55:39 +00:00
d5c83b41f9
Cleanup the vCenter Log4Shell exploit
2022-01-13 11:57:00 -05:00
7b1398f0ae
Allow overriding check module datastore options
2022-01-13 11:51:39 -05:00
62a814fa59
Refactor Log4shell exploit code into reusable bits
2022-01-13 09:45:02 -05:00
e093154865
Refactor the BeanFactory gadget code
2022-01-12 16:58:31 -05:00
e873907d13
Initial vCenter exploit via Log4Shell
2022-01-12 15:34:45 -05:00
877bab6f2a
Land #15969 , Log4j2 HTTP Header Injection Exploit
2022-01-11 16:52:08 -05:00
7b64383040
Preemptively tweak references to ysoserial
2022-01-11 16:25:21 -05:00
cb616b94c7
Removed some useless parameter + fixed a few bugs
2022-01-09 13:08:25 -08:00
6a7c81e1ba
Update authors
2022-01-08 21:56:15 -05:00
53c2400be9
Added cleaning procedure + fixed few mistakes/error mesage, removed unused docs
2022-01-08 10:56:31 -08:00
ccc90b0330
Linted doc+module, added support for 6.x version, aded support for TLS and item RCE, improved payload management
2022-01-07 17:40:15 -08:00
3f15c9ecc1
Writeup the module docs
2022-01-07 17:30:39 -05:00
9b03d0272a
Add check and auto-HTTP_HEADER capabilities
2022-01-07 17:30:39 -05:00
6198d9653d
Remove the REMOTE_LOAD datastore option
...
The necessary value can be inferred by the target and it's payload
compatibility so just set it intelligently.
2022-01-07 17:30:39 -05:00
f56f328c8d
Use an enum for the YSoSerial payload option
2022-01-07 17:30:39 -05:00
Ashley Donaldson