b5f41636b1
Land #13488 , Fix memory leak in ms01_026_dbldecode
2020-05-28 10:23:10 +01:00
ad05cf7870
Update TinyIdentD 2.2 Stack Buffer Overflow module
2020-05-23 04:43:44 +00:00
d6aea635c7
Update authors in Netsweeper/myLittleAdmin modules
...
Edits for accuracy and precision.
2020-05-22 17:05:12 -05:00
afe7ef5d9a
Bump WfsDelay for first exploit attempt
2020-05-22 09:32:22 -05:00
e471efa399
Whitelist :certutil and :vbs CmdStagers
...
These worked for @smcintyre-r7 on Windows Server 2019.
2020-05-22 09:24:16 -05:00
16886fa41e
Move generate_viewstate_payload to mixin
2020-05-21 18:37:13 -05:00
d1a07e9403
Use ViewState mixin in module
2020-05-21 18:37:13 -05:00
11030dff84
Add CVE references (they weren't there before)
2020-05-21 18:12:57 -05:00
889a4cd6e0
Add Plesk/myLittleAdmin ViewState deserialization
2020-05-21 18:12:57 -05:00
12d4ad68e3
Fix things in ThinkPHP and ManageEngine exploits
...
Current pattern is print_good instead of vprint_good for this particular
message directly or indirectly called by execute_command.
CmdStagerFlavor is checked at the top level, but it is also checked per
target. Moving this to where it's more appropriate.
2020-05-20 22:47:03 -05:00
655088bb0d
Fix punctuation typo in exchange_ecp_viewstate
2020-05-20 09:47:11 -05:00
bfe47302cf
Fix memory leak in ms01_026_dbldecode
2020-05-20 00:48:26 +01:00
9c249e8c91
Landing #13456 , distinct_tftp_traversal: increase delay between upload requests
2020-05-15 11:14:58 +01:00
aa6624e7f8
Land #13436 , service encoder fix for psexec
2020-05-14 16:43:07 -05:00
ef069ce5ef
Prefer exploit.rb's rand_text_alpha
2020-05-14 16:41:54 -05:00
a5250072bf
distinct_tftp_traversal: increase delay between upload requests
2020-05-14 05:22:36 +00:00
fc762f8a82
Land #13402 , add service_exists? method
2020-05-12 13:37:54 -05:00
9b40554ec6
Land #13370 , Add Druva inSync inSyncCPHwnet64.exe RPC Type 5 Privilege Escalation
...
Merge branch 'land-13370' into upstream-master
2020-05-12 13:20:27 -05:00
b7d16b1e72
Fix regression in psexec mixing filename and encoder
...
Closes #13407
2020-05-12 00:02:52 +02:00
1a9c04c2c4
Use new method
2020-05-08 14:49:01 -05:00
b4e2599921
Remove trailing whitespace to fix build failures
2020-05-07 09:59:34 -04:00
9769e04b6e
Land #13322 , CVE-2020-0668 Service tracing file junction overwrite
2020-05-07 09:47:20 -04:00
26d4cb7a47
Tweak the service tracking checks and update docs markdown
2020-05-07 09:46:19 -04:00
a1275845ec
Land #13200 , CVE-2019-0808 LPE for Windows 7 x86 SP0 and SP1
2020-05-06 17:23:52 -05:00
a5fe498610
Update ARCH handling, suggested changes, and last-minute fixes
2020-05-06 15:36:53 -05:00
bf16307d7f
Add Druva inSync inSyncCPHwnet64.exe RPC Type 5 Privilege Escalation
2020-05-06 14:09:46 +00:00
5609a99758
Neaten up alignment and spacing on ntusermndragover.rb
2020-05-05 21:28:51 -05:00
30b17c6323
Remove some whitespace for msftidy compliance
2020-05-04 10:14:00 -04:00
7fb17ecf17
Update some module metadata for the Kentico RCE exploit
2020-05-04 10:12:21 -04:00
c128a3ba92
Add CmdStager and Powershell targets to the Kentico RCE exploit
2020-05-04 10:07:10 -04:00
60b83d536e
Update modules/exploits/windows/http/kentico_staging_syncserver.rb
...
Co-Authored-By: bcoles <bcoles@gmail.com >
2020-05-04 09:26:14 -04:00
c5adcbfd43
Update modules/exploits/windows/http/kentico_staging_syncserver.rb
...
Co-Authored-By: bcoles <bcoles@gmail.com >
2020-05-04 09:26:13 -04:00
0679f1b317
Update modules/exploits/windows/http/kentico_staging_syncserver.rb
...
Co-Authored-By: bcoles <bcoles@gmail.com >
2020-05-04 09:26:13 -04:00
376c61bc46
Added exploit module kentico_staging_syncserver.
2020-05-04 09:26:13 -04:00
f2752eab00
add win32k revision check to check method
2020-05-04 15:04:43 +08:00
0bcc473ded
Rename option to HOSTINFO_NAME and update doc
2020-05-01 12:59:01 -05:00
c27269105e
Rename CmdStager to psh_invokewebrequest
2020-05-01 12:31:53 -05:00
1364b08c4f
Make host info name configurable as an option
...
Though it has to be recognized by the server.
2020-05-01 12:19:12 -05:00
96f802585a
Update dropper payload to stageless
...
We're using Invoke-WebRequest now. Or anything similar.
2020-05-01 12:19:12 -05:00
9adaa08ddd
Use new PowerShell Invoke-WebRequest CmdStager
2020-05-01 12:19:12 -05:00
9bfecbc2aa
Print the responses if found but don't bail
...
The responses aren't always in sync, causing unexpected failures.
2020-05-01 12:19:12 -05:00
bb034acd7c
Note reason for SERVICE_RESOURCE_LOSS
2020-05-01 12:19:12 -05:00
309475259a
Remove doubled-up command prefix from dropper
...
The library prefixes "cmd /c" automatically.
2020-05-01 12:19:12 -05:00
84061881b8
Clarify module description
2020-05-01 12:19:12 -05:00
9d601b50c2
Note how we trigger the deserialization vuln
2020-05-01 12:19:12 -05:00
efab4f04f7
Add Veeam ONE Agent .NET deserialization exploit
2020-05-01 12:19:12 -05:00
bcf9449b29
add basic check method
2020-05-01 19:02:21 +08:00
717223e1a9
One more fix...
2020-04-30 08:09:15 -05:00
35913c829e
add mkdir and other suggested fixes
2020-04-30 07:47:57 -05:00
8e9a162b1b
fix
2020-04-30 18:05:00 +08:00
Alan Foster