jvazquez-r7
1f2313d87e
Land #4054 , @jhart-r7's SunRPC lib and module cleanup
2014-11-18 17:01:01 -06:00
jvazquez-r7
fb4b6543e2
Handle other rex exceptions
2014-11-18 15:57:41 -06:00
jvazquez-r7
a0f92ce26e
Update module with review
2014-11-18 15:43:53 -06:00
jvazquez-r7
dff6af0747
Restore timeout
2014-11-18 12:17:10 -08:00
jvazquez-r7
542eb6e301
Handle exception in brute force exploits
2014-11-18 12:17:10 -08:00
jvazquez-r7
4844447d17
Use 20 seconds as default timeout
...
* Because it's the default timeout on Rex::Proto::SunRPC::Client
2014-11-18 12:17:10 -08:00
jvazquez-r7
694561dd0f
Dont shadow methods with local variables, just in case...
2014-11-18 12:17:10 -08:00
Jon Hart
60e31cb342
Allow sunrpc_create to raise on its own
2014-11-18 12:17:10 -08:00
Jon Hart
500c4249fe
Update solaris_kcms_readfile to gracefully handle RPC errors
2014-11-18 12:17:10 -08:00
Jon Hart
82f89e620b
Clean up nfs mount scanner to *print_* better
2014-11-18 12:17:10 -08:00
Jon Hart
b2f9307e0a
vprint # of RPC programs, since the table comes right after
2014-11-18 12:17:10 -08:00
Jon Hart
bfde6047d5
Introduce a user-controlled timeout for SunRPC stuff
2014-11-18 12:17:10 -08:00
Jon Hart
a9f9a8b116
Introduce new ::Rex::Proto::SunRPC::RPCError, making run_host cleaner
2014-11-18 12:17:10 -08:00
Jon Hart
c7794a7ed9
Clean up Ruby style in sunrpc_portmapper
2014-11-18 12:17:09 -08:00
Jon Hart
059d84e4ca
More consistent *print_* and Rex::Ui::Text::Table for sunrpc_portmapper
2014-11-18 12:17:09 -08:00
jvazquez-r7
7358bcfe90
Restore timeout
2014-11-18 12:48:35 -06:00
jvazquez-r7
42a40cb128
Handle exception in brute force exploits
2014-11-18 11:20:41 -06:00
jvazquez-r7
53cf85dcb4
Use 20 seconds as default timeout
...
* Because it's the default timeout on Rex::Proto::SunRPC::Client
2014-11-18 11:03:20 -06:00
jvazquez-r7
e453f1dd11
Dont shadow methods with local variables, just in case...
2014-11-18 11:02:27 -06:00
Tod Beardsley
4ecb892bdb
Land #4226 , user friendly Bundler error message
...
Fixes #4222 , thanks @jhart-r7!
2014-11-18 11:01:28 -06:00
Trevor Rosen
d04441f638
Merge branch 'landing/4207' into upstream-master
...
Land #4207
* Ensure that `rake spec` doesn't create too many threads
2014-11-18 09:23:20 -06:00
Trevor Rosen
267f93ff81
Merge branch 'landing/4205' into upstream-master
...
Land #4205
* Remove unused Msf::DBManager::Sink
* Part of improvements to thread management
2014-11-18 08:59:32 -06:00
Luke Imhoff
8249ef62c9
Merge branch 'master' into chore/MSP-11614/remove-msf-db-manager-sink
...
MSP-11614
Conflicts:
spec/lib/msf/core/task_manager_spec.rb
2014-11-18 08:54:14 -06:00
Trevor Rosen
fff36f5968
Merge branch 'landing/4189' into upstream-master
...
Land #4189
* Detect leaked threads during spec runs
* Manage threads before/after spec runs
2014-11-18 08:33:38 -06:00
Jon Hart
f51dd2b6f4
Use bundler/setup for more graceful bundler related failures
2014-11-17 18:06:01 -08:00
jvazquez-r7
7daedac399
Land #3972 @jhart-r7's post gather module for remmina Remmina
...
* Gather credentials managed with Remmina
2014-11-17 16:44:41 -06:00
jvazquez-r7
45d219c0d8
Land #4102 , @jhart-r7's fix for nbns_response
...
* Use request src_port instead of 137
2014-11-17 15:46:38 -06:00
Jon Hart
4d81a9da65
Allow sunrpc_create to raise on its own
2014-11-17 11:58:26 -08:00
Tod Beardsley
286827c6e5
Land #4186 , Samsung KNOX exploit. Ty @jvennix-r7!
2014-11-17 13:29:39 -06:00
Tod Beardsley
39980c7e87
Fix up KNOX caps, descriptive description
2014-11-17 13:29:00 -06:00
Samuel Huckins
9e8f1d1160
Land #4218 , MDM bump
2014-11-17 13:26:40 -06:00
Tod Beardsley
0f41bdc8b8
Add an OSVDB ref
2014-11-17 13:26:21 -06:00
jvazquez-r7
54de805b7a
Report credentials
...
* Even when we are not associating them to hosts
* It's a post module so maybe we cannot solve some names
2014-11-17 12:49:18 -06:00
Jon Hart
9e2513d4de
Update solaris_kcms_readfile to gracefully handle RPC errors
2014-11-17 10:41:17 -08:00
Jon Hart
364315122a
Clean up nfs mount scanner to *print_* better
2014-11-17 10:41:17 -08:00
Jon Hart
1fda9a36b7
vprint # of RPC programs, since the table comes right after
2014-11-17 10:41:17 -08:00
Jon Hart
151df3ae05
Introduce a user-controlled timeout for SunRPC stuff
2014-11-17 10:41:17 -08:00
Jon Hart
7098d89058
Introduce new ::Rex::Proto::SunRPC::RPCError, making run_host cleaner
2014-11-17 10:41:17 -08:00
Jon Hart
91abe6f7c7
Clean up Ruby style in sunrpc_portmapper
2014-11-17 10:41:17 -08:00
Jon Hart
47c7df96c5
More consistent *print_* and Rex::Ui::Text::Table for sunrpc_portmapper
2014-11-17 10:41:16 -08:00
jvazquez-r7
b3b37c7c9f
Use longer description lines
2014-11-17 12:23:22 -06:00
jvazquez-r7
145e610c0f
Avoid shadowing new method
2014-11-17 12:22:30 -06:00
jvazquez-r7
cc8b37d619
Make directory mandatory
2014-11-17 12:15:33 -06:00
jvazquez-r7
15b7435c34
Make it YARD compliant documentation
2014-11-17 12:03:37 -06:00
William Vu
fd53e969fd
Land #4217 , browser_autopwn variable fix
2014-11-17 11:46:52 -06:00
William Vu
405eae4b6e
Remove EOL whitespace
2014-11-17 11:46:36 -06:00
jvazquez-r7
20195e7f37
Update from upstream/master
2014-11-17 11:43:48 -06:00
William Vu
91ba25a898
Land #4208 , psexec delay fix
2014-11-17 11:35:56 -06:00
jvazquez-r7
2c36f79934
Land #4165 , @jhart-r7's check for datastore options on Cisco dtp
...
* Fix modules/auxiliary/spoof/cisco/dtp
* Just one of the two options is required
2014-11-17 11:23:31 -06:00
William Vu
fa9bd88091
Land #4215 , new CVEs for older modules
2014-11-17 11:21:46 -06:00
Jon Hart
cd32f00ebc
Add dir doc
2014-11-17 09:15:08 -08:00
Jon Hart
98db8b5ad9
When not a meterpreter session, split dir/ls output to match meterpreter entries output
2014-11-17 09:10:03 -08:00
Jon Hart
d5afb2b766
%q
2014-11-17 09:01:14 -08:00
Jon Hart
ce73e32673
Doc and named captures
2014-11-17 09:01:14 -08:00
Jon Hart
bf05fe1389
Refactoring, simplification, better print_*
2014-11-17 09:01:14 -08:00
Jon Hart
6e1cdfde36
Rip out create_credential* stuff. Use what works
2014-11-17 09:01:14 -08:00
Jon Hart
e5bb13a609
If remmina config files are missing data for creds, tell me what
2014-11-17 09:01:14 -08:00
Jon Hart
875d1f9ea0
Convert Remmina credential gatherer to use new credentials model
2014-11-17 09:01:14 -08:00
Jon Hart
5f1a1f8ed3
Use dir for Windows only, ls for the rest
2014-11-17 09:01:14 -08:00
Jon Hart
086f0c02d6
Remove excessive logging
2014-11-17 09:01:14 -08:00
Jon Hart
6519b0e2cb
Add dir and ls to Msf::Post::File
2014-11-17 09:01:14 -08:00
Jon Hart
90e58e9e71
Binary encoding
2014-11-17 09:01:14 -08:00
Jon Hart
e76373340e
Correct some Rubocop things that I agree with
2014-11-17 09:01:14 -08:00
Jon Hart
f729a6cf02
Add Remmina RDP/SSH/VNC password gathering
2014-11-17 09:01:13 -08:00
Matt Buck
5db7d1edd5
Bump mdm version number
2014-11-17 10:59:41 -06:00
William Vu
07c3c41269
Land #4211 , Ruby version bump
2014-11-17 10:38:34 -06:00
Joe Vennix
cd61975966
Change puts to vprint_debug.
2014-11-17 10:13:13 -06:00
Joe Vennix
fc1635e80a
Fix BAP JS ref error.
2014-11-17 10:06:15 -06:00
Luke Imhoff
33b42389f0
Merge branch 'feature/MSP-11147/thread-leak-detection' into feature/MSP-11605/lazy-thread-creation
...
MSP-11605
2014-11-17 09:35:47 -06:00
Luke Imhoff
e3869ee1ae
Include Thread status when printing leaked threads
...
MSP-11147
Sometime travis-ci is showing leaked threads even when
'Msf::Framework#threads cleaner' is being used, so I'm adding the
`Thread#status` to the data printed about the Thread to see if the
sometimes leaked threads have an odd status. There's still a chance
that there will be a race-condition between when I call Thread.list and
I ask for each Thread's status that the VM could finish aborting a
Thread so that status I print isn't the same as the one that caused the
Thread to be returned in Thread.list.
2014-11-17 09:30:46 -06:00
Luke Imhoff
ba836f2383
Only calculate thread UUIDs if they are needed
...
MSP-11147
Only calculate thread UUIDs if the thread count exceeds
EXPECTED_THREAD_COUNT_AROUND_SUITE.
2014-11-17 09:17:44 -06:00
Luke Imhoff
024b449b55
Merge branch 'master' into feature/MSP-11605/lazy-thread-creation
...
MSP-11605
2014-11-17 08:50:33 -06:00
jvazquez-r7
6f5183afec
Land #4216 , @hmoore-r7 additions to the tftp dictionary
...
* Changes originally submitted by Chris McNab
2014-11-17 08:48:16 -06:00
Joe Vennix
2a24151fa8
Remove BAP target, payload is flaky. Add warning.
2014-11-17 02:02:37 -06:00
Joe Vennix
105a28d8fd
Run the tests again.
2014-11-16 23:42:40 -06:00
Joe Vennix
a7aeac5df3
Fix APK signing on osx.
2014-11-16 23:29:54 -06:00
HD Moore
1d8b746d89
Adds new TFTP file names, submitted by Chris McNab
2014-11-16 18:47:11 -06:00
HD Moore
9fe4994492
Chris McNab has been working with MITRE to add these CVEs
...
These CVEs are not live yet, but have been confirmed by cve-assign
t
2014-11-16 18:42:53 -06:00
Joe Vennix
5de69ab6a6
minor syntax fixes.
2014-11-15 21:39:37 -06:00
Joe Vennix
3fb6ee4f7d
Remove dead constant.
2014-11-15 21:38:11 -06:00
Joe Vennix
7a62b71839
Some URL fixes from @jduck and exploit ideas from Andre Moulu.
...
The exploit works with the URLs fixed, installs the APK, but hangs at the Installing...
screen and never actually launches. We tried opening the APK in a setTimeout() intent
URI, but the previously launched intent seemed unresponsive. Andre had the bright
idea of re-opening the previously launched intent with invalid args, crashing it and
allow us to launch the payload.
2014-11-15 21:33:16 -06:00
William Vu
a521d469ed
Land #4194 , Quake protocol support
2014-11-15 17:44:19 -06:00
sinn3r
d207345778
Land #4200 - report_note handling incorrect protocol names
2014-11-15 13:16:58 -06:00
Christian Mehlmauer
28135bcb09
Land #4159 , MantisBT PHP code execution by @itseco
2014-11-15 07:49:54 +01:00
Luke Imhoff
ceb7a63a5c
Merge branch 'master' into feature/MSP-11147/thread-leak-detection
...
MSP-11147
2014-11-14 18:20:55 -06:00
Tod Beardsley
9c4614f73c
Oh good, another Ruby version bump
...
DoS Security issue in Ruby 1.9.3-p550 and prior, described here:
https://www.ruby-lang.org/en/news/2014/11/13/ruby-1-9-3-p551-is-released/
Not a hair-on-fire kind of deal, but should update at the earliest
opportunity to avoid getting DoS'ed by a malicious target.
2014-11-14 17:28:16 -06:00
sinn3r
e194d5490d
See #4162 - Don't delay before deleting a file via SMB
...
So I was looking at issue #4162 , and on my box I was seeing this
problem of the exploit failing to delete the payload in C:\Windows,
and the error was "Rex::Proto::SMB::Exceptions::NoReply The SMB
server did not reply to our request". I ended up removing the sleep(),
and that got it to function properly again. The box was a Win 7 SP1.
I also tested other Winodws boxes such as Win XP SP3, Windows Server
2008 SP2 and not having the sleep() doesn't seem to break anything.
So I don't even know why someone had to add the sleep() in the first
place.
2014-11-14 15:45:37 -06:00
William Vu
0477c5f8fe
Land #4191 , merge_check_key update for Ruby 2.1.4
2014-11-14 15:33:47 -06:00
Luke Imhoff
a2ccaad1ae
Merge branch 'master' into feature/MSP-11605/lazy-thread-creation
...
MSP-11605
2014-11-14 13:06:14 -06:00
Trevor Rosen
3b558624f3
Merge branch 'landing/4129' into upstream-master
...
Landing #4129
* Detect leaked constants in spec runs
2014-11-14 12:55:56 -06:00
Luke Imhoff
bc53e7667d
Remove unnecessary thread cleaning from Msfcli spec
...
MSP-11605
2014-11-14 12:40:04 -06:00
Luke Imhoff
43511e648a
Merge branch 'chore/MSP-11614/remove-msf-db-manager-sink' into feature/MSP-11605/lazy-thread-creation
...
MSP-11605
Conflicts:
spec/lib/msf/core/task_manager_spec.rb
2014-11-14 11:59:12 -06:00
Luke Imhoff
14fa1dba0b
Merge branch 'master' into feature/MSP-11605/lazy-thread-creation
...
MSP-11605
2014-11-14 11:58:16 -06:00
Luke Imhoff
5e6400a506
Remove Msf::TaskManager
...
MSP-11614
`Msf::TaskManager` was only used for `Msf::DBManager#sink`, which was
removed because it was unused, so `Msf::TaskManager` can also be
removed.
2014-11-14 11:15:05 -06:00
Luke Imhoff
55a8f6f339
Remove Msf::DBManager::Sink
...
MSP-11614
`Msf::DBManager::Sink` contains code for a `sink` that is a meant to
serialize database events, but it's unneeded because all database events
go directly through ActiveRecord, which handles threading.
2014-11-14 10:51:51 -06:00
Tod Beardsley
723028d5bc
Land #4204 , add missing migration
2014-11-14 10:32:35 -06:00
Luke Imhoff
8863367cc7
Merge branch 'chore/MSP-11615/update-db-schema' into chore/MSP-11614/remove-msf-db-manager-sink
...
MSP-11614
2014-11-14 10:12:18 -06:00
Luke Imhoff
40c49cefd8
Update db/schema.rb
...
MSP-11615
To get type column on metasploit_credential_publics.
2014-11-14 09:39:26 -06:00
Luke Imhoff
8925db2ec1
Remove thread cleaner from Msf::Simple::Framework shared context
...
MSP-11605
The `framework` from 'Msf::Simple::Framework' shared context is not
guaranteed to make threads with `framework.threads` anymore, so the
cleaner shouldn't allows be present in 'Msf::Simple::Framework'.
2014-11-14 09:14:13 -06:00
Luke Imhoff
0c6b820f7d
Remove unnecessary thread cleaning from Msf::Framework spec
...
MSP-11605
2014-11-14 09:11:35 -06:00
Jon Hart
57aef9a6f5
Land #4177 , @hmoore-r7's fix for #4169
2014-11-13 18:29:57 -08:00
HD Moore
2abc636f16
Merge pull request #7 from jhart-r7/landing-4177-jhart
...
Clean up failure messaging when bad CHOST
2014-11-13 18:56:12 -06:00
Juan
77e5043be9
Merge pull request #1 from FireFart/pr1
...
some changes
2014-11-13 19:54:14 -05:00
William Vu
386a1912e5
Land #4201 , release fixes
2014-11-13 15:52:24 -06:00
Christian Mehlmauer
3faa48d810
small bugfix
2014-11-13 22:51:41 +01:00
Christian Mehlmauer
7d6b6cba43
some changes
2014-11-13 22:46:53 +01:00
Matt Buck
651beb9acb
Land #4192 , enable specifying mode for Rex output file
2014-11-13 14:57:48 -06:00
Julio Auto
812aa9bc1a
Reduce number of calls to to_s and downcase
2014-11-13 14:56:17 -06:00
Tod Beardsley
e2dc862121
Fix newly introduced typo.
2014-11-13 14:53:57 -06:00
Tod Beardsley
dd1920edd6
Minor typos and grammar fixes
2014-11-13 14:48:23 -06:00
Julio Auto
e72d9bd21f
Fix report_note handling incorrect protocol names
2014-11-13 14:30:43 -06:00
Luke Imhoff
69e726e2c9
Fail if 'Msf::Framework#threads cleaner' is unnecessary
...
MSP-11605
The 'Msf::Framework#threads cleaner' shared context fails with a
RuntimeError if `framework.threads?` is false, which would indicate that
cleaning is unnecessary. This change stops 'Msf::Framework#threads
cleaner' from accessing `framework.threads`, which would create threads
only to immediately clean them up.
2014-11-13 14:22:40 -06:00
Luke Imhoff
eb3ff769a9
Msf::Framework#threads?
...
MSP-11605
`Msf::Framework#threads?` returns whether `Msf::Framework#threads` was
ever initialized. If `Msf::Framework#threads?` is true, then threads
need to be cleaned up, while if it is false then no threads need to be
cleaned up from the current framework.
2014-11-13 14:21:35 -06:00
Luke Imhoff
d9a25005a6
Wrap Msf::Framework#threads in Metasploit::Framework::ThreadFactoryProvider
...
MSP-11605
`Rex::ThreadFactory.provider` needs to be set in
`Msf::Framework#initialize`, but setting it directly to
`Msf::Framework#threads` eliminates the laziness of
`Msf::Framework#threads`. In order keep `framework.threads` lazy,
`framework` is wrapped in a
`Metasploit::Framework::ThreadFactoryProvider`, which responds to
`spawn`, which is needed by `Rex::ThreadFactory`, by calling
`framework.threads.spawn`, which lazily initialized `framework.threads`
when the first thread needs to be spawned.
2014-11-13 14:08:26 -06:00
Joe Vennix
714ce2f3ce
Land #4198 , @trosen-r7's fixes to XML import.
2014-11-13 14:07:12 -06:00
sinn3r
5a54537cbc
Land #4196 - MS14-064 bypassing UAC
2014-11-13 13:55:31 -06:00
Luke Imhoff
0bc27334c1
Thread-safe lazy Msf::Framework#db
...
MSP-11605
Switch `Msf:Framework#db` from being set in `#initialize` to a custom
method that uses `||=` to lazily initialize the `Msf::DBManager` inside
a `synchronize` block to make it thread safe.
2014-11-13 13:38:53 -06:00
Luke Imhoff
92adaa816f
Store Msf::Framework#initialize options
...
MSP-11605
Store options `Hash` passed to `Msf::Framework#new` in `#options` so
that lazily initialized children, such as DBManager, have access to
those options.
2014-11-13 13:23:17 -06:00
Luke Imhoff
bc181f0294
Thread-safe lazy Msf::Framework#sessions
...
MSP-11605
Switch `Msf::Framework#sessions` from being set in `#initialize` to a
custom method that uses `||=` to lazily initialize the
`Msf::SessionManager` inside a `synchronize` block to make it thread
safe.
2014-11-13 13:17:57 -06:00
Trevor Rosen
0959ef3d13
Fixes lack of support for MetasploitV5 tag
...
#4184
* Appears to have been overlooked somehow in the pre-BlackHat crunch
* V5 will not support credentials
* We are implementing full-workspace zip import/export for credentials
2014-11-13 13:01:55 -06:00
Samuel Huckins
cd7b69b699
Land #4197 , blank username failure fix
2014-11-13 12:59:22 -06:00
Samuel Huckins
768d7477d7
metasploit-credential bump to 0.13.3
...
MSP-11609
2014-11-13 12:56:58 -06:00
David Maloney
49f10e6ed8
use latest version of metasploit-credential
...
MSP-11609
2014-11-13 11:26:05 -06:00
Luke Imhoff
216c3d01de
Thread-safe lazy Msf::Framework#threads
...
MSP-11605
Switch Msf::Framework#threads to a custom method that uses `||=` to
lazily initialize the `Msf::ThreadManager` inside a `synchronize` block
to make it thread safe.
2014-11-13 11:12:43 -06:00
Luke Imhoff
8fc683d75d
Use MonitorMixing in Msf::Framework
...
MSP-11605
To get access to `#synchronize` for thread-safe lazy initialization.
2014-11-13 11:11:34 -06:00
David Maloney
ccc5bbd745
this spec needs to use the username factory
...
:metasploit-credential_public factory will randomly
return either a Username or BlankUsername and thus is
not appropriate for when you want tos et an explicit Username.
The :metasploit_credential_username factory should be used for this
instead
MSP-11609
2014-11-13 10:58:03 -06:00
Luke Imhoff
55aa32c6b6
Merge branch 'feature/MSP-11147/thread-leak-detection' into feature/MSP-11605/lazy-thread-creation
...
MSP-11605
2014-11-13 10:14:22 -06:00
Luke Imhoff
b17b263cc7
Ignore debugger threads
...
MSP-11147
When using the debugger, it adds a thread that should be allowed and not
go towards the count.
2014-11-13 09:49:08 -06:00
Luke Imhoff
535f69b56d
Append to RUBYOPT for debugger compatibility
...
MSP-11147
When using Rubymine's debugger, the tests would run and say there were
no tests and no break points would be hit. It was determined that this
was due the Rubymine's debugger injecting itself into RUBYOPTS and only
working if it's first in RUBYOPT, which means that
'metasploit:framework:spec:threads:suite' must inject '-Ilib
-rmetasploit/framework/spec/threads/logger' at the end of RUBOPT instead
of the beginning.
2014-11-13 09:19:07 -06:00
Juan Escobar
17032b1eed
Fix issue reported by FireFart
2014-11-13 04:48:45 -05:00
jvazquez-r7
31f3aa1f6d
Refactor create packager methods
2014-11-13 01:16:15 -06:00
jvazquez-r7
38a96e3cfc
Update target info
2014-11-13 00:56:42 -06:00
jvazquez-r7
e25b6145f9
Add module for MS14-064 bypassing UAC through python for windows
2014-11-13 00:56:10 -06:00
jvazquez-r7
f081ede2aa
Land #4155 , @pedrib's module for CVE-2014-8499
...
* Password Manager Pro privesc + password disclosure
2014-11-12 23:56:26 -06:00
Joe Vennix
ea6d8860a1
Not root, just arbitrary permissions.
2014-11-12 21:51:55 -06:00
Jon Hart
ebf6fe4e56
Minor style cleanup
2014-11-12 16:44:43 -08:00
sinn3r
a5009170e7
Land #4185 - Add CVE-2014-6352 (ms14-060 aka sandworm)
2014-11-12 17:11:43 -06:00
Trevor Rosen
f658efe144
Add the ability to specify mode in Rex output file
...
* Because sometimes you might want to append
* Preserves original hardcoded 'wb' as default
* http://pubs.opengroup.org/onlinepubs/009695399/functions/fopen.html
2014-11-12 16:08:03 -06:00
Jon Hart
07a1653e57
Add gather module for Quake servers
2014-11-12 13:32:56 -08:00
Pedro Ribeiro
9df31e950f
Add OSVDB id
2014-11-12 21:32:33 +00:00
Tod Beardsley
bfc7bfdd9a
Land #4179 , Meterpreter_bins update
...
Actually fixes #3787 as well, since this is the last component needed to
fix that.
See rapid7/meterpreter#102
Also see
https://github.com/rapid7/meterpreter_bins/commit/055eddeb183db30bfa0586652753c3e080d97273
as this brings the shipping binaries up to day with 055eddeb
2014-11-12 15:14:20 -06:00
sinn3r
846dbc7432
Fix #4163 - Update merge_check_key to keep up with 2.1.4 change
...
The merge_check_key method (found in Msf::Module::ModuleInfo)) uses
respond_to? to check is our object includes a merge_info_description
method before merging descriptions. The respond_to? method in 2.1.4
by default no longer checks private and protected methods, and this
is breaking our merge_check_key method.
Fix #4163
2014-11-12 13:46:14 -06:00
Luke Imhoff
cca82f4b36
Failing spec for Msf::Framework.new threads
...
MSP-11605
`Msf::Framework.new` creates 8 threads (change from 1 thread to 9 threads), but
it shouldn't create any threads.
2014-11-12 13:41:30 -06:00
Luke Imhoff
2fc6154ce9
Update db/schema.rb
...
MSP-11147
Must be missing on master too.
2014-11-12 13:33:21 -06:00
Tod Beardsley
54158c8662
Land #4005 , TNS poison checker
2014-11-12 13:29:59 -06:00
Tod Beardsley
d242bc220b
Minor fixups and disclosure date for TNS module
2014-11-12 13:25:10 -06:00
Tod Beardsley
955a5142ca
Edit e-mail address for antispam
2014-11-12 13:19:04 -06:00
Luke Imhoff
69043d51e0
Merge branch 'master' into feature/MSP-11147/thread-leak-detection
...
MSP-11147
2014-11-12 12:34:25 -06:00
Luke Imhoff
44f78c21b2
Tag Msfcli spec as content
...
MSP-11147
Tests currently use the real modules directory for test cases, so the
spec should be tagged with :content because it has same performance
issues as other content specs that can potentially load all the modules.
2014-11-12 12:27:33 -06:00
Luke Imhoff
3ff87c89fe
Clean up Msf::Framework spec thread-leaks
...
MSP-11147
2014-11-12 12:20:23 -06:00
Luke Imhoff
22cbc5ca02
Use named subject instead of subject
...
MSP-11147
2014-11-12 12:18:08 -06:00
Luke Imhoff
61109d5567
Fix thread-leaks in msfcli spec
...
MSP-11147
2014-11-12 12:13:53 -06:00
Fernando Arias
e05cd95c9b
Land #4188 , remerge of #4168
...
update gemspec for metasploit-credential
2014-11-12 11:26:57 -06:00
David Maloney
e0163a325d
update metasploit-credential to 0.13.2
2014-11-12 11:16:51 -06:00
Luke Imhoff
5d48f123f6
Add #4045 to CHANGELOG
2014-11-12 11:15:58 -06:00
David Maloney
c937982a28
Merge branch 'master' into bug/MSP-11592/blank-password-failure
2014-11-12 11:13:58 -06:00
David Maloney
758fee6320
Merge branch 'master' of github.com:rapid7/metasploit-framework
...
Conflicts:
Gemfile.lock
2014-11-12 11:13:33 -06:00
Luke Imhoff
ad811dc70c
CHANGELOG template for next release
2014-11-12 11:13:22 -06:00
Luke Imhoff
ad4ee3cffd
Merge branch 'master' of rapid7.github.com:/rapid7/metasploit-framework
2014-11-12 11:10:48 -06:00
Luke Imhoff
1fd8fe57df
Merge staging/great-backport to master
...
Conflicts:
spec/lib/msf/core/module_spec.rb
2014-11-12 11:08:18 -06:00
Joe Vennix
1895311911
Change URL to single line.
2014-11-12 10:56:51 -06:00
sinn3r
ac4b2bee4d
Land #4181 - Fix nil URIPORT in get_uri (HttpServer)
2014-11-12 10:54:16 -06:00
Joe Vennix
8689b0adef
Add module for samsung knox root exploit.
2014-11-12 09:53:20 -06:00
jvazquez-r7
70589668c2
Really land the #4130 module
2014-11-12 09:39:01 -06:00
Jon Hart
e658640014
Show uniq error count
2014-11-12 07:38:07 -08:00
jvazquez-r7
ece8013d7a
Use #empty?
2014-11-12 09:35:06 -06:00
jvazquez-r7
f048463ed6
Do minor fixupts
...
* Delete peer method
* Make verifications more strict
2014-11-12 09:33:49 -06:00
Jon Hart
b05198c05a
Clean up failure messaging when bad CHOST
2014-11-12 07:32:06 -08:00
jvazquez-r7
a5c87db65e
Do minor cleanup
...
* Beautify description
* Use double quotes for interpolation
2014-11-12 09:29:53 -06:00
jvazquez-r7
e1164d3e14
Use snake_case on filename
2014-11-12 09:26:47 -06:00
Luke Imhoff
8adc80fff1
Sort context entries
...
MSP-11147
2014-11-12 09:16:37 -06:00
Luke Imhoff
9766e61b7b
Update Msfcli#engage_mode spec style
...
MSP-11147
2014-11-12 09:08:36 -06:00
Jon Hart
ae339cb59f
Land #4174 , @hmoore-r7's fix for #4170
2014-11-12 07:02:22 -08:00
jvazquez-r7
c35dc2e6b3
Add module for CVE-2014-6352
2014-11-12 01:10:49 -06:00
William Vu
b2612eaf1c
Land #4180 , Metasploit Trail banner
...
Homage to Oregon Trail. :)
2014-11-11 16:28:46 -06:00
William Vu
adad3809cc
Rename logo file
2014-11-11 16:07:44 -06:00
William Vu
89a8d27602
Fix port 0 bug in URIPORT
2014-11-11 15:57:41 -06:00
Joshua Smith
329ea4fe01
the masterpiece is complete
2014-11-11 15:35:36 -06:00
Luke Imhoff
c0a3707c52
Update Msfcli#init_modules spec style
...
MSP-11147
2014-11-11 15:29:21 -06:00
William Vu
c73a866932
Land #4178 , remerge of #4113
2014-11-11 15:23:40 -06:00
OJ
fb751e3b9f
Update meterpreter_bins to 0.0.11
...
This adds support for the getsid command in the binaries.
2014-11-12 07:21:00 +10:00
Tod Beardsley
7e05f88399
Reapply PR #4113 (removed via #4175 )
2014-11-11 15:06:43 -06:00
HD Moore
6b4eb9a8e2
Differentiate failed binds from connects, closes #4169
...
This change adds two new Rex exceptions and changes the local comm to raise the right one depending on the circumstances. The problem with the existing model is
that failed binds and failed connections both raised the same exception. This change is backwards compatible with modules that rescue Rex::AddressInUse in additi
on to Rex::ConnectionError. There were two corner cases that rescued Rex::AddressInUse specifically:
1. The 'r'-services mixin and modules caught the old exception when handling bind errors. These have been updated to use BindFailed
2. The meterpreter client had a catch for the old exception when the socket reports a bad destination (usually a network connection dropped). This has been updat
ed to use InvalidDestination as that was the intention prior to this change.
Since AddressInUse was part of ConnectionError, modules and mixins which caught both in the same rescue have been updated to just catch ConnectionError.
2014-11-11 14:59:41 -06:00
William Vu
2a6d288fe8
Land #4176 , revert of 14514d7
2014-11-11 14:57:40 -06:00
Tod Beardsley
64aaa50132
Revert 14514d7 as well
...
Another one snuck in there, see #4175
Revert "update gemspec for metasploit-credential"
This reverts commit 14514d7b8b , reversing
changes made to 6653d5e913 .
2014-11-11 14:53:04 -06:00
Luke Imhoff
bb07de3294
Update Msfcli#generate_whitelist spec style
...
MSP-11147
2014-11-11 14:49:48 -06:00
William Vu
baf7065e1b
Land #4175 , revert of deea30d
2014-11-11 14:43:48 -06:00
Tod Beardsley
017a44c0ae
Revert errored merge of deea30d
...
Revert "Merge branch 'master' of https://github.com/farias-r7/metasploit-framework into upstream-master"
This reverts commit deea30ddb4 , reversing
changes made to 14514d7b8b .
2014-11-11 14:38:47 -06:00
Luke Imhoff
965607c7dc
Update Msfcli#guess_nop_name spec style
...
MSP-11147
2014-11-11 14:16:55 -06:00
Luke Imhoff
577065f68d
Update Msfcli#guess_encoder_name spec style
...
MSP-11147
2014-11-11 14:14:50 -06:00
David Maloney
2d4cc8b21c
update gemfile.lock to credential 13.2
2014-11-11 13:49:47 -06:00
Luke Imhoff
d36da497d0
Update Msfcli#guess_payload_name spec style
...
MSP-11147
2014-11-11 13:47:16 -06:00
Fernando Arias
deea30ddb4
Merge branch 'master' of https://github.com/farias-r7/metasploit-framework into upstream-master
2014-11-11 13:36:50 -06:00
Fernando Arias
14514d7b8b
update gemspec for metasploit-credential
2014-11-11 13:35:00 -06:00
Luke Imhoff
1f1af70047
Update Msfcli#usage spec style
...
MSP-11147
2014-11-11 13:22:28 -06:00
HD Moore
dbd5937dc7
Limit threads to 1 when CPORT is set, closes #4170
...
This issue also applies to TCP scanner modules.
2014-11-11 13:21:09 -06:00
Luke Imhoff
ebec5329df
Update Msfclie#dump_module_list spec style
...
MSP-11147
2014-11-11 13:21:06 -06:00
Luke Imhoff
56b53b0dcd
Remove redundant 'it' in text name
...
MSP-11147
2014-11-11 13:16:45 -06:00
Luke Imhoff
5d6aec8bed
Fix context prefix
...
MSP-11147
Instance methods should be prefixed with `#`, not `.`.
2014-11-11 13:14:34 -06:00
Luke Imhoff
a6fed7798e
Update Msfcli#usage spec style
...
MSP-11147
2014-11-11 13:11:40 -06:00
Luke Imhoff
c6f115d070
Update Msfcli#initialize spec style
...
MSP-11147
2014-11-11 13:11:05 -06:00
Jon Hart
9238d80a24
Use correct source port for NBNS spoofer
...
137 is only correct for systems that use this as their source port.
Systems running Samba, for example, don't use this. So use the port
taken from the original request, not 137 or 1337
2014-11-11 10:33:27 -08:00
Luke Imhoff
86379db65c
Remove incorrect 'Class methods' context
...
MSP-11147
2014-11-11 12:32:22 -06:00
Luke Imhoff
36ab73b83a
Extract Msfcli#framework
...
MSP-11147
Expose Msfcli @framework as Msfcli#framework so that it can be set in
tests. It also allows Msfcli#framework to lazily initialize and memoize
to @framework.
2014-11-11 12:25:14 -06:00
Luke Imhoff
cf0ecd0367
Fix thread leaks in TaskManager spec
...
MSP-11147
2014-11-11 12:02:14 -06:00
HD Moore
96ba6da697
Add the UDP scanner template, lands #4113 .
...
There is some additional work to do regarding CHOST/CPORT, but this is not tied to the udp template changes.
2014-11-11 11:59:30 -06:00
Luke Imhoff
eede74be1e
Extract 'Msf::Framework#threads cleaner'
...
MSP-11147
Extract from 'Msf::Simple::Framework' the `after(:each)` that kills and joins
threads from `framework.threads` into 'Msf::Framework#threads cleaner`.
2014-11-11 11:49:48 -06:00
jvazquez-r7
6653d5e913
Land #4168 , @nullbind's MS SQL SUSER_SNAME login enumeration module
2014-11-11 11:17:39 -06:00
jvazquez-r7
01fda27264
Fix title
2014-11-11 11:15:53 -06:00
jvazquez-r7
a588bfd31a
Use single quotes
2014-11-11 09:56:46 -06:00
jvazquez-r7
77c8dc2b64
Dont return nil from 'run'
2014-11-11 09:39:08 -06:00
jvazquez-r7
fb309aae11
Use a Fixnum as FuzzInt default value
2014-11-11 09:36:53 -06:00
jvazquez-r7
f6762b41b6
Use random fake db name
2014-11-11 09:35:51 -06:00
jvazquez-r7
94c353222d
Do small cosmetic changes
2014-11-11 09:31:57 -06:00
jvazquez-r7
e9e5869951
update from master
2014-11-11 09:24:33 -06:00
Nikita
c0285067c9
Add new module to test TNS poison
...
msf auxiliary(tnspoison_checker) > show options
Module options (auxiliary/scanner/oracle/tnspoison_checker1):
Name Current Setting Required Description
---- --------------- -------- -----------
RHOSTS 172.16.2.100, 172.16.2.24, 172.16.2.101 yes The target address range or CIDR identifier
RPORT 1521 yes The target port
THREADS 1 yes The number of concurrent threads
msf auxiliary(tnspoison_checker) > exploit
[+] 172.16.2.100:1521 is vulnerable
[*] Scanned 1 of 3 hosts (033% complete)
[-] 172.16.2.24:1521 is not vulnerable
[*] Scanned 2 of 3 hosts (066% complete)
[-] 172.16.2.101:1521 unable to connect to the server
[*] Scanned 3 of 3 hosts (100% complete)
[*] Auxiliary module execution completed
2014-11-11 17:29:27 +03:00
Juan Escobar
ac17780f6d
Fix by @FireFart to recover communication with the application after a meterpreter session
2014-11-11 05:49:18 -05:00
Juan Escobar
6bf1f613b6
Fix issues reported by FireFart
2014-11-11 00:41:58 -05:00
jvazquez-r7
091da05a86
update from master
2014-11-10 22:59:44 -06:00
OJ
39b8bcc808
Merge branch 'upstream/master' of github.com:rapid7/metasploit-framework
2014-11-11 09:25:37 +10:00
OJ
4987f77526
Land #4157 - Add getsid to python meterpreter
2014-11-11 09:24:51 +10:00
jvazquez-r7
3faf4a4702
Land #4120 , @nullbind's module for MS SQL privilege escalation
...
* through ESCALATE AS
2014-11-10 16:59:28 -06:00
jvazquez-r7
cac6494427
Use snake_case in filename
2014-11-10 16:58:46 -06:00
jvazquez-r7
2c33642de8
Do minor cleanup
2014-11-10 16:57:57 -06:00
jvazquez-r7
12ae8b3ec6
update from master
2014-11-10 16:19:26 -06:00
nullbind
493b81d874
cleanup
2014-11-10 15:22:21 -06:00
nullbind
31fa57fcb2
mssql_enum_sql_logins
2014-11-10 15:19:55 -06:00
Scott Sutherland
d543b16cc1
Added mssql_enum_sql_logins.rb
2014-11-10 15:02:46 -06:00
Scott Sutherland
ea226f7482
Update mssql_enum_sql_logins.rb
2014-11-10 15:02:14 -06:00
jvazquez-r7
0a68171bab
Land #4166 , @wchen-r7's fix for undefined method `rank'
...
* Fixes #4047
* undefined method `rank' due to an invalid encoder name
2014-11-10 15:00:17 -06:00
David Maloney
bf1558d702
update gemspec for metasploit-credential
...
update gemspec to use newest metasploit-credential
MSP-11592
2014-11-10 14:54:09 -06:00
Juan Escobar
d4bbf0fe39
Fix issues reported by wchen-r7 and mmetince
2014-11-10 15:27:10 -05:00
jvazquez-r7
86ff5f93eb
Land #4158 , Fix for null dereference on Exploit::Remote::HttpServer#remove_resource
2014-11-10 14:14:48 -06:00
jvazquez-r7
4e96833408
Check service before using it
2014-11-10 14:14:20 -06:00
jvazquez-r7
1064049729
Revert "Fix buggy calls to stop_service"
...
This reverts commit 613f5309bb .
2014-11-10 14:05:57 -06:00
Pedro Ribeiro
cc99a6a96f
Merge pull request #9 from jvazquez-r7/review_4155
...
Clean exploit for CVE-2014-8499 - PMP privesc + password disclosure
2014-11-10 19:44:28 +00:00
nullbind
74344e9295
added mssql_enum_sql_logins
2014-11-10 13:42:52 -06:00
sinn3r
0b51741779
Fix #4047 - undefined method `rank' due to an invalid encoder name
...
Fix #4047 caused by an invalid encoder name. Also added elog() to
avoid shutting everything up in msfvenom
2014-11-10 13:25:53 -06:00
jvazquez-r7
4b701700c1
Fix banner
2014-11-10 12:40:53 -06:00
Jon Hart
7ed11ffd52
Check for INTERFACE or SMAC in dtp setup
2014-11-10 10:14:47 -08:00
jvazquez-r7
65dbb1a83f
Do print_status
2014-11-10 11:26:53 -06:00
jvazquez-r7
7aed1e9581
Create loot_passwords method
2014-11-10 11:21:44 -06:00
jvazquez-r7
92df11baa7
Create report_super_admin_creds method
2014-11-10 11:16:25 -06:00
jvazquez-r7
8f17011909
do run clean up
...
* Reduce code complexity
* Don't report not valid administrator credentials
2014-11-10 11:12:04 -06:00
jvazquez-r7
635df2f233
Fail with NoAccess
2014-11-10 09:50:26 -06:00
jvazquez-r7
9c033492d2
Fix indentation
2014-11-10 09:48:22 -06:00
jvazquez-r7
2236518694
Check res.body before accessing #to_s
2014-11-10 09:47:05 -06:00
jvazquez-r7
8b8ab61e3d
Favor && over and
2014-11-10 09:45:12 -06:00
jvazquez-r7
ee4924582a
Use target_uri
2014-11-10 09:43:44 -06:00
jvazquez-r7
8ddd6a4655
Redefine RPORT having into account it is builtin
2014-11-10 09:42:30 -06:00
jvazquez-r7
eb36a36272
Change title
2014-11-10 09:40:22 -06:00
Trevor Rosen
8511dc4131
Merge branch 'landing/4135' into upstream-master
...
Land #4135
* Improve Bundle management:
* Option to install w/out DB group
* Option to install w/out pcap support
2014-11-10 09:26:42 -06:00
Spencer McIntyre
7edc248207
Don't fail if username_from_token returns None
2014-11-10 09:15:16 -05:00
Joshua Smith
1844b3956d
Land #4063 allow session lists
...
Note: the parsing for cmd_sessions needs to be revamped and DRYd up in
a separate PR.
2014-11-09 22:40:53 -06:00
Joshua Smith
03a988b5dc
Land #4150 , adds getsid command
...
Fixes #3787
2014-11-09 22:10:22 -06:00
William Vu
88810ce836
Land #4161 , "fullname" NilClass fix
2014-11-09 20:07:37 -06:00
William Vu
0e772cc338
Land #4161 , "stop" NilClass fix
2014-11-09 19:37:32 -06:00
OJ
eb830cb361
Idiomaticise the rubies
2014-11-10 07:44:36 +10:00
sinn3r
7980a7052c
Fix #4132 - msfvenom undefined method fullname for NilClass
2014-11-09 14:27:59 -06:00
sinn3r
8f3b1e71b3
Fix #4156 - NoMethodError undefined method `stop'
...
This will fix #4156 . It also fixes NoMethodError payload_exe
when I was trying to fix the undef 'stop' one
2014-11-09 14:07:02 -06:00
sinn3r
cd0dbc0e24
Missed another
2014-11-09 14:06:39 -06:00
Juan Escobar
9cce7643ab
update description and fix typos
2014-11-09 09:10:01 -05:00
Juan Escobar
5d17637038
Add CVE-2014-7146 PHP Code Execution for MantisBT
2014-11-09 08:00:44 -05:00
Pedro Ribeiro
b3c27452cd
Add full disclosure URL
2014-11-09 10:40:41 +00:00
Julio Auto
613f5309bb
Fix buggy calls to stop_service
2014-11-09 02:15:30 -06:00
Spencer McIntyre
104841babf
Add getsid to the python meterpreter
2014-11-08 20:57:24 -05:00
jvazquez-r7
bc5529396f
Land #4137 , @pedrib's module for Eventlog CVE-2014-6038/6039
2014-11-08 08:12:11 -06:00
Pedro Ribeiro
f680b666c7
Add github adv URL
2014-11-08 11:29:36 +00:00
Pedro Ribeiro
143033f657
Rename manageengine_pmp_sadmin.rb to manageengine_pmp_privesc.rb
2014-11-08 11:28:04 +00:00
Pedro Ribeiro
2843437ca9
Create exploit for CVE-2014-8499
2014-11-08 11:24:50 +00:00
Pedro Ribeiro
7d2d0aa166
Merge pull request #8 from rapid7/master
...
bla
2014-11-08 11:22:41 +00:00
Pedro Ribeiro
e7b448537f
Add OSVDB ids
2014-11-08 11:05:34 +00:00
Pedro Ribeiro
bf7c7688c0
Merge pull request #7 from jvazquez-r7/review_4137
...
Review Eventlog Analzyer exploit for CVE-2014-6038/6039
2014-11-08 11:04:28 +00:00
jvazquez-r7
9d6e0664a4
Guess service name and port
2014-11-07 20:56:01 -06:00
jvazquez-r7
a44640c9fc
Use single quotes
2014-11-07 20:48:04 -06:00
jvazquez-r7
7c1c08fc19
Use single quotes without interpolation
2014-11-07 20:46:47 -06:00
jvazquez-r7
0373156cce
Use unless over if not
2014-11-07 20:42:08 -06:00
jvazquez-r7
f5a920da99
Use || operator
2014-11-07 20:41:44 -06:00
jvazquez-r7
64754a5609
Delete unnecessary begin..end block
2014-11-07 20:38:36 -06:00
jvazquez-r7
0919f74a3d
Delete unused variable
2014-11-07 20:37:57 -06:00
jvazquez-r7
22b875d0f3
Reduce code complexity
2014-11-07 20:37:40 -06:00
jvazquez-r7
b1517e6ace
Delete unnecessary nil comparision
2014-11-07 20:34:13 -06:00
jvazquez-r7
aa1fec7f02
Use fail_with
2014-11-07 20:33:33 -06:00
jvazquez-r7
d630eac272
Reduce code complexity
2014-11-07 20:32:15 -06:00
jvazquez-r7
cea30b5427
Use built-in format for RPORT
2014-11-07 20:30:32 -06:00
jvazquez-r7
e99cc00a57
No more than 100 columns on description
2014-11-07 20:29:38 -06:00
William Vu
a830c28012
Land #4151 , downcase nil deref. fix
2014-11-07 11:43:22 -06:00
Jon Hart
2b7d25950b
Land #4148 , @wchen-r7 fixed #4133
2014-11-07 08:26:29 -08:00
sinn3r
e54442af36
Fix #4089 - undefined method `downcase' for nil:NilClass
2014-11-07 02:45:22 -06:00
sinn3r
0dbfecba36
Better method name
...
Should be srvhost, not lhost
2014-11-07 02:23:34 -06:00
Pedro Ribeiro
c00a3ac9cd
Add full disclosure URL
2014-11-07 08:06:21 +00:00
Samuel Huckins
71a96f256b
Land #4149 , readline adjustments
...
* Windows guard, DRYing
2014-11-07 00:09:48 -06:00
Joshua Smith
7b25e3be75
Land #4139 , Visual Mining NetCharts
...
landed after some touch up
2014-11-06 22:52:41 -06:00
Joshua Smith
7510fb40aa
touch up visual_mining_netcharts_upload
2014-11-06 22:50:20 -06:00
Joshua Smith
709ff1bbdb
touch up lib/rex/mime/message.rb
2014-11-06 22:48:34 -06:00
OJ
08e707225c
Add support for the getsid command
...
There has been Meterpreter work done as well to support this. But this
commit allows for a new 'getsid' command which tells you the sid of the
current process/thread. This can be used for things like determining
whether the current process is running as system. It could also be used
for golden ticket creation, among other things.
2014-11-07 10:38:22 +10:00
Trevor Rosen
b5220c8881
Update metasploit-framework-full.gemspec
...
Fix typo
2014-11-06 17:07:48 -06:00
Pedro Ribeiro
8a0249cdbf
Address Juan's points
2014-11-06 21:02:28 +00:00
Luke Imhoff
f494a9f3da
Don't depend on 'rb-readline' on Windows
...
MSP-11585
`rb-readline` gem doesn't work with Ruby Installer for 1.9.3 because of
`NoMethodError undefined method 'dlopen' for Fiddle:Module`. Removing
`rb-readline` may be a temporary fix it if turns out that this is a bug
with rb-readline or some other upstream bug.
2014-11-06 14:52:49 -06:00
Luke Imhoff
122928d952
Remove redundant rb-readline from Gemfile
...
MSP-11585
The entry in the gemspec is sufficient.
2014-11-06 14:51:10 -06:00
jvazquez-r7
64fe2dd7d6
Land #4143 , @kernelsmith's get_custom_exe fix
...
* Initializes the exe variable
* Fixes #4131
2014-11-06 14:39:57 -06:00
sinn3r
579481e5f8
Explain why I did this
...
Also tagging Fix #4133
2014-11-06 14:25:11 -06:00
sinn3r
f210ade253
Use SRVHOST for msvidctl_mpeg2
2014-11-06 14:23:21 -06:00
Luke Imhoff
8416985c9d
Give Threads UUIDs for spec run so caller can be correlated
...
Have 'metasploit/framework/spec/threads/suite/logger' generate a UUID
for each Thread. This UUID is printed on the "BEGIN Thread.new caller"
line and is assigned as a thread-local variable,
'metasploit/framework/spec/threads/logger/uuid'. In `after(:suite)`,
the log can be parsed to map the caller back to each UUID and then only
the UUID of the still existing threads is used to look up the caller and
print their stacktraces. This means only leaked threads callers will be
printed.
2014-11-06 14:05:35 -06:00
Joshua Smith
b199820d23
init exe as nil instead of ''
2014-11-06 13:31:37 -06:00
jvazquez-r7
6e51d84371
Land #4138 , @wchen-r7's reference cheking for module_reference.rb
...
* Fixes #4039
2014-11-06 10:51:29 -06:00
Tom Sellers
9295d9077e
Remove debugging output
2014-11-06 09:27:44 -06:00
Luke Imhoff
8f635a1d76
Remove empty define_task
...
MSP-11147
2014-11-06 09:11:31 -06:00
Luke Imhoff
8855e0731c
Fix multiline string indentation
...
MSP-11147
2014-11-06 09:11:12 -06:00
Luke Imhoff
8d06189a19
Tell use to run with rake spec to see Thread.new caller
...
MSP-11147
If the log isn't available, tell the user to rerun with `rake spec`
instead of printing nothing after the `:\n`, which looks incomplete.
2014-11-06 09:10:04 -06:00
Luke Imhoff
c1f1222783
Check that threads/suite.log exists before reading
...
MSP-11147
Even with leaked threads, there may be no log if the suite is run
without `rake spec`, such as when `rspec` is used directly to run a
subset of specs.
2014-11-06 09:07:11 -06:00
Tom Sellers
8bf6a34d6c
Fix empty session ID and cleanup
...
- Fixed handling of empty session IDs for those commands that required them
- Added help text for ranges with examples
2014-11-06 07:18:55 -06:00
sinn3r
f7e308cae8
Land #4110 - Citrix Netscaler BoF
2014-11-06 00:04:17 -06:00
Joshua Smith
861443d947
Land #4144 , fix default template.pdf
2014-11-05 23:13:16 -06:00
sinn3r
c2391bf011
Add an R in /Info for the trailer dictionary to make it readable
2014-11-05 22:28:37 -06:00
Joshua Smith
265c178c52
fixes #4131 , EXE::Custom NameError
2014-11-05 22:10:54 -06:00
jvazquez-r7
54c1e13a98
Land #4140 , @wchen-r7's default template for adobe_pdf_embedded_exe
...
* Fixes #4134
* Adds a default PDF template
2014-11-05 20:21:14 -06:00
jvazquez-r7
adefb2326e
Land #4124 , @wchen-r7 fixes #4115 adding HTTP auth support to iis_webdav_upload_asp
2014-11-05 18:14:33 -06:00
Jon Hart
496c8fa47d
Land #4136 , @todb-r7's fix to allow use of other ruby versions
...
Only rbenv and rvm have been tested.
For rbenv:
rbenv shell <VERSION>
For rvm:
rvm --create --versions-conf use <VERSION>@metasploit-framework
2014-11-05 15:27:53 -08:00
sinn3r
1b2554bc0d
Add a default template for CVE-2010-1240 PDF exploit
2014-11-05 17:08:38 -06:00
Jon Hart
973c639c0e
Add note about rbenv for rvm .versions.conf local override
2014-11-05 15:03:02 -08:00
jvazquez-r7
c833888c32
Just randomize
2014-11-05 15:53:06 -06:00
Luke Imhoff
d66c98b34d
Remove prior log/metasploit/framework/spec/threads/suite.log
...
MSP-11147
2014-11-05 15:51:43 -06:00
Luke Imhoff
d4d710cc3a
Merge branch 'feature/MSP-11130/metasploit-framework-spec-constants' into feature/MSP-11147/thread-leak-detection
...
MSP-11147
Merge to get framework instance cleanup, which should clean up a lot of
thread leaks too.
Conflicts:
Rakefile
lib/metasploit/framework/spec.rb
spec/spec_helper.rb
2014-11-05 15:47:59 -06:00
jvazquez-r7
79cabc6d68
Fix clean up
2014-11-05 15:46:33 -06:00
Luke Imhoff
097aa330e1
Log caller for each Thread.new for rake spec
...
MSP-11147
2014-11-05 15:34:35 -06:00
jvazquez-r7
c08993a9c0
Add module for ZDI-14-372
2014-11-05 15:31:20 -06:00
sinn3r
8da6e0bd5b
Fix bugs
2014-11-05 15:26:00 -06:00
sinn3r
5b8d9e1221
Fix typo
2014-11-05 15:14:35 -06:00
sinn3r
98f5ebd475
Only show bad refs when using -c
2014-11-05 15:07:40 -06:00
Luke Imhoff
96990fdc02
Fail before suite if more than 1 thread exists
...
MSP-11147
Detect thread leaks in a `before(:suite)` configured by
`Metasploit::Framework::Spec::Threads::Suite.configure!` and fail if any
leaks are found.
2014-11-05 14:38:43 -06:00
Pedro Ribeiro
e71ba1ad4a
Push exploit for CVE-2014-6038/39
2014-11-05 20:12:03 +00:00
Pedro Ribeiro
490d6d046b
Merge pull request #6 from rapid7/master
...
merge
2014-11-05 20:10:42 +00:00
Tod Beardsley
cca30b536f
Land #4094 , fixes for OWA brute forcer
...
Fixes #4083
Thanks TONS to @jhart-r7 for doing most of the work on this!
2014-11-05 14:00:26 -06:00
Tod Beardsley
a46839726e
Make OWA 2013 the default, other fixes
...
Thanks @jhart-r7!
See rapid7#4083 and see rapid7#4094
2014-11-05 13:56:37 -06:00
Tod Beardsley
6b0107190e
typo
2014-11-05 13:19:40 -06:00
Tod Beardsley
231d03bd3b
Allow for locally chosen rubies
...
By ignoring .versions.conf, we can allow users pick their own versions
of ruby without having to jump through a bunch of hoops on keeping
.ruby-version straight between local and remote branches.
2014-11-05 13:18:26 -06:00
Luke Imhoff
382d34d398
Fix spec.name in metasploit-framework-full
...
MSP-11578
Left in 'metasploit-framework-db' after copying and forgot to update to
'metasploit-framework-full'.
2014-11-05 12:40:31 -06:00
Luke Imhoff
63b4c0beba
Depend on metasloit-framework in optional gemspecs
...
MSP-11578
Optional gemspecs should depend on the minimal metasploit-framework
because they don't work without metasploit-framework's code.
2014-11-05 12:33:44 -06:00
jvazquez-r7
7ba705f23a
Add some randomized variables to JSP Payloads
...
Because the JASPER engine with Tomcat has been found
complaining about the out variable.
2014-11-05 12:16:33 -06:00
jvazquez-r7
468b4a399a
Fix Rex::MIME::Message specs
2014-11-05 11:43:55 -06:00
jvazquez-r7
741f99f118
Delete starting empty line
...
When header is empty it shouldn't add an starting empty
new line
2014-11-05 11:42:42 -06:00
Luke Imhoff
9137bd6527
Revert "Update Gemfile.lock"
...
MSP-11578
This reverts commit a3829b800d .
2014-11-05 11:10:51 -06:00
sinn3r
3310342a95
Add save-as feature
...
The tool produces A LOT OF results so it's really painful to manually
copy and paste and to be able to use the data. So it should automatically
save.
Tagging the issue here because I forgot to do it:
Fix #4039
2014-11-05 10:58:41 -06:00
Luke Imhoff
713578aea7
metasploit-framework-full.gemspec
...
MSP-11578
metasploit-framework-full depends on the minimal metasploit-framework
and all optional dependency gemspec: metasploit-framework-db and
metasploit-framework-pcap.
2014-11-05 10:20:09 -06:00
William Vu
40ee03ee63
Land #4126 , rm Travis testing for 2.0
2014-11-05 10:18:57 -06:00
sinn3r
f34ad57199
Check module references
2014-11-05 09:57:13 -06:00
Luke Imhoff
a3829b800d
Update Gemfile.lock
...
MSP-11578
2014-11-05 09:55:31 -06:00
Luke Imhoff
5619b6d554
Add metasploit-framework as dependency of metasploit-framework-pcap
...
MSP-11578
Any of the optional depenency gems should depend on the minimal
metasploit-framework as it supplies the versioning information.
2014-11-05 09:51:38 -06:00
Luke Imhoff
06222911f6
Move pcap bundler group to metasploit-framework-pcap.gemspec
...
MSP-11578
This will allow Metasploit Pro to use the
metasploit-framework-pcap.gemspec to ensure it has the correct version of
gems that were previously only in metasploit-framework's Gemfile and so
weren't being checked for version compatibility when Pro used
metasploit-framework.gemspec.
2014-11-05 09:40:57 -06:00
Luke Imhoff
3093ba8394
Explicitly require 'metasploit/credential' and 'metasploit_data_models'
...
By putting the db group into the metasploit-framework-db.gemspec,
bundler no longer automatically required 'metasploit/credential' and
'metasploit_data_models' because gems, such as metasploit-framework-db,
are expected to explictly require their dependencies.
2014-11-05 09:25:50 -06:00
Luke Imhoff
a56a063b84
Move db bundler group to metasploit-framework-db.gemspec
...
MSP-11578
This will allow Metasploit Pro to use the
metasploit-framework-db.gemspec to ensure it has the correct version of
gems that were previously only in metasploit-framework's Gemfile and so
weren't being checked for version compatibility when Pro used
metasploit-framework.gemspec.
2014-11-05 08:58:46 -06:00
Tom Sellers
2bec646393
rolling back a change
2014-11-05 06:49:06 -06:00
Tom Sellers
8aa6fca760
Minor fixes and status update
...
Minor tweaks after the PR from @kernelsmith
Remaining items:
1. Handle empty session IDs correctly, for example 'sessions -d' or 'sessions -k'
2. Find a method of explaining the range options in the help text
3. Retest all changed code areas
4. Edit PR Summary to reflect changes to the scope
2014-11-05 06:46:55 -06:00
Tom Sellers
ff6bc5cf68
Merge pull request #3 from kernelsmith/landing/4063-DRYer
...
modernizes & DRYs session/job ranges from kernelsmith
2014-11-05 06:05:14 -06:00
Joshua Smith
78a4ee686b
modernizes & DRYs session/job ranges
2014-11-04 23:33:31 -06:00
Jon Hart
ff8d481eec
Update description to remove comments about defaults. Default to 2013
2014-11-04 21:21:19 -08:00
Jon Hart
2c028ca7a6
Move redirect check before body check -- a redirect won't have a body
2014-11-04 14:19:21 -08:00
Jon Hart
7855ede2de
Move userpass emptiness checking into setup
2014-11-04 14:07:39 -08:00
William Vu
ebb8b70472
Land #4015 , another Android < 4.4 UXSS module
2014-11-04 15:52:29 -06:00
Tod Beardsley
f8593ca1b5
Land #4109 , tnftp savefile exploit from @wvu-r7
2014-11-04 15:44:13 -06:00
Tod Beardsley
5fb268bbdf
Updates to better OWA fix
2014-11-04 14:32:54 -06:00
Luke Imhoff
9f573e2d8d
Revert "Add .log extension to metasploit/framework/spec/constants/suite log"
...
MSP-11130
This reverts commit 4f986c4a48 .
Extension wasn't there because it was a directory name and a log file
name.
2014-11-04 14:03:54 -06:00
Tod Beardsley
714fd0bec6
Incorporate @jhart-r7's better fix
2014-11-04 14:02:37 -06:00
Luke Imhoff
dee02fc85b
Automatically clear previous log/metasploit/framework/spec/constants/each.log
...
MSP-11130
Have a task, 'metasploit:framework:spec:constants:each:clean' run before
`rake spec` that removes the previous
`log/metasploit/framework/spec/constants/each.log` so that the user doesn't
have to manually remove the load when removing
`Metasploit::Framework::Spec::Constants::Each.configure!` from
`spec/spec_helper.rb`.
2014-11-04 13:58:13 -06:00
nullbind
56a02fdb4a
added mssql_escalate_executeas_sqli.rb
2014-11-04 13:38:13 -06:00
Luke Imhoff
313d86982c
Log Spec::Constants::Each error instead of flag.
...
MSP-11130
Instead of writing `1` to the file and then printing a verbose message
in the spec task action, log the verbose message and just print the log
in the spec task action, so other tools can just look at the log when
not using `rake spec`.
NOTE: Failing specs due to unnecessary
`Metasploit::Framework::Spec::Constants::Each.configure!`
2014-11-04 13:36:52 -06:00
Luke Imhoff
1d09fa677e
log/remove-cleaner -> log/metasploit/framework/spec/constants/each.log
...
MSP-11130
Rename log file to match naming scheme for
Metasploit::Framework::Spec::Constants::Suite.
2014-11-04 13:21:47 -06:00
Luke Imhoff
4f986c4a48
Add .log extension to metasploit/framework/spec/constants/suite log
...
MSP-11130
2014-11-04 13:20:10 -06:00
Luke Imhoff
45fea32c77
Use 'Metasploit::Simple::Framework#modules loading' in 'payloads can be instantiated'
...
MSP-11130
Use `expect_to_load_module_ancestor` and `load_and_create_module` in
favor of the custom code in 'payloads can be instantiated'.
2014-11-04 13:06:52 -06:00
Luke Imhoff
c115ad3c36
Use load_and_create_module in modules_spec
...
MSP-11130
Reuse 'Msf::Simple::Framework#modules loading' context in 'all modules
with module type can be instantiated' instead of using the similar code.
2014-11-04 12:59:59 -06:00
Jon Hart
b0e388f4c3
Land #3516 , @midnitesnake's snmp_enumusers fix for Solaris, OS X
2014-11-04 08:23:16 -08:00
Luke Imhoff
7cb0954a6e
Add manual removal of log/remove-cleaner to Each removal
...
MSP-11130
When removing `Metasploit::Framework::Spec::Constants::Each.configure`
from spec/spec_helper.rb,
`Metasploit::Framework::Spec::Constants::Each.define_task` will see the
`log/remove-cleaner` from the last run unless it is manually removed.
2014-11-04 10:10:28 -06:00
Luke Imhoff
b0f1b2a1f7
Merge branch 'master' into feature/MSP-11130/metasploit-framework-spec-constants
...
MSP-11130
Conflicts:
Rakefile
2014-11-04 10:10:12 -06:00
Luke Imhoff
cc4e553c11
Remove Metasploit::Framework::Spec::Constants::Each.configured!
...
MSP-11130
No longer needed because all before suite leaks have been fixed.
2014-11-04 09:50:16 -06:00
Luke Imhoff
0c769e2fd7
Fix constant leaks in Msf::Util::EXE spec
...
MSP-11130
Remove global $framework as it loads modules prior to suite run and they
are not cleaned up.
2014-11-04 09:48:55 -06:00
Luke Imhoff
78ea93044b
Fix Msf::PayloadGenerator spec constant leaks
...
MSP-11130
Remove the constant PAYLOAD_FRAMEWORK as it leads to a
Msf::Simple::Framework instance that is not cleaned up and loads modules
prior to the beginning of the suite run.
2014-11-04 09:48:02 -06:00
Luke Imhoff
ff0391cdc7
Fix derive_module_ancestor_names
...
MSP-11130
Wrap :reference_name in an Array since :ancestor_reference_names is
expected to be an Array.
2014-11-04 09:40:55 -06:00
nullbind
15119d2a0f
comment fix-sorry
2014-11-04 09:07:08 -06:00
nullbind
f108d7b20a
fixed code comment
2014-11-04 08:51:27 -06:00
Joshua Smith
b45cbfdf53
Land 4127, fix broken refactor in util/exe
2014-11-04 07:51:12 -06:00
agix
333d420c94
Fix refactoring bug from 23 october in util/exe
...
23 October, {} instead of #{} totally break windows service generation
https://github.com/rapid7/metasploit-framework/commit/f19b093529f3b3aacefb69f8133ab788859445d1#diff-0f5729034d8b0b321e738f2fc047854fL578
2014-11-04 11:59:36 +01:00
midnitesnake
1a2b1db0d5
Merge pull request #3 from jhart-r7/landing-3516-jhart
...
Numerous cleanups for snmp_enumusers
2014-11-04 06:46:32 +00:00
jvazquez-r7
400ef51897
Land #4076 , exploit for x7chat PHP application
2014-11-03 18:22:04 -06:00
jvazquez-r7
3bf7473ac2
Add github pull request as reference
2014-11-03 18:18:42 -06:00
jvazquez-r7
44a2f366cf
Switch ranking
2014-11-03 18:06:09 -06:00
jvazquez-r7
039d3cf9ae
Do minor cleanup
2014-11-03 18:04:30 -06:00
William Vu
277fd5c7a1
Land #4123 , release fixes
2014-11-03 16:20:00 -06:00
Juan Escobar
7e4248b601
Added compatibility with older versions, Updated descriptions and fixed issue with Ubuntu 12.04
2014-11-03 16:42:50 -05:00
Tod Beardsley
30ff0a3f55
Remove 2.0 Travis testing
...
Fixes #4125
2014-11-03 15:32:20 -06:00
Tod Beardsley
0199e4d658
Land #3770 , resolve random stager bugs
2014-11-03 14:15:14 -06:00
sinn3r
9a27984ac1
switch from error to switch
2014-11-03 13:56:41 -06:00
sinn3r
a823ca6b2f
Add support for HTTP authentication. And more informative.
2014-11-03 13:46:53 -06:00
Tod Beardsley
0b39c2ed85
Land #4084 , prep for Ruby 2.1
2014-11-03 13:43:50 -06:00
Tod Beardsley
51b96cb85b
Cosmetic title/desc updates
2014-11-03 13:37:45 -06:00
HD Moore
8aecd5e4a5
Address the two open comments from @jlee-r7
2014-11-03 12:33:11 -06:00
nullbind
fbe3adcb4c
added mssql_escalate_executeas module
2014-11-03 11:29:15 -06:00
Luke Imhoff
9ea1240cbb
Default modules_path
...
MSP-11130
Default `:modules_path` to use the `#modules_path` left for
'Msf::Simple::Framework#modules#loading''s `#load_and_create_module`.
2014-11-03 11:06:49 -06:00
Luke Imhoff
0296d1784d
Derive ancestor reference names from reference name
...
MSP-11130
For 'Msf::Simple::Framework#modules loading''s load_and_create_modules,
don't require `:ancestor_reference_names` when the `:module_type` is not
payload as the one ancestor reference name will be the same as
`:reference_name`.
2014-11-03 10:59:01 -06:00
Jon Hart
8f197d4918
Move to build_probe
2014-11-03 08:41:51 -08:00
Jon Hart
05dd3fa4ba
rport, not datastore['RPORT']
2014-11-03 08:26:11 -08:00
Luke Imhoff
d97bc52d8a
Complete documentation for 'Msf::Simple::Framework::Modules loading'
...
MSP-11130
2014-11-03 09:47:29 -06:00
Luke Imhoff
f0001eb9e6
Extract 'Msf::Simple::Framework#modules loading'
...
MSP-11130
'Msf::Simple::Framework#modules loading' defines
`#load_and_create_module`, which takes the :ancestor_reference_names,
:modules_path, :module_type, and :reference_name of the module whose
ancestors to load and the reference name to create. A default modules
path, the first 'modules' path for the Rails application is available in
in the `#modules_path` let.
2014-11-03 08:59:06 -06:00
OJ
4f0fbaa60c
Land #4112 - Fix pointer types
2014-11-01 10:55:19 +10:00
jvazquez-r7
83360ba9d2
Land #4114 , @wchen-r7's change to handle Rex::HostUnreachable
2014-10-31 19:23:45 -05:00
sinn3r
6f013cdcaf
Missed these
2014-10-31 18:48:48 -05:00
jvazquez-r7
f43a6e9be0
Use PDWORD_PTR and DWORD_PTR
2014-10-31 17:35:50 -05:00
sinn3r
d6a830eb6e
Rescue the correct exception: Rex::HostUnreachable
2014-10-31 16:43:33 -05:00
Jon Hart
121ebdfef6
update_info
2014-10-31 13:17:50 -07:00
Tom Sellers
0b8b0499f3
- Added range support to sessions -c and sessions -s
...
- Added check for un-detach-able sessions
- Added back the check for session.interactive? when detaching sessions
- Collapse build_jobs_array and build_sessions_array to build_range_array
- Added check for empty or invalid parameters to detach and kill [session | job]
- Reworked session id sanity check around line 1660
- RuboCop/Style guide change: Array.new -> []
- Misc RuboCop/Style guide spacing changes
2014-10-31 15:02:17 -05:00
Jon Hart
83475bb929
Disable UnneededPercentQ in Rubocop
2014-10-31 12:19:17 -07:00
Jon Hart
f5ee2d7948
Update .rubocop.yml to use correct Metrics namespace
2014-10-31 12:15:32 -07:00
Jon Hart
b99e71dcdd
Example UDPScanner style cleanup, move most to UDPScanner
2014-10-31 12:14:04 -07:00
Jon Hart
c921611821
Move default probe and result store to UDPScanner, since most need it
2014-10-31 12:02:21 -07:00
jvazquez-r7
6154b7d55f
Fix style again
2014-10-31 12:51:48 -05:00
jvazquez-r7
203af90a44
Fix style
2014-10-31 12:50:23 -05:00
jvazquez-r7
0c23733722
Use hungarian notation
2014-10-31 12:47:50 -05:00
jvazquez-r7
8e547e27b3
Use correct types
2014-10-31 12:37:21 -05:00
Jon Hart
ff0b52cffb
Example per-batch vprint, a useful default
2014-10-31 10:31:31 -07:00
Jon Hart
1f6658639f
More sane % printing for aux scanner
2014-10-31 10:25:01 -07:00
Jon Hart
94d4388af9
Improvements to example UDPScanner
2014-10-31 09:53:10 -07:00
Jon Hart
f16720bb55
Trailing ,
2014-10-31 09:39:34 -07:00
Jon Hart
f66c43475b
More sane % printing for aux scanner
2014-10-31 09:39:21 -07:00
Jon Hart
77cd6dbc8b
Usability improvements to UDPScanner
...
* Add RPORT as a regular option, define rport
* Add CPORT as an advanced option, define cport
* Change CHOST to an advanced option
* Use a more sane THREADS value since hosts are scanned in batches
2014-10-31 09:20:14 -07:00
Joe Vennix
1e9f9ce425
Handle invalid JSON errors and fix typo.
2014-10-31 11:01:49 -05:00
sinn3r
cd16ee8791
Land #4107 - Bump to ruby-1.9.3-p550 for CVE-2014-8080
2014-10-31 10:27:09 -05:00
Jon Hart
d9f0a10737
Add new example template for scanning UDP services
2014-10-31 08:06:31 -07:00
jvazquez-r7
40bf44bd05
Don't allow 127.0.0.1 as SRVHOST
2014-10-31 08:19:15 -05:00
sinn3r
f6f7d93fa2
Land #4111 - a little something for the holiday
2014-10-30 23:45:21 -05:00
HD Moore
9b61ae5f63
This is halloween.
...
THISISHALLOWEEN=1 ./msfconsole
2014-10-30 23:35:12 -05:00
jvazquez-r7
7d2fa9ee94
Delete unnecessary to_s
2014-10-30 22:59:22 -05:00
William Vu
953a642b0e
Finally write a decent description
2014-10-30 22:51:42 -05:00
sinn3r
64f4777407
Land #4091 - Xerox DLM injection
2014-10-30 22:15:16 -05:00
sinn3r
b7a1722b46
Pass msftidy, more descriptive name and description
2014-10-30 22:14:18 -05:00
William Vu
e3ed7905f1
Add tnftp_savefile exploit
...
Also add URI{HOST,PORT} and {,v}print_good to HttpServer.
2014-10-30 20:38:16 -05:00
jvazquez-r7
8fdea5f74c
Change module filename
2014-10-30 20:34:24 -05:00
jvazquez-r7
9404e24b24
Update module information
2014-10-30 20:33:38 -05:00
Jon Hart
77433a6504
Land #3507/#3463, a communal effort around improving splunk_upload_app_exec
2014-10-30 18:29:43 -07:00
Jon Hart
1a37a6638c
Fix splunk_upload_app_exec to work on new installs. Style
2014-10-30 18:28:56 -07:00
Jon Hart
55f245f20f
Merge #3507 into local, recently updated branch of master for landing
2014-10-30 17:28:20 -07:00
OJ
cc7f7c9986
Land #4108 - Avoid local offsets in CVE-2014-4113
2014-10-31 09:08:51 +10:00
OJ
cbd616bbf5
A few sneaky style changes, but no functional ones
...
Changes were purely for style, and Juan was happy to let me make them
as part of the merge.
2014-10-31 09:08:11 +10:00
jvazquez-r7
6574db5dbb
Fix the 64 bits code
2014-10-30 17:01:59 -05:00
James Lee
d86d8e9092
Remove the now-unnecessary -L
2014-10-30 15:36:16 -05:00
Tod Beardsley
98607231e0
Bump to ruby-1.9.3-p550
2014-10-30 15:29:31 -05:00
Luke Imhoff
8b4767449f
Fix constant leaks in Msf::EncodedPayload spec
...
MSP-11130
Switch to using 'Msf::Simple::Framework' shared context and explicit
module loading instead of loading all moduels to just test with one.
2014-10-30 14:56:47 -05:00
Luke Imhoff
325c01e45d
Log constants leaked before and after suite
...
MSP-11130
Some constants can be leaked before suite if module are loaded during
spec loading, such as if a framework instance in made in the context
body of a spec instead of in a before callback.
2014-10-30 14:04:07 -05:00
sinn3r
92ad2c434d
Land #4081 - Xerox workcentre 5735 LDAP service redential extractor
2014-10-30 13:52:07 -05:00
sinn3r
470a067384
Final changes
2014-10-30 13:51:44 -05:00
sinn3r
912f6c8eee
Land #4085 - Xerox Administrator Console Password Extract
2014-10-30 13:37:32 -05:00
sinn3r
02b1c5c4bc
Final changes
2014-10-30 13:37:02 -05:00
sinn3r
127d1640da
Print password
2014-10-30 13:27:40 -05:00
Luke Imhoff
ae0a98785f
Print when Metasploit::Framework::Spec::Constants::Each before(:each) cleans
...
MSP-11130
Print to stderr the full description of the example when
`Metasploit::Framework::Spec::Constants.configure!`'s `before(:each)`
cleans constants as it may clean constants that are leaked from the
class level at parse time.
2014-10-30 12:34:55 -05:00
jvazquez-r7
03a84a1de3
Search the AccessToken
2014-10-30 12:17:03 -05:00
Joe Vennix
6dc13f90cd
Update descriptions to mention Webview bugginess.
2014-10-30 10:55:56 -05:00
Joe Vennix
0ad9f95806
Remove stray alert() for debugging.
2014-10-30 10:52:06 -05:00
Joe Vennix
88040fbce0
Add another Android < 4.4 UXSS exploit.
2014-10-30 10:34:14 -05:00
Luke Imhoff
c8e4745d6d
Fail rake spec if leak tracking unnecessary
...
MSP-11130
Fail `rake spec` if
`Metasploit::Framework::Spec::Constants::Each.configure!`'s
`before(:each)` does not clean all leaked constants and if should be
removed so that it does not interefore with future specs.
2014-10-30 09:37:17 -05:00
Jon Hart
15e1c253fa
Numerous cleanups for snmp_enumusers
...
* Bring in line with Ruby standards
* More sane format for adding new OSs
* Better logging for use on larger networks
* Better error handling
2014-10-29 23:54:32 -07:00
James Lee
667f1ca876
Move readline choice into a method
2014-10-29 22:33:23 -05:00
James Lee
7b77bbedaa
Better explanations
2014-10-29 22:32:56 -05:00
James Lee
867329d4b3
Fix readline by mucking with load path
2014-10-29 22:14:49 -05:00
jvazquez-r7
ac939325ce
Add module first version
2014-10-29 21:11:57 -05:00
Peter Arzamendi
9d56f0298a
Changed upper XXX to lower XXX.
2014-10-29 20:09:02 -05:00
Luke Imhoff
c2bd75b587
Clean up leaked constants
...
MSP-11130
2014-10-29 15:50:47 -05:00
Peter Arzamendi
b35a8935db
Updated get_once for get_once undefined method and EOFError
2014-10-29 13:47:07 -05:00
James Lee
4fb58ebba2
Force msfconsole to use stdlib's readline with -L
2014-10-29 13:21:31 -05:00
Luke Imhoff
7e2897277b
Rename shared example file to match name
...
MSP-11130
2014-10-29 12:54:29 -05:00
Deral Heiland
64a59e805c
Fix a simple typo
2014-10-29 12:40:24 -04:00
Luke Imhoff
892aeaf727
Metasploit::Framework::Spec::Constants cleaner
...
MSP-11130
Shared context will calls `Metasploit::Framework::Spec::Constants.clean
after each example.
2014-10-29 11:31:17 -05:00
Deral Heiland
1bf1be0e46
Updated to module based feedback from wchen-r7
2014-10-29 11:42:07 -04:00
Juan Escobar
2e53027bb6
Fix value of X7C2P cookie and typo
2014-10-29 08:32:36 -05:00
Peter Arzamendi
2bc8767751
Updated rescue to catch other errors from the socket API
2014-10-29 08:03:28 -05:00
Juan Escobar
9f21ac8ba2
Fix issues reported by wchen-r7
2014-10-28 21:31:33 -05:00
Jon Hart
ba5035c7ef
Prevent calling match when there is no WWW-auth header
2014-10-28 17:13:57 -07:00
Jon Hart
a5d883563d
Abort if 2013 desired but redirect didn't happen
2014-10-28 15:59:22 -07:00
Jon Hart
7ca4ba26b0
Show more helpful vprint messages when login fails
2014-10-28 15:48:04 -07:00
Jon Hart
bce8f34a71
Set proper Cookie header from built cookie string
2014-10-28 15:41:36 -07:00
Jon Hart
a3e1e11987
Ensure necessary cookies are present in OWA 2010 login response
2014-10-28 15:40:15 -07:00
Luke Imhoff
0d4b22ce7a
Detect constant leaks in individual examples
...
MSP-11130
`Metasploit::Framework::Spec::Constants::Each.configure!` will set up an
`after(:each)` callback that will fail the example if there are leaked
constants. Leaked constants are cleaned up to prevent misattribution.
2014-10-28 15:50:24 -05:00
Peter Arzamendi
604cad9fbb
Updated timeout to default to 45 seconds to wait for the print job to finish.
2014-10-28 15:45:28 -05:00
Peter Arzamendi
b17d6a661d
Moved module to auxiliary/gather and updated timeout to wait for the printer job to complete before we try to grab the creds.
2014-10-28 15:23:47 -05:00
Peter Arzamendi
0e42cf25d1
Updated per wchen-r7's recommendations. Still waiting to hear on Nokogiri
2014-10-28 15:13:16 -05:00
Luke Imhoff
f9b1f2a424
Extract Metasploit::Framework::Spec::Constants::Suite
...
MSP-11130
`Metasploit::Framework::Spec::Constants::Suite` extracts out
`LOG_PATHNAME`, `configure!`, and `define_task` as those piece are
specific to handling constant leaks for the entire suite. This is in
preparation for `Metasploit::Framework::Spec::Constants::Each`.
2014-10-28 15:07:32 -05:00
Tod Beardsley
9c028c1435
Fixes #4083 , make the split nil-safe
...
In the reported case, the expected cookies were not present on the
response, thus, the second split was trying to split a `nil`. This
solves the immediately problem by a) splitting up the splits into
discrete sections, and b) `NilClass#to_s`'ing the result of the first
split.
This makes the split safe. Now, there may be a larger issue here where
you're not getting the expected cookies -- it sounds like the target in
this case is responding differently, which implies that the module isn't
going to be effective against that particular target. But, at least it
won't crash. It may merely try fruitlessly the entire run, though. I
can't know without looking at a pcap, and in the reported case, a pcap
seems unlikely since this was a bug found in the field.
2014-10-28 14:59:20 -05:00
Luke Imhoff
3ec9cf54c9
Filter non-loaded-module constants from leaked constants
...
MSP-11130
Constants from library Modules or Classes should not be reported as
leaked since they have been required and should be persistent between
spec runs.
2014-10-28 14:05:27 -05:00
Luke Imhoff
1a1f3335b8
Extract Metasploit::Framework::Spec::Constants.full_name
...
MSP-11130
Extract method to convert child constant names to module full names so
it can be reused 'Metasploit::Framework::Spec::Constants tracker' shared
context.
2014-10-28 13:53:48 -05:00
William Vu
71a6ec8b12
Land #4093 , cups_bash_env_exec CVE-2014-6278
2014-10-28 12:47:51 -05:00
Brendan Coles
57baf0f393
Add support for CVE-2014-6278
2014-10-28 17:10:19 +00:00
William Vu
3de5c43cf4
Land #4050 , CUPS Shellshock
...
Bashbleeded!!!!!!!!!!!
2014-10-28 11:59:31 -05:00
Peter Arzamendi
1012cd8d6b
Updated based on wchen-r7 feedback.
2014-10-28 11:38:50 -05:00
Luke Imhoff
a0a9c2140b
Log leaked constants and fail rake spec on leak
...
MSP-11130
Instead of printing the leaked constants to stderr, log them to
`log/leaked-constants.log`. In task action for spec, read
`log/leaked-constants.log`. If it exists, print each leaked constants
(and it appropriate it's module full name) and then exit with 1. If the
file does not exist, do nothing.
2014-10-28 11:21:35 -05:00
Brendan Coles
78b199fe72
Remove CVE-2014-6278
2014-10-28 16:18:24 +00:00
Joe Vennix
c6bbc5bccf
Merge branch 'landing-4055' into upstream-master
2014-10-28 11:18:20 -05:00
Deral Heiland
9021e4dae6
Xerox Workcentre firmware injection exploit
2014-10-28 11:15:43 -04:00
jvazquez-r7
5e0993d756
Add OJ as author
2014-10-28 09:58:34 -05:00
jvazquez-r7
c1b82bac0e
Land #4082 , @OJ's cleanup and improvements for CVE-2014-4113
2014-10-28 09:49:18 -05:00
Tod Beardsley
dade6b97ba
Land #4088 , wget exploit
...
Fixes #4077 as well.
2014-10-28 09:03:07 -05:00
Brendan Coles
a060fec760
Detect version in check()
2014-10-28 12:28:18 +00:00
Tom Sellers
c6519d08c0
Merge pull request #2 from wvu-r7/pr/4063
...
Change killing back to stopping
2014-10-28 06:07:52 -05:00
William Vu
4251ad199e
Change killing back to stopping
...
Got a little excited with the copypasta, I guess.
2014-10-28 05:49:30 -05:00
Tom Sellers
88d093eb7e
Merge pull request #1 from wvu-r7/pr/4063
...
Add support for jobs -k ranges from @wvu
2014-10-28 05:00:54 -05:00
William Vu
5547890002
Add support for sessions -d ranges
2014-10-28 03:07:46 -05:00
William Vu
36c85b7150
Add support for jobs -k ranges
2014-10-28 03:01:53 -05:00
sinn3r
e31c9f579d
Land #3987 - Buffalo Linkstation NAS Login Scanner
2014-10-28 01:45:57 -05:00
HD Moore
64c206fa62
Add module for CVE-2014-4877 (Wget)
2014-10-27 23:37:41 -05:00
William Vu
4e12fdb057
Land #4087 , COPYING copyright year update
2014-10-27 23:34:15 -05:00
Tod Beardsley
d8b71b94a7
With 66 days left in 2014, may as well update
2014-10-27 23:07:57 -05:00
HD Moore
958fe2e5bc
Allow PASV port specification, lands #4086
2014-10-27 22:24:14 -05:00
Tod Beardsley
d8cf45ef67
Allow FTP server exploits pick a PASV port
...
This makes it somewhat easier to use FTP server exploit modules in
somewhat more restrictive networks, where you might only have a few
inbound ports to choose from.
2014-10-27 22:21:54 -05:00
James Lee
77d4623c44
Fix respond_to specs for protected methods
2014-10-27 19:39:32 -05:00
Peter Arzamendi
0b225d94b1
Xerox Admin password extractor.
2014-10-27 19:26:40 -05:00
Juan Escobar
2ba2388889
Fix issues reported by jvasquez
2014-10-27 19:15:39 -05:00
jvazquez-r7
b990b14a65
Land #3771 , @us3r777's deletion of jboss_bshdeployer STAGERNAME option
2014-10-27 18:09:35 -05:00
jvazquez-r7
cf9d53fb50
Undo mixin modification
2014-10-27 18:09:03 -05:00
OJ
908094c3d3
Remove debug, treat warnings as errors
2014-10-28 09:04:02 +10:00
OJ
0a03b2dd48
Final code tidy
2014-10-28 08:59:33 +10:00
OJ
6f3b373f01
More code tidy and unifying of stuff
2014-10-28 08:37:49 +10:00
parzamendi-r7
f7f6cff327
Update xerox_workcentre_5XXX_ldap.rb
2014-10-27 17:23:47 -05:00
jvazquez-r7
e6e4aaba3e
Land #3518 , @midnitesnake's fix for solaris sadmind_exec
2014-10-27 17:19:06 -05:00
jvazquez-r7
0b6406ae40
Land #4080 , @todb-r7's switch to TLS1 on TCP and TCPServer
2014-10-27 17:15:36 -05:00
OJ
0e761575c8
More code tidying, reduced x64/x86 duplication
2014-10-28 08:09:18 +10:00
OJ
062eff8ede
Fix project settings, make files, start tidying of code
2014-10-28 07:58:19 +10:00
midnitesnake
bc57e5d057
Merge pull request #2 from jvazquez-r7/review_3518
...
Force perl encoding
2014-10-27 21:32:17 +00:00
Luke Imhoff
dae114a7f3
Document how to derive reference_name from ancestors
...
MSP-11145
2014-10-27 15:59:12 -05:00
Tod Beardsley
7d34452448
TCP and TCPServer should use TLS1 by default
2014-10-27 15:55:50 -05:00
Peter Arzamendi
f119abbf8c
Xerox workcentre 5735 LDAP credential extractor
2014-10-27 15:52:12 -05:00
jvazquez-r7
373ce8d340
Use perl encoding
2014-10-27 15:30:02 -05:00
Luke Imhoff
485860ebfb
Uncomment specs used to cause failure
...
MSP-11145
Restore commented out specs so that that the untested payloads check
passes.
2014-10-27 15:27:16 -05:00
Luke Imhoff
216360d664
Add missing require
...
MSP-11145
2014-10-27 15:19:59 -05:00
William Vu
1508be6254
Fix whitespace in lib/msf/ui/banner.rb for #4073
2014-10-27 14:49:44 -05:00
William Vu
7f66d18cfd
Clean up whitespace a bit
2014-10-27 14:49:27 -05:00
Luke Imhoff
f37ca3e82b
SPEC -> SPEC_OPTS
...
MSP-11145
Fix typo in .travis.yml
2014-10-27 14:46:40 -05:00
jvazquez-r7
9da83b6782
Update master changes
2014-10-27 14:35:30 -05:00
Luke Imhoff
43552a8304
Tag module specs with :content
...
MSP-11145
Tag content-related specs so they can be run separately in travis-ci.
2014-10-27 14:25:34 -05:00
William Vu
626cd55b5e
Land #4073 , improved banner selection
2014-10-27 14:20:10 -05:00
Luke Imhoff
c84febea5f
tools/missing-payload-tests.rb
...
MSP-11145
**NOTE: Failing specs**
Add a tool for reading `log/untested-payload.log` and
`framework.payloads` to determine `context`s to add
`spec/modules/payloads_spec.rb` to test the untested payloads.
2014-10-27 13:03:31 -05:00
Spencer McIntyre
04a99f09bb
Land #4064 , Win32k.sys NULL Pointer Dereference
2014-10-27 14:01:07 -04:00
jvazquez-r7
f24129933f
Land jvazquez-r7#22, @zeroSteiner 64 bits version
2014-10-27 12:19:06 -05:00
jvazquez-r7
042d29b1d6
Compile binaries in house
2014-10-27 12:18:33 -05:00
William Vu
090d9b95d1
Land #4078 , pureftpd_bash_env_exec desc. update
2014-10-27 12:12:09 -05:00
William Vu
950fc46e4b
Normalize description
2014-10-27 12:09:39 -05:00
Jon Hart
b8c9ef96ca
Land #4003 , @nstarke's Login Scanner for WD MyBook Live NAS
2014-10-27 09:57:43 -07:00
Jon Hart
765b5e686c
Use configured method and URI rather than duplicated values
2014-10-27 09:56:39 -07:00
Spencer McIntyre
830f631da4
Make the check routine less strict
2014-10-27 12:51:20 -04:00
Luke Imhoff
1df82ea273
Fix typo in file name
...
MSP-11145
2014-10-27 11:34:26 -05:00
Luke Imhoff
605f48e58d
Detect leaked constants under Msf::Modules
...
MSP-11130
Detect constants leaked under Msf::Modules after the suite completes.
2014-10-27 11:13:43 -05:00
James Lee
7081026ae6
Fix some specs broken by 2.x's new rules
...
* default utf-8 everywhere broke tests in lib/rex/text_spec that dealt
with binary data
* new protected rules
2014-10-27 10:28:24 -05:00
James Lee
d4e2d533bf
Add ruby 2.x to travis testing
2014-10-27 10:28:24 -05:00
Spencer McIntyre
d6a63ccc5e
Remove unnecessary C debugging code for the exploit
2014-10-27 11:24:23 -04:00
sinn3r
aa5dc0a354
100 columns per line
2014-10-27 10:24:11 -05:00
sinn3r
7e56948191
Update description about pureftpd_bash_env_exec
...
Make exploitable requirements more obvious
2014-10-27 10:23:06 -05:00
Spencer McIntyre
46b1abac4a
More robust check routine for cve-2014-4113
2014-10-27 11:19:12 -04:00
Spencer McIntyre
5fa0403ac5
Land zeroSteiner/metasploit-framework#10 check clean up
2014-10-27 11:05:16 -04:00
jvazquez-r7
4406972b46
Do version checking minor cleanup
2014-10-27 09:32:42 -05:00
Spencer McIntyre
2d76a8da4a
Land zeroSteiner/metasploit-framework#9 clean up
2014-10-27 09:11:19 -04:00
Juan Escobar
848f24a68c
update module description
2014-10-27 02:07:16 -05:00
root
d66dc88924
Add PHP Code Execution for X7 Chat 2.0.5
2014-10-27 01:01:31 -05:00
jvazquez-r7
0aaebc7872
Make GetPtiCurrent USER32 independent
2014-10-26 18:51:02 -05:00
jvazquez-r7
c319ea91b3
Delete verbose print
2014-10-26 17:31:19 -05:00
jvazquez-r7
34697a2240
Delete 'callback3' also from 32 bits version
2014-10-26 17:28:35 -05:00
HD Moore
313c2407ad
Re-adds db.creds RPC call, lands #4075
2014-10-26 16:01:29 -05:00
Spencer McIntyre
7416c00416
Initial addition of x64 target for cve-2014-4113
2014-10-26 16:54:42 -04:00
scriptjunkie
aba25cb28c
Make RPC creds work again
2014-10-26 15:50:40 -05:00
Brendan Coles
554935e60b
Add check() and support CVE-2014-6278
2014-10-26 18:11:36 +00:00
scriptjunkie
6e39c5be70
land #2134 psexec_command improvements
2014-10-26 09:21:07 -05:00
scriptjunkie
4dfbce425a
use vprintf...
2014-10-26 09:20:32 -05:00
scriptjunkie
c31fb0633d
Merge branch 'wp-psexeccmd' of github.com:webstersprodigy/metasploit-framework into webstersprodigy-wp-psexeccmd
2014-10-26 09:05:25 -05:00
Tom Sellers
13b6f1cf48
Syntax changes
2014-10-25 09:39:15 -05:00
nstarke
44f7db4798
Refactoring Success Case
...
I have refactored the code so that it will work with
non-root accounts.
2014-10-25 13:31:36 +00:00
midnitesnake
e5347b4bdb
Merge pull request #1 from jvennix-r7/merge-snmp-bsd-fix
...
Use the SNMP fix from master.
2014-10-25 08:21:51 +01:00
Joshua Smith
0d449cb88d
resolves merge conflict between #4071 / #4072
2014-10-24 13:11:35 -05:00
Joe Vennix
136c2c4377
Use the SNMP fix from master.
2014-10-24 13:01:06 -05:00
Spencer McIntyre
65a50bdc83
Land #4071 , Change be_false to be_falsey in exe_spec
2014-10-24 13:52:58 -04:00
Spencer McIntyre
91dc875af5
Remove seemingly useless file among banners
2014-10-24 13:11:58 -04:00
Spencer McIntyre
c1a61e3b4e
Support an MSFLOGO env var and logo enumeration
2014-10-24 13:07:28 -04:00
Joshua Smith
e583cce7f2
changes be_false to be_falsey in exe_spec
2014-10-24 11:11:44 -05:00
Joshua Smith
4fa8aaecd2
Land #4069 , rspec coverage for eicar corruption
2014-10-24 11:05:30 -05:00
Joshua Smith
72f2b57924
Land #4070 , fix inverted eicar corruption logic
...
Fixes #4068
2014-10-24 10:48:58 -05:00
Joe Vennix
813a2f8c1c
Oops, false not true.
2014-10-24 10:48:58 -05:00
Joe Vennix
028fb3279f
Add spec for ensuring is_eicar_corrupted? is false.
2014-10-24 10:48:58 -05:00
Joshua Smith
a9e52437f0
fixes inverted EICAR corruption logic
2014-10-24 10:27:13 -05:00
Joe Vennix
2efdd14ad2
Oops, false not true.
2014-10-24 10:18:40 -05:00
Joe Vennix
280ee26545
Add spec for ensuring is_eicar_corrupted? is false.
2014-10-24 10:16:18 -05:00
Spencer McIntyre
82f41d56a6
Add [user_]logos_directory to Msf::Config
2014-10-24 10:52:05 -04:00
Joshua Smith
3b8067e9a2
fixes refactor error in msf/util/exe
2014-10-23 22:15:19 -05:00
Joshua Smith
34f29f218c
really resolve merge conflicts
2014-10-23 21:51:33 -05:00
Joshua Smith
bf63d85e5c
fixes merge conflicts msfpayload & exe
2014-10-23 21:43:46 -05:00
Nicholas Starke
ed9b7eae57
Merge pull request #1 from jhart-r7/landing-4003-jhart
...
Cleanup. Sanity check in setup. vprint
2014-10-23 19:49:32 -05:00
jvazquez-r7
d8eaf3dd65
Add exploit source code
2014-10-23 18:59:58 -05:00
jvazquez-r7
a75186d770
Add module for CVE-2014-4113
2014-10-23 18:51:30 -05:00
sinn3r
7cb4320a76
Land #3561 - unix cmd generic_sh encoder
2014-10-23 15:48:00 -05:00
sinn3r
13fd6a3374
Land #4046 - Centreon SQL and Command Injection
2014-10-23 13:17:00 -05:00
sinn3r
ce841e57e2
Rephrase about centreon.session
2014-10-23 13:15:55 -05:00
Trevor Rosen
33ca914fc1
Merge branch 'landing/4045' into upstream-staging/great-backport
...
Land #4045
2014-10-23 13:02:29 -05:00
sinn3r
889045d1b6
Change failure message
2014-10-23 12:55:27 -05:00
Trevor Rosen
75333702a2
Merge branch 'land/4028' into upstream-master
...
Land #4028
2014-10-23 12:36:35 -05:00
Luke Imhoff
48d6880f1d
Add docs for untested payload testing
...
MSP-11145
Add docs to rake task, shared examples, and share contexts for how to
use all 3 together.
2014-10-23 11:17:05 -05:00
Luke Imhoff
2a82f45f06
Remove unneeded section comment
...
MSP-11145
2014-10-23 10:53:24 -05:00
Luke Imhoff
f827a1c761
Extract untested-payloads.log checker spec task action
...
MSP-11145
Extract the spec task action which errored out if
`log/untested-payloads.log` exists to
`Metasploit::Framework::Spec::UntestedPayloads.define_task`.
2014-10-23 10:24:33 -05:00
Luke Imhoff
a7317cb86c
Extract 'untested payloads' shared context
...
MSP-11145
Detects if payloads are untested when using the 'payload can be
instantiated' shared examples.
2014-10-23 09:55:14 -05:00
Luke Imhoff
6c3c830efb
Extract 'payload can be instantiated' shared example
...
MSP-11145
Extracted so that pro can use it.
2014-10-23 09:35:52 -05:00
Luke Imhoff
88839e841a
Extract 'all modules with module type can be instantiated' shared example
...
MSP-11145
Extracted so it can be used by pro.
2014-10-23 09:31:44 -05:00
Tom Sellers
2a6a8245cf
Allow killing multiple specific sessions
2014-10-23 05:56:26 -05:00
Joshua Smith
f19b093529
cleans & DRYs exploit/exe & util/exe & msfpayload
2014-10-23 01:10:38 -05:00
Jon Hart
83df08aaa7
Properly encode body and catch invalid configs
2014-10-22 22:43:06 -07:00
Jon Hart
c765100efd
Land #4004 , @martinvigo's LastPass master password extraction module
2014-10-22 16:34:54 -07:00
Jon Hart
29b61984c5
Update to use correctly joined path
2014-10-22 16:34:17 -07:00
sinn3r
42cd288bc0
Land #4057 - Bring back TCP::max_send_size and TCP::send_delay options
...
Fix #3967
2014-10-22 16:23:15 -05:00
sinn3r
0ea03c00a5
Use print_brute instead of print_good for format consistency
2014-10-22 16:14:45 -05:00
James Lee
a5a84886ee
Make sure vnc closes the socket
2014-10-22 15:53:05 -05:00
HD Moore
e479a6308c
Update session.shell_upgrade to match #3401 , lands #4058
2014-10-22 15:26:33 -05:00
Tim Wright
7f7f257426
fix session.shell_upgrade after #3401
2014-10-22 21:22:10 +01:00
Tim Wright
c488e40959
Land #3401 , shell to meterpreter upgrade by @TomSellers
...
Merge branch 'landing-3401' into upstream-master
2014-10-22 20:51:18 +01:00
Tim Wright
6d04c46897
delete the old script
2014-10-22 20:49:21 +01:00
Tim Wright
b8c3fadb9e
python 3 is supported now too :)
2014-10-22 20:10:48 +01:00
Tim Wright
8c3c73a72d
inline the error message
2014-10-22 20:08:14 +01:00
Tim Wright
2ab73688dc
use framework.threads to launch cleanup thread
2014-10-22 19:40:29 +01:00
Tim Wright
22fc6496ac
Merge branch 'pr/3401' into landing-3401
2014-10-22 19:23:01 +01:00
Jon Hart
ce8a9941ea
Cleanup. Sanity check in setup. vprint
2014-10-22 10:36:24 -07:00
Jon Hart
7b33ff1363
Land #3767 , @jvazquez-r7's specs for Rex::Encoder::XDR
2014-10-22 09:22:53 -07:00
James Lee
bb119b840a
Move Tcp specs into their own shared example
...
All the Tcp options formerly in RexSocket got moved, this just brings
the specs in line with the new reality.
2014-10-22 09:16:14 -05:00
James Lee
46acf08e2d
Merge remote-tracking branch 'upstream/master' into bug/msp-11497/loginscanner-tcp-evasions
2014-10-22 09:09:34 -05:00
nstarke
ee3dd3a2ac
More Fixes for WD MyBook Live Scanner
...
Fixes include removing deregistered options
from credentials collection object and adding proof
when there is no response
2014-10-22 03:06:21 +00:00
James Lee
0fcd1ac4f6
Restore tcp evasions to smb_login
2014-10-21 18:59:11 -05:00
James Lee
e1a7e902d6
Re-enable tcp evasions for more LoginScanners
...
Untested since I don't have targets for these.
2014-10-21 18:58:28 -05:00
jvazquez-r7
3bffd24e61
Land #4056 , @wchen-r7's fix for Loginscanner specs
2014-10-21 17:37:30 -05:00
sinn3r
49b088d112
Use be_a
2014-10-21 17:15:54 -05:00
sinn3r
9de1c95b22
It's Connection timed out
2014-10-21 16:53:47 -05:00
sinn3r
d1881108cf
Fix db2 rspec
2014-10-21 16:35:20 -05:00
sinn3r
b5d536d165
Fix mysql rspec
2014-10-21 16:34:10 -05:00
sinn3r
ebbfa56f24
Land #4052 - Fix Proxies datastore option for LoginScanners
...
Fixes #3836
Fixes #3959
Fixes #3963
2014-10-21 15:43:22 -05:00
sinn3r
6d11ec8477
These mods support Proxies, so make the option visible for the user
2014-10-21 15:39:24 -05:00
Luke Imhoff
f66c714105
Clear log/untested-payloads.log
...
MSP-11145
Delete log/untested-payloads.log when all payloads are tested so that
`rake spec` does not exist 1 when it should exit 0.
2014-10-21 13:53:48 -05:00
sinn3r
db7c420d8d
Merge the latest changes
2014-10-21 13:49:42 -05:00
Luke Imhoff
da450f49a4
Fail rake spec if untested payloads
...
MSP-11145
Add action to spec task that will cause spec to exit(1) if
log/untested-payloads.log exists. The untested payloads are then
printed with instructions of which spec to update.
2014-10-21 13:46:39 -05:00
James Lee
f9f8c413a8
Derp, ssh modules don't include Tcp for #proxies
2014-10-21 13:28:13 -05:00
Luke Imhoff
003d8547c4
Failing with untested payloads to log
...
MSP-11145
Log untested payloads to log/untested-payloads.log.
2014-10-21 13:23:15 -05:00
sinn3r
79d393c5aa
Resolve merge conflicts
...
Conflicts:
lib/msf/core/exploit/smb.rb
lib/msf/core/exploit/tcp.rb
modules/auxiliary/scanner/http/axis_login.rb
2014-10-21 13:06:35 -05:00
Luke Imhoff
8f3e064e0b
Connect actual_ancestor_reference_names to tests
...
MSP-11145
2014-10-21 12:56:59 -05:00
Luke Imhoff
653c5ccf4a
Log untested payloads to stderr
...
MSP-11145
This commit is a proof that the logger works. It does no connect the
adding tested payloads reference names to the
actual_ancestor_reference_name_set to show that the logger is working.
2014-10-21 12:44:01 -05:00
James Lee
83b1d270cd
Fix ftp and mssql
2014-10-21 11:09:39 -05:00
James Lee
8b2dcac730
Fix telnet
2014-10-21 11:08:41 -05:00
James Lee
4705aeb762
Restore tcp evasions to ftp, pop3, vnc
2014-10-21 11:06:55 -05:00
Luke Imhoff
162c62f205
Fix ancestor reference names in spec
...
MSP-11145
ancestor_reference_name derivation was using the source_location of
initialize, but that didn't work for payload modules whose #initialize
was only in mixin Modules.
2014-10-21 10:26:28 -05:00
James Lee
7d150ce0dd
Add tcp evasions to mysql
2014-10-21 10:05:18 -05:00
James Lee
2fcb1004fb
Move tcp options to Tcp::Client out of RexSocket
2014-10-21 09:59:26 -05:00
James Lee
e76ee294a1
Restore tcp evasions to telnet
2014-10-21 09:44:55 -05:00
Luke Imhoff
9dfbbbde7d
Add missing require
...
MSP-11145
2014-10-21 09:39:31 -05:00
Luke Imhoff
556bf361a2
Failing payloads spec
...
MSP-11145
Spec fails due to missing requires.
2014-10-21 09:33:01 -05:00
James Lee
cb9a77c06b
Fix NoMethodError when unable to connect
...
Derp.
2014-10-21 08:58:45 -05:00
James Lee
6f3b26f5e9
Remove tcp evasions from Http
...
Can't use 'em anyway
2014-10-21 08:27:29 -05:00
nstarke
82b74d5f3c
Fixes to MyBook Live Module
...
This commit contains three fixes as requested on PR
#4003 . Those include:
+ Removing extraneous puts statement
+ Checking for valid response
+ SSL support.
2014-10-21 00:50:40 +00:00
nstarke
70b13819d9
Adding Login Scanner for MyBook Live
...
This is a LoginScanner auxiliary module for Western
Digital MyBook Live NAS devices as well as the spec
for testing.
2014-10-21 00:50:40 +00:00
jvazquez-r7
d6f4c02c2a
Land #3979 , @wchen-r7 fixes #3976 , http_login not using TARGETURI, neither uri normalization
2014-10-20 18:10:57 -05:00
Spencer McIntyre
f886ab6f97
Land #4020 , Jenkins-CI CSRF token support
2014-10-20 19:03:24 -04:00
jvazquez-r7
74ac16081f
Land #3981 , @wchen-r7 Fixes #3974 , axis_login.rb does not normalize URI
2014-10-20 17:51:13 -05:00
jvazquez-r7
00f137cdcf
Land #4040 , @nullbind's MS SQL privilege escalation through SQLi
2014-10-20 16:23:50 -05:00
jvazquez-r7
acc590b59c
Modify metadata
2014-10-20 16:22:10 -05:00
jvazquez-r7
1381c7fb37
Modify title
2014-10-20 16:17:47 -05:00
jvazquez-r7
323680c31a
Clean code
2014-10-20 16:17:06 -05:00
jvazquez-r7
3d03a8c788
Land @jhart-r7's fix for decode_int
2014-10-20 14:44:06 -05:00
Luke Imhoff
bf23926314
Spec all posts can be instantiated
...
MSP-11145
2014-10-20 13:42:21 -05:00
jvazquez-r7
c77a0984bd
Land #3989 , @us3r777's exploit for CVE-2014-7228, Joomla Update unserialize
...
the commit.
empty message aborts
2014-10-20 13:39:08 -05:00
Luke Imhoff
535dea1d7d
Spec all nops can be instantiated
...
MSP-11145
2014-10-20 13:35:57 -05:00
Luke Imhoff
594b0bf7bb
Spec all exploits can be instantiated
...
MSP-11145
2014-10-20 13:32:55 -05:00
jvazquez-r7
4e6f61766d
Change module filename
2014-10-20 13:31:22 -05:00
Luke Imhoff
103382a2ef
Spec all encoders can be instantiated
...
MSP-11145
2014-10-20 13:31:12 -05:00
jvazquez-r7
e202bc10f0
Fix title
2014-10-20 13:30:44 -05:00
Jon Hart
82de2eb1f3
Fix Rex::Encoder::XDR.decode_int! to properly handle short data
2014-10-20 11:30:13 -07:00
jvazquez-r7
f07c5de711
Do code cleanup
2014-10-20 13:27:48 -05:00
Luke Imhoff
2c997d99b5
Extract module instantiation context to shared examples
...
MSP-11145
2014-10-20 13:21:22 -05:00
Luke Imhoff
7e9398e1af
Spec all auxiliary modules can be instantiated
...
MSP-11145
2014-10-20 12:52:07 -05:00
Tod Beardsley
85f48a3fb2
Land #3738 , SMBServer file descriptor updates
2014-10-20 12:40:43 -05:00
sinn3r
dbaf9c5857
Land #4001 - HP Data Protector EXEC_INTEGUTIL Remote Code Execution
2014-10-20 11:44:21 -05:00
HD Moore
935a23296d
Updates to NAT-PMP, lands #4041
2014-10-20 11:26:26 -05:00
sinn3r
6b9742b444
Land #3966 - Add exploit for CVE-2014-4872 BMC / Numara Track-It!
2014-10-20 11:23:23 -05:00
William Vu
c1c5b0bf6a
Land #4051 , typo and grammar fixes
2014-10-20 11:08:37 -05:00
Tod Beardsley
6812b8fa82
Typo and grammar
2014-10-20 11:02:09 -05:00
jvazquez-r7
052a9fec86
Delete return
2014-10-20 10:52:33 -05:00
jvazquez-r7
199f6eba76
Fix check method
2014-10-20 10:46:40 -05:00
James Lee
3051b6c5ba
Clean up exceptions
...
Of particular note is mysql, who was rescuing Rex::ConnectionTimeout
*after* Rex::ConnectionError, which never would have fired anyway.
2014-10-20 10:27:02 -05:00
us3r777
16101612a4
Some changes to use primer
...
Follow wiki How-to-write-a-module-using-HttpServer-and-HttpClient
2014-10-20 17:26:16 +02:00
James Lee
b7d69bec83
Restore proxies to ssh scanners
2014-10-20 10:19:06 -05:00
us3r777
1e143fa300
Removed unused variables
2014-10-20 16:58:41 +02:00
jvazquez-r7
57fe829f96
Switch generic_sh's rank to ManualRanking
2014-10-20 09:34:19 -05:00
jvazquez-r7
c991c5e377
Readd generic_sh encoder
2014-10-20 09:33:34 -05:00
nullbind
036d43ba37
fixed logic bug
2014-10-19 20:56:29 -05:00
Martin Vigo
a7dc0b9f07
Merge pull request #3 from jhart-r7/landing-4004-jhart
...
Final cleanup of LastPass module -- track account, more *print_ cleaning
2014-10-19 17:19:48 -07:00
Jon Hart
2985b39267
Land #3980 , @wchen-r7 fixed #3975
2014-10-19 17:11:06 -07:00
Jon Hart
88c1647c80
Loot the passwords, obviously
2014-10-19 13:11:10 -07:00
Jon Hart
0971d7c3ac
Remove ... from prints, only map a browser if we found something
2014-10-19 13:05:11 -07:00
Jon Hart
967800eed0
Track account name for more useful table and prints
2014-10-19 12:59:51 -07:00
Jon Hart
5a05246682
Consistent case in *print_*
2014-10-19 12:30:50 -07:00
William Vu
08715791ed
Land #4048 , rsync scanner version check
2014-10-19 14:14:02 -05:00
fmunozs
4976b9a2d9
Merge pull request #1 from zeroSteiner/fix-pr4020-login
...
Retry the script page request to get the token
2014-10-19 13:51:18 -05:00
Spencer McIntyre
005baa7f7e
Retry the script page request to get the token
...
After logging in to Jenkins the script console page
needs to be requested again to get the CSRF token.
2014-10-19 14:04:16 -04:00
Brendan Coles
0ede70e7f6
Add exploit module for CUPS shellshock
2014-10-19 17:58:49 +00:00
ikkini
c2174c7910
return if no version response received
2014-10-19 00:29:36 +02:00
nullbind
1e2f1eaee0
cleaning up
2014-10-18 12:00:11 -05:00
Martin Vigo
09faf2584f
Merge pull request #2 from jhart-r7/landing-4004-jhart
...
Fix multiuser LastPass extraction, print/vprint cleanup
2014-10-17 20:22:20 -07:00
sinn3r
d1523c59a9
Land #3965 - BMC Track-It! Arbitrary File Upload
2014-10-17 19:47:42 -05:00
Jon Hart
a30663e412
Fix multiuser LastPass extraction, print/vprint cleanup
2014-10-17 17:40:19 -07:00
James Lee
329a600b84
Add tcp evasion options to mssql_login
2014-10-17 17:40:21 -05:00
James Lee
6498ed0dc8
Report the actual host that failed to connect
...
Instead of the eventual target where our proxy chain will connect. In
the usual case (no Proxies set), this will be the same output as before.
When proxies are given, the user will see that the first proxy
connection is actually what failed.
2014-10-17 17:37:04 -05:00
sinn3r
8b5a33c23f
Land #4044 - MS14-060 "Sandworm"
2014-10-17 16:46:32 -05:00
William Vu
d5b698bf2d
Land #3944 , pkexec exploit
2014-10-17 16:30:55 -05:00
William Vu
ce40c1152a
Land #4014 , msfconsole spinnerz
2014-10-17 16:25:31 -05:00
jvazquez-r7
70f8e8d306
Update description
2014-10-17 16:17:00 -05:00
jvazquez-r7
e52241bfe3
Update target info
2014-10-17 16:14:54 -05:00
jvazquez-r7
7652b580cd
Beautify description
2014-10-17 15:31:37 -05:00
jvazquez-r7
d831a20629
Add references and fix typos
2014-10-17 15:29:28 -05:00
Martin Vigo
afed6a0b8a
Merge pull request #1 from jhart-r7/landing-4004-jhart
...
Refactoring of LastPass post module
2014-10-17 12:54:04 -07:00
Jon Hart
d2a00b208e
Minor style cleanup to appease Rubocop
2014-10-17 12:50:18 -07:00
Luke Imhoff
080ea3e56a
Merge branch 'staging/great-backport' into feature/MSP-11126/msf-module-reorg
...
MSP-11126
2014-10-17 14:28:13 -05:00
jvazquez-r7
c39e7c1472
Land #20 , @wchen-r7's description update
2014-10-17 14:02:47 -05:00
Luke Imhoff
06fbbf7001
Fully-qualified Msf::NormalRanking in Msf::Module::Ranking
...
MSP-11126
Needed due to loss of `Msf` lexical scope.
2014-10-17 13:58:57 -05:00
sinn3r
ef1556eb62
Another update
2014-10-17 13:56:37 -05:00
jvazquez-r7
8fa648744c
Add @wchen-r7's unc regex
2014-10-17 13:46:13 -05:00
Luke Imhoff
43354774e1
Fully qualified Msf::RankingName in Msf::Module::Ranking
...
MSP-11126
To compensate for loss of `Msf` lexical scope.
2014-10-17 13:43:51 -05:00
William Vu
10f3969079
Land #4043 , s/http/http:/ splat
...
What is a splat?
2014-10-17 13:41:07 -05:00
Luke Imhoff
ae45c1b9d3
Msf::Module::Rank -> Msf::Module::Ranking
...
MSP-11126
So that mixin module won't appear as Rank constant that Msf::Module
subclasses are supposed to define.
2014-10-17 13:39:53 -05:00
Jon Hart
d97fe548b9
Store the browser name in LastPass loot
2014-10-17 11:33:31 -07:00
Joshua Smith
19e8a50573
Land 3847, specs for Rex::Oui
2014-10-17 13:22:51 -05:00
Jon Hart
43238c7324
Simplify LastPass extraction. Track what browser that puked creds
2014-10-17 11:19:36 -07:00
Joshua Smith
32faa0bc62
Land 3796, specs for Rex::Encoder::Alpha2 encoders
2014-10-17 13:15:00 -05:00
Tod Beardsley
a431bff13f
@wvu-r7 is a skilled negotiator. s/stdout/stderr/
2014-10-17 13:13:44 -05:00
Luke Imhoff
a6a2886faa
Fully-qualify Msf::OptionContainer references
...
MSP-11126
2014-10-17 13:09:27 -05:00
Luke Imhoff
112b5988f2
Add missing autoload to fix loading on travis-ci
...
MSP-11126
`Msf::Module::Failure` fails to load on travis-ci probably due to a load
order difference, so add `:Failure` to autoloads in `Msf::Module`.
2014-10-17 13:05:59 -05:00
Trevor Rosen
22f5347660
Merge branch 'landing/4042' into upstream-master
...
Land #4042
the commit.
2014-10-17 12:51:50 -05:00
Luke Imhoff
0c00c7cc50
Fully-qualifiy Msf::MODULE_TYPES constants
...
MSP-11126
Fully-qualify `Msf::MODULE_TYPES`, `Msf::MODULE_ANY`,
Msf::MODULE_ENCODER`, `Msf::MODULE_EXPLOIT`, `Msf::MODULE_NOP`,
`Msf::MODULE_AUX`, `Msf::MODULE_PAYLOAD`, `Msf::MODULE_POST` so that
their usage isn't dependent on nested lexical scoping.
2014-10-17 12:43:40 -05:00
Tod Beardsley
5978bd5e62
Control the startup msg with -q, too
2014-10-17 12:41:58 -05:00
William Vu
dbfe398e35
Land #4037 , Drupageddon exploit
2014-10-17 12:39:59 -05:00
William Vu
a514e3ea16
Fix bad indent (should be spaces)
...
msftidy is happy now.
2014-10-17 12:39:25 -05:00
William Vu
f2328e679f
Land #4034 , POODLE scanner
2014-10-17 12:36:48 -05:00
William Vu
367ea5d3db
Add disclosure date
2014-10-17 12:35:28 -05:00
Tod Beardsley
a45b21b6bf
-q will quiet the animation, too
2014-10-17 12:32:28 -05:00
Tod Beardsley
ccdaf2b576
Fix the banner
...
Turns out these will be broken in outstanding PRs for a while. At least
they won't be merge conflicts.
2014-10-17 12:23:23 -05:00
Jon Hart
9177b931fd
Refactoring of LastPass module to use correct Firefox path on *nix
2014-10-17 10:20:55 -07:00
Luke Imhoff
200d64040d
Fully-qualify Msf::ServiceState
...
MSP-11152
Replace unqualified `ServiceState` with `Msf::ServiceState`.
2014-10-17 11:58:11 -05:00
Luke Imhoff
7ffd07c44d
Remove protected method from specs examples
...
MSP-11126
2014-10-17 11:49:01 -05:00
Luke Imhoff
575717681c
Extract Msf::Module::Privileged shared examples
...
MSP-11126
2014-10-17 11:48:36 -05:00
URI Assassin
35d3bbf74d
Fix up comment splats with the correct URI
...
See the complaint on #4039 . This doesn't fix that particular
issue (it's somewhat unrelated), but does solve around
a file parsing problem reported by @void-in
2014-10-17 11:47:33 -05:00
Luke Imhoff
172afd180a
Extract Msf::Module::Privileged
...
MSP-11126
2014-10-17 11:45:03 -05:00
Luke Imhoff
45302b9403
Extract Msf::Module::UUID shared examples
...
MSP-11126
2014-10-17 11:34:35 -05:00
Luke Imhoff
cbae9be5b5
Extract Msf::Module::UUID
...
MSP-11126
2014-10-17 11:31:56 -05:00
Tod Beardsley
ad501b25e4
Filename move to be less redundant
2014-10-17 11:25:14 -05:00
Luke Imhoff
d86eda5f1d
Extract Msf::Module::Author shared examples
...
MSP-11126
2014-10-17 11:20:23 -05:00
Luke Imhoff
a59e635913
Extract Msf::Module::Author
...
MSP-11126
2014-10-17 11:17:12 -05:00
jvazquez-r7
e5903562ee
Delete bad/incomplete validation method
2014-10-17 10:36:01 -05:00
nullbind
bf92769ba2
added mssql_escalate_dbowner_sqli
2014-10-17 10:25:20 -05:00
Luke Imhoff
9f32cbd476
Use :: to force top-level constant resolution
...
MSP-11152
When `Msf::DBManager::Import::MetasploitFramework` is included in
`Msf::DBManager::Import`, it's child namespace of
`Msf::DBManager::Import::MetasploitFramework::Zip becomes resolvable as
`Zip` in `Msf::DBManager::Import` methods, so need to use `::Zip` to
cause `Zip` to be resolved from rubyzip gem.
2014-10-17 10:15:59 -05:00
Luke Imhoff
13923a8ca5
Fully-qualify Msf::DBImportError
...
MSP-11152
Constant was unqualified in some of the reorganized Msf::DBManager code
because that code was take advantage of the old nested lexical scope
that included `Msf`.
2014-10-17 09:29:01 -05:00
jvazquez-r7
7ac416763e
Land #18 , @wchen-r7 description update
2014-10-17 09:12:06 -05:00
Luke Imhoff
e822920298
Msf::Module::Author -> Msf::Author
...
MSP-11126
`Msf::Module::Author` was already aliased to `Msf::Author`. This just
moved `Msf::Module::Author` to that alias to free up
`Msf::Module::Author` so it can be used for a concern for
`Msf::Module`'s author methods.
2014-10-17 08:59:54 -05:00
sinn3r
a79427a659
I shoulda checked before git commit
2014-10-17 00:54:45 -05:00
sinn3r
4c0048f26a
Update description
2014-10-17 00:46:17 -05:00
sinn3r
3a63fa12b8
'ppsx_module_smaller' to branch cve_2014_4114
2014-10-17 00:10:57 -05:00
William Vu
e242bf914f
Land #4031 , fixes for pureftpd_bash_env_exec
2014-10-16 19:55:09 -05:00
jvazquez-r7
1d16bd5c77
Fix vulnerability discoverer
2014-10-16 18:01:45 -05:00
jvazquez-r7
807f1e3560
Fix target name
2014-10-16 17:58:45 -05:00
jvazquez-r7
bf8dce574a
Add ppsx template
2014-10-16 17:55:22 -05:00
jvazquez-r7
c1f9ccda64
Fix ruby
2014-10-16 17:55:00 -05:00
jvazquez-r7
e40642799e
Add sandworm module
2014-10-16 16:37:37 -05:00
Luke Imhoff
ebc62cf9c9
Spec Msf::Module::Author
...
MSP-11126
Bare minimum of methods to assist with moves.
2014-10-16 16:03:28 -05:00
Luke Imhoff
839657abec
Extract Msf::Module::Network shared examples
...
MSP-11126
2014-10-16 15:54:35 -05:00
Luke Imhoff
b5039c3817
Extract Msf::Module::Network
...
MSP-11126
2014-10-16 15:51:59 -05:00
Luke Imhoff
ee9623c11e
Remove class method examples moved to shared examples
...
MSP-11126
2014-10-16 15:41:28 -05:00
Luke Imhoff
244e4a9954
Extract Msf::Module::Search shared examples
...
MSP-11126
2014-10-16 15:40:19 -05:00
Luke Imhoff
be945d26fc
Extract Msf::Module::FullName shared examples
...
MSP-11126
2014-10-16 15:33:13 -05:00
Luke Imhoff
2e538bd72d
Extract Msf::Module::Search
...
MSP-11126
2014-10-16 15:27:54 -05:00
Luke Imhoff
7743fdb2f9
Extract Msf::Module::FullName
...
MSP-11126
2014-10-16 15:24:59 -05:00
Jon Hart
8fdae8fbfb
Move protocol and lifetime to mixin, use correct map_target if CHOST
2014-10-16 13:24:17 -07:00
Luke Imhoff
0e53548c82
Extract Msf::Target
...
MSP-11126
2014-10-16 15:13:18 -05:00
Luke Imhoff
e5cc456be7
Extract Msf::Platform
...
MSP-11126
2014-10-16 15:11:59 -05:00
Luke Imhoff
27c006a8f9
Extract Msf::SiteReference
...
MSP-11126
2014-10-16 15:09:55 -05:00
Luke Imhoff
9981271e2a
extract Msf::Reference
...
MSP-11126
2014-10-16 15:03:21 -05:00
Luke Imhoff
c8730ca55b
Extract Msf::Author
...
MSP-11126
2014-10-16 14:59:15 -05:00
Luke Imhoff
fe5ffa9cec
Standardize on autoload over require
...
MSP-11126
Standardize on autoload to prevent trying to use colliding names for
included Module with Modules/Classes just under the namespace.
2014-10-16 14:58:08 -05:00
Luke Imhoff
c501e1e58a
Extract Msf::Module::Rank shared examples
...
MSP-11126
2014-10-16 14:41:59 -05:00
Luke Imhoff
d5c7a50e86
Extract Msf::Module::Rank
...
MSP-11126
2014-10-16 14:39:33 -05:00
Luke Imhoff
925cd63171
Extrat Msf::Module::Type shared examples
...
MSP-11126
2014-10-16 14:28:43 -05:00
Luke Imhoff
e6f442697b
Extract Msf::Module::Type
...
MSP-11126
2014-10-16 14:23:21 -05:00
Brandon Perry
353d2f79cc
tweak pw generation
2014-10-16 12:06:19 -07:00
Brandon Perry
5f8c0cb4f3
Merge branch 'drupal' of https://github.com/FireFart/metasploit-framework into drupageddon
2014-10-16 11:53:54 -07:00
Christian Mehlmauer
c8dd08f605
password hashing
2014-10-17 15:52:47 +02:00
Brandon Perry
23b7b8e400
fix for version 7.0-7.31
2014-10-16 11:53:48 -07:00
Luke Imhoff
e418f98d45
arch -> Msf::Module::Arch
...
MSP-11126
2014-10-16 13:21:11 -05:00
Luke Imhoff
28af6a490b
Extract Msf::Module::Arch shared examples
...
MSP-11126
2014-10-16 13:16:57 -05:00
Luke Imhoff
44b2e5e35c
Extract Msf::Module::Arch
...
MSP-11126
2014-10-16 13:14:56 -05:00
Luke Imhoff
a2dc3b754f
Extract Msf::Module::ModuleInfo shared examples
...
MSP-11126
2014-10-16 13:10:15 -05:00
Luke Imhoff
31c93e9dbc
Extract Msf::Module::ModuleInfo
...
MSP-11126
2014-10-16 13:01:42 -05:00
James Lee
40b360555f
Make the error message a little more useful
2014-10-16 12:47:13 -05:00
Brandon Perry
9bab77ece6
add urls
2014-10-16 10:36:37 -07:00
Brandon Perry
b031ce4df3
Create drupal_drupageddon.rb
2014-10-16 16:42:47 -05:00
Brandon Perry
5c4ac48db7
update the drupal module a bit with error checking
2014-10-16 10:32:39 -07:00
Trevor Rosen
c503e8a3d8
Merge branch 'landing/4026' into upstream-master
...
Land #4026
* db.rb (DBManager) now in multiple files
* Cucumber coverage for DB-related msfconsole commands
2014-10-16 11:52:57 -05:00
Luke Imhoff
f8ada87e86
Extract Msf::Module::Options shared examples
...
MSP-11126
2014-10-16 11:24:03 -05:00
Luke Imhoff
f9caa4d25e
Extract Msf::Module::Options
...
MSP-11126
Methods for registering, derigsterings, and validating options.
2014-10-16 11:14:42 -05:00
Tod Beardsley
8cf10be779
Don't assume SSLv3 is set (kill FP+s)
2014-10-16 10:43:58 -05:00
Tod Beardsley
0b67efd51e
Add a POODLE scanner and general SSL version scan
2014-10-16 10:27:37 -05:00
Trevor Rosen
b02dc7a44f
Merge branch 'landing/3971' into HEAD
...
Land #3791 - specs for code reorg
2014-10-16 10:26:51 -05:00
Luke Imhoff
c50cb2eb8a
Extract Msf::Module::UI::*::Verbose and shared examples
...
MSP-11126
2014-10-16 10:05:45 -05:00
Luke Imhoff
a3afb92ee2
Extract Msf::Module::UI::Line shared examples
...
MSP-11126
2014-10-16 09:51:23 -05:00
Luke Imhoff
a9a6f0c5f9
Extract Msf::Module::UI::Line
...
MSP-11126
2014-10-16 09:50:07 -05:00
Luke Imhoff
96864b3892
Extract Msf::Module::UI::Message shared examples
...
MSP-11126
2014-10-16 09:45:17 -05:00
Luke Imhoff
bc2bd99698
Extract Msf::Module::UI::Message
...
MSP-11126
2014-10-16 09:39:30 -05:00
Luke Imhoff
4d9f7db15a
Extract Msf::Module::Compatibility
...
MSP-11126
2014-10-16 09:29:31 -05:00
Luke Imhoff
f5d09f735e
Extract Msf::Module::Compatibility
...
MSP-11126
2014-10-16 09:14:57 -05:00
Luke Imhoff
9b10a3f1dc
Extract Msf::Module::DataStore shared examples
...
MSP-11126
2014-10-16 09:14:44 -05:00
Luke Imhoff
85169d5e8d
Extract Msf::Module::DataStore
...
MSP-11126
2014-10-16 09:03:23 -05:00
Luke Imhoff
6a194b3a88
Extract Msf::Module::ModuleStore shared examples
...
MSP-11126
2014-10-16 09:03:12 -05:00
Luke Imhoff
f068d669d6
Extract Msf::Module::ModuleStore
...
MSP-11126
2014-10-16 09:03:07 -05:00
Luke Imhoff
370daaed5e
Extract Msf::Module::Failure
...
MSP-11126
Move `Msf::Module::Failure` to a file of its own.
2014-10-16 09:02:55 -05:00
Spencer McIntyre
09069f75c2
Fix #4019 , fix NameError peer and disconnect in check
2014-10-16 08:32:20 -04:00
Martin Vigo
8fc87aa721
Solve conflict
2014-10-15 23:40:27 -07:00
Martin Vigo
36d6220f8f
Make use of Rex::Ui::Text::Table
2014-10-15 23:13:53 -07:00
Martin Vigo
bb421859d3
Refactor code and add support for all Windows
2014-10-15 22:15:54 -07:00
Martin Vigo
c7e0ced02b
Remove useless conditions
2014-10-15 21:29:47 -07:00
Martin Vigo
2bdc703930
Remove useless condition
2014-10-15 21:16:06 -07:00
Martin Vigo
5fa39782b8
Fix unused variable
2014-10-15 21:10:50 -07:00
Martin Vigo
8fc0f0955e
Add support for Firefox
2014-10-15 20:44:20 -07:00
Martin Vigo
47794510c3
Add support for Firefox in XP
2014-10-15 20:44:19 -07:00
Martin Vigo
b15b05fa7b
Merge branch 'master' of github.com:martinvigo/metasploit-framework
2014-10-15 20:43:06 -07:00
Martin Vigo
6fb1287b3d
Merge remote-tracking branch 'upstream/master'
2014-10-15 20:35:58 -07:00
Martin Vigo
484d98d0a8
Meet rubocop and msftify rules
2014-10-15 20:17:36 -07:00
Martin Vigo
85e6febe09
Add module to extract/decrypt LastPass credentials
2014-10-15 20:17:36 -07:00
Samuel Huckins
50a2f4c2a7
Adding missing lock changes from #4030
2014-10-15 20:39:13 -05:00
Samuel Huckins
87d8fc187e
Lands #4030 , latest meterpreter bins
2014-10-15 20:35:26 -05:00
Tod Beardsley
4f32cc8c01
Bump to meterpreter_bins 0.0.10
2014-10-15 19:36:48 -05:00
Tod Beardsley
8afe4ab5e0
Update Gemspec for meterpreter 0.0.8
2014-10-15 19:00:19 -05:00
James Lee
41a57b7ba5
Re-enable proxies for HTTP-based login scanners
2014-10-15 17:00:44 -05:00
Tod Beardsley
d5a0b81680
Land #4024 , auto-negotiate SSL versions
...
Thanks @hmoore-r7!
2014-10-15 16:04:38 -05:00
HD Moore
5a350b2bf3
Merge pull request #6 from todb-r7/pr4024-auto-negotiate-ssl
...
Add 'Auto' to tcp.rb as well.
2014-10-15 16:03:52 -05:00
Tod Beardsley
62be638258
Add 'Auto' to tcp.rb as well.
2014-10-15 16:01:42 -05:00
Luke Imhoff
98a56d594a
Spec Msf::Target
...
MSP-11496
2014-10-15 15:18:28 -05:00
Luke Imhoff
6bf5e996cf
Spec Msf::Platform
...
MSP-11496
2014-10-15 15:15:33 -05:00
Luke Imhoff
c2c311f087
Spec Msf::SiteReference
...
MSP-11496
2014-10-15 15:13:20 -05:00
Luke Imhoff
26958f5aaa
Spec Msf::Reference
...
MSP-11496
2014-10-15 15:08:12 -05:00
Luke Imhoff
714e9435e5
Spec Msf::Author
...
MSP-11496
2014-10-15 15:07:22 -05:00
Luke Imhoff
43e5abdef4
Spec Msf::Module::UpdateableOptions
...
MSP-11496
2014-10-15 14:59:44 -05:00
Luke Imhoff
23395911d1
Spec Msf::Module::Failure
...
MSP-11496
2014-10-15 14:50:49 -05:00
Joshua Smith
8ec0aa0a75
Land 4006, msfcli support for show actions
2014-10-15 14:43:27 -05:00
Luke Imhoff
fd2b7126d6
Msf::Module method specs
...
MSP-11496
Use respond_to matcher to check that methods aren't dropped during
reorganization.
2014-10-15 14:40:07 -05:00
Tod Beardsley
b866983bc2
Land #4025 , auto-negotiate meterpreter SSL
2014-10-15 14:25:44 -05:00
James Lee
3a9c2f95c9
Add magic encoding to new files
2014-10-15 14:23:34 -05:00
James Lee
2986031db5
Move SMBServer into its own file
2014-10-15 14:22:23 -05:00
James Lee
1064488ada
Whitespace
2014-10-15 14:21:39 -05:00
Luke Imhoff
9456506e3d
Merge branch 'master' into feature/MSP-11124/msf-dbmanager-reorg
...
MSP-11124
2014-10-15 14:08:55 -05:00
Luke Imhoff
3bce8e418d
unserialize_object -> Msf::DBManager::Import::MetasploitFramework shared examples
...
MSP-11124
2014-10-15 14:03:55 -05:00
Luke Imhoff
1f7ad1cac9
unserialize_object -> Msf::DBManager::Import::MetasploitFramework
...
MSP-11124
2014-10-15 14:03:18 -05:00
Luke Imhoff
1aca55bc2a
nils_for_nulls -> Msf::DBManager::Import::MetasploitFramework shared examples
...
MSP-11124
2014-10-15 14:00:42 -05:00
Luke Imhoff
bed98fe43b
nils_for_nulls -> Msf::DBManager::Import::MetasploitFramework
...
MSP-11124
2014-10-15 13:59:03 -05:00
HD Moore
fcd9b4b293
Allow non-SSLv3 Meterpreters (auto-negotiate)
2014-10-15 13:57:51 -05:00
Luke Imhoff
27c5cf8887
Move helpers to Msf::DBManager::Import::Libpcap shared examples
...
MSP-11124
2014-10-15 13:57:27 -05:00
Luke Imhoff
ac30990177
Move libpcap helpers to Libpcap module
...
MSP-11124
2014-10-15 13:55:24 -05:00
Luke Imhoff
5d59224520
Extract Msf::DBManager::Import::Report shared examples
...
MSP-11124
2014-10-15 13:53:09 -05:00
Luke Imhoff
7aed88f11b
Extract Msf::DBManager::Import::Report
...
MSP-11124
2014-10-15 13:51:57 -05:00
HD Moore
cb3a4afac5
Typo: request -> requested in message
2014-10-15 13:48:22 -05:00
Luke Imhoff
505ca5fcc0
Extract Msf::DBManager::Import::Wapiti shared examples
...
MSP-11124
2014-10-15 13:47:22 -05:00
Luke Imhoff
e5e051c905
Extract Msf::DBManager::Import::Wapiti
...
MSP-11124
2014-10-15 13:42:54 -05:00
Luke Imhoff
6e0c7f0aaf
Extract Msf::DBManager::Import::Spiceworks shared examples
...
MSP-11124
2014-10-15 13:40:03 -05:00
Luke Imhoff
e65a386d3d
Extract Msf::DBManager::Import::Spiceworks
...
MSP-11124
2014-10-15 13:37:35 -05:00
HD Moore
7516512650
Raise an ArgumentError vs RuntimeError for backwards compatibility
2014-10-15 13:30:38 -05:00
HD Moore
a762d871bf
Autonegotiate SSL/TLS versions when not explicit
2014-10-15 13:26:40 -05:00
Luke Imhoff
92a6c79200
Extract Msf::DBManager::Import::Retina shared examples
...
MSP-11124
2014-10-15 13:24:40 -05:00
Luke Imhoff
dfe690ac52
Extract Msf::DBManager::Import::Retina
...
MSP-11124
2014-10-15 13:23:12 -05:00
Luke Imhoff
ac6a8387a5
Extract Msf::DBManager::Import::Outpost24 shared examples
...
MSP-11124
2014-10-15 13:21:21 -05:00
Luke Imhoff
8af280b1cb
Extract Msf::DBManager::Import::Outpost24
...
MSP-11124
2014-10-15 13:16:11 -05:00
Luke Imhoff
eff95221da
Order methods
...
MSP-11124
2014-10-15 13:14:20 -05:00
Luke Imhoff
0418027c90
Extract Msf::DBManager::Import::OpenVAS
...
MSP-11124
2014-10-15 13:13:57 -05:00
Luke Imhoff
cf555e2390
Extract Msf::DBManager::Import::OpenVAS
...
MSP-11124
2014-10-15 13:11:49 -05:00
Luke Imhoff
aa4c104df5
Extract Msf::DBManager::Import::Nmap shared examples
...
MSP-11124
2014-10-15 13:08:05 -05:00
Luke Imhoff
5d6044786a
Extract Msf::DBManager::Import::Nmap
...
MSP-11124
2014-10-15 13:06:28 -05:00
Luke Imhoff
926c5adb49
Extract Msf::DBManager::Import::Nikto shared examples
...
MSP-11124
2014-10-15 12:57:24 -05:00
Luke Imhoff
cf3a3a0d65
Move nexpose requires to appropriate module
...
MSP-11124
2014-10-15 12:54:30 -05:00
Luke Imhoff
16f143c2ed
Extract Msf::DBManager::Import::Nikto
...
MSP-11124
2014-10-15 12:51:16 -05:00
Luke Imhoff
3049301c96
Extract Msf::DBManager::Import::Nexpose::Simple shared examples
...
MSP-11124
2014-10-15 12:44:24 -05:00
Luke Imhoff
e64a14c748
Extract Msf::DBManager::Import::Nexpose::Simple
...
MSP-11124
2014-10-15 12:40:04 -05:00
Luke Imhoff
b49dd166fd
Extract Msf::DBManager::Import::Nexpose::Raw shared examples
...
MSP-11124
2014-10-15 12:38:35 -05:00
HD Moore
0941b98596
Unland #4022 with #4023 (more discussion)
...
essage aborts
2014-10-15 12:32:10 -05:00
Tod Beardsley
c4d1a4c7dc
Revert #4022 , as the solution is incomplete
...
Revert "Land 4022, datastore should default TLS1 vs SSL3"
This reverts commit 4c8662c6c1 , reversing
changes made to 0937f32ff9 .
2014-10-15 12:32:08 -05:00
Luke Imhoff
2b861f91e9
Extract Msf::DBManager::Import::Nexpose::Raw
...
MSP-11124
2014-10-15 11:59:03 -05:00
Joshua Smith
4c8662c6c1
Land 4022, datastore should default TLS1 vs SSL3
2014-10-15 11:49:28 -05:00
Luke Imhoff
3638b0a91b
Extract Msf::DBManager::Import::Netsparker shared examples
...
MSP-11124
2014-10-15 11:49:01 -05:00
Luke Imhoff
c371eab26a
Extract Msf::DBManager::Import::Netsparker
...
MSP-11124
2014-10-15 11:46:38 -05:00
Luke Imhoff
a73b0e2283
Move requires for nessus parses to appropriate module
...
MSP-11124
2014-10-15 11:42:00 -05:00
Luke Imhoff
b43035145d
Move nessus helper function to closest module
...
MSP-11124
2014-10-15 11:39:23 -05:00
Luke Imhoff
cceec8eb53
Extract Msf::DBManager::Import::Nessus::XML::V* shared examples
...
MSP-11124
2014-10-15 11:37:24 -05:00
Luke Imhoff
aae6dc9066
Extract Msf::DBManager::Import::Nessus::XML::V*
...
MSP-11124
Extract different versions of Nessus XML format.
2014-10-15 11:34:37 -05:00
Luke Imhoff
cee782ab8b
Extract Msf::DBManager::Import::Nessus::XML shared examples
...
MSP-11124
2014-10-15 11:30:23 -05:00
Luke Imhoff
a0494b2eeb
Extract Msf::DBManager::Import::Nessus::XML
...
MSP-11124
2014-10-15 11:27:23 -05:00
Luke Imhoff
71af8fd9c2
Extract Msf::DBManager::Import::Nessus::NBE shared examples
...
MSP-11124
2014-10-15 11:23:52 -05:00
Luke Imhoff
0c861848bc
Extract Msf::DBManager::Import::Nessus::NBE
...
MSP-11124
2014-10-15 11:21:26 -05:00
Luke Imhoff
4c9b29de95
Extract Msf::DBManager::Import::MetasploitFramework::Credential shared examples
...
MSP-11124
2014-10-15 11:15:13 -05:00
Luke Imhoff
d0d0c478aa
Extract Msf::DBManager::Import::MetasploitFramework::Credential
...
MSP-11124
2014-10-15 11:12:13 -05:00
Luke Imhoff
7d101be0f5
Extract Msf::DBManager::Import::MetasploitFramework::Zip shared examples
...
MSP-11124
2014-10-15 11:02:27 -05:00
Luke Imhoff
46a2c47dfe
Extract Msf::DBManager::Import::MetasploitFramework::Zip
...
MSP-11124
2014-10-15 10:59:41 -05:00
Tod Beardsley
1754b23ffb
Datastore options should default to TLS1, not SSL3
...
Otherwise, we risk getting our connections killed by particularly
aggressive DPI devices (IPS, firewalls, etc)
Squashed commit of the following:
commit 5e203851d5c9dce1fe984b106ce3031a3653e54b
Author: Tod Beardsley <tod_beardsley@rapid7.com >
Date: Wed Oct 15 10:19:04 2014 -0500
Whoops missed one
commit 477b15a08e06e74d725f1c45486b37e4b403e3c2
Author: Tod Beardsley <tod_beardsley@rapid7.com >
Date: Wed Oct 15 10:16:59 2014 -0500
Other datastore options also want TLS1 as default
commit 8d397bd9b500ff6a8462170b4c39849228494795
Author: Tod Beardsley <tod_beardsley@rapid7.com >
Date: Wed Oct 15 10:12:06 2014 -0500
TCP datastore opts default to TLS1
Old encryption is old. See also: POODLE
2014-10-15 10:28:53 -05:00
Luke Imhoff
65885c8cc8
MsfXml -> MetasploitFramework::XML
...
MSP-11124
2014-10-15 10:25:42 -05:00
Luke Imhoff
102e9d8972
import_msf_file -> Msf::DBManager::Import::MsfXml shared examples
...
MSP-11124
2014-10-15 10:04:21 -05:00
Luke Imhoff
ac9a593b43
import_msf_file -> Msf::DBManager::Import::MsfXml
...
MSP-11124
2014-10-15 10:02:42 -05:00
Luke Imhoff
c7d16810ad
Extract Msf::DBManager::Import::MBSA shared examples
...
MSP-11124
2014-10-15 09:58:24 -05:00
Luke Imhoff
d870188377
Extract Msf::DBManager::Import::MBSA
...
MSP-11124
2014-10-15 09:54:03 -05:00
Luke Imhoff
1edad5e0b7
Extract Msf::DBManager::Import::Libpcap shared examples
...
MSP-11124
2014-10-15 09:49:58 -05:00
Luke Imhoff
f29408680f
Extract Msf::DBManager::Import::Libpcap
...
MSP-11124
2014-10-15 09:48:23 -05:00
Luke Imhoff
8b8befeee1
Extract Msf::DBManager::Import::IPList shared examples
...
MSP-11124
2014-10-15 09:43:49 -05:00
Luke Imhoff
44968400e9
Extract Msf::DBManager::Import::IPList
...
MSP-11124
2014-10-15 09:42:11 -05:00
Luke Imhoff
66b1dcc42d
Extract Msf::DBManager::Import::FusionVM shared examples
...
MSP-11124
2014-10-15 09:38:44 -05:00
Luke Imhoff
e5236e9b56
Extract Msf::DBManager::Import::FusionVM
...
MSP-11124
2014-10-15 09:36:29 -05:00
Luke Imhoff
0bfc496824
Extract Msf::DBManager::Import::Foundstone shared examples
...
MSP-11124
2014-10-15 09:31:17 -05:00
Luke Imhoff
2e85dc910a
Extracts Msf::DBManager::Import::Foundstone
...
MSP-11124
2014-10-15 09:27:53 -05:00
Luke Imhoff
56c8bad6c5
Extract Msf::DBManager::Import::CI shared examples
...
MSP-11124
2014-10-15 09:24:46 -05:00
Luke Imhoff
68a1ebd2fb
Extract Msf::DBManager::Import::CI
...
MSP-11124
2014-10-15 09:23:08 -05:00
Luke Imhoff
85f35bd29b
Extract Msf::DBManager::Import::Burp shared examples
...
MSP-11124
2014-10-15 09:18:22 -05:00
Luke Imhoff
8d628c221b
Extract Msf::DBManager::Import::Burp
...
MSP-11124
2014-10-15 09:16:57 -05:00
Luke Imhoff
33e1213010
Extract Msf::DBManager::Import::Appscan shared examples
...
MSP-11124
2014-10-15 09:14:12 -05:00
Luke Imhoff
f42307a6ff
Extract Msf::DBManager::Import::Appscan
...
MSP-11124
2014-10-15 09:12:38 -05:00
Luke Imhoff
6a1f718c3a
Extract Msf::DBManager::Import::Amap shared examples
...
MSP-11124
2014-10-15 09:08:50 -05:00
Luke Imhoff
dcac8a45ee
Extract Msf::DBManager::Import::Amap
...
MSP-11124
2014-10-15 09:06:03 -05:00
Jon Hart
07f2d4dafe
Further improvements to NAT-PMP. Faster, more useful, less not useful
2014-10-15 06:39:38 -07:00
William Vu
0937f32ff9
Land #4021 , TLSv1 default for RPC connections
2014-10-15 01:32:45 -05:00
HD Moore
6cf62765de
Default to TLSv1 for RPC connections
2014-10-15 01:20:43 -05:00
Fernando Munoz
4c2ae1a753
Fix jenkins when CSRF is enabled
2014-10-14 19:33:23 -05:00
James Lee
5434996969
Move TcpServer into its own file
2014-10-14 18:43:40 -05:00
Tod Beardsley
1095d1dca3
Land #4015 , dates in the info on modules
2014-10-14 16:37:26 -05:00
Tod Beardsley
592f1e9893
Land #3999 , errors on login suppressed by default
...
This also solved the merge conflict on:
modules/auxiliary/scanner/http/jenkins_login.rb
Fixes #3995 .
2014-10-14 16:35:09 -05:00
Jon Hart
ea6824c46f
WIP of NAT-PMP rework
2014-10-14 14:20:24 -07:00
Luke Imhoff
a00d039796
Move require for IP360 XML parser
...
MSP-11124
2014-10-14 16:18:47 -05:00
Luke Imhoff
d85ee2ee0a
Extract Msf::DBManager::Import::IP360::V3 shared examples
...
MSP-11124
2014-10-14 16:17:34 -05:00
Luke Imhoff
599bcc33a9
Extract Msf::DBManager::Import::IP360::V3
...
MSP-11124
2014-10-14 16:16:47 -05:00
wvu-r7
d775c6cfdb
Merge pull request #9 from todb-r7/pr4015-disclosure-fix
...
Pr4015 disclosure fix
2014-10-14 16:12:36 -05:00
Luke Imhoff
7e05900428
Extract Msf::DBManager::Import::IP360::ASPL shared examples
...
MSP-11124
2014-10-14 16:02:44 -05:00
Tod Beardsley
e68aaa4226
Don't disclose empty disclosure dates
...
For rapid7#4015
2014-10-14 16:02:23 -05:00
Tod Beardsley
b8aa3f5357
Test #4015 , disclosure dates on info
2014-10-14 16:01:59 -05:00
Luke Imhoff
81c18c96ee
Extract Msf::DBManager::Import::IP260::ASPL
...
MSP-11124
2014-10-14 15:58:43 -05:00
Luke Imhoff
c28f1fce3a
Extract Msf::DBManager::Import::Acunetix shared examples
...
MSP-11124
2014-10-14 15:45:07 -05:00
Luke Imhoff
6c0f549abb
Extract Msf::DBManager::Import::Acunetix
...
MSP-11124
2014-10-14 15:40:29 -05:00
Luke Imhoff
0c10b5a859
Extract #handle_qualys to Msf::DBManager::Import::Qualys
...
MSP-11124
2014-10-14 15:32:22 -05:00
Luke Imhoff
55ca928fee
Extract Msf::DBManager::Import::Qualys::Scan shared examples
...
MSP-11124
2014-10-14 15:31:01 -05:00
Luke Imhoff
11bcac8a4e
Extract Msf::DBManager::Import::Qualys::Scan
...
MSP-11124
2014-10-14 15:19:55 -05:00
William Vu
f612c8cd3e
Add disclosure date to info
2014-10-14 15:15:24 -05:00
William Vu
fdd79e64c3
Land #4010 , ReverseAllowProxy clarification
2014-10-14 15:10:50 -05:00
Tod Beardsley
e010d70913
No need for that bool option
2014-10-14 14:59:57 -05:00
Tod Beardsley
bf0a5d038e
Add an animation to comfort the user
...
Sometimes msfconsole takes a little while to start.
This adds a fairly common ASCII spinner to the startup sequence.
I haven't spec'ed it, and the code organization isn't great, so consider
this PR more of a cry for help than something immediately landable.
That said, it works for me.
2014-10-14 14:54:45 -05:00
Tod Beardsley
8e58efbf4f
Land #4008 , OLE specs
2014-10-14 13:57:54 -05:00
Tod Beardsley
9630d4676f
Land #4012 , info showing actions
2014-10-14 13:51:37 -05:00
William Vu
309d578196
Land #4013 , OSVDB refs for a couple modules
2014-10-14 13:44:31 -05:00
William Vu
bdbad5a81d
Fix misaligned bracket
2014-10-14 13:43:59 -05:00
Tod Beardsley
9f6008e275
A couple OSVDB updates for recent modules
2014-10-14 13:39:36 -05:00
Tod Beardsley
4f8801eeba
Land #3651 , local Bluetooth exploit a @KoreLogic
...
This started life as #3653 . I'll take this out of unstable as well,
since it got there on commit b10cbe4f
2014-10-14 13:13:34 -05:00
William Vu
972efd423c
Land #4011 , module description cleanup
2014-10-14 12:43:17 -05:00
William Vu
5c4f61057f
Show available actions for info
2014-10-14 12:41:02 -05:00
Tod Beardsley
56534e7ad3
Changed a login failed to vprint instead of print
...
People often like to supress failed attempts. Note that this change may
or may not have any effect, given the status of #3995 .
This module was introduced in PR #3947 .
2014-10-14 12:01:09 -05:00
Tod Beardsley
b1223165d4
Trivial grammar fixes
2014-10-14 12:00:50 -05:00
Tod Beardsley
6ea3a78b47
Clarify the description on HP perfd module
...
Introduced in #3992
2014-10-14 11:58:52 -05:00
jvazquez-r7
39a09ad750
Use ARCH_CMD on Windows target
2014-10-14 10:24:32 -05:00
Pedro Laguna
70d1eefaa9
Update reverse_tcp.rb
...
As I am using a exploit that does a check on the Server HTTP headers to identify the target I saw an error message that reads like this:
>The target server fingerprint "" does not match "(?-mix:(Jetty|JBoss))", use 'set FingerprintCheck false' to disable this check.
Then, while using a HTTP proxy to analyse the requests I am presented with an error that tells me to set another internal option to override a default behaviour. Although it should be pretty clear to everyone using the metasploit framework, I think it is more convenient if all error messages have the same format/way to present suggestions, in this case, presenting the full command the user needs to introduce in order to carry on with the execution of the exploit.
2014-10-14 11:24:59 +01:00
jvazquez-r7
a0fc0cf87f
Update ranking
2014-10-13 17:44:00 -05:00
Luke Imhoff
dd5ae26174
Extract Msf::DBManager::Import::Qualys::Asset shared examples
...
MSP-11124
2014-10-13 16:09:41 -05:00
Luke Imhoff
1f49f767dc
Extract Msf::DBManager::Import::Qualys::Asset
...
MSP-11124
2014-10-13 16:06:15 -05:00
jvazquez-r7
2f20998eaa
Force Rex::OLE::Util to work on LITTLE_ENDIAN
2014-10-13 16:01:43 -05:00
Luke Imhoff
a7d1577494
ImportMsfXml -> Import::MsfXml
...
MSP-11124
2014-10-13 15:46:13 -05:00
Luke Imhoff
87825d40b1
Fix migration.rb loading
...
MSP-11124
2014-10-13 15:39:15 -05:00
Luke Imhoff
b8ea44235b
Remove nesting in Msf::DBManager::ImportMsfXml
...
MSP-11124
Don't use nested modules to prevent Msf::DBManager::ImportMsfXml from
being the declaring location for Msf::DBManager.
2014-10-13 15:37:16 -05:00
Luke Imhoff
ef04261686
Fix indentation in Msf::DBManager
...
MSP-11124
2014-10-13 15:26:19 -05:00
Luke Imhoff
c6ea3a3880
Distribute requires to where they are needed
...
MSP-11124
Push requires down to the Msf::DBManager mixins that actually need them.
2014-10-13 15:24:56 -05:00
Luke Imhoff
4371254dd2
Reorder remaining code in Msf::DBManager
...
MSP-11124
2014-10-13 15:13:28 -05:00
Luke Imhoff
acdf6e7dbf
Move missed Msf::DBManager::Connection examples
...
MSP-11124
2014-10-13 15:06:46 -05:00
Luke Imhoff
92aaecf94b
Move add_rails_engine_migrations_paths to Msf::DBManager::Migration
...
MSP-11124
2014-10-13 15:02:20 -05:00
Luke Imhoff
2dd925c18c
Move add_rails_engine_migration_paths to Msf::DBManager::Migration
...
MSP-11124
2014-10-13 15:01:14 -05:00
Luke Imhoff
1dfaba1884
Remove nesting in Msf::DBManager::Migration
...
MSP-11124
To prevent migration.rb as counting as the definer of `Msf::DBManager`.
2014-10-13 14:56:08 -05:00
Luke Imhoff
66ce59725b
Extract Msf::DBManager::Adapter shared examples
...
MSP-11124
2014-10-13 14:53:40 -05:00
Luke Imhoff
bc4d2ff152
Extract Msf::DBManager::Adapter
...
MSP-11124
Extract methods related to setting up the adapter/driver(s).
2014-10-13 14:49:26 -05:00
Luke Imhoff
2b4150ac46
Extract Msf::DBManager::Connection shared examples
...
MSP-11124
2014-10-13 14:47:22 -05:00
jvazquez-r7
51f1309cc3
Add specs for Rex::OLE::CLSID
2014-10-13 14:28:58 -05:00
jvazquez-r7
8b9c8da4ac
Add specs for Rex::OLE::Util
2014-10-13 13:41:43 -05:00
Nikita
621b9523b1
Update tnspoison_checker.rb
2014-10-13 22:05:08 +04:00
Luke Imhoff
930b020211
Extract Msf::DBManager::Connection
...
MSP-11124
Extract methods that connect, disconnect and show status of connection
to database.
2014-10-13 12:07:13 -05:00
Luke Imhoff
43a4858fe3
Extract Msf::DBManager::Web shared examples
...
MSP-11124
2014-10-13 12:01:49 -05:00
Luke Imhoff
f472411c8c
Extract Msf::DBManager::Web
...
MSP-11124
Extract `Mdm::Web*` methods.
2014-10-13 11:59:39 -05:00
Luke Imhoff
3a2f8b7684
Extract Msf::DBManager::VulnAttempt shared examples
...
MSP-11124
2014-10-13 11:34:12 -05:00
Luke Imhoff
5067e43ac1
Extract Msf::DBManager::VulnAttempt
...
MSP-11124
Extract `Mdm::VulnAttempt` methods.
2014-10-13 11:32:15 -05:00
Luke Imhoff
adfeef2aa9
Extract Msf::DBManager::Route shared examples
...
MSP-11124
2014-10-13 11:28:19 -05:00
Luke Imhoff
e7e12ec6a5
Extract Msf::DBManager::Route
...
MSP-11124
Extract `Mdm::Route` methods.
2014-10-13 11:23:37 -05:00
Luke Imhoff
e1ae403292
Extract Msf::DBManager::SessionEvent shared examples
...
MSP-11124
2014-10-13 11:15:07 -05:00
Luke Imhoff
8011187aa9
Extract Msf::DBManager::SessionEvent
...
MSP-11124
Extract `Mdm::SessionEvent` methods.
2014-10-13 11:13:39 -05:00
Luke Imhoff
98142def08
Extract Msf::DBManager::HostTag shared examples
...
MSP-11124
2014-10-13 11:03:21 -05:00
Luke Imhoff
1f86712d63
Extract Msf::DBManager::HostTag
...
MSP-11124
Extract `Mdm::HostTag` method.
2014-10-13 11:00:36 -05:00
Luke Imhoff
6fb263d989
Extract Msf::DBManager::Session shared examples
...
MSP-11124
2014-10-13 10:52:39 -05:00
Luke Imhoff
1811d4e58f
Extract Msf::DBManager::Session
...
MSP-11124
Extract methods related to `Mdm::Session`s.
2014-10-13 10:50:11 -05:00
jvazquez-r7
eb190a5a78
Avoid explicit use of subject on shared examples
2014-10-13 10:43:53 -05:00
jvazquez-r7
e4a7025157
Avoid explicit use of subject
2014-10-13 10:41:12 -05:00
Luke Imhoff
4aab5129b0
Extract Msf::DBManager::HostDetail shared examples
...
MSP-11124
2014-10-13 10:27:55 -05:00
William Vu
6ffe0807af
Update msfcli to use HasActions
2014-10-13 10:24:05 -05:00
jvazquez-r7
10d50e77eb
Avoid explicit use of subject
2014-10-13 10:21:31 -05:00
Luke Imhoff
f16b3f05b4
Extract Msf::DBManager::HostDetail
...
MSP-11124
Extract method related to `Mdm::HostDetail`s.
2014-10-13 10:15:14 -05:00
Luke Imhoff
8026352433
Extract Msf::DBManager::Ref shared examples
...
MSP-11124
2014-10-13 10:12:09 -05:00
Luke Imhoff
87ee06b792
Extract Msf::DBManager::Ref
...
MSP-11124
Extract methods related to `Mdm::Ref`s.
2014-10-13 10:06:37 -05:00
Luke Imhoff
7a5b3c9ee7
Move report_artifact example to Msf::DBManager::Report
...
MSP-11124
2014-10-13 10:01:08 -05:00
Luke Imhoff
5668a2820e
Move #report_artifact to Msf::DBManager::Report
...
MSP-11124
2014-10-13 10:00:19 -05:00
Luke Imhoff
a970d76a2a
Extract Msf::DBManager::VulnDetail shared examples
...
MSP-11124
2014-10-13 09:58:59 -05:00
Luke Imhoff
43c9909636
Extract Msf::DBManager::VulnDetail
...
MSP-11124
Extract methods related to `Mdm::VulnDetail`s.
2014-10-13 09:54:38 -05:00
Luke Imhoff
97b3198923
Extract Msf::DBManager::ExploitAttempt shared examples
...
MSP-11124
2014-10-13 09:43:40 -05:00
Luke Imhoff
f42f8e106a
Extract Msf::DBManager::ExploitAttempt
...
MSP-11124
Extract methods that create `Mdm::ExploitAttempt`s.
2014-10-13 09:41:32 -05:00
Luke Imhoff
b007fba79f
Extract Msf::DBManager::Task shared examples
...
MSP-11124
2014-10-13 09:32:42 -05:00
Luke Imhoff
e0f76a7517
Extract Msf::DBManager::Task
...
MSP-11124
Extract methods related to `Mdm::Task`s.
2014-10-13 09:28:48 -05:00
Luke Imhoff
66845508d9
Extract Msf::DBManager::Report shared examples
...
MSP-11124
2014-10-13 09:24:27 -05:00
Luke Imhoff
90b50339c3
Extract Msf::DBManager::Report
...
MSP-11124
Extract methods related to the obsolete `Mdm::Report`. These methods
should be deleted, but since this branch is just for moves, I won't
delete them now.
2014-10-13 09:19:39 -05:00
Luke Imhoff
e82a46cc47
Extract Msf::DBManager::Event shared examples
...
MSP-11124
2014-10-13 09:12:49 -05:00
Luke Imhoff
9632c83cde
Extract Msf::DBManager::Event
...
MSP-11124
Extract methods related to `Mdm::Event`s.
2014-10-13 09:05:10 -05:00
Luke Imhoff
0e93b55397
Extract Msf::DBManager::Client shared examples
...
MSP-11124
2014-10-13 08:40:34 -05:00
Luke Imhoff
89d588272e
Extract Msf::DBManager::Client
...
MSP-11124
Extract methods related to `Mdm::Client`s.
2014-10-13 08:27:09 -05:00
Nikita
1996886ae9
Update tnspoison_checker.rb
2014-10-13 12:53:39 +04:00
Nikita
22aabc7805
Add new module to test TNS poison
...
This module simply checks the server for vulnerabilities like TNS Poison
2014-10-13 12:21:07 +04:00
Martin Vigo
b9e4f04260
Add support for Firefox
2014-10-12 22:48:20 -07:00
Martin Vigo
8efe714be6
Add support for Firefox in XP
2014-10-12 22:48:19 -07:00
Martin Vigo
b8dc8acef1
Merge remote-tracking branch 'upstream/master'
2014-10-12 22:24:58 -07:00
Jon Hart
d51d2bf5a0
Land #3990 , @wchen-r7's fix for #3984 , a busted check in drupal_views_user_enum
2014-10-12 19:38:55 -07:00
Jon Hart
458da2bca4
Land #3988 , @wchen-r7's fix for #3985 , a lack of logging for 'check'
2014-10-12 18:46:35 -07:00
Jon Hart
d4297a7159
Land #3992 , @espreto's HP perfd gather module
2014-10-12 18:35:06 -07:00
Jon Hart
76275a259a
Minor style cleanup of help and a failure message
2014-10-12 18:34:13 -07:00
Roberto Soares
d0f1cd1251
Merge pull request #1 from jhart-r7/landing-3992-jhart-fixes
...
Refactor hp_enum_perfd for better looting
2014-10-12 20:44:24 -03:00
jvazquez-r7
ca05c4c2f4
Fix @wchen-r7's feedback
...
* use vprint_* on check
* rescue get_once
2014-10-12 17:44:33 -05:00
us3r777
444b01c4b0
Typo + shorten php serialized object
2014-10-12 21:29:04 +02:00
sinn3r
96be53dcf1
Land #3962 - Show selected action
2014-10-12 14:02:40 -05:00
jvazquez-r7
46bf8f28e0
Fix regex
2014-10-11 21:37:05 -05:00
jvazquez-r7
6092e84067
Add module for ZDI-14-344
2014-10-11 21:33:23 -05:00
Jon Hart
c3a58cec9e
Make note of other commands to investigate
2014-10-11 13:07:52 -07:00
Jon Hart
c80a5b5796
List commands in sorted order
2014-10-11 13:00:30 -07:00
Jon Hart
4ffc8b153c
Support running more than one perfd command in a single pass
2014-10-11 11:38:00 -07:00
Jon Hart
c72593fae4
Store just banner for service, loot the rest. Also, minor style.
2014-10-11 11:12:49 -07:00
Jon Hart
9550c54cd2
Correct indentation and whitespace
2014-10-11 10:39:12 -07:00
sinn3r
9500038695
Fix #3995 - Make negative messages less verbose
...
As an user testing against a large network, I only want to see
good news, not bad news.
2014-10-11 11:11:09 -05:00
Roberto Soares Espreto
7bd0f2c114
Changed Name, array in OptEnum and operator
2014-10-11 09:03:18 -03:00
Roberto Soares Espreto
cbde2e8cd1
Variable cmd now with interpolation
2014-10-10 18:21:16 -03:00
William Vu
a04ad3aa8c
Update print_error to reflect new usage
2014-10-10 14:38:26 -05:00
William Vu
26743b4c38
Rewrite existing code to use HasActions
...
And fix a bug in the initial use case where mod.action was dropped.
2014-10-10 14:35:54 -05:00
Roberto Soares Espreto
291bfed47e
Using Rex.sleep instead of select
2014-10-10 15:17:40 -03:00
William Vu
7e7e0259e4
Fix tab completion for post actions
2014-10-10 12:24:23 -05:00
William Vu
238a30a769
Update print_error to include post modules
2014-10-10 12:12:43 -05:00
Roberto Soares Espreto
bd315d7655
Changed print_good and OptEnum
2014-10-10 13:54:42 -03:00
Roberto Soares Espreto
08fdb4fab2
Add module to enumerate environment HP via perfd daemon
2014-10-10 13:09:36 -03:00
sinn3r
260aa8dc22
Fix #3984 - Fix broken check for drupal_views_user_enum
2014-10-10 10:23:20 -05:00
nstarke
f8d6af6d4e
Rescuing from JSON Parse
...
Previous code was not using any sort of exception handling
for parsing the response body. I have added a rescue block
for JSON errors to remedy this problem.
2014-10-10 12:41:11 +00:00
0a2940
e689a0626d
Use Rex.sleep :-)
...
"Right is right even if no one is doing it; wrong is wrong even if everyone is doing it"
user@x:/opt/metasploit$ grep -nr "select(nil, nil, nil" . | wc -l
189
user@x:/opt/metasploit$ grep -nr "Rex.sleep" . | wc -l
25
2014-10-10 10:05:46 +01:00
sinn3r
48d2343152
Fix #3985 - check command should elog
2014-10-10 01:06:37 -05:00
nstarke
472985a8a8
Adding Buffalo Linkstation NAS Login Scanner
...
I have added a login scanner for the Buffalo Linkstation
NAS. I have been testing against version 1.68 of the
firmware. Also included are some specs for this module.
2014-10-10 03:16:48 +00:00
Luke Imhoff
b05a466e0a
Extract Msf::DBManager::Vuln shared examples
...
MSP-11124
2014-10-09 15:51:39 -05:00
Luke Imhoff
08aee23966
Extract Msf::DBManager::Vuln
...
MSP-11124
Extract all methods related to `Mdm::Vuln`s from `Msf::DBManager`.
2014-10-09 15:47:34 -05:00
Luke Imhoff
e403e54896
Extract Msf::DBManager::Note shared examples
...
MSP-11124
2014-10-09 15:39:55 -05:00
Luke Imhoff
2fa02f5c44
Extract Msf::DBManager::Note
...
Extract all methods related to `Mdm::Note`s.
2014-10-09 15:29:07 -05:00
Tod Beardsley
aefd15c185
Land #3376 , ARRIS SNMP enumerator from @inokii
2014-10-09 15:28:06 -05:00
Luke Imhoff
e42d60801d
Extract Msf::DBManager::Loot shared examples
...
MSP-11124
2014-10-09 15:21:43 -05:00
jvazquez-r7
520e1bccca
Land #3692 , @TomSellers's support for Metasploit Credential on enum_snmp
2014-10-09 15:18:44 -05:00
Luke Imhoff
0bc71ecd24
Extract Msf::DBManager::Loot
...
MSP-11124
2014-10-09 15:15:40 -05:00
Luke Imhoff
2c6753a2e0
Extract Msf::DBManager::Import shared examples
...
MSP-11124
2014-10-09 15:07:17 -05:00
Luke Imhoff
cb9bdd96c7
Extract Msf::DBManager::Import
...
MSP-11124
Extract all methods dealing with imports.
2014-10-09 14:51:24 -05:00
sinn3r
7d8eadada6
Fix #3974 - Validate and normalize URI for axis_login
2014-10-09 14:33:39 -05:00
sinn3r
c9c34beafa
Fix #3975 - Register TARGETURI, not URI
...
The module should register TARGETURI and call #target_uri for
URI validation.
2014-10-09 14:10:29 -05:00
Luke Imhoff
45f5fe36f1
Extract Msf::DBManager::ExploitedHost shared examples
...
MSP-11124
2014-10-09 12:58:30 -05:00
Luke Imhoff
d18dcf5961
Extract Msf::DBManager::ExploitedHost
...
MSP-11124
Extract methods related to `Mdm::ExploitedHost`s.
2014-10-09 12:54:04 -05:00
Pedro Ribeiro
4b7a446547
... and restore use of the complicated socket
2014-10-09 18:30:45 +01:00
Pedro Ribeiro
c78651fccc
Use numbers for version tracking
2014-10-09 18:29:27 +01:00
Pedro Ribeiro
8163b7de96
Thanks for helping me clean up Todd!
2014-10-09 18:20:31 +01:00
sinn3r
d366cdcd6e
Fix #3976 - validate and normalize user-supplied URI for http_login.rb
...
URI should be validated and normalized before being used in an HTTP
request.
2014-10-09 12:14:33 -05:00
Pedro Ribeiro
9d1e206e43
Incorporate cred changes and other minor fixes
2014-10-09 17:59:38 +01:00
Spencer McIntyre
a535d236f6
Land #3947 , login scanner for jenkins by @nstarke
2014-10-09 12:59:02 -04:00
Spencer McIntyre
6ea530988e
Apply rubocop changes and remove multiline print
2014-10-09 12:57:39 -04:00
us3r777
2428688565
CVE-2014-7228 Joomla/Akeeba Kickstart RCE
...
Exploit via serialiazed PHP object injection. The Joomla! must be
updating more precisely, the file $JOOMLA_WEBROOT/administrator/
components/com_joomlaupdate/restoration.php must be present
2014-10-09 18:51:24 +02:00
Luke Imhoff
3ec93dea43
Extract Msf::DBManager::Cred shared examples
...
MSP-11124
2014-10-09 11:44:15 -05:00
Luke Imhoff
ceba04d556
Extract Msf::DBManager::Cred
...
MSP-11124
Extract methods related to `Mdm::Cred`s.
2014-10-09 11:41:04 -05:00
jvazquez-r7
3305b1e9c3
Land #3984 , @nullbind's MSSQL privilege escalation module
2014-10-09 11:39:15 -05:00
jvazquez-r7
10b160bedd
Do final cleanup
2014-10-09 11:38:45 -05:00
Luke Imhoff
96b4491d8e
Extract Msf::DBManager::Service shared examples
...
MSP-11124
2014-10-09 11:35:07 -05:00
Luke Imhoff
0284edf430
Extract Msf::DBManager::Service
...
MSP-11124
Extract methods related to `Mdm::Service`s.
2014-10-09 11:31:29 -05:00
jvazquez-r7
bbe435f5c9
Don't rescue everything
2014-10-09 11:25:13 -05:00
Luke Imhoff
e7800697eb
Extract Msf::DBManager::Host shared examples
...
MSP-11124
2014-10-09 11:16:04 -05:00
Luke Imhoff
0cfac32290
Extract Msf::DBManager::Host
...
MSP-11124
Extract methods related to `Mdm::Host`s.
2014-10-09 11:11:36 -05:00
jvazquez-r7
0cd7454a64
Use default value for doprint
2014-10-09 11:04:42 -05:00
jvazquez-r7
db6f6d4559
Reduce code complexity
2014-10-09 10:59:14 -05:00
Luke Imhoff
148ad8b050
Extract Msf::DBManager::WMAP shared examples
...
MSP-11124
2014-10-09 10:49:26 -05:00
jvazquez-r7
615b8e5f4a
Make easy method comments
2014-10-09 10:48:00 -05:00
jvazquez-r7
dd03e5fd7d
Make just one connection
2014-10-09 10:46:51 -05:00
Luke Imhoff
bb26f4f303
Extract Msf::DBManager::Wmap
...
MSP-11124
Extract methods that are commented as related to WMAP.
2014-10-09 10:13:34 -05:00
jvazquez-r7
ccf677aad6
land #3978 , Fixes #3973 , Wrong datastore option URI in glassfish_login
2014-10-09 09:53:01 -05:00
Luke Imhoff
e723aa7eb3
Extract Msf::DBManager::IPAddress shared examples
...
MSP-11124
2014-10-09 09:40:11 -05:00
Luke Imhoff
b0147c994a
Extract Msf::DBManager::IPAddress
...
MSP-11124
Extract the IP address validation methods to
`Msf::DBManager::IPAddress`.
2014-10-09 09:35:19 -05:00
Luke Imhoff
f5ea81cd97
Test for #match_values
...
MSP-11124
2014-10-09 09:20:27 -05:00
Luke Imhoff
3a96ae9be9
Move #match_values to Msf::DBManager::ModuleCache
...
MSP-11124
`#match_values` is only used in `#search_modules`, so `#match_values`
should be grouped with `#search_modules` in
`Msf::DBManager::ModuleCache`.
2014-10-09 09:18:03 -05:00
Luke Imhoff
37c38ad27b
Extract Msf::DBManager::ModuleCache shared examples
...
MSP-11124
2014-10-09 09:14:45 -05:00
Luke Imhoff
d4a94366a6
Extract Msf::DBManager::ModuleCache
...
MSP-11124
Extract methods related to the module cache state and maintenance to
`Msf::DBManager::ModuleCache`.
2014-10-09 08:53:41 -05:00
jvazquez-r7
392b3bcf2f
Land #3977 , @FireFart's WPVDB reference for php_wordpress_infusionsoft module
2014-10-09 00:32:27 -05:00
sinn3r
df0d4f9fb2
Fix #3973 - Unneeded datastore option URI
...
When Glassfish is installed, the web root is always /, so there is
no point to make this arbitrary.
2014-10-09 00:06:15 -05:00
Christian Mehlmauer
1584c4781c
Add reference
2014-10-09 06:58:15 +02:00
nullbind
168f1e559c
fixed status
2014-10-08 21:19:50 -05:00
nullbind
3ebcaa16a1
removed scanner
2014-10-08 21:18:56 -05:00
nstarke
328be3cf34
Fine Tuning Jenkins Login Module
...
At the request of the maintainers, I have deregistered the
RHOST option and made the failure proof a verbose only
print.
2014-10-08 17:53:21 -05:00
jvazquez-r7
4f96d88a2f
Land #3949 , @us3r777's exploit for CVE-2014-6446, wordpress infusionsoft plugin php upload
2014-10-08 16:35:49 -05:00
jvazquez-r7
66a8e7481b
Fix description
2014-10-08 16:35:14 -05:00
jvazquez-r7
8ba8402be3
Update timeout
2014-10-08 16:32:05 -05:00
jvazquez-r7
bbf180997a
Do minor cleanup
2014-10-08 16:29:11 -05:00
Luke Imhoff
70d4f672e2
Extract Msf::DBManager::Workspace examples to shared example
...
MSP-11124
2014-10-08 15:54:29 -05:00
Luke Imhoff
ee0de997d5
Extract Msf::DBManager::Workspace
...
MSP-11124
Gather together all workspace related methods into
`Msf::DBManager::Workspace` and include it in `Msf::DBManager`.
2014-10-08 15:46:35 -05:00
Pedro Ribeiro
4817e1e953
Update trackit_sql_domain_creds.rb
2014-10-08 21:41:04 +01:00
Luke Imhoff
a64036f6cf
Move Msf::DBManager#sync to Msf::DBManager::Sink
...
MSP-11124
The comment on `#sync` says it's related to `sink`, so move it into its
Module.
2014-10-08 15:38:56 -05:00
Luke Imhoff
37e0b9ffe0
Extract Msf::DBManagerSink examples to shared example
...
MSP-11124
2014-10-08 15:30:20 -05:00
Luke Imhoff
a054259ee5
Extract Msf::DBManager::Sink
...
MSP-11124
Extract attributes and methods associated with the deprecated sink.
2014-10-08 15:26:28 -05:00
Joe Vennix
aa18eb54d3
Land #3920 , @agix's removal of dead encode code from msfpayload.
...
Was originally supposed to add support for encoders, but
this was never a supported feature of msfpayload.
2014-10-08 15:03:28 -05:00
William Vu
f86c0c2bb5
Land #3970 , rm jtr_unshadow
2014-10-08 14:55:15 -05:00
William Vu
1d766ba95b
Rename dump_auxiliary_action{,s}
...
To dump_module_action{,s} to accommodate post modules, etc.
2014-10-08 14:49:14 -05:00
jvazquez-r7
f30309fe81
Land #3919 , @wchen-r7's Fixes #3914 , Inconsistent unicode names
2014-10-08 14:46:14 -05:00
William Vu
f6a9cfcc52
Break away the elsif into a separate if
...
In case exploits support actions for some crazy reason in the future.
2014-10-08 14:30:41 -05:00
Luke Imhoff
15f9461279
Merge db.rb into db_manager.rb
...
MSP-11124
The class name is DBManager, so the correct file name is db_manager.rb
2014-10-08 14:27:22 -05:00
Luke Imhoff
cffc74d571
Extract Msf::DBImportError
...
MSP-11124
2014-10-08 14:14:35 -05:00
William Vu
b2ba6e7ae1
Make the code more maintainable
...
Despite the code around it.
Thanks for the advice, @jlee-r7!
2014-10-08 14:14:28 -05:00
Luke Imhoff
7a5ce19735
Fix code style
...
MSP-11124
Fix comment style and order methods.
2014-10-08 14:07:05 -05:00
Luke Imhoff
6824515949
Fix indentation and whitespace in Msf::DatabaseEvent
...
MSP-11124
2014-10-08 14:04:21 -05:00
Luke Imhoff
2206a86387
Extract Msf::DatabaseEvent
...
MSP-11124
Extract `Msf::DatabaseEvent` from `lib/msf/core/db.rb` into a more
conventional `lib/msf/core/database_event.rb`.
2014-10-08 14:01:58 -05:00
jvazquez-r7
dbc199ad77
space after commas
2014-10-08 13:56:59 -05:00
Luke Imhoff
6b3d70ce00
Fix code style in Msf::ServiceState
...
MSP-11124
2014-10-08 13:52:42 -05:00
Luke Imhoff
46156fbbc6
Fix indentation in Msf::ServiceState
...
MSP-11124
2014-10-08 13:50:26 -05:00
Luke Imhoff
57d9dc306c
Extract Msf::ServiceState
...
MSP-11124
Extract Msf::ServiceState from `lib/msf/core/db.rb` and put it into
`lib/msf/core/service_state.rb`.
2014-10-08 13:45:15 -05:00
William Vu
c0ef2c7938
Support post modules
...
I kinda hate this code.
TODO: Get rid of and/or and the extra parens.
2014-10-08 13:23:50 -05:00
Jay Smith
7dd6a4d0d9
Merge in changes from @todb-r7.
2014-10-08 13:25:44 -04:00
jvazquez-r7
411f6c8b2d
Land #3793 , @mfadzilr's exploit for CVE-2014-6287, HFS remote code execution
2014-10-08 12:16:09 -05:00
jvazquez-r7
98b69e095c
Use %TEMP% and update ranking
2014-10-08 12:12:00 -05:00
jvazquez-r7
d90fe4f724
Improve check method
2014-10-08 12:03:16 -05:00
jvazquez-r7
25344aeb6a
Change filename
2014-10-08 11:55:33 -05:00
Luke Imhoff
0708ac1361
Fix comment style in Msf::HostState
...
MSP-11124
2014-10-08 11:47:04 -05:00
Luke Imhoff
5ecd194a0d
Fix indent in Msf::HostState
...
MSP-11124
2014-10-08 11:43:28 -05:00
Luke Imhoff
6e6780da86
Split Msf::HostState into own file
...
MSP-11124
2014-10-08 11:37:59 -05:00
jvazquez-r7
909f88680b
Make exploit aggressive
2014-10-08 11:08:01 -05:00
Luke Imhoff
a0a19e5ce8
Spec classes, constants and methods from lib/msf/db.rb
...
MSP-11466
Method specces only check that the method is defined as they only need
to catch deleted methods during the reorganization.
2014-10-08 11:07:15 -05:00
Luke Imhoff
692e53501e
Add modern --require to .rspec
...
MSP-11466
Modern rspec --init adds `--require spec_helper` to .rspec so that you
don't need to `require 'spec_helper` in all your specs.
2014-10-08 10:55:40 -05:00
Luke Imhoff
6a54f0ac4c
Spec methods from db_manager.rb
...
MSP-11466
2014-10-08 10:53:14 -05:00
Luke Imhoff
c09335985b
Sort specs
...
MSP-11466
2014-10-08 10:52:21 -05:00
jvazquez-r7
d02f0dc4b9
Make minor cleanup
2014-10-08 10:36:56 -05:00
jvazquez-r7
d913bf1c35
Fix metadata
2014-10-08 10:29:59 -05:00
Tod Beardsley
a901916b0b
Remove nonfunctional jtr_unshadow
...
This module hasn't been doing anything but print_error a go away message
since June, so may as well get rid of it.
2014-10-08 10:23:29 -05:00
William Vu
71e883569f
Land #3969 , rm hashrockets from refs
2014-10-08 10:07:35 -05:00
Brendan Coles
e0016d4af3
Remove hash rocket from refs array #3766
...
[SeeRM #8776 ]
2014-10-08 09:16:38 +00:00
Brendan Coles
3c7be9c4c5
Remove hash rockets from references #3766
...
[SeeRM #8776 ]
2014-10-08 09:01:19 +00:00
Pedro Ribeiro
6af6b502c3
Remove spaces at EOL
2014-10-08 08:30:30 +01:00
Pedro Ribeiro
0a9795216a
Add OSVDB id and full disclosure URL
2014-10-08 08:25:41 +01:00
Pedro Ribeiro
713ff5134a
Add OSVDB id
2014-10-08 08:24:44 +01:00
Pedro Ribeiro
bd812c593c
Add full disclosure URL
2014-10-08 08:24:04 +01:00
Pedro Ribeiro
bbac61397d
Restore :address to rhost and explain why
2014-10-08 08:23:43 +01:00
sinn3r
c5494e037d
Land #3900 - Add F5 iControl Remote Root Command Execution
2014-10-08 00:30:07 -05:00
Pedro Ribeiro
9cb0ad1ac2
Change the reporting address to the real value
2014-10-08 01:18:17 +01:00
Pedro Ribeiro
6e9bebdaf9
Fix noob mistake in assignment
2014-10-08 01:04:15 +01:00
Pedro Ribeiro
7dbfa19e65
Add exploit for Track-It! domain/sql creds vuln
2014-10-07 23:54:43 +01:00
Pedro Ribeiro
d328b2c29d
Add exploit for Track-It! file upload vuln
2014-10-07 23:50:10 +01:00
Pedro Ribeiro
f2f4f91af5
Merge pull request #4 from rapid7/master
...
merge
2014-10-07 23:48:16 +01:00
jvazquez-r7
299d9afa6f
Add module for centreon vulnerabilities
2014-10-07 14:40:51 -05:00
William Vu
a8b5bf4625
Show selected auxiliary action
2014-10-07 14:34:41 -05:00
nstarke
eed0958de5
Fixing Comment
...
Comment was incorrect and needed to be fixed.
2014-10-07 11:28:40 -05:00
William Vu
056ee4f207
Land #3958 , kill command for pyterp
2014-10-07 10:58:37 -05:00
jvazquez-r7
3daa1ed4c5
Avoid changing modules indentation in this pull request
2014-10-07 10:41:25 -05:00
jvazquez-r7
e168280cc1
Add changes after discussion with msf team
2014-10-07 10:25:32 -05:00
jvazquez-r7
341d8b01cc
Favor echo encoder for back compatibility
2014-10-07 10:24:32 -05:00
jvazquez-r7
3628f73235
Fix ARCH_CMD perl encoding
2014-10-07 10:21:30 -05:00
Spencer McIntyre
766a69e310
Add sys_process_kill to the python meterpreter
2014-10-07 10:10:22 -04:00
jvazquez-r7
e63b389713
Add @jlee-r7's changes to perl encoding
2014-10-07 00:16:16 -05:00
nullbind
031fb19153
requested updates
2014-10-06 23:52:30 -05:00
jvazquez-r7
0ec855cd07
Add debug log for ARCH_CMD encoder results
2014-10-06 22:34:09 -05:00
William Vu
3e92892c8b
Land #3954 , file:// for the check command
2014-10-06 22:05:51 -05:00
William Vu
399a61d52e
Land #3946 , ntp_readvar updates
2014-10-06 21:57:57 -05:00
nstarke
e1b0ba5d3d
Removing 'require pry'
...
I accidentally left a reference to pry in my code.
Removing
2014-10-06 21:40:39 -05:00
nstarke
b8c2643d56
Converting Module to LoginScanner w/ Specs
...
The previous commits for this Jenkins CI module relied on an
obsolete pattern. Consequently, it was necessary to write
this module as a LoginScanner and incorporate the appropriate
specs so that the tests will run properly.
2014-10-06 21:14:10 -05:00
jvazquez-r7
260e829a59
Fix PayloadGenerator to have platform into account, so msfvenom works as expected
2014-10-06 19:20:59 -05:00
jvazquez-r7
0089810026
Merge to update
2014-10-06 19:09:31 -05:00
jvazquez-r7
6f174a9996
Fix obvious introduced bug
2014-10-06 18:56:25 -05:00
jvazquez-r7
6b52ce9101
Delete 'old' generic_sh unix cmd encoder, favor splitting
2014-10-06 18:45:10 -05:00
jvazquez-r7
212762e1d6
Delete RequiredCmd for unix cmd encoders, favor EncoderType
2014-10-06 18:42:21 -05:00
Spencer McIntyre
6ea5d20b11
Land #3955 , fix NoMethodError for wordpress_login_enum
2014-10-06 17:22:29 -04:00
jvazquez-r7
3aadaf672e
Fix @lsanchez-r7's feedback, single expectation per test and avoid explicit use of subject
2014-10-06 16:08:20 -05:00
sinn3r
d3354d01f0
Fix #3808 - NoMethodError undefined method `map'
...
NoMethodError undefined method `map' due to an incorrect use of
load_password_vars
2014-10-06 15:42:51 -05:00
sinn3r
17f278effd
Fix #3822 - Support file:// syntax for check()
2014-10-06 13:37:14 -05:00
Jon Hart
8c8ccc1d54
Update Authors
2014-10-06 11:30:39 -07:00
us3r777
03888bc97b
Change the check function
...
Use regex based detection
2014-10-06 18:56:01 +02:00
us3r777
29111c516c
Wordpress Infusionsoft Gravity Forms CVE-2014-6446
...
The Infusionsoft Gravity Forms plugin 1.5.3 through 1.5.10 for
WordPress does not properly restrict access, which allows remote
attackers to upload arbitrary files and execute arbitrary PHP
code via a request to utilities/code_generator.php.
2014-10-06 14:10:01 +02:00
agix
12cd686bc4
Delete Encoder possibility in msfpayload
2014-10-06 11:22:53 +02:00
nstarke
69400cf280
Fixing Author Declaration
...
I had accidentally listed myself three times as the author.
Fixing that issue so that I am only declaring myself once.
2014-10-05 23:17:28 -05:00
Martin Vigo
8567edc22f
Merge remote-tracking branch 'upstream/master'
2014-10-05 20:57:27 -07:00
nstarke
c0a3691817
Adding Jenkins-CI Login Scanner
...
Per Github issue #3871 (RM8774), I have added a
login scanner module for Jenkins-CI installations.
2014-10-05 22:08:34 -05:00
James Lee
a65ee6cf30
Land #3373 , recog
...
Conflicts:
Gemfile
Gemfile.lock
data/js/detect/os.js
lib/msf/core/exploit/remote/browser_exploit_server.rb
modules/exploits/android/browser/webview_addjavascriptinterface.rb
2014-10-03 18:05:58 -05:00
Tod Beardsley
097d2bfbb5
Land #3922 : Metasploit Park banner
2014-10-03 16:32:56 -05:00
Jon Hart
a341756e83
Support spoofing source IPs for NTP readvar, include status messages
2014-10-03 14:05:57 -07:00
Jon Hart
fa4414155a
Only include the exact readvar payload, not any padding
2014-10-03 13:58:13 -07:00
Jon Hart
65c1a8230a
Address most Rubocop complaints
2014-10-03 13:47:29 -07:00
Jon Hart
0715c671c6
Update NTP readvar module to detect DRDoS, UDPScanner to be faster
2014-10-03 13:28:30 -07:00
Tod Beardsley
d048bb7725
Add some color to the msfpark banner
...
It looks kind of naked without some color compared to all the other
banners.
2014-10-03 14:52:54 -05:00
Samuel Huckins
f2fc0d88ef
Lands #3943 , changes to engine require
2014-10-03 14:26:50 -05:00
Matt Buck
0bb4eac259
Rename the method for optional requires
...
MSP-11412
2014-10-03 14:06:13 -05:00
Matt Buck
88cbf22ef0
Optionally require mdm, as well
...
MSP-11412
2014-10-03 13:49:39 -05:00
Matt Buck
478dbd32f2
Bump to newly-released versions of gems
...
MSP-11412
2014-10-03 12:07:23 -05:00
Matt Buck
f748256e47
Use the prerelease versions of the gems
...
MSP-11412
2014-10-03 10:29:10 -05:00
William Vu
f7e709dcb3
Land #3941 , new WPVDB reference
2014-10-03 10:17:02 -05:00
Christian Mehlmauer
f45b89503d
change WPVULNDBID to WPVDB
2014-10-03 17:13:18 +02:00
0a2940
f2b9aeed74
typo
2014-10-03 11:02:56 +01:00
0a2940
f60f6d9c92
add exploit for CVE-2011-1485
2014-10-03 10:54:43 +01:00
Spencer McIntyre
7da22d064d
Remove an unnecessary var and fix process_close
2014-10-02 20:52:45 -04:00
Matt Buck
04dbfb9ad6
Bump metasploit gem dependencies
...
MSP-11412
2014-10-02 18:11:13 -05:00
Brandon Perry
2c9446e6a8
Update f5_icontrol_exec.rb
2014-10-02 17:56:24 -05:00
sinn3r
6f50ef581c
Land #3935 - Fix SNMP scanners on OS X/FreeBSD
2014-10-02 16:38:36 -05:00
sinn3r
6d7870a4ac
Land #3934 - New :vuln_test option to BES
2014-10-02 16:31:50 -05:00
Christian Mehlmauer
33b37727c7
Added wpvulndb links
2014-10-02 23:03:31 +02:00
Matt Buck
dabec92e61
Ensure require of metasploit/credential/engine is optional
2014-10-02 14:46:56 -05:00
Matt Buck
7ed1977d0b
Specific require all metasploit gem dependencies' engines
...
MSP-11412
2014-10-02 14:20:10 -05:00
Matt Buck
71efeb0c26
Also PATH out the deps for metasploit-credential and metasploit_data_models
...
MSP-11412
2014-10-02 14:08:35 -05:00
sinn3r
0820a4fe6a
Land #3933 - Fix cmd_exec with Python Meterpreter on OS X
2014-10-02 13:48:19 -05:00
Matt Buck
05c71af03c
PATH out the deps to metasploit-concern and metasploit-model, for the moment
2014-10-02 13:29:50 -05:00
Samuel Huckins
0dfd8e25b8
Land #3846 , Rex::ImageSource specs
2014-10-02 12:33:56 -05:00
William Vu
ee92648693
Land #3906 , Zsh completion for Metasploit
2014-10-02 11:06:10 -05:00
HD Moore
24eec0e2a6
Swap to recog ~> 1.0 pre Luke's comment
2014-10-02 09:51:41 -05:00
Joe Vennix
7861b17e16
Use write() to fix SNMP on osx/freebsd.
2014-10-02 09:15:43 -05:00
HD Moore
5f4098f650
Bump recog to ~> 1.0.0
2014-10-02 00:51:37 -05:00
Joe Vennix
6571213f1c
Remove un-truthy doc string.
2014-10-01 23:41:02 -05:00
Joe Vennix
5a8eca8946
Adds a :vuln_test option to BES, just like in BAP.
...
I needed this to run a custom JS check for the Android
webview vuln when the exploit is served straight
through BES. The check already existed when using BAP,
so I tried to preserve that syntax, and also added a
:vuln_test_error as an optional error message.
This commit also does some mild refactoring of un-
useful behavior in BES.
2014-10-01 23:34:31 -05:00
Joe Vennix
b1b8cba4c5
Rescue an IOError on channel double-close.
...
This was causing output from python meterpreter
commands run on OSX to be discarded when the error
was raised, making cmd_exec not-so-useful.
2014-10-01 22:35:41 -05:00
HD Moore
0380c5e887
Add CVE-2014-6278 support, lands #3932
2014-10-01 18:25:41 -05:00
William Vu
c1b0acf460
Add CVE-2014-6278 support to the exploit module
...
Same thing.
2014-10-01 17:58:25 -05:00
William Vu
5df614d39b
Land #3928 , release fixes
2014-10-01 17:21:08 -05:00
HD Moore
77bb2df215
Adds support for both CVEs, lands #3931
2014-10-01 17:06:59 -05:00
sinn3r
3ec6166193
Land #3927 - Shellshock PureFPTd extauth
2014-10-01 17:00:55 -05:00
HD Moore
4dd285c319
Merge pull request #4 from jlee-r7/feature/recog
...
Feature/recog
2014-10-01 16:43:18 -05:00
William Vu
51bc5f52c1
Add CVE-2014-6278 support
...
Going with an OptEnum to simplify the code for now...
2014-10-01 16:40:55 -05:00
Spencer McIntyre
8cf718e891
Update pureftpd bash module rank and description
2014-10-01 17:19:31 -04:00
James Lee
5cb016c1b1
Use Match constant in BES as well
2014-10-01 16:17:13 -05:00
James Lee
7e05ff343e
Fix smbdirect
...
Also some whitespace and a typo in output message
2014-10-01 16:02:59 -05:00
James Lee
a21752bc9c
Fix NoMethodError on os, mark DCs as 'server'
2014-10-01 16:02:46 -05:00
James Lee
a75d47aad9
Use yardoc for new methods
...
Also substitute '&&' for 'and', and fix some whitespace
2014-10-01 16:02:33 -05:00
Tod Beardsley
4fbab43f27
Release fixes, all titles and descs
2014-10-01 14:26:09 -05:00
Spencer McIntyre
cf6029b2cf
Remove the less stable echo stager from the exploit
2014-10-01 15:15:07 -04:00
Spencer McIntyre
632edcbf89
Add CVE-2014-6271 exploit via Pure-FTPd ext-auth
2014-10-01 14:57:40 -04:00
William Vu
9bfd013e10
Land #3923 , mv misc/pxexploit to local/pxeexploit
...
Also renamed typo'd pxexploit -> pxeexploit.
2014-09-30 17:48:06 -05:00
William Vu
5fc57f7ed5
Land #3924 , rm dlink_upnp_exec_noauth_telnetd
...
Deprecated.
2014-09-30 17:46:07 -05:00
William Vu
039e544ffa
Land #3925 , rm indeces_enum
...
Deprecated.
2014-09-30 17:45:38 -05:00
sinn3r
be1df68563
Remove auxiliary/scanner/elasticsearch/indeces_enum.rb
...
Time is up, so good bye.
2014-09-30 17:24:21 -05:00
sinn3r
9e67beb396
Remove modules/exploits/linux/http/dlink_upnp_exec_noauth_telnetd.rb
...
Time is up, so good bye.
2014-09-30 17:21:55 -05:00
sinn3r
b17396931f
Fixes #3876 - Move pxeexploit to local directory
2014-09-30 17:16:13 -05:00
William Vu
909ac522d1
Add metasploit-park.txt banner to msfconsole
...
Obviously a homage to Jurassic Park. :)
2014-09-30 16:28:23 -05:00
agix
aad9589c45
Msfpayload doesn't work if ENCODER option is set
2014-09-30 22:08:34 +02:00
Tod Beardsley
c1cb8bcfdd
Land #3918 , bugfix on self.rhost mssql_login
2014-09-30 13:36:42 -05:00
sinn3r
296a51f661
Land #3917 - Description & module title update
2014-09-30 12:37:38 -05:00
sinn3r
1e2d860ae1
Fix #3914 - Inconsistent unicode names
2014-09-30 12:19:27 -05:00
William Vu
5ea968f3ee
Update description to prefer the exploit module
2014-09-30 11:34:28 -05:00
sinn3r
7163b8c55a
Fixes #3915 - NoMethodError private method `rhost'
...
There's no self.rhost, but rhost is defined
2014-09-30 11:34:16 -05:00
William Vu
162e42080a
Update title to reflect scanner status
2014-09-30 11:04:17 -05:00
sinn3r
10dc6ed2fe
Land #3912 - Update check method and additional references
2014-09-30 10:18:56 -05:00
William Vu
de65ab0519
Fix broken check in exploit module
...
See 71d6b37088 .
2014-09-29 23:03:09 -05:00
William Vu
12d7073086
Use idiomatic Ruby for the marker
2014-09-29 22:32:07 -05:00
William Vu
71d6b37088
Fix bad header error from pure Bash CGI script
2014-09-29 22:25:42 -05:00
William Vu
df44dfb01a
Add OSVDB and EDB references to Shellshock modules
2014-09-29 21:39:07 -05:00
sinn3r
b2d2101be2
Land #3913 - Change hardcoded table prefixes
2014-09-29 17:55:45 -05:00
sinn3r
8f3e03d4f2
Land #3903 - ManageEngine OpManager / Social IT Arbitrary File Upload
2014-09-29 17:53:43 -05:00
Christian Mehlmauer
b266233e95
fix bug
2014-09-30 00:21:52 +02:00
Pedro Ribeiro
533b807bdc
Add OSVDB id
2014-09-29 21:52:44 +01:00
HD Moore
3b5eb42b55
Switch to Msf::OperatingSystems::Match::WINDOWS
2014-09-29 15:50:25 -05:00
HD Moore
878f3d12cd
Remove kind_of? per @trosen-r7
2014-09-29 15:39:10 -05:00
HD Moore
77efa7c19a
Change if/else to case statement
2014-09-29 15:37:58 -05:00
HD Moore
bfadfda581
Fix typo on match string for opera_configoverwrite
2014-09-29 15:34:35 -05:00
sinn3r
ffe5aafb2f
Land #3905 - Update exploits/multi/http/apache_mod_cgi_bash_env_exec
2014-09-29 15:19:35 -05:00
sinn3r
21b2d9eb3f
Land #3899 - WordPress custom-contact-forms Plugin SQL Upload
2014-09-29 14:40:28 -05:00
sinn3r
9e5826c4eb
Land #3844 - Add the JSObfu mixin to Firefox exploits
2014-09-29 11:15:14 -05:00
sinn3r
ababc3d8ff
Land #3869 - HP Network Node Manager I PMD Buffer Overflow
2014-09-29 11:00:12 -05:00
HD Moore
8fa666b75d
Verbose messages on why a connection is closed
2014-09-28 17:41:21 -07:00
Martin Vigo
ba42469e34
Merge remote-tracking branch 'upstream/master'
2014-09-28 02:31:49 -07:00
Martin Vigo
8dafc93dc3
Meet rubocop and msftify rules
2014-09-28 01:59:02 -07:00
Meatballs
d5959d6bd6
Land #2585 , Refactor Bypassuac with Runas Mixin
2014-09-28 09:24:22 +01:00
Meatballs
e14dd9900b
Land #3896 , Change Max LOGLEVEL to 3
2014-09-28 09:18:29 +01:00
Meatballs
67c25c20ca
Land #3357 , Run Local Exploits in AutoRunScript
2014-09-28 09:12:26 +01:00
Meatballs
3fc57109e6
Dont rescue Exception
2014-09-28 09:12:03 +01:00
Spencer McIntyre
3181d4e080
Add zsh completion definitions for utilities
2014-09-27 20:12:02 -04:00
Spencer McIntyre
fe12ed02de
Support a user defined header in the exploit too
2014-09-27 18:58:53 -04:00
Pedro Ribeiro
f20610a657
Added full disclosure URL
2014-09-27 21:34:57 +01:00
Pedro Ribeiro
030aaa4723
Add exploit for CVE-2014-6034
2014-09-27 19:33:49 +01:00
Pedro Ribeiro
ce8452a17a
Merge pull request #3 from rapid7/master
...
bla
2014-09-27 19:24:32 +01:00
HD Moore
64dbc396dd
Add header specification to check module, lands #3902
2014-09-27 12:58:29 -05:00
William Vu
044eeb87a0
Add variable HTTP header
...
Also switch from OptEnum to OptString for flexibility.
2014-09-27 12:39:24 -05:00
Brandon Perry
161a145ec2
Create f5_icontrol_exec.rb
2014-09-27 10:40:13 -05:00
Christian Mehlmauer
c51c19ca88
bugfix
2014-09-27 14:56:34 +02:00
Christian Mehlmauer
9a424a81bc
fixed bug
2014-09-27 13:46:55 +02:00
Christian Mehlmauer
1c30c35717
Added WordPress custom_contact_forms module
2014-09-27 13:42:49 +02:00
sinn3r
c75a0185ec
Land #3897 - Fix check for apache_mod_cgi_bash_env & apache_mod_cgi_bash_env_exec
2014-09-26 17:06:23 -05:00
jvazquez-r7
80d9af9b49
Fix spacing in description
2014-09-26 17:03:28 -05:00
jvazquez-r7
9e540637ba
Add module for CVE-2014-5377 ManageEngine DeviceExpert User Credentials
2014-09-26 17:02:27 -05:00
jvazquez-r7
3259509a9c
Use return
2014-09-26 16:04:15 -05:00
jvazquez-r7
0a3735fab4
Make it better
2014-09-26 16:01:10 -05:00
jvazquez-r7
3538b84693
Try to make a better check
2014-09-26 15:55:26 -05:00
sinn3r
ae82ebc734
Change max LogLevel to 3
...
There is no such thing as a LogLevel 5.
2014-09-26 14:20:47 -05:00
jvazquez-r7
6e2d297e0c
Credit the original vuln discoverer
2014-09-26 13:45:09 -05:00
jvazquez-r7
1fa488f791
Land #3893 , @jlee-r7's exploit module for DHCP CVE-2014-2014-6271
2014-09-26 13:43:33 -05:00
jvazquez-r7
e1f00a83bc
Fix Rex because domainname and domain_name were duplicated
2014-09-26 13:40:52 -05:00
jvazquez-r7
5044117a78
Refactor dhclient_bash_env to use the egypt's mixin mods
2014-09-26 13:34:44 -05:00
nullbind
ebf4e5452e
Added mssql_escalate_dbowner module
2014-09-26 10:29:35 -05:00
jvazquez-r7
a4bc17ef89
deregister options needed for exploitation
2014-09-26 10:15:46 -05:00
jvazquez-r7
54e6763990
Add injection to HOSTNAME and URL
2014-09-26 10:13:24 -05:00
jvazquez-r7
a31b4ecad9
Merge branch 'review_3893' into test_land_3893
2014-09-26 08:41:43 -05:00
James Lee
86f85a356d
Add DHCP server module for CVE-2014-6271
2014-09-26 01:24:42 -05:00
sinn3r
38c8d92131
Land #3888 - exploit module version of CVE-2014-6271
2014-09-26 00:31:41 -05:00
HD Moore
b878ad2b75
Add a module to exploit bash via DHCP, lands #3891
...
This module is just a starting point for folks to test their DHCP client implementations and we plan to significantly overhaul this once we get a bit of breathing room.
2014-09-25 23:38:40 -05:00
Ramon de C Valle
9c11d80968
Add dhclient_bash_env.rb (Bash exploit)
...
This module exploits a code injection in specially crafted environment
variables in Bash, specifically targeting dhclient network configuration
scripts through the HOSTNAME, DOMAINNAME, and URL DHCP options.
2014-09-26 01:37:00 -03:00
HD Moore
52ffddd639
Adds domain and url options to DHCP/PXE server, lands #3889
...
There are serious style and code quality issues with this class and normally I would push for a full refactor, but given the urgency of delivering DHCP functionality to support the bash issues, we will have to refactor the DHCP Server code another day.
2014-09-25 22:43:51 -05:00
HD Moore
6516abb3a0
Fix an ancient bug in the DHCP mixin, lands #3890
2014-09-25 22:39:51 -05:00
Ramon de C Valle
bdac82bc7c
Fix lib/msf/core/exploit/dhcp.rb
2014-09-25 22:18:26 -03:00
Ramon de C Valle
5dde73bb51
Add domain name and url options to DHCP server
2014-09-25 19:58:42 -03:00
jvazquez-r7
ad864cc94b
Delete unnecessary code
2014-09-25 16:18:01 -05:00
Joe Vennix
2b02174999
Yank Android->jsobfu integration. Not really needed currently.
2014-09-25 16:00:37 -05:00
jvazquez-r7
9245bedf58
Make it more generic, add X86_64 target
2014-09-25 15:54:20 -05:00
Samuel Huckins
be6552dae7
Clarifying VMware priv esc via bash module name
2014-09-25 14:34:09 -05:00
jvazquez-r7
d8c03d612e
Avoid failures due to bad payload selection
2014-09-25 13:49:04 -05:00
jvazquez-r7
91e5dc38bd
Use datastore timeout
2014-09-25 13:36:05 -05:00
jvazquez-r7
8a43d635c3
Add exploit module for CVE-2014-6271
2014-09-25 13:26:57 -05:00
jvazquez-r7
e0fc30c040
Land #3884 , @wvu's check and reporting for apache_mod_cgi_bash_env
2014-09-25 09:52:17 -05:00
William Vu
f66c854ad6
Fix description to be less lulzy
2014-09-25 07:09:08 -05:00
William Vu
9ed28408e1
Favor check_host for a scanner
2014-09-25 07:06:12 -05:00
William Vu
62b74aeaed
Reimplement old check code I was testing before
...
I would like to credit @wchen-r7 for providing advice and feedback.
@jvazquez-r7, too! :)
2014-09-25 06:38:25 -05:00
Joe Vennix
979d046bbf
Land #3885 , @mubix's improvements to vmware root.
...
This prevents the need to kill any processes before getting root
privs, which is a good timesaver.
2014-09-25 01:38:57 -05:00
William Vu
d9120cd586
Fix typo in description
...
Running on fumes here...
2014-09-25 01:22:08 -05:00
William Vu
790df96396
Fix missed var
2014-09-25 01:19:14 -05:00
Rob Fuller
f13289ab65
remove debugging
2014-09-25 02:16:19 -04:00
William Vu
e051cf020d
Add missed mixin
2014-09-25 01:14:58 -05:00
William Vu
27b8580f8d
Add protip to description
...
This gets you lots of shells.
2014-09-25 01:10:22 -05:00
Rob Fuller
8cb4ed4cb7
re-add quotes -oops
2014-09-25 02:09:12 -04:00
William Vu
b1e9b3664e
Improve false positive check
2014-09-25 01:01:11 -05:00
Rob Fuller
6fb587ef96
update to use vmware-vmx-stats
2014-09-25 01:55:04 -04:00
William Vu
8daf8d4339
Report vuln for apache_mod_cgi_bash_env
...
Now with fewer false positives! It's kinda like a check method.
2014-09-25 00:42:14 -05:00
jvazquez-r7
37753e656e
Land #3882 , @jvennix-r7's vmware/bash privilege escalation module
2014-09-25 00:42:12 -05:00
jvennix-r7
a9049f445b
Merge pull request #15 from jvazquez-r7/test_3882
...
Fix processes check
2014-09-25 00:39:13 -05:00
jvazquez-r7
456d731aa3
Fix processes check
2014-09-25 00:24:39 -05:00
William Vu
fd34bdb22f
Add missed fix (formatting)
2014-09-24 23:12:29 -05:00
William Vu
5a59b7cd89
Fix formatting
2014-09-24 23:12:11 -05:00
William Vu
d70c5b889a
Add missed fix (add peer)
2014-09-24 22:53:33 -05:00
William Vu
e6f0736797
Add peer
2014-09-24 22:48:51 -05:00
Tod Beardsley
47ff2fdf89
Land #3883 , more generic HTTP method/CMD
2014-09-24 22:44:18 -05:00
William Vu
8b6519b5b4
Revert shortened reference
...
But it's so long. :(
2014-09-24 22:43:33 -05:00
William Vu
ecb10ebe28
Add variable HTTP method and other stuff
2014-09-24 22:41:01 -05:00
Joe Vennix
f6708b4d83
Check for running vmware processes first.
2014-09-24 19:11:38 -05:00
Tod Beardsley
ff5398bf3f
Land #3880 , bash scanner module
2014-09-24 19:03:37 -05:00
William Vu
a600a0655d
Scannerify the module
2014-09-24 18:58:39 -05:00
William Vu
abadf65d8d
Clean up title and formatting
2014-09-24 18:42:43 -05:00
William Vu
2562964581
Revert to my original code of using CMD
2014-09-24 18:00:13 -05:00
Joe Vennix
99da950734
Adds osx vmware/bash priv escalation.
2014-09-24 17:44:14 -05:00
William Vu
6ae578f80f
Add Stephane Chazelas as an author
2014-09-24 17:14:18 -05:00
William Vu
b2555408a4
Rename module
...
I don't think we're gonna make a supermodule like we had hoped.
2014-09-24 16:55:10 -05:00
William Vu
31e9e97146
Replace unnecessary reference with a better one
2014-09-24 16:52:43 -05:00
William Vu
fc04bf9d48
Update description
...
This is what I had when @todb-r7 beat me to the punch. >:P
2014-09-24 16:22:58 -05:00
wvu-r7
2b127ea2ee
Merge pull request #6 from todb-r7/fixup-pr3880
...
Fix description
2014-09-24 16:19:00 -05:00
Tod Beardsley
2f788c2e0c
Fix description
2014-09-24 16:13:05 -05:00
Joe Vennix
b96a7ed1d0
Install a global object in firefox payloads, bump jsobfu.
2014-09-24 16:05:00 -05:00
William Vu
ca63fe931d
Add CVE-2014-6271 PoC
2014-09-24 16:02:59 -05:00
jvazquez-r7
e4f71d79ac
Fix grammar
2014-09-24 15:17:09 -05:00
Joe Vennix
5d234c0e01
Pass #send in this so jsobfu is not confused.
2014-09-24 15:07:14 -05:00
jvazquez-r7
0247e4a521
Change RequiredCmd for reverse_bash_telnet_ssl cmd payload
2014-09-24 00:40:14 -05:00
jvazquez-r7
f2cfbebbfb
Add module for ZDI-14-305
2014-09-24 00:22:16 -05:00
Brendan Coles
5f6e84580c
Clean up and use Metasploit::Credential
2014-09-24 01:00:23 +00:00
sinn3r
11b9a8a6ae
Land #3814 - Advantech WebAccess dvs.ocx GetColor BoF
2014-09-23 15:06:21 -05:00
jvazquez-r7
b021ff4399
Add noche tags
2014-09-23 13:11:06 -05:00
jvazquez-r7
5c6236e874
Fix rop chain to allow VirtualAlloc when end of stack is too close
2014-09-23 13:08:26 -05:00
sinn3r
35f788a1a4
Land #3848 - Add specs for Rex::Arch
2014-09-23 13:03:40 -05:00
sinn3r
fe1842520c
Land #3849 - Rex::ExtTime rspec
2014-09-23 13:00:17 -05:00
sinn3r
31ecbfdc4e
Land #3756 - EMC AlphaStor Device Manager Opcode 0x75 Command Injection
2014-09-23 12:57:46 -05:00
jvazquez-r7
0dfc2d3f87
Add specs for Rex::ExtTime
2014-09-22 14:55:14 -05:00
Jon Hart
259a368577
Land #3841 , @jabra-'s modifications to ssdp_amp to support spoofing
2014-09-22 12:28:46 -07:00
Jon Hart
fc4c1907d3
Land #3839 , @jabra-'s updates to dns_amp to support spoofing
2014-09-22 12:14:39 -07:00
jvazquez-r7
db587afac8
Add specs for Rex::Arch
2014-09-22 14:10:55 -05:00
Jon Hart
8f63075da4
Land #3837 , @jabra-'s update to chargen scanner to support spoofing
2014-09-22 12:02:01 -07:00
Jon Hart
650b65250f
Merge branch 'master' of github.com:rapid7/metasploit-framework into upstream-master
2014-09-22 11:51:10 -07:00
Jon Hart
4e9f1282de
Land #3834 , @jabra-'s updates to UDPscanner to support spoofing
2014-09-22 11:49:53 -07:00
Jon Hart
e86b18cdd4
Add sanity check for NUM_REQUESTS
2014-09-22 11:48:39 -07:00
jvazquez-r7
701d6470c9
Add specs for Rex::Oui
2014-09-22 13:28:07 -05:00
darkbushido
091be3f45a
Merge branch 'pr/3845' into upstream
2014-09-22 13:01:00 -05:00
jvazquez-r7
45011ae87f
Add shared examples
2014-09-22 12:15:04 -05:00
jvazquez-r7
a677749f5b
Add specs for #read_asciiz and fix bugs there
2014-09-22 12:14:21 -05:00
jvazquez-r7
f804d42ddc
Add specs for Memory#index
2014-09-22 11:43:18 -05:00
jvazquez-r7
b121764003
Add specs for Memory#subsource
2014-09-22 11:30:30 -05:00
jvazquez-r7
3500e1ce7c
Add specs for Memory#close
2014-09-22 11:18:21 -05:00
jvazquez-r7
a612caf1ae
Finish examples for Memory#read
2014-09-22 11:17:09 -05:00
jvazquez-r7
df7ee55962
Add first specs for Rex::ImageSource::Memory#read
2014-09-22 11:06:34 -05:00
jvazquez-r7
77122895db
Add specs for Rex::ImageSource::Memory#initialize
2014-09-22 11:02:24 -05:00
jvazquez-r7
a249eb1026
Add specs for Disk#subsource and Disk#close
2014-09-22 10:50:11 -05:00
jvazquez-r7
23bf36bc75
Start specs for Disk#subsource
2014-09-22 10:37:56 -05:00
jvazquez-r7
3f1eea55a6
Add specs for Disk#read and Disk#index
2014-09-22 10:35:54 -05:00
Luke Imhoff
f61afe2598
Merge branch 'master' into bug/MSP-11368/boot-profiling
...
MSP-11368
2014-09-22 10:00:07 -05:00
jvazquez-r7
46e4235e79
Add spec templates
2014-09-22 09:16:21 -05:00
William Vu
ebacb26e51
Land #3838 , msfvenom badchar fix
2014-09-22 03:08:57 -05:00
William Vu
8a0f86fb27
Land #3843 , typo fix for download_file
2014-09-22 00:48:46 -05:00
Joe Vennix
ec88957ff4
Whitespace tweaks.
2014-09-21 23:57:58 -05:00
Joe Vennix
d9e6f2896f
Add the JSObfu mixin to a lot of places.
2014-09-21 23:45:59 -05:00
Joe Vennix
829248f427
Land #3840 , @wchen-r7's tweaks to os.js and module addition.
2014-09-21 22:38:27 -05:00
sinn3r
2a714a7c4d
Fix a typo
...
Downloading and deleting are two very different things. Thanks Dan.
2014-09-21 18:35:26 -05:00
Martin Vigo
c361bdfcba
Merge branch 'master' of github.com:martinvigo/metasploit-framework
2014-09-20 23:24:39 -07:00
Martin Vigo
e96fe529e9
Add module to extract/decrypt LastPass credentials
2014-09-20 23:22:26 -07:00
sinn3r
2e96026725
avoid saying 'should'
2014-09-21 00:56:13 -05:00
sinn3r
e1cfc74c32
Move jsobfu to a mixin
2014-09-21 00:39:04 -05:00
sinn3r
cd037466a6
upate doc
2014-09-20 23:40:47 -05:00
sinn3r
9191af6241
Update js_obfuscate
2014-09-20 23:38:35 -05:00
sinn3r
a9420befa4
Default to 0
2014-09-20 21:39:20 -05:00
sinn3r
046045c608
Chagne option description
2014-09-20 21:38:57 -05:00
sinn3r
fd5aee02d7
Update js_obfuscate
2014-09-20 21:36:17 -05:00
sinn3r
cd70014446
Fix os detection rspec
...
no more window
2014-09-20 21:29:13 -05:00
Josh Abraham
b7a0847114
SRC IP spoofing added to the SSDP amplification module
2014-09-20 21:37:01 -04:00
sinn3r
7bab825224
Last changes
2014-09-20 18:39:09 -05:00
sinn3r
2d828a2144
Update rspec
2014-09-20 18:09:22 -05:00
sinn3r
135bed254d
Update BrowserExploitServer for JSObfu
2014-09-20 17:59:36 -05:00
Joe Vennix
d9a713b415
Decode the badchars string correctly.
2014-09-20 17:48:03 -05:00
Josh Abraham
bb018de3a1
chargen src IP spoofing
2014-09-20 16:08:52 -04:00
Josh Abraham
cd8b1318e0
send data based on input not @probe
2014-09-20 15:18:58 -04:00
Josh Abraham
3fb00ece9e
refactored the code based on PR feedback
2014-09-20 14:10:00 -04:00
mfadzilr
a2a2ca550e
add test result on different windows version
2014-09-20 20:06:30 +08:00
mfadzilr
dd71c666dc
added osvdb reference and software download url, use FileDropper method
...
for cleanup
2014-09-20 15:31:28 +08:00
sinn3r
d52236fe05
Land #3835 - JSObfu to a gem
2014-09-20 01:38:45 -05:00
mfadzilr
19ed594e98
using FileDropper method for cleanup
2014-09-20 10:52:21 +08:00
Joe Vennix
8e1b00ce95
Adds JSObfu.disabled for spec stubbing, fixes BES specs.
2014-09-19 20:42:05 -05:00
Joe Vennix
df999db547
Add spec to ensure gem loads without error.
2014-09-19 19:49:01 -05:00
Joe Vennix
0f4be63903
Move JSObfu a gem then pull it into the Rex namespace.
2014-09-19 19:10:39 -05:00
jvazquez-r7
9acccfe9ba
Fix description
2014-09-19 17:18:59 -05:00
jvazquez-r7
d826132f87
Delete CVE, add EDB
2014-09-19 17:16:03 -05:00
jvazquez-r7
7afbec9d6c
Land #2890 , @Ahmed-Elhady-Mohamed module for OSVDB 93034
2014-09-19 17:12:49 -05:00
jvazquez-r7
1fa5c8c00c
Add check method
2014-09-19 17:11:16 -05:00
jvazquez-r7
ce0b00bb0b
Change module location and filename
2014-09-19 16:59:35 -05:00
jvazquez-r7
0267e889e2
Use FileDropper
2014-09-19 16:58:21 -05:00
jvazquez-r7
6fd5027e05
Avoid UploadPath datastore option, parse from response
2014-09-19 16:55:28 -05:00
jvazquez-r7
2ce9bdf152
Use target_uri.path.to_s instead of uri
2014-09-19 16:43:40 -05:00
jvazquez-r7
eb55c7108b
Fix indentantion again
2014-09-19 16:41:07 -05:00
jvazquez-r7
cbfb7e600d
Use Rex::MIME::Message
2014-09-19 16:29:09 -05:00
jvazquez-r7
cffb28b5d3
Fix indentantion
2014-09-19 16:18:46 -05:00
Luke Imhoff
5884cbc196
Optimize skip logic in #update_all_module_details
...
MSP-11368
Use `Hash<String, Set<String>>` instead of `Array<(String, String)>` so
that `include?` call is faster because (1) it's only search through
reference names of the same module_type and (2) `Set#include?` is faster
than `Array#include?`. This change is a 8.20% average reduction in boot
time compare to b863978028 , for a overall
reduction of 40.95% over b5c3c87790 .
See statistics at
https://docs.google.com/spreadsheets/d/1TnZIUFIR1S5nCnkeM-7XR3AVSbyCl39x2mItJKJCOqg/edit?usp=sharing
and data at
https://drive.google.com/folderview?id=0Bx1hRHfpRW92VEFvQ2FaN3RoWWs&usp=drive_web
2014-09-19 15:34:10 -05:00
jvazquez-r7
b16085baa6
Land #3244 , @dmaloney-r7's fix for integer comparisions on metasm
2014-09-19 15:31:37 -05:00
jvazquez-r7
c00094ba6e
Land #3345 , @mvdevnull's auxiliary module for OSVDB 106815, Alienvault sqli
2014-09-19 15:01:21 -05:00
jvazquez-r7
62414e2214
Add Timeout to exploit sqli
2014-09-19 15:00:54 -05:00
jvazquez-r7
db6372ec8b
Do minor module cleanup
2014-09-19 14:43:35 -05:00
Luke Imhoff
8b5a146067
Wrap Array#include? usage
...
MSP-11368
Wrap skipped.include? call to confirm it is the culprit for
Array#include? inside of with_connection in profile.
2014-09-19 14:38:12 -05:00
jvazquez-r7
4a9294e3bf
Mark module as not executable
2014-09-19 14:36:44 -05:00
jvazquez-r7
405ac34a16
Fix author name
2014-09-19 13:56:13 -05:00
jvazquez-r7
79d5fb56d4
Land #3829 , @jhart-r7's UDP emtpy probe scanner
2014-09-19 13:54:35 -05:00
Jon Hart
737f77d31a
Cleaner output when PORTS is invalid
2014-09-19 11:12:14 -07:00
Jon Hart
3493987300
report_service when we find something this way
2014-09-19 10:45:06 -07:00
Luke Imhoff
9b92d0d6d4
Use Rex::Compat.open_file to open profiling report
...
MSP-11368
Use Rex::Compat.open_file instead of `system('open <pdf>')` so that
opening the pdf works on Linux in addition to OSX.
2014-09-19 11:13:28 -05:00
jvazquez-r7
80d36ec08a
Land #3833 , @darkbushido's cucumber fixes
2014-09-19 11:03:41 -05:00
Josh Abraham
43171141da
update for ntp modules
2014-09-19 11:14:11 -04:00
Josh Abraham
c216cf8c53
added spoofing capabilities to udp_scanner
2014-09-19 10:29:05 -04:00
Martin Vigo
f30f3392aa
Add module to extract/decrypt LastPass credentials
2014-09-18 23:40:05 -07:00
mfadzilr
677d035ce8
added proper regex for check function
...
add comment for changed code
2014-09-19 11:30:51 +08:00
Luke Imhoff
b863978028
Remove fastlib
...
MSP-11368
MSP-11143
Remove fastlib as it slows down the code loading process. From the
previous commit, the mean loading for
`METASPLOIT_FRAMEWORK_PROFILE=true msfconsole -q -x exit` was
27.9530±0.3485 seconds (N=10). The mean after removal of fastlib
was 17.9820±0.6497 seconds (N=10). This means an average 35.67%
reduction in boot time.
2014-09-18 15:24:21 -05:00
Jon Hart
a54b23642e
Relocate empty UDP scanner
2014-09-18 12:31:52 -07:00
Brendan Coles
6cad5d9aeb
Add ManageEngine DeviceExpert User Credentials
2014-09-18 19:18:59 +00:00
Luke Imhoff
21b3d6bb4a
Profiling support for msfconsole boot
...
Set METASPLOIT_FRAMEWORK_PROFILE=true in the environment. Run
`./msfconsole -q -x exit`. A pdf will be saved to
tmp/profiles/msfconsole/YYYYMMDDHHMMSS.pdf with the call graph with
numbers being in 100 samples per second. The pdf is automatically
opened with `open`.
2014-09-18 14:09:38 -05:00
James Lee
1faa816a8a
Land #3818 , Metasploit::Concern loading
2014-09-18 13:06:41 -05:00
Luke Imhoff
39d302a120
Update metasploit_data_models
...
MSP-11359
Include fix for loading from metasploit_data_models/lib.
2014-09-18 12:35:26 -05:00
Luke Imhoff
8d38735f4a
Update schema with detected_arch
...
MSP-11359
2014-09-18 12:35:09 -05:00
Luke Imhoff
44588cc014
Add detected_arch to expected hosts columns in spec
...
MSP-11359
2014-09-18 12:34:34 -05:00
Luke Imhoff
0f854ce5ed
Update to released metasploit-model
...
MSP-11359
2014-09-18 11:33:41 -05:00
Luke Imhoff
03cc69d902
Update gems
...
MSP-11359
2014-09-18 11:33:22 -05:00
Luke Imhoff
21d6e4afb3
Move metasploit-concern to gemspec
...
MSP-11359
The dependency on `metasploit-concern` should not have been in the db
group as `Metasploit::Concern.run` is called for
`Msf::Exploit:Remote::HttpServer`, which works without the db group
installed. This is a fix for a bug from #3781 .
2014-09-18 09:33:57 -05:00
Tod Beardsley
5dad73a28f
Explicitly require credential_collection
...
Otherwise, you run into a require ordering problem on some platforms.
This is not a great way to fix this -- but it's a fast way, and possibly
even a good way, since you're being explicit about what your module
requirements are.
2014-09-17 15:47:30 -05:00
Tod Beardsley
b5c3c87790
Land #3812 , discourage Meterpreter scripts
2014-09-17 15:32:15 -05:00
Tod Beardsley
4bbd107911
Land #3813 , sponge left in patient
2014-09-17 15:28:54 -05:00
jvazquez-r7
64ac1e6b26
Rand padding
2014-09-17 08:09:09 -05:00
sinn3r
50fa5745bb
Rm print_debug line
...
I forgot to remove this line while testing the module
2014-09-16 16:46:40 -05:00
sinn3r
5e076e0375
Text about not accepting changes to meterpreter scripts
2014-09-16 16:41:14 -05:00
jvazquez-r7
e593a4c898
Add comment about gadgets origin
2014-09-16 16:38:03 -05:00
sinn3r
ffe0eca7fd
Land #3609 - Fix gettelnet
2014-09-16 16:27:46 -05:00
James Lee
3e42fcbbab
Land #3794 , NDR encoding specs
...
MSP-11370 #land
2014-09-16 16:23:22 -05:00
sinn3r
07c14f5ee8
Land #3388 - Post mod to check Win32_QuickFixEngineering
2014-09-16 16:18:04 -05:00
sinn3r
36a3abe036
Add a reference
2014-09-16 16:17:22 -05:00
Joe Vennix
a846d084ca
Lands #3806 , @dmaloney-r7's fixes to SMB LoginScanner.
2014-09-16 15:35:53 -05:00
David Maloney
5ff4a55cd2
smb connection error not setting result properly
...
if the initial connection from the SMB LoginScanner fails
it wouldn't set the target information on the result. this could cause
smb_login to throw a stack trace when it calls invalidate_login
2014-09-16 15:24:14 -05:00
jvazquez-r7
80f02c2a05
Make module ready to go
2014-09-16 15:18:11 -05:00
David Maloney
e5aa5c4014
missing postgres rescues
2014-09-16 15:04:07 -05:00
sinn3r
169d04020d
Land #3571 - Add Wordpress XML-RPC Login Scanner (with LoginScanner)
2014-09-16 14:51:24 -05:00
sinn3r
4ed1fa55f5
Don't need this header
2014-09-16 14:50:32 -05:00
darkbushido
835f224b3c
tagging the module tests as WIP since proxies keep showing up in options
2014-09-16 14:35:57 -05:00
Samuel Huckins
70400803ee
Merge branch 'master' of github.com:rapid7/metasploit-framework
2014-09-16 14:21:10 -05:00
William Vu
35b8c2be4b
Land #3800 , release fixes
2014-09-16 14:05:23 -05:00
Samuel Huckins
4c3c8e5337
Land #3795 , various LoginScanners shored up
2014-09-16 13:55:26 -05:00
sinn3r
b028424152
Land #3752 - add "show missing"
2014-09-16 13:45:13 -05:00
David Maloney
aeed66b694
missing mysql rescue
2014-09-16 13:41:03 -05:00
William Vu
cf13597048
Land #3801 , REMOTE_JS for Android UXSS
...
For BeEF integration, etc.
2014-09-16 13:38:40 -05:00
Joe Vennix
59dfa624c4
Add a REMOTE_JS datastore option for BeEf hooks etc.
2014-09-16 13:31:03 -05:00
David Maloney
d708de07a3
return the lgoinscanner class name in an invalid exception
...
when a loginScanner throws an Invalid exception , the message
will now include the classname of the Scanner that threw it.
2014-09-16 13:24:08 -05:00
sinn3r
3e09283ce5
Land #3777 - Fix struts_code_exec_classloader on windows
2014-09-16 13:09:58 -05:00
sinn3r
ceaf1d64d0
Land #3799 - Add CVE-2014-5519: phpwiki/ploticus RCE
2014-09-16 12:56:04 -05:00
sinn3r
158d4972d9
More references and pass msftidy
2014-09-16 12:54:27 -05:00
Tod Beardsley
bd17c96a6e
Dropped a hyphen in the title
2014-09-16 12:47:44 -05:00
Vincent Herbulot
7a7b6cb443
Some refactoring
...
Use EDB instead of URL for Exploit-DB.
Remove peer variable as peer comes from HttpClient.
2014-09-16 17:49:45 +02:00
David Maloney
6decd3cbd2
fix exceptions thrown in telnet loginscanner too
2014-09-16 10:09:59 -05:00
mfadzilr
978803e9d8
add proper regex
2014-09-16 21:49:02 +08:00
HD Moore
29eb3ebf86
Fix up the StageEncodingFallback logic and error handling
2014-09-15 21:56:35 -05:00
HD Moore
4d3e353028
Merge pull request #2 from agix/multipleStageEncoders
...
Unblock when invalid encoder is selected and allow multiple encoder
2014-09-15 20:54:41 -05:00
us3r777
4c615ecf94
Module for CVE-2014-5519, phpwiki/ploticus RCE
2014-09-16 00:09:41 +02:00
jvazquez-r7
ca4c4f55bd
Add specs for Rex::Encoder::Alpha2::UnicodeMixed
2014-09-15 17:05:08 -05:00
jvazquez-r7
ee45056827
Add specs for Rex::Encoder::Alpha2::UnicodeUpper
2014-09-15 16:57:26 -05:00
jvazquez-r7
3dc53cd013
Add specs for Rex::Encoder::Alpha2::AlphaMixed
2014-09-15 16:43:40 -05:00
jvazquez-r7
e8dce6ac59
Add specs for Rex::Encoder::Alpha2::AlphaUpper
2014-09-15 16:35:54 -05:00
jvazquez-r7
0e1ba8fb5e
Use non aphanumeric badchar
2014-09-15 15:59:18 -05:00
jvazquez-r7
36e5dcd149
Fix shared examples
2014-09-15 15:56:19 -05:00
jvazquez-r7
2e126b6a68
Include it_behaves_like
2014-09-15 15:46:53 -05:00
jvazquez-r7
4064fb60ef
Refactor specs for Rex::Encoder::Alpha2::Generic
2014-09-15 15:43:31 -05:00
jvazquez-r7
2728318358
Add specs for Rex::Encoder::Alpha2::Generic
2014-09-15 15:26:13 -05:00
David Maloney
bf8f7221c7
rescue exceptions in check_setup
2014-09-15 13:52:17 -05:00
jvazquez-r7
3f5fdaebb4
Add specs for Rex::Encoder::NDR
2014-09-15 13:49:18 -05:00
jvazquez-r7
7d4c4c3658
Land #3699 , @dmaloney-r7's ipboard login refactor
2014-09-15 08:29:42 -05:00
mfadzilr
783b03efb6
change line 84 as mubix advice, update disclosure date according to
...
bugtraq security list.
2014-09-15 17:21:05 +08:00
agix
9cbc7e46a3
Fix suggested stuff
...
https://github.com/hmoore-r7/metasploit-framework/pull/2
2014-09-15 09:47:06 +02:00
mfadzilr
9860ed340e
run msftidy, make correction for CVE format and space at EOL (line 77)
2014-09-15 13:13:25 +08:00
mfadzilr
f1d3c44f4f
exploit module for HTTP File Server version 2.3b, exploiting HFS scripting commands 'save' and 'exec'.
2014-09-15 12:59:27 +08:00
mfadzilr
74ef83812a
update module vulnerability information
2014-09-15 01:43:18 +08:00
mfadzilr
8b4b66fcaa
initial test
2014-09-14 12:26:02 +08:00
HD Moore
b8a1010ba4
Switch to Array#union and rename preserved_registers
2014-09-13 22:48:14 -05:00
jvazquez-r7
3a6066792d
Work in rop chain...
2014-09-13 17:38:19 -05:00
dmaloney-r7
8452ac1d37
Merge pull request #14 from jvazquez-r7/review_3699
...
Add specs for #attempt_login
2014-09-13 11:56:18 -05:00
agix
c71428be50
Choose fallback if stage encoding fail
2014-09-13 13:56:54 +02:00
HD Moore
6bd3675f03
Land #3680 , add specs for Rex::MIME
2014-09-13 00:34:39 -05:00
HD Moore
6a2a85d2c4
Land #3789 , adds specs for Rex::Proto::Http::Packet::Header
...
orts
2014-09-13 00:21:43 -05:00
jvazquez-r7
9e21cc8ad4
Add specs for invalid IPBoard application
2014-09-12 16:14:10 -05:00
jvazquez-r7
917a7ffa1e
Add specs for valid IPBoard application
2014-09-12 16:08:03 -05:00
jvazquez-r7
83bf220a10
Land #3730 , @TomSellers's post module for Remote Desktop Connection Manager
2014-09-12 15:38:33 -05:00
jvazquez-r7
5da6a450f1
fix find condition
2014-09-12 15:21:50 -05:00
jvazquez-r7
1749fc73c2
Change module filename
2014-09-12 15:05:33 -05:00
Cucumber
b80519dc16
Lands #3779 , specs
...
MSP-11343
Merge specs that I missed during last merge.
2014-09-12 14:49:26 -05:00
James Lee
f68628c487
Add minimal specs for rex/proto/http/packet/header
2014-09-12 14:30:27 -05:00
jvazquez-r7
95b6529579
Fix run method
2014-09-12 14:27:25 -05:00
jvazquez-r7
373861abb0
Land #3526 , @jhart-r7's soap_xml scanner cleanup
2014-09-12 13:29:52 -05:00
jvazquez-r7
12f949781a
Use double quote for xml strings
2014-09-12 13:18:48 -05:00
jvazquez-r7
8bf639faba
Land #3785 , @jvennix-r7's detection for firefox 29-32
2014-09-12 12:26:51 -05:00
sinn3r
12e3cb3c6a
Land #3764 - Add specs for Rex::Encoder::NonAlpha
2014-09-12 12:09:55 -05:00
sinn3r
54c353a15e
Land #3788 - Adds a spec to ensure HttpServer runs Concern hooks.
2014-09-12 12:05:55 -05:00
jvazquez-r7
e810acd4e9
Land #3748 , @wchen-r7's HP System Management Homepage LoginScanner Upgrade
2014-09-12 11:13:14 -05:00
Joe Vennix
87aeac2b13
Fix syntax error in os.js, specs ftw.
2014-09-12 11:01:08 -05:00
Joe Vennix
a617556f29
Add a helpful comment.
2014-09-12 10:55:08 -05:00
Joe Vennix
0194674542
Oops. Don't duplicate spec block.
2014-09-12 10:54:30 -05:00
Joe Vennix
46f256a6bd
Adds a spec to ensure HttpServer runs Concern hooks.
2014-09-12 10:52:57 -05:00
jvazquez-r7
67c0ee654b
Use Gem::Version
2014-09-12 10:35:12 -05:00
jvazquez-r7
25a09ea227
Fix valid requests specs
2014-09-12 10:30:17 -05:00
William Vu
2977e8e102
Add msfcli (M)issing
2014-09-12 10:25:13 -05:00
William Vu
425874315c
Add show missing
2014-09-12 10:23:12 -05:00
jvazquez-r7
0d054d8354
Update with master changes
2014-09-12 09:52:32 -05:00
jvazquez-r7
183ba3422d
Add specs for logins
2014-09-12 09:50:32 -05:00
jvazquez-r7
b8d31891f8
Clean YARD documentation
2014-09-12 09:32:32 -05:00
jvazquez-r7
e2ef927177
Add first version for ZDI-14-255
2014-09-12 08:57:54 -05:00
William Vu
69d0fad5a6
Land #3724 , NetworkManager creds module
2014-09-12 06:52:39 -05:00
William Vu
18e99589a5
Fix word splitting problem
2014-09-12 06:51:57 -05:00
William Vu
60b29cbd5e
Fix word splitting problem
2014-09-12 06:50:53 -05:00
agix
7485d9172a
Rescue only NoEncodersSucceededError to pass the tests
2014-09-12 13:30:03 +02:00
William Vu
8a6a205e39
Land #3724 , NetworkManager creds module
2014-09-12 05:48:35 -05:00
William Vu
131401f024
Remove unused method
2014-09-12 05:48:11 -05:00
agix
28e61edef4
Unblock when invalid encoder is selected and allow multiple encoder
2014-09-12 12:48:09 +02:00
cdoughty-r7
54bbb0d495
Merge pull request #3786 from bturner-r7/rake-without-cucumber
...
Fix rake when cucumber gem is not present
2014-09-11 23:13:55 -05:00
Brandon Turner
ba848c963a
Fix rake when cucumber gem is not present
2014-09-11 22:31:57 -05:00
Joe Vennix
8e091b6da0
Add support for ff 29 - 32 feature.
2014-09-11 22:01:36 -05:00
Joe Vennix
55519d8867
Land #3781 , my addition of Metasploit::Concern to msf.
2014-09-11 16:57:24 -05:00
darkbushido
090338f575
changing the cucumber timeout to 4 minutes....
2014-09-11 16:54:19 -05:00
darkbushido
4ef60d1a00
removing unused step files
...
changing the ms08_067 tests to fail when proxies show up in the wrong section
2014-09-11 16:51:49 -05:00
Tod Beardsley
c07e9008b9
Land #3778 , fix CONTRIBUTING.md typos
2014-09-11 16:06:38 -05:00
Luke Imhoff
706655f755
Land #3779 , Glassfish LoginScanner exception
...
MSP-11343
2014-09-11 15:57:47 -05:00
darkbushido
93cd53a800
setting cucumber-rails require to false in Gemfile
...
this stops the warning about cucumber being double required from showing up
2014-09-11 15:47:42 -05:00
Tod Beardsley
d2f2b142b4
Land #3760 , Arris WEP/WPA leak from @dheiland-r7
2014-09-11 15:39:19 -05:00
Tod Beardsley
0ed7f19eb2
Land #3780 , msfelfscan use correct offsets
2014-09-11 15:28:18 -05:00
Joe Vennix
6ade4d8dab
Kill empty line in Gemfile.
2014-09-11 14:47:17 -05:00
Joe Vennix
8654b63c58
Make sure Metasploit::Concern is accessible everywhere.
2014-09-11 14:46:35 -05:00
David Maloney
0663355237
catch connectionreset in ftp login scanner
...
add exception rescue for Errno::ECONNRESET
2014-09-11 14:39:36 -05:00
Tod Beardsley
4fc1ec09c7
Land #3759 , Android UXSS, with ref/desc fixes
...
Incidentally, this also closes jvennix-r7#14 (let's see if I can close a
PR by merging from another repo!)
Also fixes #3782 (opened by accident).
2014-09-11 14:27:51 -05:00
Tod Beardsley
fbba4b32e0
Update the title and desc to be more descriptive
...
See #3759
2014-09-11 14:06:14 -05:00
Tod Beardsley
d627ab7628
Add refs for Android UXSS
...
See #3759
2014-09-11 14:05:50 -05:00
Joe Vennix
37e6173d1f
Make Metasploit::Concern a first-class dep.
...
Also adds a Concern hook to HttpServer, so Pro can more
easily change its behavior.
2014-09-11 13:28:45 -05:00
James Lee
0ab36453b9
Add another header spec
2014-09-11 12:20:54 -05:00
James Lee
a8e3ff0c0f
Add specs to verify server header matching
2014-09-11 11:42:38 -05:00
James Lee
9151c2c79d
Add docstrings and avoid multiple returns
2014-09-11 10:50:42 -05:00
James Lee
20e48a233a
Explicitly set @version to nil if we can't detect
2014-09-11 10:30:52 -05:00
Cenk Kalpakoğlu
11004ab7c6
typo fix
2014-09-11 16:27:35 +03:00
Sascha Schirra
be0c68d8bb
BUGFIX: wrong imagebase used
2014-09-11 12:33:09 +02:00
Sascha Schirra
88cacd000e
flags for phdr.p_flags added
2014-09-11 12:31:44 +02:00
James Lee
8aa06b8605
Better api for check_setup
2014-09-10 23:43:54 -05:00
HD Moore
71228b48a0
Update 3 more encoders to be StageEncoder compatible
...
This could probably use some DRY love via a mixin
2014-09-10 20:21:35 -05:00
James Lee
c1658e5d51
Add a check_setup method
2014-09-10 20:09:46 -05:00
James Lee
84e4db9035
Don't raise in the middle
...
MSP-11343
This means we don't bomb out with an unhandled exception, instead
continuing attempting logins against the host even though it will never
succeed. Next up: verify state before running scan!()
2014-09-10 20:09:33 -05:00
HD Moore
815e007f48
Fix two cosmetic typos
2014-09-10 19:07:40 -05:00
Tod Beardsley
9fcf87b27b
Detypo CONTRIBUTING.md
2014-09-10 18:26:09 -05:00
Tod Beardsley
deaf0eb3d1
Merge pull request #1 from rapid7/master
...
I wonder if this PR will work.
2014-09-10 18:23:54 -05:00
Jon Hart
5477d5452e
Land @todb-r7's #3776 , s/redmine/github issues/g
2014-09-10 16:16:32 -07:00
Deral Heiland
872ba6a53b
Update arris_dg950 module with required changes
...
Collapsed several levels of the if/else statement and changed out 2 with
case. Changed print_good to print_line. Removed rescue ::Interrupt and
altered variable names to make them more readable
2014-09-10 19:07:53 -04:00
jvazquez-r7
373eb3dda0
Make struts_code_exec_classloader to work on windows
2014-09-10 18:00:16 -05:00
Tod Beardsley
1938cd8663
Update CONTRIBUTING.md
...
Fix a sentence.
2014-09-10 15:22:24 -05:00
Tod Beardsley
877c2dd394
Update CONTRIBUTING.md
...
Redmine is on its way out. See here:
https://github.com/rapid7/metasploit-framework/wiki/Decommissioning-Redmine
2014-09-10 15:21:47 -05:00
sinn3r
65287e41cd
Land #3773 - Fix windows cmd redirection in firefox payloads
2014-09-10 13:25:42 -05:00
Jon Hart
e317bfe0d5
Add preliminary module for discovering services with empty UDP probes
2014-09-10 10:58:22 -07:00
sinn3r
280e16c241
Land #3677 - Updated shodan_search for new API
2014-09-10 11:39:00 -05:00
sinn3r
006393360e
Add conditions to check healthy shodan results
2014-09-10 11:38:06 -05:00
sinn3r
6920c71541
Land #3775 - ssh_login_pubkey fix for the uninit prepended_creds bug
...
Closes #3774
2014-09-10 11:08:14 -05:00
James Lee
257f0fc93e
Quick fix for ssh_login_pubkey
...
Fixes #3772 , closes #3774
2014-09-10 09:57:17 -05:00
Joe Vennix
1bb6573570
Fix windows cmd redirection in ff payloads.
2014-09-10 00:47:05 -05:00
James Lee
99c9d5a578
Land #3683 , cucumber tests for msfconsole
2014-09-09 21:28:45 -05:00
Jon Hart
495e1c14a1
Land #3721 , @brandonprry's module for Railo CVE-2014-5468
2014-09-09 19:10:46 -07:00
Jon Hart
26d8432a22
Minor style and usability changes to @brandonprry's #3721
2014-09-09 19:09:45 -07:00
Brandon Perry
db6052ec6a
Update check method
2014-09-09 18:51:42 -05:00
sinn3r
1b4ceec4f9
Land #3743 - Add specs for Rex::Arch::X86
2014-09-09 17:24:08 -05:00
sinn3r
0a6ce1f305
Land #3727 - SolarWinds Storage Manager exploit AND Msf::Payload::JSP
2014-09-09 17:21:03 -05:00
sinn3r
e82348f157
Land #3762 - Add specs for Rex::Arch::Sparc
2014-09-09 16:10:26 -05:00
us3r777
2ae23bbe99
Remove STAGERNAME option
...
This option wasn't really required, the stager can be removed as
soon as the WAR is deployed. This commit does the modifications needed
to remove the stager right after the WAR deployment.
2014-09-09 21:44:08 +02:00
HD Moore
6c0dae953d
Stage encoding is now SaveRegister aware
2014-09-09 14:21:51 -05:00
sinn3r
027f543bdb
Land #3732 - Eventlog Analzyer exploit
2014-09-09 11:33:20 -05:00
sinn3r
75269fd0fa
Make sure we're not doing a 'negative' timeout
2014-09-09 11:26:49 -05:00
Cenk Kalpakoğlu
262b5413bc
Merge pull request #1 from dmaloney-r7/wordpress-xmlrpc-login-scanner
...
Wordpress xmlrpc login scanner
2014-09-09 14:29:47 +03:00
Joe Vennix
7793ed4fea
Add some common UXSS scripts.
2014-09-09 02:31:27 -05:00
jvazquez-r7
962c66b3bb
Fix some descriptions
2014-09-08 18:17:24 -05:00
jvazquez-r7
8370bf0f2a
Finish XDR specs
2014-09-08 18:05:09 -05:00
James Lee
b8000517cf
Land #3746 , reinstate DB_ALL_CREDS
2014-09-08 17:24:12 -05:00
jvazquez-r7
44724d1141
Add specs for .decode_varray
2014-09-08 17:12:04 -05:00
jvazquez-r7
8af13592c2
Add first specs for Rex::Encoder::XDR
2014-09-08 16:25:53 -05:00
Tod Beardsley
b9c8eb70c4
Land #3675 , update copyright on Rex
2014-09-08 16:05:41 -05:00
HD Moore
250b3d227c
Fix the rex.rb header and copyright date
2014-09-08 15:32:13 -05:00
David Maloney
2ac15f2088
some fixes based on Christruncer's feedback
...
fixed some stuff i borked, back to you chris
2014-09-08 15:27:01 -05:00
David Maloney
cd3cdc5384
Merge branch 'master' into feature/ipboard-login-refactor
2014-09-08 14:48:37 -05:00
jvazquez-r7
f521cc598d
Delete .encode specs, anyone uses the method, plus looks wrong
2014-09-08 14:42:43 -05:00
jvazquez-r7
9a74e60db3
Add specs for .encode
2014-09-08 14:32:33 -05:00
jvazquez-r7
11ca383d4f
Add specs for .encode_byte
2014-09-08 14:24:03 -05:00
jvazquez-r7
3535a6a21d
Add first specs for .gen_decoder and .encode_byte
2014-09-08 14:07:21 -05:00
William Vu
b61d1dca88
Land #3763 , release fixes
2014-09-08 14:02:45 -05:00
Tod Beardsley
4abee39ab2
Fixup for release
...
Ack, a missing disclosure date on the GDB exploit. I'm deferring to the
PR itself for this as the disclosure and URL reference.
2014-09-08 14:00:34 -05:00
David Maloney
ef748fdef7
check if database is connected first
...
wooops
2014-09-08 12:54:19 -05:00
David Maloney
09e6c2f51f
Merge branch 'master' into feature/MSP-11162/db-all-creds
2014-09-08 12:52:25 -05:00
David Maloney
16502b831f
Merge branch 'master' of github.com:rapid7/metasploit-framework
2014-09-08 12:45:52 -05:00
David Maloney
b84142715f
rescue mysql host blocked
...
rbmysql can throw an exception if the
server blocked this host due to too many connection errors
2014-09-08 12:45:10 -05:00
jvazquez-r7
4c15954be5
Add specs for Rex::Arch::Sparc
2014-09-08 11:59:52 -05:00
William Vu
ae5a8f449c
Land #3691 , gdbserver hax
2014-09-08 11:48:39 -05:00
jvennix-r7
b48aa8f2ca
Merge pull request #13 from wvu-r7/pr/3691
...
Add verify_checksum and use it
2014-09-08 11:41:54 -05:00
Deral Heiland
9a6ee5090a
Add Arris DG950A SNMP data extraction module
...
This module will extract critical data such as WPA and WEP keys from
the Arris DG950a model cable modem via the SNMP protocal.
2014-09-08 11:04:31 -04:00
sinn3r
0ccb39c057
Land #3726 - Fix typos in wordpress login
2014-09-08 09:40:57 -05:00
cx
1b5e40ff78
New Creds model added
2014-09-08 11:42:05 +03:00
William Vu
5c1d95812c
Add verify_checksum and use it
...
Also fixed a YARD typo.
2014-09-08 02:19:21 -05:00
Joe Vennix
27889ea411
Add a safety fallback on js load.
2014-09-08 00:46:47 -05:00
Joe Vennix
8407d45c9c
Rework the timers.
2014-09-08 00:40:00 -05:00
Joe Vennix
5c9c8edfcf
Fix refs.
2014-09-07 23:33:45 -05:00
Joe Vennix
5efaf7d4cf
rename module, handle asyncness.
2014-09-07 23:25:08 -05:00
jvazquez-r7
10bb77af9f
Land #3716 , @wchen-r7's Glassfish LoginScanner update
2014-09-07 21:54:34 -05:00
jvazquez-r7
6cdfd322f2
change should to expect
2014-09-07 21:35:33 -05:00
jvazquez-r7
e6f7b35d0d
Use context to describe #attempt_login
2014-09-07 21:26:01 -05:00
jvazquez-r7
f266ca99f5
Use allow_any_instance_of as with rspec 3
2014-09-07 21:18:22 -05:00
jvazquez-r7
768b50974f
Redo try_glassfish_3 specs
2014-09-07 21:04:43 -05:00
jvazquez-r7
07238ef7b3
Redo try_glassfish_2 specs
2014-09-07 20:47:54 -05:00
Joe Vennix
1bf89fb6bd
Add Android <= 4.3 AOSP UXSS module.
2014-09-07 20:44:03 -05:00
jvazquez-r7
9a42e7635a
Use expect instead of should on try_login
2014-09-07 20:01:44 -05:00
jvazquez-r7
06207afb12
Use expect instead of should
2014-09-07 19:37:24 -05:00
jvazquez-r7
424d1ec47f
Add example to describe how send_request handles a JSESSIONID cookie
2014-09-07 19:33:56 -05:00
jvazquez-r7
28aa7429ed
Land #3751 , @wchen-r7's [FixRM #8836 ] Use windows\\win.ini vs boot.ini
2014-09-07 01:47:10 -05:00
jvazquez-r7
c86d01a667
Fix win.ini signature
2014-09-07 01:46:38 -05:00
William Vu
422d6bd2e4
Land #3758 , nil deref fix for iax2/call.rb
2014-09-06 16:08:32 -05:00
HD Moore
af24e30ae9
Return instead of crashing if no challenge is received
2014-09-06 15:51:50 -05:00
sinn3r
ff6cce8bd1
3rd person
2014-09-06 01:56:39 -05:00
sinn3r
6df7658267
Very small change to the doc
2014-09-06 01:54:52 -05:00
sinn3r
419b2136b1
remove the "instance methods" context
2014-09-06 01:42:48 -05:00
sinn3r
c8ccb5e848
In 3rd person
2014-09-06 01:39:32 -05:00
sinn3r
febf70fed1
Merge pull request #21 from jvazquez-r7/review_3716
...
Clean YARD documentation
2014-09-06 01:22:58 -05:00
sinn3r
44b9dc9b28
Update tmlisten_traversal
2014-09-06 01:18:11 -05:00
jvazquez-r7
78cf75c4d5
Clean YARD documentation
2014-09-06 00:24:39 -05:00
William Vu
7d942be715
Land #3755 , WVE and BPS reference removal
2014-09-05 19:56:40 -05:00
sinn3r
0d56a8ee14
Merge pull request #20 from wvu-r7/pr/3755
...
Remove WVE references from msftidy
2014-09-05 19:55:38 -05:00
William Vu
48e098b172
Remove WVE references from msftidy
2014-09-05 19:28:27 -05:00
Samuel Huckins
643329e2c4
Land #3757 , postgres login scanner nil public fix
2014-09-05 16:35:46 -05:00
jvennix-r7
671c7f1095
Merge pull request #12 from wvu-r7/pr/3691
...
Fix read_ack to read only the ACK
2014-09-05 16:09:38 -05:00
David Maloney
0d9fbe798a
turn nil publics and privates into blanks
...
don't pass nil into the credential object, pass an empty string instead
this is the expected behaviour and avoids stack traces
2014-09-05 16:06:58 -05:00
jvazquez-r7
df278dd2dc
Conver to exploit
2014-09-05 14:47:33 -05:00
sinn3r
ce0e7b59f5
Remove WVE and BPS reference identifiers
...
Reasons why they should be gone:
WVE:
* wirelessve.org is down.
* Not a single module uses WVE as a reference
BPS:
* "BreakingPoint" no longer exists
* The URL takes you to a login page to ixia. And there is no point
of referencing something people can't see.
* Not a single module uses BPS as a reference.
2014-09-05 13:28:10 -05:00
William Vu
b6e04599a7
Fix read_ack to read only the ACK
...
It was reading the response, too. Also removed an extraneous send_ack.
2014-09-05 12:30:59 -05:00
jvazquez-r7
d4a8b7e00d
Move to exploits
2014-09-05 10:38:28 -05:00
jvazquez-r7
892f72e4ce
Move module path
2014-09-05 10:30:27 -05:00
jvazquez-r7
d041ee6629
Delete exploit modules from this branch
2014-09-05 10:29:24 -05:00
William Vu
9a7d1b2390
Land #3733 , "guest" for ipmi_users.txt
2014-09-04 21:11:42 -05:00
Chris Hebert
abffdd8705
Update alienvault_newpolicyform_sqli.rb
...
cleaned up according to msftidy.rb suggestions
modules/auxiliary/gather/alienvault_newpolicyform_sqli.rb:17 - [WARNING] Spaces at EOL
modules/auxiliary/gather/alienvault_newpolicyform_sqli.rb:18 - [WARNING] Tabbed indent: "\tlack of input filtering to read an arbitrary file from the file system.\n"
modules/auxiliary/gather/alienvault_newpolicyform_sqli.rb:29 - [WARNING] Space-Tab mixed indent: "\t [ 'OSVDB', '106815' ],\n"
modules/auxiliary/gather/alienvault_newpolicyform_sqli.rb:29 - [WARNING] Tabbed indent: "\t [ 'OSVDB', '106815' ],\n"
modules/auxiliary/gather/alienvault_newpolicyform_sqli.rb:30 - [WARNING] Space-Tab mixed indent: "\t [ 'EDB', '33317'],\n"
modules/auxiliary/gather/alienvault_newpolicyform_sqli.rb:30 - [WARNING] Tabbed indent: "\t [ 'EDB', '33317'],\n"
modules/auxiliary/gather/alienvault_newpolicyform_sqli.rb:110 - [WARNING] Spaces at EOL
2014-09-04 21:46:37 -04:00
Chris Hebert
664cc131e3
Update alienvault_newpolicyform_sqli.rb
...
added 'ctx' variable relating to jvazquez-r7 note added on Jun 9
2014-09-04 21:34:24 -04:00
sinn3r
08ce278cca
Got these wrong
2014-09-04 17:05:51 -05:00
sinn3r
cb490fc00e
[SeeRM #8836 ] Change boot.ini to win.ini
2014-09-04 17:03:21 -05:00
jvazquez-r7
d83131f1d9
Land #3750 , @wvu favoring unless
2014-09-04 16:17:07 -05:00
jvazquez-r7
ff210a7c0a
delete parenthesis
2014-09-04 16:16:29 -05:00
sinn3r
85b48fd437
Land #3736 - Revert initial ff xpi prompt bypass for Firefox 22-27
2014-09-04 16:08:15 -05:00
jvazquez-r7
f063dcf0f4
Land #3741 , @pedrib's module for CVE-2014-5005 Desktop Central file upload
2014-09-04 15:44:21 -05:00
jvazquez-r7
f466b112df
Minor cleaning on check
2014-09-04 15:43:59 -05:00
jvazquez-r7
74b8e8eb40
Change module filename
2014-09-04 15:39:34 -05:00
jvazquez-r7
c32b977a27
Land #3747 , @wvu changes to printer_ready_message
2014-09-04 15:26:52 -05:00
William Vu
2d8c7a7a4d
Refactor if statement to early return
...
This eliminates the protracted if statement and aligns the code body.
2014-09-04 15:05:30 -05:00
William Vu
614c7c178d
Land #3749 , jtr_oracle_fast missing require fix
2014-09-04 15:03:37 -05:00
jvazquez-r7
c1bca5c138
Land #3742 , @pedrib's changes to desktopcentral_file_upload check method
2014-09-04 14:47:36 -05:00
jvazquez-r7
7563c0bd0e
Use Gem::Version
2014-09-04 14:40:13 -05:00
HD Moore
34455b5dc6
Fix missing require for jtr_oracle_fast
2014-09-04 14:38:07 -05:00
William Vu
50ac8366fd
Refactor CHANGE/RESET to actions
...
Missed in c1fdc4d945 .
2014-09-04 14:36:04 -05:00
jvazquez-r7
2615a7a3be
Favor \&\& and || operands
2014-09-04 14:35:37 -05:00
sinn3r
0dcf481d76
This one is good to go
2014-09-04 14:13:33 -05:00
William Vu
4c12521ab2
Fix an incomplete refactor
2014-09-04 13:32:25 -05:00
William Vu
84f9ec0aad
Refactor implicit options hash
...
Missed in c1fdc4d945 .
2014-09-04 13:30:06 -05:00
David Maloney
00ec47fb83
call new prepend cred methods
...
add method calls o all the lgoinscanner modules
so that they call the prepend_db_* methods as approrpiate
these methods automatically check to see if DB_ALL_CREDS was
selected
2014-09-04 12:32:35 -05:00
David Maloney
093f488360
add db_all_cred methods to authbrute
...
adds 3 methods to add db_all_creds functionality back to
the loginscanners
2014-09-04 12:20:42 -05:00
David Maloney
c5755824a6
pass in vhost and useragent
...
have http loginscanner modules pass in VHOST
and Useragent to the LoginScanner classes
2014-09-04 11:02:19 -05:00
David Maloney
28427ccee3
add VHOST and useragent support to loginscanner
2014-09-04 10:59:07 -05:00
HD Moore
4966082de5
Replace 'rescue nil' with DRY-violating versions :(
2014-09-03 23:06:11 -05:00
sinn3r
dd4fd7bb39
The reporting part
2014-09-03 16:32:23 -05:00
sinn3r
e1694ec3e5
LoginScanner update for hp_sys_mgmt_login
...
Work in progress
2014-09-03 16:23:57 -05:00
Joe Vennix
0e18d69aab
Add extended mode to prevent service from dying.
2014-09-03 16:07:27 -05:00
Joe Vennix
4293500a5e
Implement running exe in multi.
2014-09-03 15:56:21 -05:00
Pedro Ribeiro
f0e3fa18a3
Restore the original filename
2014-09-03 21:32:05 +01:00
Joe Vennix
268d42cf07
Add PrependFork to payload options.
2014-09-03 14:56:22 -05:00
jvazquez-r7
185ce36859
Land #3701 , @wchen-ru's AppleTV modules
2014-09-03 12:30:50 -05:00
sinn3r
37f110febb
Merge pull request #19 from jvazquez-r7/land_wchen_3701
...
Add http socket to the module sockets array and allow the framework to cleanup
2014-09-03 12:08:51 -05:00
jvazquez-r7
10dee28fbd
Add http socket to the module sockets and allow the framework to cleanup
2014-09-03 12:01:48 -05:00
sinn3r
5acbcc80e2
no threading
2014-09-03 11:37:30 -05:00
Pedro Ribeiro
ded085f5cc
Add CVE ID
2014-09-03 07:22:10 +01:00
Brandon Perry
ee3e5c9159
Add check method
2014-09-02 21:35:47 -05:00
sinn3r
61e58dc6d3
Yard doc
2014-09-02 20:48:07 -05:00
sinn3r
954475c0bf
Add rspec and update about secure admin
2014-09-02 20:35:25 -05:00
darkbushido
77f0a2d420
fixing a merge error with travis.yml
2014-09-02 19:07:39 -05:00
darkbushido
794dc136f6
Merge branch 'aruba-testing-with-updated-master' into aruba-testing
2014-09-02 19:00:46 -05:00
darkbushido
50e804d9cb
updating how we use cucumber to match lukes changes
2014-09-02 18:57:55 -05:00
jvazquez-r7
15f19468a1
Do last cleanup
2014-09-02 18:57:10 -05:00
jvazquez-r7
3ad0542b2a
Fix some specs
2014-09-02 18:50:37 -05:00
jvazquez-r7
a1823b6c1e
Add more specs for Rex::Arch::X86
2014-09-02 18:17:14 -05:00
Tod Beardsley
67786e34ae
Land #3739 , knock out rspec deprecations
2014-09-02 17:41:22 -05:00
Pedro Ribeiro
c672fad9ef
Add OSVDB ID, remove comma from Author field
2014-09-02 23:17:10 +01:00
Pedro Ribeiro
d69049008c
Refactor and rename desktopcentra_file_upload
...
- Rewrite check method
- Declare that v7 is also exploitable (tested and it works)
- Rename to dc_agentlogupload_file_upload to match the other DC module's naming convention
- Add CVE / OSVDB / Full disclosure references
2014-09-02 23:12:33 +01:00
Pedro Ribeiro
05856016c9
Add exploit for CVE-2014-5005
2014-09-02 23:09:10 +01:00
James Lee
83af97e5ab
Land #3728 , creds outfile
2014-09-02 16:15:10 -05:00
darkbushido
5b3800c13a
removing the hacked stty solution
2014-09-02 13:57:48 -05:00
darkbushido
13a0b8da83
Merge branch 'master' into aruba-testing-with-updated-master
...
Conflicts:
Gemfile.lock
config/cucumber.yml
features/support/env.rb
features/support/hooks.rb
lib/tasks/cucumber.rake
2014-09-02 13:56:02 -05:00
HD Moore
85c5de07ec
Fix use of datastore['SMBServerIdleTimeout']
2014-09-02 13:47:01 -05:00
HD Moore
6fcc864942
Reduce the chance of file descriptor leaks in SMBServer
...
This patch addresses three observed error conditions in long-running SMB services.
1. A call to get_once() in on_client_data could raise a Timeout exception and bubble all the way up to the dispatcher. This should technically never happen, but gets triggered for zero-byte writes and clients closing their connections. The fix was to handle the exception and lower the timeout. The change was tested with a number of SMB clients to make sure this didn't introduce any regressions.
2. A client could indefinitely keep a connection to the SMB server. The SMB server now disconnects idle clients after 120 seconds of inactivity (configurable).
3. A client could send a large amount of data that was invalid SMB traffic, using up memory as a potential DoS.
Caveats: The idle client sweep occurs every 100 requests or at an interval equal to the idle timeout. A client could fill up the entire connection table on its own, preventing the sweep from occurring by preventing new connections. Fixing this would require a dedicated thread to sweep for idle connections and is a more aggressive attack than this patch is designed to defend against (accidental connection flooding, basically).
2014-09-02 13:29:37 -05:00
jvazquez-r7
16111aa2f7
Use RSpec::Mocks::Double
2014-09-02 13:25:05 -05:00
jvazquez-r7
fdb66d978b
Fix remainings be_truthy and be_falsey conditionals
2014-09-02 13:22:21 -05:00
jvazquez-r7
9cec62d52b
Merge branch 'specs_its' into fix_deprecation_warnings
2014-09-02 13:14:21 -05:00
jvazquez-r7
15e564ddf3
Merge branch 'collection_owner' into fix_deprecation_warnings
2014-09-02 13:14:09 -05:00
jvazquez-r7
824ff7fc72
Merge branch 'specs_skip' into fix_deprecation_warnings
2014-09-02 13:13:09 -05:00
jvazquez-r7
33784777df
Avoid its in Msfupdate specs
2014-09-02 12:53:24 -05:00
jvazquez-r7
e0c6f5032f
Avoid its in Msf::DBManager specs
2014-09-02 12:46:50 -05:00
Joe Vennix
f7617183d9
Revert "Add initial firefox xpi prompt bypass."
...
This reverts commit ebcf972c08 .
2014-09-02 12:27:41 -05:00
jvazquez-r7
d7af3a628d
Avoid its on Msf::ModuleManager::Cache shared examples specs
2014-09-02 12:02:26 -05:00
jvazquez-r7
bf0d30cf03
Fix rspec-collection_matchers deprecation warning in Rex::Socket::RangeWalker
2014-09-02 11:08:26 -05:00
jvazquez-r7
5a0b6ece6e
Use is_expected
2014-09-02 10:27:53 -05:00
jvazquez-r7
764af20567
Fix rspec-collection_matchers deprecation warnings in Rex::Socket
2014-09-02 10:21:52 -05:00
cx
aaeb5a2f5f
jhart-r7 suggestions added
2014-09-02 12:05:54 +03:00
John Sawyer
3281781f6a
Addressed r7 comments, fixed bug in results loop
2014-09-01 13:43:31 -04:00
Tom Sellers
288a891665
Add the 'guest' IPMI user
...
The 'guest' IPMI user exists on many Cisco Unified Computing Server (UCS) implementations.
2014-09-01 07:01:06 -05:00
Pedro Ribeiro
d480a5e744
Credit h0ng10 properly
2014-09-01 07:58:26 +01:00
Pedro Ribeiro
59847eb15b
Remove newline at the top
2014-09-01 07:56:53 +01:00
Pedro Ribeiro
6a370a5f69
Add exploit for eventlog analyzer file upload
2014-09-01 07:56:01 +01:00
Matthew Kienow
7dd73084bb
Added WiFi ifindex discovery and enhanced error handling
2014-09-01 00:49:10 -04:00
Matthew Kienow
cf0f00a376
Variable name changes per ruby style guide
2014-08-31 23:57:20 -04:00
Matthew Kienow
0735de0fd4
Changes to error output per PR comments
2014-08-31 23:57:20 -04:00
Matthew Kienow
0a01da1ca9
Changed default value for SNMP Version option
2014-08-31 23:57:20 -04:00
Matthew Kienow
e6126fde72
Modified to pull username and password first
2014-08-31 23:57:19 -04:00
Matthew Kienow
5153886077
Added disclosure URL and cleaned up output fields
2014-08-31 23:57:19 -04:00
inokii
4ef369112f
Cleanup per msftidy report of Spaces at EOL
2014-08-31 23:57:19 -04:00
inokii
e37d56766f
Corrected extraction of WEP keys, current key, RADIUS server and port
2014-08-31 23:57:19 -04:00
inokii
f1cd601401
Modified logic to attempt to process WiFi key data even if primary Wifi interface is not up
2014-08-31 23:57:19 -04:00
inokii
e5111f7634
Simplified get_radius_info method and cleaned up comments
2014-08-31 23:57:19 -04:00
inokii
c556a6e331
Fixed syntax issue
2014-08-31 23:57:19 -04:00
inokii
81047e911a
Corrected OIDs to all numeric
2014-08-31 23:57:19 -04:00
inokii
b253e444cb
Initial commit of SBG6580 scanner after cleanup
2014-08-31 23:57:18 -04:00
Pedro Ribeiro
9e8658268b
Merge pull request #2 from rapid7/master
...
update
2014-08-31 22:09:06 +01:00
Tom Sellers
20a02a9d29
Cleanup
2014-08-31 14:01:13 -05:00
Tom Sellers
6f7bc94db4
Creation of rdcmanager_creds.rb
2014-08-31 13:38:08 -05:00
Kurt Grutzmacher
0ef71c70d3
s/services/creds
2014-08-31 09:54:49 -07:00
Kurt Grutzmacher
3bb370437c
Returns csv output to creds command
...
commit 82b2c1deae removed the -o option
from the creds command. This returns it to its former glory!
2014-08-31 08:35:22 -07:00
jvazquez-r7
c05edd4b63
Delete debug print_status
2014-08-31 01:34:47 -05:00
jvazquez-r7
8b1791da22
Modify modules to keep old behavior
2014-08-31 01:18:53 -05:00
jvazquez-r7
559ec4adfe
Add module for ZDI-14-299
2014-08-31 01:11:46 -05:00
DrDinosaur
8ba5488198
Update wordpress_login_enum.rb
...
Fixed some typos.
2014-08-30 13:37:48 -10:00
jvazquez-r7
e1b6ee283f
Allow Msf::Payload::JSP to guess system shell path if it isnt provided
2014-08-30 16:27:02 -05:00
Brandon Perry
438f0e6365
typos
2014-08-30 09:22:58 -05:00
Brandon Perry
f72cce9ff2
Update railo_cfml_rfi.rb
2014-08-29 17:33:15 -05:00
David Maloney
a142e78a66
refactor wordpress_xml_rpc_login
...
refactor the login module to use the loginscanner class
2014-08-29 13:09:09 -05:00
David Maloney
928aeffcba
add wordpress_rpc loginscanner and specs
2014-08-29 13:06:12 -05:00
David Maloney
0e14b271a1
Merge branch 'master' into wordpress-xmlrpc-login-scanner
2014-08-29 12:50:34 -05:00
Spencer McIntyre
1cdf1c2c6e
Land #3709 , @nnam's wing ftp admin console cmd exec
2014-08-29 13:46:01 -04:00
Spencer McIntyre
8095b4893c
Rename and apply rubocop style to wing_ftp_admin_exec
2014-08-29 13:42:11 -04:00
cx
bd9417490e
Merge branch 'master' into linux-post-enum-psk
2014-08-29 15:50:28 +03:00
cx
eaf73f9f84
Linux Gather 802-11-Wireless Security Credentials
2014-08-29 11:08:08 +03:00
sinn3r
f7091d854e
Add a timeout
2014-08-28 22:26:38 -05:00
jvazquez-r7
40f581458a
Land #3570 , @ikkini scanner for rsync
2014-08-28 18:48:32 -05:00
jvazquez-r7
9fb9ab813c
Add URL reference
2014-08-28 18:47:56 -05:00
jvazquez-r7
bc542a011d
Change module filename
2014-08-28 18:42:30 -05:00
jvazquez-r7
213fe23970
Clean rsync_modules_list
2014-08-28 18:40:55 -05:00
Samuel Huckins
b4e3ce0fdc
Merge branch 'master' of github.com:rapid7/metasploit-framework
2014-08-28 17:14:07 -05:00
Samuel Huckins
fa77caa819
Merge branch 'bug/MSP-11153/database-config-overrides'
...
MSP-11153 #land
2014-08-28 17:12:37 -05:00
jvazquez-r7
20bcb8029b
Land #3723 , solves #3719 msfcli crash
2014-08-28 17:09:53 -05:00
James Lee
031445fee7
Check for nil resource files
...
See #3719
2014-08-28 16:27:33 -05:00
Luke Imhoff
20177c7c23
Restore backup database.yml when retesting after interrupt
...
MSP-11153
Restore the config/database.yml backed up to
config/database.yml.cucumber.bak in the db:config:restore task, which is
made a dependency of the environment rake task so that
config/database.yml is restored before Rails tries to use it in the
environment task. This specifically, allows for rake cucumber to be
interrupted when the config/database.yml has been moved to
config/database.yml.cucumber.bak and a subsequence rake cucumber to
succeed and restore config/database.yml, but any task that depends on
environment will restore the config/database.yml.
2014-08-28 15:20:53 -05:00
nnam
02bbd53b82
Fix failure messages for check().
2014-08-28 12:09:35 -07:00
Luke Imhoff
7a8d7a38d1
Remove debugging 'puts'
...
MSP-11153
2014-08-28 13:48:46 -05:00
Nicholas Nam
6c90a50e47
Handle res.nil case in check(). Revert check for res.nil in
...
execute_command() because it was failing prior to the reverse_shell
connecting.
2014-08-28 10:57:52 -07:00
Nicholas Nam
0788ce9745
Removed unused require and import. Handle the res.nil case in
...
execute_command() and authenticate().
2014-08-28 10:30:30 -07:00
sinn3r
f097ef96e0
Use &&
2014-08-28 12:13:03 -05:00
sinn3r
d0d9949d91
Do SSL options correctly
2014-08-28 12:04:14 -05:00
Luke Imhoff
5ab8fcd026
Remove realpath call from expected user_configurations_pathname
...
MSP-11153
realpath is not used in the actual code anymore because it doesn't work
for non-existent paths.
2014-08-28 11:51:25 -05:00
jvazquez-r7
58091b9e2b
Land #3708 , @pedrib fix for manage_engine_dc_pmp_sqli
2014-08-28 10:47:03 -05:00
jvazquez-r7
d8c15766bd
Land #3567 @OJ's fixes to the MQAC local exploit solving conflicts
2014-08-28 10:19:47 -05:00
jvazquez-r7
9d3d25a3b3
Solve conflicts
2014-08-28 10:19:12 -05:00
Spencer McIntyre
dd8690323a
Land #3722 , fix typos in openssl ccs scanner
2014-08-28 10:50:18 -04:00
Matt Andreko
784ece574e
Found additional typos.
2014-08-28 09:03:19 -05:00
Matt Andreko
cb634cfef3
Fixed annoying typo that shows up in validation screenshots
2014-08-28 08:50:30 -05:00
Brandon Perry
f4965ec5cf
Create railo_cfml_rfi.rb
2014-08-28 08:42:07 -05:00
Luke Imhoff
188f5d012a
Add scenario for no database.yml
...
MSP-11153
2014-08-27 22:02:16 -05:00
Luke Imhoff
7453f6fa3a
Project "database.yml" scenario
...
MSP-11153
2014-08-27 21:47:31 -05:00
Luke Imhoff
e6750b985c
Add 'the' to make steps read better
...
MSP-11153
2014-08-27 21:38:46 -05:00
Luke Imhoff
972470c241
Ensure a fake project database.yml is used for scenarios
...
MSP-11153
Ensures that cucumber still works if config/database.yml is not set and
so other location is being used to run cucumber.
2014-08-27 21:36:23 -05:00
Luke Imhoff
496865e591
Order database.yml definitions to match precedence
...
MSP-11153
2014-08-27 21:15:00 -05:00
Luke Imhoff
d752cdccf6
Remove unneeded command_line.yml
...
MSP-11153
Remove definition of command_line.yml in scenarios that don't use --yaml
flag.
2014-08-27 21:09:49 -05:00
Luke Imhoff
b701ba5dcf
~/.msf4/database.yml scenario
...
MSP-11153
2014-08-27 20:57:08 -05:00
Luke Imhoff
b1e745aa16
MSF_DATABASE_CONFIG scenario
...
MSP-11153
2014-08-27 20:33:52 -05:00
inkrypto
4a479d17a9
Randomize padding on aux module, fix spacing on exploits
2014-08-27 20:41:33 -04:00
Tom Sellers
0b820c59b1
Fix to self.refname
2014-08-27 18:34:15 -05:00
Tod Beardsley
6d45f75b47
Land #3690 , credential_collect refactor
...
@TomSellers strikes again!
2014-08-27 18:31:59 -05:00
Tom Sellers
9b0c5dfb0c
Minor fix
2014-08-27 18:31:13 -05:00
sinn3r
0ba2f1e457
Leave a note about the old empty password issue
2014-08-27 17:06:11 -05:00
Luke Imhoff
275fa5cb50
Remove unnecessary return
...
MSP-11153
Leftover from earlier design.
2014-08-27 16:58:45 -05:00
Luke Imhoff
83b6f268b4
Remove unnecessary realpath
...
MSP-11153
Causes errors on machines that don't have ~/.msf4 like travis-ci.
2014-08-27 16:58:05 -05:00
sinn3r
d5b70cca24
"Auth bypass" does not really describe what the feature actually does
2014-08-27 16:56:07 -05:00
Luke Imhoff
2b2d9085d3
Add cucumber to test matrix
...
MSP-11153
2014-08-27 16:50:25 -05:00
Luke Imhoff
bfc509c18a
Add feature that tests --yaml is favored over others
...
MSP-11153
2014-08-27 16:46:23 -05:00
sinn3r
df215a380d
Do not send 2 content-length headers
2014-08-27 16:05:08 -05:00
sinn3r
a32ffc4c26
Add the final portion for Glassfish login module
2014-08-27 15:09:11 -05:00
Luke Imhoff
1857c6ae39
Add aruba
...
MSP-11153
aruba adds steps for testing commandline applications with cucumber.
2014-08-27 14:22:20 -05:00
Luke Imhoff
2f48f7c48c
rails generate cucumber:install
...
MSP-11153
Add cucumber-rails for testing msfconsole's loading of database.yml from
different paths.
2014-08-27 14:10:04 -05:00
darkbushido
984f073c7d
changing from cucumber to cucumber-rails
...
using the MSF_DATABASE_CONFIG to tell msfconsole where to find the database.yml
2014-08-27 13:44:34 -05:00
darkbushido
1da7ab9bda
Rake will only show the load error when features are called
...
if you dont have cucumber installed it will only display the message if you call
rake features
2014-08-27 12:13:30 -05:00
Luke Imhoff
951ce15b44
Move database.yml selection to Metasploit::Framework::Database
...
MSP-11153
Test the following paths in order and only return them if the path
exists:
1. MSF_DATABASE_CONFIG environment variable
2. ~/.msf4/database.yml
3. <project>/config/database.yml
2014-08-27 12:01:43 -05:00
sinn3r
633eaab466
Land #3714 - Firefox 22-27 WebIDL Privileged Javascript Injection
2014-08-27 01:45:18 -05:00
sinn3r
5d8cbe0544
Early version of Glassfish using LoginScanner
2014-08-27 01:23:02 -05:00
Joe Vennix
26cfed6c6a
Rename exploit module.
2014-08-26 23:05:41 -05:00
Tod Beardsley
bf2c390ff4
Land fix for #3712 typo
2014-08-26 20:38:00 -05:00
Joe Vennix
96276aa6fa
Get the disclosure date right.
2014-08-26 20:36:58 -05:00
Tod Beardsley
c045c9606c
Fix typo in PR #3712
...
Fixes the typo pointed out in
rapid7#3712#discussion_r16750554
Derp
2014-08-26 20:36:28 -05:00
Joe Vennix
52f33128cd
Add Firefox WebIDL Javascript exploit.
...
Also removes an incorrect reference from another FF exploit.
2014-08-26 20:35:17 -05:00
Jon Hart
1f35c0ff1c
Merge #3713 , @hmoore-r7's SIP cleanup of my SIP cleanup
2014-08-26 17:52:35 -07:00
Jon Hart
316a952e9c
Make SIP note, service and print output more similar
2014-08-26 17:47:31 -07:00
HD Moore
fde2687c9e
Store edition,version,build in the fingerprint.match
2014-08-26 18:44:08 -05:00
dmaloney-r7
8d26b66e2f
Merge pull request #3689 from TomSellers/loginpalooza/vmauthd-creds-update
...
Credential Gem: LoginScanner - vmauthd_login ( Rebase of PR 3608)
2014-08-26 18:43:12 -05:00
Tom Sellers
4a1b037af0
Remaining files..
2014-08-26 18:15:58 -05:00
Tom Sellers
d5e39ae284
Adjustments for new LoginScanner code
2014-08-26 18:13:00 -05:00
jvazquez-r7
b37e1a5421
Solve conflicts
2014-08-26 17:51:37 -05:00
Tod Beardsley
fe99f4b6e7
Land #3712 , a nicer exploit-checker for msftidy
2014-08-26 16:59:56 -05:00
jvazquez-r7
0d9d722525
skip examples pending of pivotaltracker 38730815
2014-08-26 16:49:13 -05:00
Josh
073c668cd8
Merge pull request #12 from todb-r7/commit-hooks-should-only-check-modules
...
Land 12 from todb, only pre-commit-hook on actual modules
2014-08-26 16:47:23 -05:00
HD Moore
2d2606aeaf
Update sip note format, small tweaks to output, service.info
2014-08-26 16:42:00 -05:00
Tod Beardsley
dbdb4afb8c
Add a top anchor to the file match regex.
2014-08-26 16:19:29 -05:00
Joshua Smith
622e8a7714
adds better exploit module detection to msftidy
2014-08-26 15:30:08 -05:00
Joshua Smith
49adde2095
Land 3702, prefer be_falsey and cleanup specs
2014-08-26 15:24:41 -05:00
Joshua Smith
1fa26e2afb
cleans up a bunch of spec msftidy issues
2014-08-26 15:24:08 -05:00
jvazquez-r7
042b8a3672
Switch from pending to skip in specs
2014-08-26 15:17:00 -05:00
HD Moore
ba1f7c3bf6
Land #3687 , reworks the nat-pmp portscanner
2014-08-26 14:34:46 -05:00
HD Moore
ed9bb3e52c
Fix a small typo
2014-08-26 14:34:10 -05:00
Jon Hart
775ebce56b
Correct natpmp_portscan's print_* usage to include peer
2014-08-26 12:27:12 -07:00
HD Moore
3b8bbdf10c
Merge master back in before landing #3545
2014-08-26 14:07:58 -05:00
HD Moore
4e19d9ade1
Land #3545 , fix up sip scanners, msftidy, db services cmd
2014-08-26 14:07:21 -05:00
Jon Hart
5826d7b164
vprint_status when no external address obtained, print_ is too noisy
2014-08-26 12:05:40 -07:00
David Maloney
8c72256e5d
Merge branch 'master' of github.com:rapid7/metasploit-framework
2014-08-26 14:00:03 -05:00
Tod Beardsley
2254c3060e
Land #3710 , pack V* for two elem array
...
This also fixes #3706
2014-08-26 13:58:37 -05:00
David Maloney
c42517a14a
missing exception rescue
...
needed to also rescue Errno::ETIMEDOUT
2014-08-26 13:58:34 -05:00
Jon Hart
e75e213b52
Clarify SIP mixin method name, store header values as string, etc
2014-08-26 11:40:49 -07:00
Jon Hart
677d7804ae
Fix bad merge
2014-08-26 10:49:54 -07:00
Jon Hart
5ad090e833
Add unit test for and correct parsing of NAT-PMP port map responses
2014-08-26 10:49:53 -07:00
Jon Hart
246f021437
Update natpmp_external_address to use Msf::Auxiliary::UDPScanner
2014-08-26 10:49:53 -07:00
Jon Hart
5c57f9b4eb
Don't overload RPORT/LPORT for mapping external -> internal ports
2014-08-26 10:49:53 -07:00
Jon Hart
162508f532
Update NAT-PMP modules to use new/updated mixins
2014-08-26 10:49:53 -07:00
Jon Hart
816404bb88
Move common NAT-PMP functionality into a central place
2014-08-26 10:49:53 -07:00
Jon Hart
32a14cfc43
Missed the file...
2014-08-26 10:49:53 -07:00
Jon Hart
b0347906e3
Correct NATPMP external address resposne epoch and result parsing
2014-08-26 10:49:52 -07:00
Jon Hart
ca11eae3a9
Show a useful failure message when the external address probe fails
2014-08-26 10:49:52 -07:00
William Vu
9f6a40dfd6
Fix bad pack in mswin_tiff_overflow
...
Reported by @egyjuzer in #3706 .
2014-08-26 11:14:44 -05:00
Jon Hart
ff7e0f3c19
Land #3705 , xistence's UPNP SSDP M-SEARCH amplification scanner
2014-08-26 08:30:43 -07:00
Jon Hart
bb00c97f46
Add a CERT reference
2014-08-26 08:29:28 -07:00
Jon Hart
40fe2fd3a9
Remove DRDoS references, as this just proves amplification
2014-08-26 08:23:50 -07:00
Jon Hart
10f52d8765
Use MX of 1 to speed up responses from endpoints that respect it
2014-08-26 08:00:30 -07:00
Jon Hart
333c3a90ae
Space between SSDP headers and values, which is sometimes required
2014-08-26 07:57:59 -07:00
Jon Hart
337cd02dd7
Change Auxiliary::DRDoS' prove_drdos to prove_amplification
2014-08-26 07:48:44 -07:00
Jon Hart
9749c78632
Add amplification multiplier for vulnerable proofs
2014-08-26 07:36:38 -07:00
Jon Hart
04fbd07a16
vprint_error in the unlikely event we get an unexpected response
2014-08-26 07:30:14 -07:00
Nicholas Nam
40b66fae33
Add Wing FTP Server post-auth remote command execution module
2014-08-26 07:28:41 -07:00
Jon Hart
79b05db409
Correct minor style issues
2014-08-26 07:26:30 -07:00
jvazquez-r7
41420a97d5
Solve conflicts
2014-08-26 09:04:05 -05:00
Pedro Ribeiro
a8d03aeb59
Fix bug with PMP db paths
2014-08-26 12:54:31 +01:00
Pedro Ribeiro
473341610c
Update name to mention DC; correct servlet name
2014-08-26 12:39:48 +01:00
Pedro Ribeiro
bcdea05b51
Merge pull request #1 from rapid7/master
...
Update from original
2014-08-26 12:37:49 +01:00
xistence
63b75a0093
SSDP Amplification module changes
2014-08-26 16:03:32 +07:00
Joshua Smith
b3e898736f
Land 3694, msfconsole.rc wasn't loading, add yard
2014-08-26 01:12:33 -05:00
xistence
a90d142140
Add UPnP SSDP Amplication Scanner
2014-08-26 12:53:14 +07:00
Joshua Smith
97754afe4f
Land 3703, be_truthy instead of be_true
2014-08-26 00:00:05 -05:00
jvazquez-r7
57afaf6580
undo be_false case
2014-08-25 23:58:08 -05:00
jvazquez-r7
60ecf4e8c4
Use be_truthy instead of be_true
2014-08-25 23:58:08 -05:00
jvazquez-r7
aa47746290
Undo incorrect be_true switch
2014-08-25 18:23:55 -05:00
jvazquez-r7
6c631a2069
undo be_false case
2014-08-25 18:18:47 -05:00
jvazquez-r7
7bfcad9c27
Use be_truthy instead of be_true
2014-08-25 18:13:38 -05:00
jvazquez-r7
c372f5164b
And switch more cases to be_falsey
2014-08-25 17:50:38 -05:00
jvazquez-r7
a1e1cef418
More use of be_falsey
2014-08-25 17:38:50 -05:00
jvazquez-r7
dd1c015e4e
Use be_falsey
2014-08-25 17:34:55 -05:00
jvazquez-r7
9a14b64051
First version of Rex::Arch::X86 specs
2014-08-25 16:44:28 -05:00
HD Moore
73e4ec709f
Fix smb_port and require 'recog' when no DB/MDM
2014-08-25 15:42:18 -05:00
sinn3r
463815d240
Add AppleTV modules (imge, video and login)
2014-08-25 15:24:41 -05:00
Jon Hart
a41748e77e
Correct SIP header note storage to align with Recog
2014-08-25 13:12:30 -07:00
Jon Hart
6a522cc105
Remove unused BATCHSIZE from SIP options_tcp, duplicate from options
2014-08-25 13:12:29 -07:00
Jon Hart
bfa89bb3a5
Enforce binary encoding on non-modules, no encoding on modules
2014-08-25 13:12:29 -07:00
Jon Hart
6185721a61
Address @hmoore-r7's feedback regarding binary encoding
2014-08-25 13:11:22 -07:00
Jon Hart
a4f623a955
Show port and protocol when printing service notes, not just name
2014-08-25 13:11:22 -07:00
Jon Hart
9955cb5b27
Enforce proper protocol case where necessary
2014-08-25 13:11:22 -07:00
Jon Hart
b760815c86
Also pull the Allow headers (previous behavior)
2014-08-25 13:11:21 -07:00
Jon Hart
637f86f37d
Gut SIP UDP stuff, use Msf::Auxiliary::UDPScanner
2014-08-25 13:11:21 -07:00
Jon Hart
50d90defbc
Use a correct default Accept header -- responses++
2014-08-25 13:11:21 -07:00
Jon Hart
c2e70446ed
Move SIP module stuff to Msf::Exploit::Remote::SIP
2014-08-25 13:11:21 -07:00
Jon Hart
fc67aed174
Correct style and doc issues, tidy failure message when not SIP
2014-08-25 13:11:21 -07:00
Jon Hart
e3753e3649
Refactor SIP response parsing for future improvements
2014-08-25 13:11:21 -07:00
Jon Hart
02e41c27e7
Split SIP response parsing out on its own, add unit tests.
...
Passes rspec but fails in framework. WIP.
2014-08-25 13:11:20 -07:00
Jon Hart
69aa56d8d3
Disable rubocop RedundantBegin for modules
2014-08-25 13:11:20 -07:00
Jon Hart
d4ea3e9f29
Pass protocol down to parse_reply for report_* purposes
2014-08-25 13:09:39 -07:00
Jon Hart
a2e2e37a69
Fix SIP options scanning
2014-08-25 13:09:39 -07:00
Jon Hart
2a4d73ee35
Add status message that displays delay between requests
2014-08-25 12:55:27 -07:00
Jon Hart
5c61c09c6b
auxiliary/scanner/http/soap_xml cleanup
...
This:
* Corrects Ruby style (most) everywhere
* Uses Rex's sleep, converts to milliseconds -- seconds are too granular
* Moves begin/rescue inside nested verb+noun loop
* Prints errors even if not in verbose mode
* Corrects URI construction when PATH ends with /
2014-08-25 12:55:27 -07:00
Joe Vennix
6d3255a3b5
Update bad config error.
2014-08-25 14:43:23 -05:00
David Maloney
152ddb2f32
refactor the ipboard-login module
...
now that we have the loginScanner class, we simplify the module
by using the scanner and credcollection classes to handle all
the real work for us
2014-08-25 14:32:47 -05:00
Joe Vennix
b652ebb44f
Add other gdb-supported platforms that run on allowed arches.
2014-08-25 14:15:20 -05:00
Joe Vennix
c4a173e943
Remove automatic target, couldn't figure out generic payloads.
2014-08-25 14:14:47 -05:00
darkbushido
2877cdc362
Merge branch 'master' into aruba-testing
2014-08-25 14:09:37 -05:00
William Vu
6e3739a220
Land #3698 , release fixes
2014-08-25 14:00:29 -05:00
David Maloney
32b1a5ea23
add ipboard loginscanner
...
add loginscanner class for IPBoard with specs
this should replicate the functionality originally written
by Chris Truncer, but move it into a testable, reusable class
2014-08-25 13:58:30 -05:00
Tod Beardsley
6d9833e32b
Minor pre-release updates with descriptions
2014-08-25 13:34:45 -05:00
Tod Beardsley
03a1f4455d
No need to escape single quotes in %q{} strigns
2014-08-25 13:03:33 -05:00
Tod Beardsley
2f87c880df
Add link to blog post for NTP modules
2014-08-25 12:58:10 -05:00
Tod Beardsley
c3213a73e5
Use peer when writing scanner modules
...
This fixes the module seen in PR rapid7#3684 to use the peer method at
the beginning of print_* messages, rather than the vhost method at the
end. Doing this tends to make reading the output much easier since it's
more consistent.
Incidentally, this module has an msftidy complaint:
````
--- Checking new and changed module syntax with tools/msftidy.rb ---
modules/auxiliary/scanner/http/ipboard_login.rb - [INFO] Please use
vars_get in send_request_cgi: send_request_cgi({ 'uri' =>
normalize_uri(target_uri.path,
"index.php?app=core&module=global§ion=login&do=process"
````
This should be fixed as well, or explained why it's not being honored.
2014-08-25 12:48:32 -05:00
William Vu
1ee83ff57e
Land #3696 , pile of NTP DRDoS 0days
...
Dr. DoS in da house?
2014-08-25 11:47:28 -05:00
William Vu
7a76efa7f7
Add reference and disclosure date
2014-08-25 11:46:47 -05:00
HD Moore
92ff0974b7
Add YARD option formatting
2014-08-25 01:45:59 -05:00
OJ
a39f7b94ec
Land #3684 - IP Board Login Scanner
2014-08-25 11:54:42 +10:00
Christopher Truncer
302e4025ba
Removed unnecessary function
2014-08-24 20:45:28 -04:00
Christopher Truncer
2b59063d6c
Updated based on feedback
2014-08-24 19:53:29 -04:00
Tom Sellers
fa502c9c69
Minor adjustments
2014-08-24 17:39:13 -05:00
Tom Sellers
601c5515f8
Corrected 3 issues identified by jlee-r7
2014-08-24 17:18:31 -05:00
jvazquez-r7
c20b4dc0ff
Land #3645 , @jlee-r7's fix for mremoge credentials gather module
2014-08-24 15:53:29 -05:00
James Lee
19d6feca62
Fix regression where msfconsole.rc wasn't loading
...
Also add some slightly better docs for the Driver class
2014-08-24 15:10:41 -05:00
Tom Sellers
081a3437a4
Refactor for Credentials gem
2014-08-24 09:38:15 -05:00
Joe Vennix
a27754c5c1
Tweak specs a bit.
2014-08-24 02:41:37 -05:00
Joe Vennix
120f416f9c
Add spec for Msf::EncodedPayload.create.
2014-08-24 02:36:09 -05:00
Joe Vennix
6313b29b7a
Add #arch method to Msf::EncodedPayload.
...
This allows exploits with few one automatic target to support many
different architectures.
2014-08-24 02:22:15 -05:00
Joe Vennix
88f626184c
Remove linux platform limitation, target depends on arch only.
2014-08-24 01:39:04 -05:00
Joe Vennix
04d0b87067
Reorder module title.
2014-08-24 01:18:21 -05:00
Joe Vennix
1d3531d09d
Put include above constant defs.
2014-08-24 01:17:32 -05:00
Joe Vennix
c65ba20017
Fix incorrect Platforms key.
2014-08-24 01:15:34 -05:00
Joe Vennix
4e63faea08
Get a shell from a loose gdbserver session.
2014-08-24 01:10:30 -05:00
Tom Sellers
1fa43bfe64
Rework for Credential lib update
2014-08-23 10:53:55 -05:00
John Sawyer
0a27a18104
Committing changes from r7 comments
2014-08-23 00:08:27 -04:00
Christopher Truncer
84f4fa5c76
Updated module based on feedback
2014-08-22 21:16:53 -04:00
jvazquez-r7
3bbe9bf074
Land #3540 , JBoss refactoring with @us3r777
2014-08-22 17:06:28 -05:00
jvazquez-r7
0737d0dbd5
Refactor auxiliary module
2014-08-22 17:05:45 -05:00
jvazquez-r7
0031913b34
Fix nil accesses
2014-08-22 16:19:11 -05:00
jvazquez-r7
8945f04ffd
Add specs for Msf::HTTP::JBoss::BeanShell
2014-08-22 16:13:38 -05:00
jvazquez-r7
f57dd9a224
Add specs for #generate_bsh
2014-08-22 15:39:58 -05:00
jvazquez-r7
2b3058869f
Add Msf::HTTP::JBoss::BeanShellScripts specs
2014-08-22 15:36:29 -05:00
jvazquez-r7
7ee5423310
Add specs for Msf::HTTP::JBoss::Base
2014-08-22 15:11:27 -05:00
William Vu
5d708b65b4
Land #3676 , updated Meterpreter bins!
...
For KB2871997.
2014-08-22 14:33:27 -05:00
jvazquez-r7
4742dbad91
Fix YARD documentation
2014-08-22 14:18:13 -05:00
jvazquez-r7
9ef09a7725
Pass msftidy
2014-08-22 13:24:59 -05:00
jvazquez-r7
38e6576990
Update
2014-08-22 13:22:57 -05:00
jvazquez-r7
da0950df24
Land #3674 , @todb-r7's patch for RangeWalker spec
2014-08-22 11:57:14 -05:00
jvazquez-r7
e93fbbd904
Land #3685 , @pedrib's exploit for CVE-2014-3996
2014-08-22 11:45:41 -05:00
jvazquez-r7
cf147254ad
Use snake_case in the filename
2014-08-22 11:44:35 -05:00
jvazquez-r7
823649dfa9
Clean exploit, just a little
2014-08-22 11:43:58 -05:00
jvazquez-r7
9815b1638d
Refactor pick_target
2014-08-22 11:31:06 -05:00
Joe Vennix
95fbb8f1b7
Land PR #3672 , dmaloney-r7's login scanner credential rework.
2014-08-22 11:15:32 -05:00
jvazquez-r7
ecace8beec
Refactor check method
2014-08-22 11:05:36 -05:00
Brandon Turner
05f0d09828
Merge branch staging/electro-release into master
...
On August 15, shuckins-r7 merged the Metasploit 4.10.0 branch
(staging/electro-release) into master. Rather than merging with
history, he squashed all history into two commits (see
149c3ecc63 and
82760bf5b3 ).
We want to preserve history (for things like git blame, git log, etc.).
So on August 22, we reverted the commits above (see
19ba7772f3 ).
This merge commit merges the staging/electro-release branch
(62b81d6814 ) into master
(48f0743d1b ). It ensures that any changes
committed to master since the original squashed merge are retained.
As a side effect, you may see this merge commit in history/blame for the
time period between August 15 and August 22.
2014-08-22 10:50:38 -05:00
jvazquez-r7
ced65734e9
Make some datastore options advanced
2014-08-22 10:26:04 -05:00
dmaloney-r7
6ee39f89de
Merge pull request #13 from jvennix-r7/update-gemfile-lock-so-travis-can-run
...
Update lockfile in msf repo after `bundle install`
2014-08-22 10:24:10 -05:00
jvazquez-r7
b4e3e84f92
Use CamelCase for target keys
2014-08-22 10:23:36 -05:00
jvazquez-r7
b58550fe00
Indent description and fix title
2014-08-22 10:21:08 -05:00
Brandon Turner
19ba7772f3
Revert "Various merge resolutions from master <- staging"
...
This reverts commit 149c3ecc63 .
Conflicts:
lib/metasploit/framework/command/base.rb
lib/metasploit/framework/common_engine.rb
lib/metasploit/framework/require.rb
lib/msf/core/modules/namespace.rb
modules/auxiliary/analyze/jtr_postgres_fast.rb
modules/auxiliary/scanner/smb/smb_login.rb
msfconsole
2014-08-22 10:17:44 -05:00
inkrypto
7e2d474a26
Ranking, Version, Spacing Edit
2014-08-22 11:06:42 -04:00
joev
05afe416a9
Update lockfile to pull in new msf-cred versions.
2014-08-21 15:44:16 -05:00
inkrypto
7587997d73
Spell check
2014-08-21 12:47:25 -04:00
Christopher Truncer
3918acb1e1
Changed keyword used when returning
2014-08-21 12:34:54 -04:00
Christopher Truncer
a0b72bba93
Updated module based on feedback
2014-08-21 12:26:41 -04:00
jvazquez-r7
fd05e634e8
Move once more let into describe
2014-08-21 10:41:37 -05:00
jvazquez-r7
b0a4ea6750
Move let helpers to describe groups
2014-08-21 10:39:16 -05:00
jvazquez-r7
6301d79162
Describe setters just expecting how assignement to properties should happen
2014-08-21 10:34:52 -05:00
jvazquez-r7
54395e38a0
Use a part subject to describe #add_part
2014-08-21 10:29:44 -05:00
darkbushido
df62c4a29d
setting the timeout to 180
2014-08-21 10:15:07 -05:00
darkbushido
264192e796
setting the timeout to 120
2014-08-21 10:00:35 -05:00
darkbushido
9e4b02abb1
increasing the aruba timeout to 240 seconds
...
msfconsole is taking over 60 seconds to load on travis
2014-08-21 09:45:53 -05:00
Pedro Ribeiro
da752b0134
Add exploit for CVE-2014-3996
2014-08-21 15:30:28 +01:00
Christopher Truncer
383906c26c
Removed function no longer used
2014-08-20 22:51:01 -04:00
Christopher Truncer
c93bfb4673
Fixed targeturi value
2014-08-20 21:23:45 -04:00
Christopher Truncer
7f90b81711
IP Board Login Scanner Module
2014-08-20 21:18:19 -04:00
darkbushido
07ea8bedb5
Merge branch 'master' into aruba-testing
2014-08-20 20:06:40 -05:00
darkbushido
715f54b755
trying to get travis-ci to run cucumber
2014-08-20 19:43:13 -05:00
Jon Hart
9f9f28cc31
If a peer is 127.0.0.1, don't try to store it because we (currently...) can't
2014-08-20 15:48:54 -07:00
Jon Hart
9db3dc7ad8
Store peer data note in the same format as originally
2014-08-20 15:10:45 -07:00
Jon Hart
758c3fa518
Only discard monlist replies that are impossibly short
...
This fixes the case where if a monlist reply only includes one peer
2014-08-20 15:02:21 -07:00
Jon Hart
7ad9300d37
Update ntp_monlist to use UDPScanner, NTP and DRDoS mixins
2014-08-20 14:41:00 -07:00
darkbushido
73911e9007
adding in the positive test case
2014-08-20 15:54:49 -05:00
David Maloney
48f0743d1b
remove crappy basedir method
...
this method is no lopnger needed
2014-08-20 15:28:36 -05:00
David Maloney
6bc55bf8cc
change is_apt method
2014-08-20 15:27:11 -05:00
David Maloney
b547f7fc75
fix msfbasedir for go_pro
...
go_pro uses the wrong base director y for starting
up metasploit pro when using the go_pro command
this caused errors
2014-08-20 15:22:18 -05:00
Jon Hart
8fd4ee87ab
Allow singular NTP version and mode 7 implementation testing
2014-08-20 12:21:39 -07:00
jvazquez-r7
9d007a8c63
Add @jlee-r7's feedback
2014-08-20 12:04:33 -05:00
Tod Beardsley
f9b902c6cc
Land #3681 , restore rake and rspec functionality
...
Since this is a more complete fix than #3678 and #3679 , this merge
closes #3678 and closes #3679 . Lets see if that magic syntax works!
2014-08-20 11:27:09 -05:00
James Lee
cef4ddf535
Fix a crash when msfconsole is a symlink
2014-08-20 11:03:41 -05:00
James Lee
c3e8bc8fa0
Fix a crash when we can't connect to PG, again
2014-08-20 11:02:46 -05:00
darkbushido
15a7ed0031
adding scenarios for booting msfconsole without a db
2014-08-20 11:02:11 -05:00
James Lee
fa27def41f
Revert "Fix a crash when we can't connect to PG"
...
This reverts commit b6deb6a342 .
2014-08-20 11:01:29 -05:00
jvazquez-r7
9dcc95fb04
Fix Rex::MIME::Message#initialize boundaries parsing
2014-08-20 10:22:38 -05:00
jvazquez-r7
e8a6307df1
Fix Rex::MIME::Header#parse
2014-08-20 09:42:44 -05:00
jvazquez-r7
e5fc0a007f
Add some Message specs
2014-08-20 09:31:49 -05:00
jvazquez-r7
e4b586a96d
Add specs for add_part_inline_attachment
2014-08-20 08:32:58 -05:00
John Sawyer
1959f7a235
Updated shodan_search for new API
2014-08-20 00:48:13 -04:00
OJ
a6b7262611
Updated to meterpreter_bins version 0.0.7
...
This has been a long time coming! Kiwi has been broken for a while and
this updated fixes that problem.
Details of the binaries build date/commits are in the gemspec in the
main meterpreter_bins repo.
2014-08-20 12:30:34 +10:00
William Vu
f0f5772217
Land #3675 , firefox_svg_plugin un-deprecation
2014-08-19 17:52:41 -05:00
sinn3r
e2e2dfc6a3
Undo FF
2014-08-19 17:47:44 -05:00
sinn3r
777efb5e48
Land #3669 - Deprecate ff 17 svg exploit
2014-08-19 17:42:31 -05:00
sinn3r
c73ec66c7a
Land #3659 - Add HybridAuth install.php PHP Code Execution
2014-08-19 17:19:01 -05:00
jvazquez-r7
381c88f814
Add specs for add_part and add_part_attachment
2014-08-19 17:06:59 -05:00
Tod Beardsley
a4c6a10edb
The .foo domain is live now.
...
I still kinda hate these tests, though, since they fail in wildcard DNS
environments (like OpenDNS).
2014-08-19 16:47:30 -05:00
dmaloney-r7
0c9dafff54
Merge pull request #3673 from jlee-r7/bug/MSP-11061/crash-without-postgres
...
Fix a crash when we can't connect to PG
2014-08-19 16:16:30 -05:00
James Lee
b6deb6a342
Fix a crash when we can't connect to PG
...
MSP-11061
No Postgres, no cry
2014-08-19 15:30:24 -05:00
Tod Beardsley
08430ee7ac
Land #3616 , cred gem for imap from @TomSellers
2014-08-19 15:26:12 -05:00
Tom Sellers
74920d26a4
Update to server/capture/imap.rb for new Credential system
2014-08-19 15:25:31 -05:00
jvazquez-r7
0585b13398
Add first specs for Rex::MIME::Message
2014-08-19 15:17:17 -05:00
darkbushido
f80fd68480
adding more scenarios
...
updating ms08-067's scenarios so they are testing show options and show advanced
changing the scenario descriptions and feature descriptions for help.feature and
ms08-067
2014-08-19 15:06:47 -05:00
darkbushido
8f3f37dd54
updating how cucumber loads features
...
starting to use a cucumber.yml to store the profile configs
we will not be running @targets by default
2014-08-19 15:05:47 -05:00
darkbushido
fd9e92bb24
Merge branch 'master' into aruba-testing
2014-08-19 14:31:53 -05:00
Tod Beardsley
170c8b699a
Land #3617 from @TomSellers, ftp anon scanner
2014-08-19 13:22:30 -05:00
sinn3r
311cc5befb
Land #3668 - Add specs for Rex::Exploitation::HeapLib
2014-08-19 13:14:24 -05:00
Tom Sellers
3fdad4dc91
Update auxillary/scanner/ftp with Credential Gem
2014-08-19 13:13:05 -05:00
sinn3r
7bf637716a
Land #3663 - Add specs for Rex::Exploitation::EncryptJS
2014-08-19 13:08:14 -05:00
William Vu
dc95b01cc5
Land #3670 , smb_login private_type fix
...
[FixRM #8841 ]
2014-08-19 11:30:23 -05:00
William Vu
b748cee760
Land #3664 , enum_osx dump_hash removal
2014-08-19 11:29:23 -05:00
jvazquez-r7
325c05d0e0
Land #3671 , @wchen-r7's fix for RangeWalker spec
2014-08-19 11:01:14 -05:00
sinn3r
f3528c929f
geez, glassfish gtf outta there
2014-08-19 10:40:52 -05:00
sinn3r
ad241910d0
This is more invalid than the other one
2014-08-19 10:39:50 -05:00
David Maloney
e9dea358b8
gemfile change
2014-08-19 10:32:44 -05:00
David Maloney
473b92a060
Merge branch 'master' into feature/MSP-10992/scanner-dry
...
Conflicts:
Gemfile.lock
lib/metasploit/framework/command/console.rb
lib/metasploit/framework/common_engine.rb
lib/metasploit/framework/credential.rb
lib/metasploit/framework/credential_collection.rb
lib/metasploit/framework/login_scanner/afp.rb
lib/metasploit/framework/login_scanner/axis2.rb
lib/metasploit/framework/login_scanner/db2.rb
lib/metasploit/framework/login_scanner/ftp.rb
lib/metasploit/framework/login_scanner/http.rb
lib/metasploit/framework/login_scanner/mssql.rb
lib/metasploit/framework/login_scanner/mysql.rb
lib/metasploit/framework/login_scanner/pop3.rb
lib/metasploit/framework/login_scanner/postgres.rb
lib/metasploit/framework/login_scanner/result.rb
lib/metasploit/framework/login_scanner/smb.rb
lib/metasploit/framework/login_scanner/snmp.rb
lib/metasploit/framework/login_scanner/ssh.rb
lib/metasploit/framework/login_scanner/telnet.rb
lib/metasploit/framework/login_scanner/vnc.rb
lib/metasploit/framework/parsed_options/console.rb
lib/metasploit/framework/require.rb
lib/metasploit/framework/version.rb
lib/msf/core/modules/namespace.rb
modules/auxiliary/analyze/jtr_postgres_fast.rb
modules/auxiliary/scanner/afp/afp_login.rb
modules/auxiliary/scanner/db2/db2_auth.rb
modules/auxiliary/scanner/ftp/ftp_login.rb
modules/auxiliary/scanner/http/axis_login.rb
modules/auxiliary/scanner/http/http_login.rb
modules/auxiliary/scanner/http/tomcat_mgr_login.rb
modules/auxiliary/scanner/mssql/mssql_login.rb
modules/auxiliary/scanner/mysql/mysql_login.rb
modules/auxiliary/scanner/pop3/pop3_login.rb
modules/auxiliary/scanner/postgres/postgres_login.rb
modules/auxiliary/scanner/snmp/snmp_login.rb
modules/auxiliary/scanner/ssh/ssh_login.rb
modules/auxiliary/scanner/ssh/ssh_login_pubkey.rb
modules/auxiliary/scanner/telnet/telnet_login.rb
modules/auxiliary/scanner/vnc/vnc_login.rb
modules/auxiliary/scanner/winrm/winrm_login.rb
spec/lib/metasploit/framework/credential_spec.rb
spec/lib/msf/core/framework_spec.rb
2014-08-19 10:30:16 -05:00
sinn3r
17b03e7d34
Fix rspec due to an invalid dns becoming valid
2014-08-19 10:28:30 -05:00
darkbushido
a09037ffa3
Merge branch 'master' into aruba-testing
...
Conflicts:
.rubocop.yml
Gemfile
Gemfile.lock
Rakefile
lib/metasploit/framework/command/console.rb
lib/metasploit/framework/common_engine.rb
lib/metasploit/framework/parsed_options/console.rb
lib/metasploit/framework/require.rb
lib/metasploit/framework/version.rb
lib/msf/core/modules/namespace.rb
modules/auxiliary/analyze/jtr_postgres_fast.rb
spec/lib/msf/core/framework_spec.rb
2014-08-19 09:06:53 -05:00
OJ
e0df664656
Land #3653 : NETAPI x64 fixes
2014-08-19 11:40:43 +10:00
sinn3r
7330e3585f
Support Glassfish 4.0 and lots of other changes
2014-08-18 19:03:26 -05:00
jvazquez-r7
663e11f16b
Add specs for Rex::MIME::Part
2014-08-18 18:03:27 -05:00
jvazquez-r7
85662d5ccd
Add specs for Rex::MIME::Header
2014-08-18 17:33:26 -05:00
jvazquez-r7
73ac0e9537
Add specs for Rex::MIME::Encoding
2014-08-18 16:04:08 -05:00
James Lee
f169b8dff3
Fix hashes being stored as passwords
2014-08-18 15:52:13 -05:00
joev
b93fda5cef
Remove browser_autopwn hook from deprecated FF module.
2014-08-18 15:33:43 -05:00
joev
87aa63de6e
Deprecate FF17 SVG exploit.
...
This exploit needs flash, the tostring_console injection one does not.
2014-08-18 15:32:51 -05:00
cdoughty-r7
5fac1510bc
Merge pull request #3667 from todb-r7/fix-release
...
Release fixes: Minor caps, grammar, desc fixes
2014-08-18 14:06:01 -05:00
Brendan Coles
564431fd41
Use arrays in refs for consistency
2014-08-18 18:54:54 +00:00
jvazquez-r7
f812d2619c
Fix load_js when opts[:newobfu] and add specs
2014-08-18 13:50:19 -05:00
Tod Beardsley
6792ded714
Land #3666 , fix msfconsole start w/out database
2014-08-18 13:44:20 -05:00
Tod Beardsley
cad281494f
Minor caps, grammar, desc fixes
2014-08-18 13:35:34 -05:00
James Lee
b9e449f5e2
Fix crash when database.yml doesn't exist
2014-08-18 12:40:57 -05:00
jvazquez-r7
3dae6ee934
Not prefixing the class when describing method
2014-08-18 12:19:30 -05:00
jvazquez-r7
2dc579d467
Add template for specs
2014-08-18 12:16:20 -05:00
jvazquez-r7
75df32b1d3
Use single quoted strings out of the spec strings
2014-08-18 11:43:54 -05:00
joev
5654370316
Remove hashdump functionality from enum_osx.
...
There is a specific hashdump module that is more up-to-date, no need to duplicate
functionality (and code).
2014-08-18 11:40:11 -05:00
sinn3r
7c1605efe4
Land #3662 - Fix android payload issue when running browser_autopwn
2014-08-18 11:38:28 -05:00
jvazquez-r7
4ffd166918
Add specs for Rex::Exploitation::EncryptJS
2014-08-18 11:31:36 -05:00
Vincent Herbulot
fd40a68525
Added YARD documentation to lib/msf/http/jboss
2014-08-18 18:19:37 +02:00
joev
5bfbb7654e
Add android meterpreter to browser autopwn.
2014-08-18 11:09:16 -05:00
Vincent Herbulot
2b59337e9a
Jboss spec modifications.
...
Various changes in the jboss spec to match the newly refactored
methods in lib/msf/http/jboss.
2014-08-18 17:19:09 +02:00
William Vu
c5c63f44e9
Land #3661 , binary coding for libs
2014-08-17 18:01:19 -05:00
HD Moore
5e123e024d
Add 'coding: binary' to all msf/rex library files
...
This fixes a huge number of hard-to-detect runtime bugs
that occur when a default utf-8 string from one of these
libraries is passed into a method expecting ascii-8bit
2014-08-17 17:31:53 -05:00
HD Moore
d8e82b9394
Lands #3655 , fixes pack operators
...
the commit.
he commit.
2014-08-17 17:25:52 -05:00
Brendan Coles
b8b2e3edff
Add HybridAuth install.php PHP Code Execution module
2014-08-16 23:31:46 +00:00
HD Moore
6d92d701d7
Merge feature/recog into post-electro master for this PR
2014-08-16 01:19:08 -05:00
sinn3r
e656a81c63
Land #3656 - FF toString console.time Privileged Javascript Injection
2014-08-15 17:07:23 -05:00
joev
6d958475d6
Oops, this doesn't work on 23, only 22.
2014-08-15 17:00:58 -05:00
joev
fb1fe7cb8b
Add some obfuscation.
2014-08-15 16:54:30 -05:00
joev
b574a4c4c5
Wow, this gets a shell all the way back to 15.0.
2014-08-15 16:39:36 -05:00
joev
5706371c77
Update browser autopwn settings.
2014-08-15 16:32:06 -05:00
joev
8c63c8f43d
Add browserautopwn hook now that this is not user-assisted.
2014-08-15 16:28:21 -05:00
joev
694d917acc
No need for web console YESSSS
2014-08-15 16:02:26 -05:00
joev
738a295f0a
Rename module to tostring_console*.
2014-08-15 15:17:37 -05:00
Meatballs
0cc3bdfb35
Moar bad packs
2014-08-15 21:11:37 +01:00
joev
f182613034
Invalid CVE format.
2014-08-15 15:09:45 -05:00
joev
edb9d32e5c
Add module for toString() injection in firefox.
2014-08-15 15:08:10 -05:00
inkrypto
7972da350d
Files move to appropriate directories and have proper formatting
2014-08-15 14:37:29 -04:00
inkrypto
92750ccc03
Remove emc files
2014-08-15 14:30:19 -04:00
Tod Beardsley
904c1b20b1
Land #3654 , update to 4.10-dev (electro)
2014-08-15 12:51:28 -05:00
Samuel Huckins
82760bf5b3
Deprecation warnings hidden for non-listeners
2014-08-15 12:33:44 -05:00
Samuel Huckins
149c3ecc63
Various merge resolutions from master <- staging
...
* --ask option ported to new location
* --version option now works
* MSF version updated
* All specs passing
2014-08-15 11:33:31 -05:00
jvazquez-r7
4cfd2abd8d
Land #3621 , @kaospunk's exploit for gitlab-shell CVE-2013-4490 command injection
2014-08-15 09:17:16 -05:00
jvazquez-r7
4e0f6dfcc7
Do minor cleanup
2014-08-15 09:10:08 -05:00
darkbushido
ac29ba957c
Merge branch 'staging/electro-release' into aruba-testing
2014-08-15 09:02:53 -05:00
Meatballs
8302e82ca1
Use x64 ptr sizes
2014-08-14 23:32:04 +01:00
Jay Smith
b55f425ec0
Merge in changes from @todb-r7.
2014-08-14 17:22:07 -04:00
Samuel Huckins
1183c5cfeb
Merge branch 'update-rubocop-yaml'
2014-08-14 12:44:30 -05:00
Samuel Huckins
9553bfc45f
Merge branch 'remove-rubocop'
2014-08-14 12:41:04 -05:00
Samuel Huckins
45490e7e59
Merge branch 'master' of github.com:rapid7/metasploit-framework
2014-08-14 12:36:41 -05:00
Tod Beardsley
a80d4c25a6
Be more forceful about Rubocop in CONTRIBUTING.md
2014-08-14 11:51:44 -05:00
Tod Beardsley
ee968db9ef
Include .rubocop.yml from PR #3649
2014-08-14 11:20:19 -05:00
Tod Beardsley
fbb8262704
More .rubocop.yml exceptions
...
While we expect to remove Rubocop via PR rapid7#3639 , the Rubocop YAML
file is still useful for those developers that want to use Rubocop on
their own. Like me, for instance.
2014-08-14 11:17:14 -05:00
Brandon Turner
62b81d6814
Merge pull request #3644 from dmaloney-r7/bug/MSP-11050/rails_root
...
MSP-11050 #land
2014-08-14 08:52:15 -05:00
inkrypto
5fee4df2c0
BA EMC modules
2014-08-13 23:18:43 -04:00
sinn3r
f91116a8e8
Land #3634 - Virtual box 3D Acceleration OpenGL Host escape
2014-08-13 20:08:13 -05:00
kaospunk
5ed3e6005a
Implement suggestions
...
This commit addresses feedback such as adding a check
function and changing the login fail case by being
more specific on what is checked for. The failing
ARCH_CMD payloads were addressed by adding BadChars.
Last, an ARCH_PYTHON target was added based on
@zerosteiner's feedback.
2014-08-13 20:26:48 -04:00
darkbushido
565f622fe0
renaming targets.yml to .example
...
ignoring the targets.yml file
2014-08-13 17:40:51 -05:00
darkbushido
0d045d007a
moving the module file
...
adding some comments on things we should not see when running
msfconsole
2014-08-13 17:37:40 -05:00
Lance Sanchez
e7f773fda2
Merge pull request #2 from jhart-r7/target_hooks
...
Target hooks
2014-08-13 17:35:21 -05:00
Jon Hart
e66d2c8d19
Merge branch 'aruba-testing' into target_hooks
2014-08-13 15:29:53 -07:00
Jon Hart
0bb9214753
Add missed files
2014-08-13 15:25:41 -07:00
Jon Hart
2f45d2c72e
Add @target hooks to set RHOST/RHOSTS from config
2014-08-13 15:22:09 -07:00
darkbushido
74daf14e54
moving the scenarios around
2014-08-13 17:02:11 -05:00
darkbushido
2409da9555
cutting down on steps calling steps
2014-08-13 16:46:36 -05:00
Lance Sanchez
372178b523
Merge pull request #1 from jhart-r7/aruba-testing
...
Add @msfconsole tag, simpler module example
2014-08-13 16:44:05 -05:00
jvazquez-r7
127d094a8d
Dont share once device is opened
2014-08-13 16:13:38 -05:00
Jon Hart
fa6d356425
Add @msfconsole tag, simpler module example
2014-08-13 13:55:11 -07:00
darkbushido
c82ba34f7c
working on a first pass at cucumber for framework
2014-08-13 14:28:28 -05:00
sinn3r
558cea6017
Land #3638 - Add VMTurbo Operations Manager 'vmtadmin.cgi' RCE
2014-08-13 11:55:56 -05:00
jvazquez-r7
e0ed777d0b
Land #3646 , @Meatballs1 tidy of virtual_box_guest_additions
2014-08-13 08:44:10 -05:00
Meatballs
05a198bc96
Correct spelling
2014-08-13 14:06:25 +01:00
Spencer McIntyre
56c96f3aa2
Land #3647 , @Meatballs1 correct unpack specifier
2014-08-13 08:44:38 -04:00
Meatballs
256204f2af
Use correct pack/unpack specifier
2014-08-13 11:36:16 +01:00
Meatballs
4a01c27ed4
Use get_env and good pack specifier
2014-08-13 10:59:22 +01:00
Emilio Pinna
4ff73a1467
Add version build check
2014-08-13 09:53:43 +02:00
James Lee
b7e4bd4080
Fix 'domain\user' reporting in mremote
2014-08-12 18:01:42 -05:00
jvazquez-r7
50e2e325d7
Land #3534 , @KoreLogicSecurity's exploit for CVE-2014-2477
2014-08-12 17:18:34 -05:00
jvazquez-r7
da4b572a0d
Change module name
2014-08-12 17:17:26 -05:00
jvazquez-r7
3eccc12f50
Switch from vprint to print
2014-08-12 17:11:24 -05:00
jvazquez-r7
f203fdebcb
Use Msf::Exploit::Local::WindowsKernel
2014-08-12 17:09:39 -05:00
jvazquez-r7
e1debd68ad
Merge to update
2014-08-12 16:21:39 -05:00
jvazquez-r7
183b27ee27
There is only one target
2014-08-12 16:14:41 -05:00
jvazquez-r7
c8e4048c19
Some style fixes
2014-08-12 16:11:31 -05:00
jvazquez-r7
ea3d2f727b
Dont fail_with while checking
2014-08-12 16:09:59 -05:00
Emilio Pinna
3440f82b2e
Minor description adjustment
2014-08-12 22:18:59 +02:00
Emilio Pinna
9e38ffb797
Add the check for the manual payload setting
2014-08-12 21:55:42 +02:00
sinn3r
b84192c654
Land #3642 - Be sure which the full payload is used
2014-08-12 14:52:26 -05:00
jvazquez-r7
93990f4578
Land #3631 , @wchen-r7's fixes to avoid datastore options assignment at runtime
2014-08-12 14:46:02 -05:00
jvazquez-r7
b46b6af50d
Land #3630 , @wchen-r7's fix for datastore assignments on smb_enumusers
2014-08-12 14:26:55 -05:00
David Maloney
84374fe92c
Merge branch 'staging/electro-release' into bug/MSP-11050/rails_root
2014-08-12 13:54:38 -05:00
David Maloney
12f1234296
always set our rails root to our root
...
this works fine when calling any framework binaries
from their path as CWD. if you call tehm from another path
you will get an incorrect root which can cause certain things to load
incorrectly
Signed-off-by: David Maloney <DMaloney@rapid7.com >
2014-08-12 13:53:28 -05:00
jvazquez-r7
33da1a6871
Give a chance to the mixin
2014-08-12 13:49:39 -05:00
Emilio Pinna
5b6be55c50
Fix (properly) 'execute_command()' missing 'opts' parameter
2014-08-12 19:49:27 +02:00
Tod Beardsley
bbcd63cd10
Update Gemfile.lock as well for PR #3639
2014-08-12 12:28:39 -05:00
Emilio Pinna
3af17ffad0
Fixed 'execute_command()' missing 'opts' parameter
2014-08-12 19:24:24 +02:00
Samuel Huckins
fc65a45d94
Merge branch 'electro-remove-rubocop' into staging/electro-release
2014-08-12 12:03:16 -05:00
jvazquez-r7
042423088c
Make sure which the full payload is used
2014-08-12 11:41:29 -05:00
David Maloney
fcfce9efec
Merge branch 'staging/electro-release' into feature/MSP-10992/scanner-dry
2014-08-12 11:22:51 -05:00
Brandon Turner
c937c4b8b3
Merge pull request #3641 from limhoff-r7/bug/MSP-11046/resource
...
MSP-11046 #land
2014-08-12 11:10:39 -05:00
Tod Beardsley
6b262cb3b4
Remove rubocop and msftidy touchpoints
...
This replicates PR rapid7#3639 for the staging/electro-release branch
Rubocop replaces the default YAML library which makes development
testing difficult. It does not cause problems on Travis, but according
to reports, it does cause instability with many individual dev
environments.
While I would love to have a more solid source of this bug report, right
now this was an oral report from @shuckins-r7 (who I tend to believe a
lot).
(Conflict resolved on rubocop.yml)
2014-08-12 10:51:09 -05:00
Luke Imhoff
e051272a20
Fix typo
...
MSP-11046
`ActiveSupport::OrderedOptions` automatically create an attribute for
any missing keys, so when `options.console.resource` was used it would
return `nil` instead of the erroring. The correct option name was
`options.console.resources` (note the pluralization).
2014-08-12 10:49:35 -05:00
Luke Imhoff
225c6da616
Remove rubocop because it causes backtrace
...
MSP-11046
See https://gist.github.com/limhoff-r7/7c398b5f4c44ed40cf1f
2014-08-12 10:47:26 -05:00
Tod Beardsley
47cb906408
Remove rubocop and msftidy touchpoints
...
Rubocop replaces the default YAML library which makes development
testing difficult. It does not cause problems on Travis, but according
to reports, it does cause instability with many individual dev
environments.
While I would love to have a more solid source of this bug report, right
now this was an oral report from @shuckins-r7 (who I tend to believe a
lot).
2014-08-12 10:37:58 -05:00
Luke Imhoff
427cc5f7ed
Merge remote-tracking branch 'upstream/staging/electro-release' into staging/electro-release
2014-08-12 10:04:58 -05:00
cx
c937e80521
Added Fixes#2 mentioned by Firefart
...
Details:
* MSF's HTTP::Wordpress class included and wordpress related
variables are used.
2014-08-12 15:16:43 +03:00
Emilio Pinna
f71589f534
Simplify payload upload using 'CmdStager' mixin
2014-08-12 10:49:17 +02:00
sinn3r
4aeb1eda9c
Don't use datastore options as default values
2014-08-11 18:55:32 -05:00
kaospunk
4e6a04d3ad
Modifications for login and key addition
...
This commit adds additional support for logging in
on multiple versions of Gitlab as well as adding a
key to exploit the vulnerability.
2014-08-11 19:54:10 -04:00
Emilio Pinna
cc5770558d
Remove local payload saving used for debugging
2014-08-11 19:16:14 +02:00
Emilio Pinna
4790b18424
Use FileDropper mixin to delete uploaded file
2014-08-11 19:02:09 +02:00
Emilio Pinna
ac526ca9bd
Fix print_* to vprint_* in check method
2014-08-11 18:58:11 +02:00
Emilio Pinna
4b4b24b79d
Fix errors printing
2014-08-11 18:54:43 +02:00
Emilio Pinna
c97cd75beb
Rephrase 'Author' section
2014-08-11 18:52:21 +02:00
Emilio Pinna
0138f3648d
Add VMTurbo Operations Manager 'vmtadmin.cgi' Remote Command Execution module.
2014-08-11 16:57:39 +02:00
cx
c90434c926
Added Fixes mentioned by Firefart
...
Details:
* string interpolation removed
* Minor styling issues are fixed
* peer var used
* target_uri added instead of datastore
2014-08-11 14:37:39 +03:00
kaospunk
a995bcf2ef
Fix URI building and failure cases
...
This update uses the normalize_uri method for building
URIs. Additionally, failure cases have been modified
for a less generic version.
2014-08-10 19:53:33 -04:00
Meatballs
351b687759
Land #3612 , Windows Local Kernel exploits refactor
2014-08-10 22:05:06 +01:00
Meatballs
b277f588fb
Use railgun helper functions
2014-08-10 21:52:12 +01:00
Jon Hart
8e626c1b60
Add rspec coverage for Msf::Auxiliary::DRDoS
2014-08-09 21:12:10 -07:00
joev
af3ca19ab2
Land #3501 , @AnwarMohamed's android meterpreter commands.
2014-08-09 16:29:59 -05:00
Anwar Mohamed
92432503ce
Merge pull request #5 from jvennix-r7/android_ext3
...
Final-round of code tweaks. All commands working well.
2014-08-09 23:45:45 +03:00
Tod Beardsley
ef2663a050
Land #3637 , on stage, from unknown
2014-08-09 14:16:06 -05:00
Tod Beardsley
08bb815bd8
Add Yokogawa unauth admin module
2014-08-09 13:30:10 -05:00
joev
dbaa377aa1
Final-round of code tweaks. All commands working well.
2014-08-09 13:04:52 -05:00
jvazquez-r7
486b5523ee
Refactor set_version
2014-08-09 02:17:07 -05:00
jvazquez-r7
d959affd6e
Delete debug message
2014-08-09 01:58:42 -05:00
jvazquez-r7
da04b43861
Add module for CVE-2014-0983
2014-08-09 01:56:38 -05:00
Jon Hart
d6198c786d
Move rdoc for Msf::Auxiliary::DRDoS
2014-08-08 23:23:48 -07:00
Jon Hart
a5e9abc227
Update R7-2014-12 NTP modules to use new DRDoS mixin
2014-08-08 23:15:54 -07:00
Jon Hart
ddcaa11216
Add new mixin for helping to detect DRDoS vulns
2014-08-08 23:15:09 -07:00
Jon Hart
c48cf48d85
Return the NTP message, not the string
2014-08-08 21:39:48 -07:00
Jon Hart
00452b41c9
Gut admin functions from R7-2014-12 NTP modules
...
None of these are admin modules. All of that stuff should eventually go
in auxiliary/admin
2014-08-08 21:22:11 -07:00
Jon Hart
ed3ccdc9e0
Initial commit of modules for NTP vulns described in R7-2014-12
...
Not entirely functional or polished, but mostly working
2014-08-08 21:00:43 -07:00
Jon Hart
3307726c21
Land #3627 , @wchen-r7's cleanup of ctypes in smb_enumshares
2014-08-08 19:17:15 -07:00
Jon Hart
73253b575a
Land #3626 , @wchen-r7's storing of text loot as txt
2014-08-08 18:57:38 -07:00
Jon Hart
b3bb20f569
Land #3629 , @wchen-r7's HTTP traversal fixes
2014-08-08 18:08:32 -07:00
Jon Hart
c35dc4d3ac
Extract query params separately
...
Prevents stomping on data
2014-08-08 18:07:25 -07:00
sinn3r
93174a818b
Land #3628 - Add --ask option in msfconsole
2014-08-08 11:03:15 -05:00
sinn3r
969e5ddd39
Override the correct smb_direct
2014-08-07 18:48:46 -05:00
sinn3r
3b27102c4c
Override the correct smb_direct
2014-08-07 18:47:33 -05:00
sinn3r
436e2abfff
Fix datastore options
2014-08-07 17:59:40 -05:00
sinn3r
1963318e70
Fix datastore options
2014-08-07 17:58:25 -05:00
sinn3r
ab8f2c7d3f
Datastore option fix
2014-08-07 17:57:44 -05:00
sinn3r
6f8c7f092a
Fix direct datastore assignments to pass msftidy
2014-08-07 17:51:45 -05:00
sinn3r
2967d85e44
Land #3624 - Wordpress XMLRPC DoS
2014-08-07 17:25:22 -05:00
Iquaba
b33d2b8583
Adds a newline for readability
2014-08-07 13:49:13 -05:00
Iquaba
6cea921478
Adds --ask option to prompt before exiting msfconsole
2014-08-07 13:44:46 -05:00
sinn3r
c79fe731c5
Um, this is the right way to do it.
2014-08-07 13:32:48 -05:00
sinn3r
f7bda738cf
Fix file handle leak
2014-08-07 13:30:34 -05:00
sinn3r
711630d059
Fix datastore assignments
2014-08-07 13:28:51 -05:00
sinn3r
c7090f57a5
Fix "text" ctype in smb_enumshares
...
"text" is not a valid ctype, should be text/plain
2014-08-07 11:25:55 -05:00
Christian Mehlmauer
a7be5b5164
Added fingerprinting
2014-08-07 18:12:58 +02:00
sinn3r
e432f3f442
Support all text-based ctypes
2014-08-07 11:10:32 -05:00
sinn3r
f3d90ada14
Land #3625 - Update adobe_pdf_embedded_exe target description
2014-08-07 11:01:30 -05:00
jvazquez-r7
b259e5b464
Update description again
2014-08-07 09:21:25 -05:00
jvazquez-r7
4af0eca330
Update target description
2014-08-07 09:11:01 -05:00
Christian Mehlmauer
d6e60453d6
Added Wordpress XMLRPC DoS
2014-08-07 11:38:44 +02:00
Luke Imhoff
1d430dbb45
Run migrations when connection already established in console
...
MSP-10955
`Msf::Ui::Console::Driver#initialize` doesn't call
`framework.db.connect` if it can't find the the `database.yml`, but when
using `msfpro`, the connection is already established, so the console
doesn't need to know where the database file is and should just run the
migrations so that `framework.db.migrate` can be set and
`framework.db.active` will return `true`.
2014-08-06 19:55:51 -05:00
Luke Imhoff
5af4959558
Merge remote-tracking branch 'upstream/staging/electro-release' into staging/electro-release
2014-08-06 19:54:46 -05:00
Brandon Turner
91bb0b6e10
Merge tag '2014072301' into staging/electro-release
...
Conflicts:
Gemfile.lock
modules/post/windows/gather/credentials/gpp.rb
This removes the active flag in the gpp.rb module. According to Lance,
the active flag is no longer used.
2014-08-06 15:58:12 -05:00
Luke Imhoff
b910dfbf56
Merge remote-tracking branch 'upstream/staging/electro-release' into staging/electro-release
2014-08-06 12:40:07 -05:00
Meatballs
1c6b74467f
Land #3618 , @byt3bl33d3r's powershell require fix
2014-08-06 18:24:16 +01:00
Spencer McIntyre
2ed02c30a8
Use better variable names instad of an array
2014-08-05 21:34:36 -07:00
Spencer McIntyre
b602e47454
Implement improvements based on feedback
2014-08-05 21:24:37 -07:00
kaospunk
48359faaaf
Add gitlab-shell command injection module
...
This request adds a module for gitlab-shell command
injection for versions prior to 1.7.4. This has been
tested by installing version 7.1.1 on Ubuntu and then
using information at http://intelligentexploit.com/view-details.html?id=17746
to modify the version of gitlab-shell to a vulnerable one. This
was done as I could not find a better method for downloading
and deploying an older, vulnerable version of Gitlab.
2014-08-05 23:21:57 -04:00
sinn3r
9b6259e58b
Land #3569 - Updated smb_enumshares to support spidering
2014-08-05 20:23:09 -05:00
sinn3r
f520616730
This fixes a few things, see commit message for more info
...
This commit fixes the following:
1. Not handling eval_host()'s nil file return value, which can causes
a NoMethodError at runtime due to various conditions.
2. Renames datastore option VERBOSE to ShowFiles to pass msftidy
3. Avoids overwriting datastore options directly to pass msftidy
2014-08-05 19:20:11 -05:00
Samuel Huckins
34a42476b2
Merge branch 'master' of github.com:rapid7/metasploit-framework
2014-08-05 16:30:32 -05:00
Samuel Huckins
69e8edf6b2
Bumping ruby patch to proper latest
2014-08-05 11:49:35 -05:00
Luke Imhoff
7013a2755b
Favor MSF_DATABASE_CONFIG for paths['config/database']
...
MSP-10848
Use these locations, in order for
Metasploit::Framework::Application.config.paths['config/database']:
1. MSF_DATABASE_CONFIG environment variable
2. ~/.msf4/database.yml (if it exists)
3. config/database.yml
2014-08-05 10:16:33 -05:00
Luke Imhoff
2818b4e2f2
Merge remote-tracking branch 'upstream/staging/electro-release' into staging/electro-release
2014-08-05 09:11:44 -05:00
Trevor Rosen
b769b419ae
Merge pull request #3615 from limhoff-r7/bug/MSP-10848/nightly-msfconsole
...
require 'action_view/railtie' for pro compatibility
2014-08-05 07:56:37 -05:00
byt3bl33d3r
77bba6e4ee
fixed msfcli with missing require
2014-08-05 09:38:33 +02:00
Luke Imhoff
d56dd318b9
require 'action_view/railtie' for pro compatibility
...
MSP-10848
Other railties, like jquery-rails, need 'action_view/railtie', but don't
require it themselves, so require it explictly in
`config/application.rb` to prevent msfconsole boot errors.
2014-08-04 20:12:28 -05:00
Luke Imhoff
ec5c1c588a
Merge pull request #3614 from limhoff-r7/bug/MSP-10848/nightly-msfconsole
...
# MSP-10848
Add missing require
2014-08-04 19:11:17 -05:00
Luke Imhoff
9c29b78b9a
Add missing require
...
MSP-10848
Not triggered on OSX development machines, only on Linux.
2014-08-04 18:23:25 -05:00
Luke Imhoff
6bc7643475
Merge remote-tracking branch 'upstream/staging/electro-release' into staging/electro-release
2014-08-04 18:06:54 -05:00
Alton Johnson
da845c7e89
Changed default VERBOSE option to false.
2014-08-04 18:06:35 -05:00
Jon Hart
f25bb735a0
Land #3543 , @todb-r7's Rubocop cleanup of MS08-067
2014-08-04 14:35:30 -07:00
sinn3r
1691795901
Land #3598 to electro-release - Refactor sso to use Credential::Creation
2014-08-04 16:31:49 -05:00
Jon Hart
b81c7e28f4
Land #3588 , @tobd-r7's Fix SpaceBeforeModifierKeyword Rubocop warning
2014-08-04 14:25:03 -07:00
sinn3r
7044dabea1
Land #3600 - GPP Junk Padding Fix
2014-08-04 16:21:57 -05:00
dmaloney-r7
594b0e1abb
Merge pull request #3611 from shuckins-r7/bug/MSP-11021/import-reports-attr-fix
...
Date attrs set after creation in report import
2014-08-04 14:39:56 -05:00
Spencer McIntyre
9cd6353246
Update mqac_write to use the mixin and restore pointers
2014-08-04 12:15:39 -07:00
Samuel Huckins
8fe9ec098e
Date attrs set after creation in report import
...
MSP-11021
* created_at and updated_at are protected against mass-assignment, so
these need to be set after for reports and report artifacts
2014-08-04 14:02:59 -05:00
Spencer McIntyre
a523898909
Apply rubocop suggestions for ms_ndproxy
2014-08-04 11:49:01 -07:00
Spencer McIntyre
86e2377218
Switch ms_ndproxy to use the new WindowsKernel mixin
2014-08-04 11:49:01 -07:00
Spencer McIntyre
58d29167e8
Refactor MS11-080 to use the mixin and for style
2014-08-04 11:49:01 -07:00
Spencer McIntyre
6543b08eb4
Support writing a copy of the original token
2014-08-04 11:49:00 -07:00
Spencer McIntyre
4b73ad6f40
Fix guessing the arch with modules specifying an array
2014-08-04 11:49:00 -07:00
Spencer McIntyre
893b9a6e99
Add an open_device function for wrapping CreateFileA
2014-08-04 11:49:00 -07:00
Spencer McIntyre
43a5120696
Cleanup the WindowsKernel mixin
2014-08-04 11:49:00 -07:00
Spencer McIntyre
49837a3ba6
Create a basic WindowsKernel exploit mixin
2014-08-04 11:49:00 -07:00
William Vu
f274eb78ac
Land #3610 , release fixes
2014-08-04 12:40:41 -05:00
Tod Beardsley
4de59ad7d1
Add reasonable description for gnome-commander
2014-08-04 12:35:34 -05:00
jvazquez-r7
ed97751ead
Land #2999 , @j0hnf's modifiction to check_dir_file to handle file:
2014-08-04 11:55:18 -05:00
jvazquez-r7
cd45ed0e0a
Handle exceptions when connecting the SMBHSARE
2014-08-04 11:54:30 -05:00
jvazquez-r7
85b5c5a691
Refactor check_path
2014-08-04 11:48:13 -05:00
jvazquez-r7
1e29bef51b
Fix msftidy warnings
2014-08-04 11:46:27 -05:00
jvazquez-r7
04bf0b4ab6
Fix forgotten comma
2014-08-04 11:34:12 -05:00
jvazquez-r7
68d8afc18d
Land #3604 , @hmoore-r7's [FixRM #8838 ] smb_lookupsid nil class dereference
2014-08-04 10:38:42 -05:00
Miroslav Stampar
c280c2528b
Fix gettelnet usability
2014-08-04 12:02:07 +02:00
Joshua Smith
159ce3fbbe
Land 3587, add rubocop autoconfig
2014-08-04 01:18:34 -05:00
Joshua Smith
3e3caeb6ee
Land 3591, fix post/test/* modules' loadpath
...
some additional module cleanup here:
SHA: 6884c87cfa
2014-08-04 01:07:35 -05:00
Joshua Smith
6884c87cfa
removes IDs/Revisions, resplats test/modules
2014-08-04 01:04:23 -05:00
Joshua Smith
f2e4d41697
Land 3607, sqlmap plugin cleanup
...
after some additional cleanup here:
SHA: a4f2fb218c
2014-08-04 00:12:53 -05:00
Joshua Smith
a4f2fb218c
adds most rubocop cleanups, not all
2014-08-04 00:11:25 -05:00
Joshua Smith
c08b1cb829
uses mult-assign & include? more readable
2014-08-03 23:59:03 -05:00
Joshua Smith
453d19713d
Land 3605, hides flash during cmd_psh_payload
2014-08-03 23:45:44 -05:00
Joshua Smith
282633fd9d
Land 3606, makefile typo fix for CVE-2013-2465
2014-08-03 23:28:20 -05:00
Joshua Smith
6c2b8f54cf
rubocop cleanup, long lines, etc
2014-08-03 23:19:08 -05:00
OJ
2b021e647d
Minor tidies to conform to standards
2014-08-03 23:19:08 -05:00
OJ
31c51eeb63
Move error messages to check
2014-08-03 23:19:08 -05:00
OJ
cbf15660bf
Add some small fixes to the MQAC local exploit
...
* Check for `INVALID_HANDLE_VALUE` when attempting to open the
device, as this is what is returned when the device doesn't exist.
* Make sure that we only run the exploit against tartgets that we
support directly to make sure we don't BSOD machines (such as what
happens with SP1/SP2).
* Add a call to `check` in the exploit code.
2014-08-03 23:19:08 -05:00
Victor
3fd15d001d
Update sqlmap.rb
2014-08-04 04:25:33 +04:00
Victor
2805af2a04
\t error msgs bug and some codestyle tweaks
...
Minor bugs: `\t` were used inside single quoted strings.
Tweak: `a, b = c` is the same as `a = c[0]; b = [1] if c.length > 1`.
Minor tweak: `qwe if rty` form instead of multiline when `qwe` is only one line long.
Minor tweak: thanks to `#{}` interpolation we can omit `.to_s`.
2014-08-04 04:11:49 +04:00
HD Moore
8cca4d7795
Fix the makefile to use the right directory
...
Reported by severos on IRC, the current output
class is in the right place, but the makefile
was broken.
2014-08-03 13:38:15 -05:00
Samuel Huckins
dd550013ce
Merge branch 'bug/MSP-10963/realm-uniqueness' into staging/electro-release
2014-08-02 17:48:40 -05:00
Samuel Huckins
49a91ac5bb
Updating metasploit-credential dep to v0.8.6
2014-08-02 17:43:08 -05:00
b00stfr3ak
88f23832e6
Added Time out
...
For some reason the handler was closing before the command could
complete. Added the time out from bypassuac and now both psh and exe
work perfectly.
2014-08-02 14:29:42 -07:00
Tom Sellers
693e744da4
Hide icon flash on taskbar during cmd_psh_payload
...
When 'cmd_psh_payload' is run via 'cmd_exec' on a windows shell that is running in the context of an interactive user an icon will flash very quickly on the user's task bar. This can be avoided (verified) by adding the /b switch to the start section of the command launcher text. I have verified that this switch exists from Windows 2000 through Windows 2012 R2.
2014-08-02 15:52:52 -05:00
Tom Sellers
6315710697
Update for most recent PowerShell.rb
...
This update makes the module compatible with Meatballs' march PowerShell changes mentioned earlier (lines 112/113). It also includes changes recommended by Timwr and about 2/3 of the issues mentioned by Rubocop. I didn't make some of the Rubocop changes based on HD's comments in IRC that it was still being tuned to meet the project's requirements.
2014-08-02 15:32:45 -05:00
Tom Sellers
11515fc75c
Update core.rb
2014-08-02 15:27:10 -05:00
HD Moore
3bc8d1fee9
See #RM8838. Handle null domain_sid properly
...
This switches to the local sid if the domain sid is null, even if
the ACTION is set to DOMAIN. This solves the issue identified in
```
[*] 192.168.0.4 PIPE(LSARPC) LOCAL(NAS - 5-21-2272853860-1115691317-1341221697) DOMAIN(WORKGROUP - )
[-] 192.168.0.4 No domain SID identified, falling back to the local SID...
[*] 192.168.0.4 USER=guest RID=501
[*] 192.168.0.4 GROUP=None RID=513
```
2014-08-02 14:25:17 -05:00
Samuel Huckins
95e6599d5b
Merge branch 'staging/electro-release' of github.com:rapid7/metasploit-framework into staging/electro-release
2014-08-02 13:55:26 -05:00
us3r777
cd2e225359
Refactored auxilliary jboss_bshdeployer
...
Switch modules/auxiliary/admin/http/jboss_bshdeployer.rb to use the
changes.
2014-08-02 11:10:49 +02:00
Luke Imhoff
3bd4279038
Update metasploit-credential
...
MSP-10963
2014-08-02 01:01:53 -05:00
Luke Imhoff
d696b5f4e5
Merge pull request #3602 from limhoff-r7/bug/MSP-10998/float-versions
...
MSP-10998
Remove Msf::Framework::VersionAPI and Msf::Framework::VersionCore
2014-08-02 00:57:11 -05:00
Luke Imhoff
c69c06af89
Update metasploit-credential
...
MSP-10963
2014-08-01 22:05:45 -05:00
Luke Imhoff
3057af773a
Merge branch 'bug/MSP-10998/float-versions' into bug/MSP-10963/realm-uniqueness
...
MSP-10963
2014-08-01 22:04:34 -05:00
Luke Imhoff
a37244c14e
Fix specs
...
MSP-10998
2014-08-01 21:55:10 -05:00
Luke Imhoff
6603443df4
Add missing require
...
MSP-10998
2014-08-01 21:54:41 -05:00
Luke Imhoff
9096a8a1f5
Remove Msf::Framework::VersionAPI
...
MSP-10998
It's compacting of the version parts into a single float doesn't work
with APIMinor over 10, so replace with Gem::Version, which compares
parts correctly.
2014-08-01 21:43:14 -05:00
Luke Imhoff
22db5aad8a
Remove Msf::Framework::VersionCore
...
MSP-10998
It can't handle 4.10.0 because it tries to compact the multiple part
version into one float using (1 / 10.0).
2014-08-01 21:31:48 -05:00
Samuel Huckins
c45728509c
Merge branch 'staging/electro-release' of github.com:rapid7/metasploit-framework into staging/electro-release
2014-08-01 20:44:36 -05:00
Luke Imhoff
75dfcb2791
Merge remote-tracking branch 'upstream/staging/electro-release' into staging/electro-release
2014-08-01 20:04:23 -05:00
b00stfr3ak
add5cefe17
Change runas method to use lib
...
Changed runas method to use the new runas lib. Also did some rubocop
changes.
2014-08-01 17:13:24 -07:00
b00stfr3ak
df98098b0c
New shell_execute_option command
...
Also removed upload option
2014-08-01 17:12:04 -07:00
b00stfr3ak
5aa347ef65
Changed Method Names
...
Changed names to look like shell_execute_(option), to make it more
defined on what it does.
2014-08-01 17:10:32 -07:00
us3r777
a800e7f1ea
Merge pull request #1 from jvazquez-r7/work_3540
...
Work on jboss refactoring
2014-08-02 01:02:53 +02:00
b00stfr3ak
5c2b074264
Matched bypassuac to upstream
2014-08-01 14:40:23 -07:00
b00stfr3ak
def652a50e
Merge https://github.com/rapid7/metasploit-framework into bypassuac/psh_option
2014-08-01 14:32:55 -07:00
Tod Beardsley
c31fc61617
Land #3270 , @jlee-r7 deprecation ipv6 payloads
...
These are not needed, since you can just config the regular handler now
and pick either.
This resolves the conflict (rm'ed the old modules)
Conflicts:
modules/payloads/stagers/windows/reverse_ipv6_http.rb
modules/payloads/stagers/windows/reverse_ipv6_https.rb
2014-08-01 16:27:59 -05:00
darkbushido
ceaffce727
Merge branch 'pr/3593' into staging/electro-release
2014-08-01 16:01:10 -05:00
David Maloney
ab7111120b
and all the rest
...
finally!
2014-08-01 14:54:18 -05:00
David Maloney
4821851ae4
telnet and ssh next
2014-08-01 14:47:08 -05:00
David Maloney
12902b0a6d
the refactor continues!
2014-08-01 14:41:03 -05:00
David Maloney
b74813b9a1
mysql and pop3 now
2014-08-01 14:30:33 -05:00
jvazquez-r7
73ca8c0f6d
Work on jboss refactoring
2014-08-01 14:28:26 -05:00
David Maloney
2e7738c788
http and mssql now
2014-08-01 14:22:58 -05:00
Samuel Huckins
31b7ffe32d
Merge branch 'staging/electro-release' of github.com:rapid7/metasploit-framework into staging/electro-release
2014-08-01 13:14:11 -05:00
dmaloney-r7
e6a0e079b6
Merge pull request #3596 from darkbushido/bug/MSP-10937/adding-parent-to-cores-to-credential
...
.to_credential now assigns a parent
2014-08-01 13:13:48 -05:00
David Maloney
33f73a8af7
refactor db2
2014-08-01 13:00:27 -05:00
David Maloney
439b893fea
refactor axislogin
2014-08-01 12:30:16 -05:00
David Maloney
0fffb179fa
refactor afp_login
2014-08-01 12:10:52 -05:00
David Maloney
c3691ba056
finish refactoring ftp_login
2014-08-01 12:06:13 -05:00
David Maloney
db345fcb58
make credential_collection always set private_type
2014-08-01 11:57:35 -05:00
David Maloney
a380646667
start refactoring ftp loginscanner
2014-08-01 11:47:13 -05:00
David Maloney
320f032dfe
add to_h to result
2014-08-01 11:46:43 -05:00
David Maloney
dbde046f44
use to_h instead of to_hash
...
apparently ruby 2 adds this as a standard method so
we should stay compliant
2014-08-01 09:45:51 -05:00
David Maloney
0e65792f43
Merge branch 'staging/electro-release' into feature/loginscanner-report-dry
2014-08-01 09:41:30 -05:00
Brandon Turner
915e09ac50
Update framework version spec and Gemfile
2014-08-01 09:26:38 -05:00
Meatballs
b4111df381
Retab spec
2014-08-01 14:41:20 +01:00
Meatballs
4ef3de84f3
get some more test cases
2014-08-01 14:34:17 +01:00
Meatballs
1fb4216d6d
Update spec
2014-08-01 12:08:03 +01:00
Brandon Turner
0ad2a7c89b
Bump version to 4.10.0
2014-07-31 23:43:46 -05:00
David Maloney
374c6532fa
add to_hash to Credential
...
begining of the chain to DRYing up
credential reporting in the loginscanner
2014-07-31 18:10:48 -05:00
Meatballs
f737108bf7
Land #2551 , Runas post library and powershell ask technique
2014-07-31 23:17:31 +01:00
Meatballs
902cf4bc1e
Fix var name
2014-07-31 23:16:53 +01:00
Meatballs
90c0f587bf
Fix for newer powershell
2014-07-31 23:11:51 +01:00
Meatballs
15c1ab64cd
Quick rubocop
2014-07-31 23:11:00 +01:00
Meatballs
d336c56b99
Merge remote-tracking branch 'upstream/master' into land_2551
2014-07-31 23:06:37 +01:00
Meatballs
e05904c3f3
Land #3597 , script/web_delivery powershell fixes
2014-07-31 23:00:31 +01:00
Meatballs
bff8a734ae
Fix and be Architecture Agnostic
2014-07-31 22:58:43 +01:00
James Lee
62240537db
Refactor sso to use Credential::Creation
2014-07-31 16:06:23 -05:00
Spencer McIntyre
5a25120660
Apply rubocop changes to multi/script/web_delivery
2014-07-31 16:16:23 -04:00
Spencer McIntyre
8af4c496c9
Add a missing include and require statement for psh
2014-07-31 16:08:25 -04:00
darkbushido
ad6eed01a2
.to_credential now assigns a parent
...
Metasploit::Credential::Core#to_credential will set the parent to the original core objext
Metasploit::Framework::Credential#to_credential also sets the parent to itself.
2014-07-31 14:52:27 -05:00
Luke Imhoff
7cc5af589f
Only require config/application.rb when Rails.application not set
...
MSP-10964
Allows other Rails::Applications to use the commands.
2014-07-31 13:32:22 -05:00
Luke Imhoff
f9ab7f7a88
Only error out if Rails.env differs from options.environment
...
MSP-10964
2014-07-31 13:28:21 -05:00
Luke Imhoff
aa2e26f8f2
Allow RAILS_ENV to override default environment of 'production'
...
MSP-10964
2014-07-31 13:24:23 -05:00
Samuel Huckins
735687e6a1
Merge branch 'staging/electro-release' of github.com:rapid7/metasploit-framework into staging/electro-release
2014-07-31 12:31:27 -05:00
Luke Imhoff
38c6e2d3e0
Merge remote-tracking branch 'upstream/staging/electro-release' into staging/electro-release
2014-07-31 10:16:00 -05:00
William Vu
0546282441
Land #3590 , #3574 reversion
2014-07-31 09:59:04 -05:00
James Lee
6a72572237
Wrap comments at 80
2014-07-31 09:41:08 -05:00
James Lee
735ccda4db
Add an example for add-ssh-key
2014-07-31 09:40:36 -05:00
Luke Imhoff
73ed9f89f0
Merge remote-tracking branch 'upstream/staging/electro-release' into staging/electro-release
2014-07-31 08:31:37 -05:00
b00stfr3ak
391e2bb99b
Fixed some style changes
...
Removed upload var, it really served no purpose.
2014-07-30 22:42:07 -07:00
Meatballs
53b66f3b4a
Land #2075 , Powershell Improvements
2014-07-31 00:49:39 +01:00
James Lee
77d99b7374
Land #3586 , fix msfconsole when running without db
...
Conflicts:
Gemfile.lock
metasploit-framework.gemspec
2014-07-30 17:24:21 -05:00
James Lee
1c35ec4271
Land #3585 , fix fd leak in pwdump import
...
Conflicts:
db/schema.rb
2014-07-30 15:17:27 -05:00
James Lee
23b04c8ece
Fix post/test/* modules' loadpath
...
Allows loading when pwd is not framework's install root
2014-07-30 14:21:42 -05:00
Tod Beardsley
3320a1ef77
Revert PR #3574
...
This reverts commit 96945442ff .
With this PR, the following now appears in framework.log:
````
[07/30/2014 14:01:37] [e(0)] core: Error updating module details for
auxiliary/fuzzers/http/http_form_field: NoMethodError undefined method
`name' for []:Array
````
2014-07-30 14:06:46 -05:00
Samuel Huckins
1e7ef15923
Merge branch 'staging/electro-release' of github.com:rapid7/metasploit-framework into staging/electro-release
2014-07-30 13:13:08 -05:00
Matt Buck
f7aa324c35
Update metasploit-model and metasploit_data_models deps
2014-07-30 13:10:09 -05:00
Trevor Rosen
3e915e5059
Merge branch 'staging/electro-release' into bug/MSP-10715/import-security-issues
...
Update deps
Conflicts:
Gemfile
Gemfile.lock
2014-07-30 12:49:15 -05:00
Samuel Huckins
8a3df99b01
Merge branch 'staging/electro-release' of github.com:rapid7/metasploit-framework into staging/electro-release
2014-07-30 12:36:03 -05:00
Luke Imhoff
14341c68a3
Merge remote-tracking branch 'upstream/staging/electro-release' into staging/electro-release
2014-07-30 12:24:10 -05:00
Trevor Rosen
ea72a7e5c3
Merge pull request #3583 from jlee-r7/feature/MSP-9932/creds-add-subcommands
...
Add `creds` subcommands
MSP-9932 #land
2014-07-30 12:01:36 -05:00
James Lee
85b00eede6
Add #present? checks
2014-07-30 11:52:59 -05:00
James Lee
ef59d88f64
Fix spec failure due to workspace mismatch
...
Also fixes intermittent failure from FactoryGirl picking a heinous
Origin type.
2014-07-30 11:26:35 -05:00
Luke Imhoff
e4f665fe72
Require 'active_record/railtie' for specs
...
MSP-10905
2014-07-30 11:10:02 -05:00
jvazquez-r7
4ed085d0d2
Land #3581 , @FireFart's update for W3 Total Cache Hash extract module
2014-07-30 10:45:11 -05:00
jvazquez-r7
674c3ca260
Use [] for references
2014-07-30 10:44:42 -05:00
Tod Beardsley
7bf9d25221
Also remove the offenses from the todo
2014-07-30 10:30:58 -05:00
jvazquez-r7
a79eec84ac
Land #3584 , @FireFart's update for wp_asset_manager_upload_exec
2014-07-30 10:28:51 -05:00
Tod Beardsley
49e48566da
Ignore PercentLiteralDelimiters and WordArray
...
Per a discussion in IRC, these rules in particular don't
appear to be valuable for Metasploit at this stage.
2014-07-30 10:28:12 -05:00
jvazquez-r7
9de8297848
Use [] for References
2014-07-30 10:28:00 -05:00
jvazquez-r7
313fd6ffab
Land #3582 , @FireFart's rubocop cleanup for wp_property_upload_exec
2014-07-30 10:24:58 -05:00
jvazquez-r7
58fbb0b421
Use [] for References
2014-07-30 10:24:14 -05:00
Luke Imhoff
d7a0c1f3e8
Optionally require 'active_record/railtie` in Rakefile
...
MSP-10905
Require in Rakefile so that db tasks are defined. Make it optionally so
that `rake` doesn't error out when metasploit-framework installed with
`bundle install --without db`.
2014-07-30 10:10:20 -05:00
Luke Imhoff
ceb8a0f5c2
Extract option require pattern to helper Module
...
MSP-10905
`Metasplot::Framework::Require.optionally` can be used to optionally
require a library and then issue a warning if the require fails or run a
block when it succeeds.
2014-07-30 10:07:53 -05:00
Trevor Rosen
d863ff907e
Merge pull request #3576 from dmaloney-r7/feature/MSP-9641/cred-rpc-calls
...
Feature/msp 9641/cred roc calls
MSP-9641 #land
2014-07-30 09:40:38 -05:00
Anwar Mohamed
8766faa14e
Merge pull request #4 from jvennix-r7/anwar-android-bins
...
Rebuilt Android bins, remove store_loot calls
2014-07-30 13:07:53 +02:00
Joe Vennix
ed6594ddb8
Change filename to calllog_dump.
2014-07-30 00:16:23 -07:00
Joe Vennix
ece3b5583a
Revert to file-based solution.
2014-07-30 00:13:44 -07:00
Joe Vennix
c52b72830a
Merge branch 'android_ext2' of github.com:AnwarMohamed/metasploit-framework into anwar-android-bins
2014-07-29 23:58:42 -07:00
Samuel Huckins
be18dddac7
Merge branch 'staging/electro-release' of github.com:shuckins-r7/metasploit-framework into staging/electro-release
2014-07-29 20:50:05 -05:00
HD Moore
318418a90b
Lands #3589 , adds rhost:rport to vmware fingerprint
2014-07-29 18:50:53 -05:00
jvazquez-r7
1fe459eb42
Add info to know where the info comes from
2014-07-29 18:47:40 -05:00
OJ
f3e8c51573
Merge rubocop changes from Kernelsmith
2014-07-30 08:35:57 +10:00
Tod Beardsley
adf03e28ce
Fix SpaceBeforeModifierKeyword Rubocop warning
...
This also deals with some errant tabs where internal spaces should be,
as well as one syntax error which was preventing an old meterpreter
script from ever working correctly.
Some day, we need to get rid of those Meterpeter scripts. Srsly.
2014-07-29 17:10:54 -05:00
Tod Beardsley
1e47383118
Add .rubocop_todo.yml
2014-07-29 16:54:19 -05:00
Tod Beardsley
4871492ec1
Tidy up .rubocopy.yml
...
This alphabetizes the configuration for rubocop.yml and preps for a
rubocop auto-config so we're not constantly hit with warnings.
2014-07-29 16:48:49 -05:00
Luke Imhoff
1a6d4843c7
Merge branch 'staging/electro-release' into bug/MSP-10905/msfconsole-database
...
MSP-10905
2014-07-29 15:52:11 -05:00
Luke Imhoff
a77ca325ea
Merge remote-tracking branch 'upstream/staging/electro-release' into staging/electro-release
2014-07-29 15:51:48 -05:00
Luke Imhoff
ba4891bca0
Restore Rails.groups arguments
...
MSP-10905
They don't cause a problem.
2014-07-29 15:50:52 -05:00
Trevor Rosen
8fda4ee239
Fix fd leak and blind IO#gets in pwdump import
...
MSP-10715
2014-07-29 15:15:47 -05:00
Luke Imhoff
f5ff22eba4
msfconsole with bundle install --without db
...
MSP-10905
2014-07-29 14:46:44 -05:00
Luke Imhoff
38da44c26b
Fix arity difference between rails and msfconsole options
...
MSP-10905
2014-07-29 14:32:42 -05:00
Luke Imhoff
04541ac724
Parse msfconsole options before initializing Rails
...
MSP-10905
2014-07-29 14:07:14 -05:00
Luke Imhoff
8e7dd1b658
Add missing require
...
MSP-10905
2014-07-29 14:06:27 -05:00
Luke Imhoff
9a5085cbba
Prevent circular dependency
...
MSP-10905
Use Metasploit::Framework::Version directly instead of
Msf::Framework to prevent circular dependency when starting msfconsole.
2014-07-29 14:04:15 -05:00
Luke Imhoff
24a5a155f4
Require gems
...
MSP-10905
2014-07-29 14:02:56 -05:00
Christian Mehlmauer
75057b5df3
Fixed variable
2014-07-29 21:02:15 +02:00
jvennix-r7
0876302fba
Merge pull request #3580 from dmaloney-r7/bug/MSP-10869/credential-parent
...
Credential Parent References
2014-07-29 14:00:59 -05:00
Luke Imhoff
539817fddb
Add metasploit-model as a direct dependency
...
MSP-10905
Metasploit::Model constants need to be accessible without the db group
installed.
2014-07-29 13:55:56 -05:00
Christian Mehlmauer
cc3285fa57
Updated checkcode
2014-07-29 20:53:54 +02:00
Christian Mehlmauer
61ab88b2c5
Updated wp_asset_manager_upload_exec module
2014-07-29 20:53:18 +02:00
Christian Mehlmauer
e438c140ab
Updated wp_property_upload_exec module
2014-07-29 20:34:34 +02:00
Christian Mehlmauer
3d2a62bc29
Updated W3 Total Cache Hash extract module
2014-07-29 19:49:48 +02:00
James Lee
1ee32b3b98
Bump metasploit-model so we can use Realm::Key map
2014-07-29 12:19:03 -05:00
David Maloney
78a3263cfe
have Credentials remember their aprents
...
a Credential object can be created from several
other types of objects. Keep a reference to the originating
'parent' so we can find our way back
2014-07-29 11:20:52 -05:00
AnwarMohamed
c2be3d6875
fixing autoload bug
2014-07-29 17:51:56 +02:00
James Lee
ef7f5fe967
Make metasploit-model a direct dep
...
Needed for all the scanners that use Metasploit::Model::Realm::Key
constants.
2014-07-29 10:30:46 -05:00
AnwarMohamed
b02dbcc2e7
remove extra whitespace
2014-07-29 16:23:27 +02:00
AnwarMohamed
7512e04894
fixing autoload
2014-07-29 16:21:31 +02:00
jvazquez-r7
820ea7e50b
Land #3577 , @FireFart's update for wordpress foxypress module
2014-07-29 09:10:07 -05:00
AnwarMohamed
6bbb2124a7
bug fixing
2014-07-29 15:49:14 +02:00
us3r777
d6c7eb8850
Fixed a typo introduced in commit 9e92448
2014-07-29 09:04:12 +02:00
Joe Vennix
27444e61ef
Merge branch 'android_ext2' of github.com:AnwarMohamed/metasploit-framework into anwar-android-bins
2014-07-28 21:30:04 -07:00
Joshua Smith
e00d892f99
rubocop cleanup, long lines, etc
2014-07-28 22:04:45 -05:00
us3r777
2efeb850ee
Added spec to lib/msf/http/jboss
2014-07-29 02:04:57 +02:00
us3r777
9e9244830a
Added spec for lib/msf/http/jboss
...
Also renamed get_undeploy_bsh and get_undeploy_stager to
gen_undeploy_bsh and gen_undeploy_stager to be consistent
with the other functions
2014-07-29 01:57:04 +02:00
William Vu
0208420a67
Land #3565 , GNOME Commander post module
2014-07-28 17:28:36 -05:00
William Vu
f4bd44d9c6
Fix outstanding issues
2014-07-28 17:28:15 -05:00
David Bloom
a904ed8507
Update gnome_commander_creds.rb
2014-07-28 22:49:13 +02:00
David Bloom
b121bf6d6c
Update gnome_commander_creds.rb
2014-07-28 22:46:50 +02:00
Christian Mehlmauer
621e85a32d
Correct version
2014-07-28 22:45:04 +02:00
Christian Mehlmauer
d334797116
Updated foxpress module
2014-07-28 22:23:22 +02:00
David Maloney
3870b59873
remove rpg_get_auth_info
...
this is an rpc call that calls a method that
does not even exist...
WAT?!
2014-07-28 15:13:03 -05:00
David Maloney
c9d231b48b
remove old rpc methods
...
added rpc methods to create new creds
removing the old methods for
the obsolete cred models
2014-07-28 14:52:53 -05:00
David Maloney
e29b2aed9b
add credential rpc calls
2014-07-28 14:49:35 -05:00
James Lee
49d0fc37c2
Add support for different realm_key
2014-07-28 14:39:24 -05:00
William Vu
ba7d8efb07
Land #3574 , has_actions.rb cleanup
2014-07-28 12:59:33 -05:00
William Vu
d85b081809
Land #3575 , nessus_xmlrpc_ping service state fix
2014-07-28 12:55:36 -05:00
Christopher Truncer
7129108c58
Fixed status in MSF db for Nessus
2014-07-28 13:49:24 -04:00
Luke Imhoff
533d0be2fb
Merge remote-tracking branch 'upstream/staging/electro-release' into staging/electro-release
2014-07-28 12:12:45 -05:00
David Maloney
1e32574768
Merge branch 'staging/electro-release' into feature/MSP-9641/cred-rpc-calls
2014-07-28 11:10:59 -05:00
jvazquez-r7
79fe342688
Land #3558 , @FireFart's improvements to wordpress mixin
2014-07-28 09:52:20 -05:00
jvazquez-r7
2d5fd5e0d5
Use constant for WORDPRESS_VERSION_PATTERN
2014-07-28 09:22:50 -05:00
James Lee
c65db18090
Add rudimentary specs and fix some help wording
2014-07-28 09:19:09 -05:00
jvazquez-r7
b061d24b84
Favor & over and
2014-07-28 09:05:53 -05:00
cx
7247f8879b
Empty line fix
...
Details:
* Empty line fix added to each_user_pass function
2014-07-28 12:50:41 +03:00
AnwarMohamed
283046b25d
fixing auto load on new session
2014-07-28 10:49:50 +02:00
Joe Vennix
173381b205
Merge branch 'android_ext2' of github.com:AnwarMohamed/metasploit-framework into anwar-android-bins
2014-07-27 23:04:03 -07:00
AnwarMohamed
9f0bf67521
fixing minor bugs
2014-07-28 07:49:46 +02:00
Joe Vennix
2b46e76e85
Recompiled again.
2014-07-27 22:23:26 -07:00
Joshua Smith
96945442ff
removes unnec. retruns & uses of 'not' - has_actions.rb
2014-07-27 18:20:12 -05:00
Joe Vennix
ae1f498aae
Check in new android binaries.
2014-07-27 13:22:12 -07:00
James Lee
1931024c86
Bump credential version for #to_s fixes
2014-07-27 14:08:39 -05:00
James Lee
a35e7371bb
Add simple tabbing for creds command
2014-07-27 14:08:38 -05:00
James Lee
b8bb4c7bc0
Add add-ssh-key to help output, fix some warnings
2014-07-27 13:46:38 -05:00
James Lee
a38a627b94
Merge branch 'staging/electro-release' into feature/MSP-9932/creds-add-subcommands
2014-07-27 13:38:33 -05:00
cx
5679a72aa8
Added Fixes mentioned by jhart-r7
...
Details:
* res && res.body fix
* empty return removed
* vprint added/changed
* is_? convention fixed
* Unknown error removed
* Minor styling issues are fixed
* VERBOSE Option Removed
2014-07-27 00:40:37 +03:00
ikkini
18f1bdbb2c
Merge pull request #1 from todb-r7/fix-pr3570
...
Revert "change to .gitignore"
2014-07-26 07:55:23 +02:00
Alton Johnson
555e6c9cff
Modified a few things based on suggestions.
2014-07-25 18:23:12 -05:00
sinn3r
faee2c7026
Land #3492 - sqlmap plugin for sqlmap API
2014-07-25 16:30:30 -05:00
Tod Beardsley
3e304536ea
Land #3554 , Typo3 mixin specs
2014-07-25 16:06:40 -05:00
Alton Johnson
58502f139a
Updated.
2014-07-25 15:46:50 -05:00
Tod Beardsley
1cdff92e72
Revert "change to .gitignore"
...
This reverts commit 6747ba91ed .
2014-07-25 14:56:10 -05:00
cx
cdabfb84f4
Add Wordpress XML-RPC Login Scanner
...
This module attempts to authenticate against a Wordpress-site (via
XMLRPC) using username and password combinations indicated by the
USER_FILE, PASS_FILE, and USERPASS_FILE options.
The module, checks for XMLRPC response using `demo.sayHello` function
and sweeps users with `wp.getUsers` function.
If `verbose` is set `true`, the raw XML response will be printed.
The module might be usefull when the target's administration page
is protected.
2014-07-25 16:24:09 +03:00
Alton Johnson
d0cd5cfc7a
Updated.
2014-07-24 21:53:23 -05:00
Alton Johnson
cdc56df09f
Updated smb_enumshares.rb
2014-07-24 21:18:02 -05:00
Alton Johnson
51c488a5ea
Added smb_enumshares.
2014-07-24 21:11:18 -05:00
OJ
210342df5b
Minor tidies to conform to standards
2014-07-25 09:32:54 +10:00
James Lee
a0a2fddee8
Land #3562 , yardoc cleanup
2014-07-24 17:25:12 -05:00
OJ
9fe2dd59aa
Move error messages to check
2014-07-25 07:57:09 +10:00
James Lee
bc836f3606
Add a little easter egg in the NTLM hash
2014-07-24 16:37:24 -05:00
David Bloom
e35ee1f037
Update gnome_commander_creds.rb
2014-07-24 23:36:32 +02:00
David Bloom
f4440680b6
Update gnome_commander_creds.rb
2014-07-24 23:30:26 +02:00
ikkini
03f68e21e7
Merge branch 'rsync_modules' of https://github.com/ikkini/metasploit-framework into rsync_modules
2014-07-24 23:29:14 +02:00
ikkini
ccb26637e7
List all (listable) modules from a rsync daemon
2014-07-24 23:26:41 +02:00
David Bloom
9dc37c3cc7
Update gnome_commander_creds.rb
2014-07-24 23:18:26 +02:00
David Bloom
48982b3b89
Update gnome_commander_creds.rb
2014-07-24 23:16:45 +02:00
David Bloom
2e5c2a514b
Update gnome_commander_creds.rb
2014-07-24 23:16:10 +02:00
David Bloom
9aa1b86d8f
Update gnome_commander_creds.rb
2014-07-24 23:10:00 +02:00
David Bloom
718c401472
Update gnome_commander_creds.rb
2014-07-24 23:01:30 +02:00
us3r777
cd2ec0a863
Refactored jboss mixin and modules
...
Moved fail_with() from mixin to modules. Added PACKAGE datastore to
lib/msf/http/jboss/bsh.rb.
2014-07-24 22:58:58 +02:00
James Lee
b8b3509c96
Re-add the ability to delete creds
2014-07-24 15:44:52 -05:00
Tod Beardsley
8b2ff062c3
Land #3568 , @jhart-r7 regex fix for dir traversal
2014-07-24 15:43:43 -05:00
James Lee
18ce342e2a
Refactor a bit for readability
2014-07-24 15:42:36 -05:00
Jon Hart
bd1970ced9
Fix basic HTTP directory traversal detection
2014-07-24 13:22:58 -07:00
ikkini
6692545eb6
Delete rsync_list.rb
2014-07-24 22:10:08 +02:00
ikkini
f12b97e8c0
List all (listable) modules from a rsync daemon
2014-07-24 22:04:00 +02:00
James Lee
1470f3de30
Fix padding when a cell value is nil
2014-07-24 14:00:09 -05:00
David Maloney
7a49f218d4
update .yardopts
2014-07-24 13:59:04 -05:00
James Lee
8a279d202c
Whitespace
2014-07-24 13:56:57 -05:00
James Lee
5286b7cc22
Land #3566 , ducktype better
2014-07-24 11:19:40 -05:00
David Bloom
8a6fa178d6
Update gnome_commander_creds.rb
2014-07-24 08:10:28 +02:00
OJ
3ec30bdf78
Add some small fixes to the MQAC local exploit
...
* Check for `INVALID_HANDLE_VALUE` when attempting to open the
device, as this is what is returned when the device doesn't exist.
* Make sure that we only run the exploit against tartgets that we
support directly to make sure we don't BSOD machines (such as what
happens with SP1/SP2).
* Add a call to `check` in the exploit code.
2014-07-24 14:48:29 +10:00
OJ
ddf0636dab
Land #3557 : MQAC arbitrary write priv esc XP SP3
2014-07-24 11:24:56 +10:00
James Lee
1a4e59e547
Add add-ssh-key subcommand
2014-07-23 17:09:02 -05:00
darkbushido
064d624322
changing Credential == operator
...
it should no longer raise no method errors when comparing a credential to
an object that doesnt respond to public, private, or realm
2014-07-23 16:17:09 -05:00
Samuel Huckins
6c1a3f4992
Merge pull request #3555 from jlee-r7/bug/MSP-10817/jtr-typo
...
Now able to complete without error.
MSP-10817 #land
2014-07-23 15:55:42 -05:00
James Lee
eee72a86ba
Fix the case when john cracks only half of LM
2014-07-23 15:25:32 -05:00
Samuel Huckins
ffd7d28bc6
Merge pull request #3559 from dmaloney-r7/feature/MSP-10230/snmp_login
...
MSP-10230 #land
2014-07-23 13:59:37 -05:00
David Bloom
41e5e24b19
Update gnome_commander_creds.rb
2014-07-23 20:26:43 +02:00
David Bloom
30c00f4fd6
gnome-commander credentials add
2014-07-23 20:20:29 +02:00
David Maloney
b1d1e4fc04
Merge branch 'staging/electro-release' of github.com:rapid7/metasploit-framework into staging/electro-release
2014-07-23 12:08:56 -05:00
David Maloney
b7d15d0b08
simple fix to mysql loginscanner
...
typo caused connection_timeout default to not get set
2014-07-23 12:07:57 -05:00
Jay Smith
042278ed6a
Update code to reflect @OJ code suggestions
2014-07-23 11:01:43 -04:00
James Lee
4f19a1defa
Add an origin type and actually honor realm
...
Also adds better help text
2014-07-22 19:52:10 -05:00
Jay Smith
534a5d964b
Add CVE-2014-4971 BthPan local privilege escalation
...
Add CVE-2014-4971 BthPan local privilege escalation for Windows XP SP3
2014-07-22 18:17:06 -04:00
Christian Mehlmauer
57839e0f4b
Fix some yardoc issues
2014-07-22 23:26:50 +02:00
us3r777
b526fc50f8
Refactored jboss mixin and modules
...
Moved VERB option to the mixin. Replaced "if datastore['VERBOSE']"
by vprint_status().
2014-07-22 23:08:42 +02:00
David Maloney
1f007bf3c9
start adding new rpc calls
...
Signed-off-by: David Maloney <DMaloney@rapid7.com >
2014-07-22 15:46:27 -05:00
Christian Mehlmauer
c1a0f707ef
typos
2014-07-22 22:29:01 +02:00
jvazquez-r7
f6f8d7b993
Delete debug print_status
2014-07-22 15:00:03 -05:00
jvazquez-r7
b086462ed6
More cleanups of modules which REALLY need the 'old' generic encoder
2014-07-22 14:57:53 -05:00
Trevor Rosen
a338b4a11c
Merge branch 'feature/MSP-10029/core-search' into staging/electro-release
...
Support search
2014-07-22 14:50:38 -05:00
jvazquez-r7
3d7ed10ea0
Second review of modules which shouldn't be affected by changes
2014-07-22 14:33:57 -05:00
jvazquez-r7
5e8da09b2d
Allow some modules to use the old encoder
2014-07-22 14:28:11 -05:00
Jay Smith
0db3a0ec97
Update code to reflect @jlee-r7's code review
2014-07-22 15:14:24 -04:00
Jay Smith
125b2df8f5
Update code to reflect @hdmoore code suggestions
2014-07-22 14:53:24 -04:00
Spencer McIntyre
7f79e58e7f
Lots and cleanups based on PR feed back
2014-07-22 14:45:00 -04:00
jvazquez-r7
b0f8d8eaf1
Delete debug print_status
2014-07-22 13:29:00 -05:00
jvazquez-r7
f546eae464
Modify encoders to allow back compatibility
2014-07-22 13:27:12 -05:00
Christian Mehlmauer
073a8c5233
redirection returns an URI
2014-07-22 19:55:26 +02:00
Christian Mehlmauer
a6479a77d6
Implented feedback from @jhart-r7
2014-07-22 19:49:58 +02:00
David Maloney
e54f5e8ee7
working snmp_login module
2014-07-22 12:44:21 -05:00
Spencer McIntyre
5d9c6bea9d
Fix a typo and use the execute_shellcode function
2014-07-22 13:06:57 -04:00
Samuel Huckins
469ac30539
Merge branch 'upstream-master'
2014-07-22 11:50:13 -05:00
David Maloney
c553fcac73
start refacotirng snmp_login
2014-07-22 11:46:22 -05:00
David Maloney
0eb4fc0ed1
community string collection
...
add community string collection to handle snmp loginscanner
credentials
2014-07-22 11:44:31 -05:00
jvazquez-r7
a642ce5e1c
Delete not necessary end keywords
2014-07-22 11:35:04 -05:00
Samuel Huckins
e2dd0a35d2
Merge branch 'master' of github.com:shuckins-r7/metasploit-framework
2014-07-22 11:23:19 -05:00
jvazquez-r7
b770745e9d
Split generic_sh in echo, perl and ifs encoders
2014-07-22 10:27:45 -05:00
Spencer McIntyre
12904edf83
Remove unnecessary target info and add url reference
2014-07-22 11:20:07 -04:00
Christian Mehlmauer
baff003ecc
extracted check version to module
...
also added some wordpress specs and applied
rubocop
2014-07-22 17:02:35 +02:00
Spencer McIntyre
ca0dcf23b0
Add a simple check method for cve-2014-4971
2014-07-22 10:54:10 -04:00
Luke Imhoff
14fa49cdeb
Update spec to handle Mdm::Service#proto sequence
...
MSP-10029
Mdm::Service factories were changed in metasploit_data_models 0.19.0 to
use a sequence that cycles between 'tcp' and 'udp'. To make the spec
clearer, just hard-code the protos under test instead of relying on
default behavior.
2014-07-22 09:47:35 -05:00
Spencer McIntyre
6a545c2642
Clean up the mqac escalation module
2014-07-22 10:39:34 -04:00
Luke Imhoff
f3eb708dd1
Update metasploit_data_models and metasploit-credential for tag search
...
MSP-10029
Use metasploit_data_models that supports searching Mdm::Tag and a
compatible metasploit-credential. Needed so
Metasploit::Credential::Core#tags can be searched in Pro.
2014-07-22 09:07:18 -05:00
Spencer McIntyre
da4eb0e08f
First commit of MQAC arbitrary write priv escalation
2014-07-22 10:04:12 -04:00
jvazquez-r7
ef12a632f6
Change filename
2014-07-22 08:20:32 -05:00
James Lee
2013e28608
WIP: First stab at creds add-* subcommands
2014-07-22 02:05:55 -05:00
Luke Imhoff
f8af435df6
Fix version restrictions on metasploit-credential
...
MSP-10029
The '<' version should have been '0.8' and not '0.7.10' because '0.8' is
the next incompatible version number.
2014-07-21 19:44:20 -05:00
James Lee
addecb6311
Fix running shipped bins by using a config file
...
This should get everything working again.
MSP-10817
2014-07-21 18:26:50 -05:00
James Lee
917d2c718b
Use All4 instead of LanMan
...
... Which was the original behavior. A full incremental LanMan can take
many hours instead of the few seconds this module was intended to run.
2014-07-21 18:24:35 -05:00
Brandon Perry
d62b24744c
Moar " -> '
2014-07-21 18:04:36 -05:00
Brandon Perry
1a157ff803
Change all the " to ' when not interpolating
2014-07-21 18:00:03 -05:00
James Lee
a2a75ffb03
Fix typo and full path issue
...
Previously, the JtR library was prepending the path to data/john/ for
shipped bins; without it, modules weren't finding the executables.
2014-07-21 17:58:27 -05:00
Brandon Perry
5190ed750f
This adds the human readable IDs
...
and converts the negative if's into unless.
2014-07-21 17:49:53 -05:00
jvazquez-r7
72c2c07495
Add the specs, really
2014-07-21 17:39:51 -05:00
jvazquez-r7
47d9a30af0
Add specs for Typo3 mixin
2014-07-21 17:39:07 -05:00
us3r777
ae2cd63391
Refactored Jboss mixin
...
Moved TARGETURI option to the JBoss mixin. The mixin now includes
Msf::Exploit::Remote::HttpClient which provides USERNAME and PASSWORD
2014-07-21 23:41:58 +02:00
Joe Vennix
9db951cadc
Add sane defaults for HTTP method and path.
2014-07-21 14:57:28 -05:00
Luke Imhoff
1a10b21e7f
Use metasploit-credential with association search
...
MSP-10029
2014-07-21 13:39:17 -05:00
sinn3r
6048f21875
Land #3552 - Correct DbVisualizer title name
2014-07-21 13:07:33 -05:00
sinn3r
73e665b863
Land #3542 - Multi Manage DbVisualizer Query
2014-07-21 13:02:19 -05:00
sinn3r
fbbaaf2e2a
Fix spaces and module description
2014-07-21 13:01:18 -05:00
Luke Imhoff
a4e5c36de5
Update to metasploit-credential to use gem.
...
MSP-10808
2014-07-21 12:57:20 -05:00
jvazquez-r7
fe0b6fa79e
Land #3532 , @luisco's joomla login bruteforcer
2014-07-21 12:56:15 -05:00
jvazquez-r7
aefaa3dd96
Make rubocop more happy
2014-07-21 12:55:45 -05:00
Tod Beardsley
a62ee99d1d
Actually require NetAPI
2014-07-21 12:48:34 -05:00
Tod Beardsley
ffafd4c01f
Add NTP fuzzer from @jhart-r7
...
Looks good to me!
2014-07-21 12:38:12 -05:00
Tod Beardsley
a41768fd7d
Correct DbVisualizer title name
...
I think "DbVis Software" is the name of the company and the product
itself is called DbVisualizer.
Also fixed the description on the WPTouch module.
2014-07-21 12:35:01 -05:00
sinn3r
aa27af96f4
Land #3547 - rubocop changes
2014-07-21 12:26:51 -05:00
jvazquez-r7
478e43170a
Report credentials to database
2014-07-21 12:26:13 -05:00
jvazquez-r7
63fca1bfdd
Make some datastore options required
2014-07-21 12:10:52 -05:00
jvazquez-r7
436ac706e8
Rescue Rex::ConnectionError while finding the uri
2014-07-21 12:00:24 -05:00
jvazquez-r7
30de4cdf8d
Fix get_login_hidden
2014-07-21 11:57:37 -05:00
jvazquez-r7
ff3a21b520
Refactor do_web_login
2014-07-21 11:35:19 -05:00
jvazquez-r7
22f41e4435
Use vars_post
2014-07-21 11:07:00 -05:00
jvazquez-r7
92fd3bc72b
Deleting REQUEST_TYPE option because I don't think has sense here
2014-07-21 10:53:43 -05:00
jvazquez-r7
986b8e5d02
First style issues cleanup
2014-07-21 09:49:05 -05:00
HD Moore
b3c7fff32a
Land #3551 , fix inconsistent pack/unpack usage
2014-07-20 17:11:49 -05:00
HD Moore
eea0b24aec
Land #3550 , fix railgun use of pack/unpack Q
2014-07-20 17:09:53 -05:00
Meatballs
3daf78777b
Use native unpack for PDWORDs
2014-07-20 22:57:19 +01:00
Meatballs
4fecae084b
Q (native) to Q< (le)
2014-07-20 22:38:30 +01:00
Meatballs
b0a596b4a1
Update newer modules
2014-07-20 21:59:10 +01:00
Meatballs
5f0533677e
Cheat/Rubycop all the things
2014-07-20 21:07:59 +01:00
Meatballs
474ee81807
Merge remote-tracking branch 'upstream/master' into pr2075
2014-07-20 21:01:54 +01:00
Meatballs
b28343842f
Address @jhart-r7's comments
2014-07-20 21:00:34 +01:00
William Vu
d9f4a84c16
Land #3548 , peer rhost fix
2014-07-19 16:05:30 -05:00
HD Moore
5ba96d6054
Fix peer(rhost)->peer() usage in mediawiki_svg_fileaccess
2014-07-19 15:56:41 -05:00
scriptjunkie
066a5e2a4b
Land #3377 , GPP gathering module fixes
2014-07-19 11:12:51 -05:00
scriptjunkie
8fe508207c
Merge Meatballs' gpp_again pull into new branch
2014-07-19 11:10:14 -05:00
Christian Mehlmauer
a809c9e0b5
Changed to vprint and added comment
2014-07-18 22:15:56 +02:00
Christian Mehlmauer
c6e129c622
Fix rubocop warnings
2014-07-18 21:58:33 +02:00
root
7a5f3b8991
Implementing Ruby Style Guide and replace send_request_raw send_request_cgi
2014-07-18 14:31:38 -05:00
Samuel Huckins
ed1ed5d5a4
Merge pull request #117 from rapid7/feature/MSP-9943/db-import-creds
...
Deprecation warning exorcised, specs passing, export/import accuracy confirmed.
MSP-9943 #land
2014-07-18 11:56:59 -05:00
James Lee
2eea95e120
Silence warnings about I18n defaults
2014-07-18 11:49:49 -05:00
James Lee
175d857611
Fix empty message and don't lie in yardoc
2014-07-18 11:36:31 -05:00
Tod Beardsley
942112d18e
Land #3538 , SAP fix from @jvazquez-r7
...
This looks good to me, the whole print statement is enclosed in a check
for results.
2014-07-18 10:27:47 -05:00
us3r777
088f208c7c
Added auxiliary module jboss_bshdeployer
...
The module allows to deploy a WAR (a webshell for instance) using the
BSHDeployer.
Also refactored modules/exploits/multi/http/jboss_bshdeployer.rb to
use the new Mixin (lib/msf/http/jboss).
2014-07-18 11:51:46 +02:00
root
1f02891dc7
Change name of module and implementation of the recommended changes 2
2014-07-18 00:17:35 -05:00
root
0168a99eaa
Change name of module and implementation of the recommended changes
2014-07-17 23:49:25 -05:00
root
f2eabdba94
implementation of the recommended changes
2014-07-17 23:36:37 -05:00
jvazquez-r7
ad2e7c3713
print header only if there are results...
2014-07-17 18:02:24 -05:00
us3r777
58adc350b5
Refactor: Creation of a JBoss mixin
...
The jboss_bsheployer as is does not allow to deploy a custom WAR file.
It is convenient when ports are blocked to be able to deploy a webshell
instead of just launching a payload. This will require a auxiliary
module which will use the JBoss mixin methods.
2014-07-18 00:56:32 +02:00
James Lee
2dab69d67c
Use constant instead of hardcoded filename
2014-07-17 16:04:25 -05:00
James Lee
7d1cd22aca
Quick and dirty import of cred zip
2014-07-17 15:59:16 -05:00
sinn3r
c59d72b0c6
Land #3530 - dbvis database administrator
2014-07-17 14:36:34 -05:00
midnitesnake
36f6bcca15
Applied Jon Hart's recommendations
2014-07-17 20:29:26 +01:00
sinn3r
6d35867f7f
Update module description
2014-07-17 14:24:57 -05:00
sinn3r
8e7361d952
Fix indent again
2014-07-17 14:12:04 -05:00
sinn3r
aed8af3abc
Retabbed
2014-07-17 14:03:27 -05:00
Jay Smith
2be6eb16a2
Add in exploit check and version checks
...
Move the initial checking for the vboxguest device and os checks
into the MSF check routine.
2014-07-17 14:56:34 -04:00
sinn3r
d6ab418d6f
Fix spaces
2014-07-17 13:52:00 -05:00
Tod Beardsley
19477dbfef
Land #3537 from @PagedeGeek, msfcrawler fix
2014-07-17 13:38:15 -05:00
Tod Beardsley
cd08acd9c6
Merging my fix to #3537 , nokogiri for msfcrawler
2014-07-17 13:37:37 -05:00
Kyle Gray
08cd2690f9
Merge branch 'bug/MSP-10724/fix-import-failure' into staging/electro-release MSP-10724 #land
2014-07-17 13:37:13 -05:00
Tod Beardsley
b050b5d1df
Rubocop -a on MS08-067
...
This reduces the number of style guide violations from 230ish to 36.
Nearly all of it has to do with errant parameters, element alignment,
and comment blocks.
Obviously, since this was all automatically fixed, some pretty severe
testing should occur before landing this.
I kind of don't like the automatic styling of the arrays for the
references, but maybe I can get used to it. It's open for discussion.
@jhart-r7 please take a look at this as well -- anything jumping out at
you on this that we should be avoiding for Rubocop?
2014-07-17 12:29:20 -05:00
David Bloom
b4e68a7c25
Update dbvis_query.rb
2014-07-17 19:21:35 +02:00
Tod Beardsley
2a66bd63b7
Unincluding hpricot
...
The Gemfile was badly formatted anyway, since it lacked a justifying
comment, as all other included gems have.
2014-07-17 11:38:13 -05:00
Jon Hart
06fd1ead9d
Address more style issues
2014-07-17 09:37:27 -07:00
Tod Beardsley
5d3b472293
Merge PR#3541 to this branch to undo it.
2014-07-17 11:36:36 -05:00
Tod Beardsley
6bdb3205b0
Unignore .ruby-version
2014-07-17 11:30:26 -05:00
Jon Hart
17b0560dff
Add rubygems check to msftidy. remove rubygems.
2014-07-17 09:29:13 -07:00
Joshua Smith
9fb18f13cc
Land #3541 , adds hpricot to gemfile
2014-07-17 11:14:13 -05:00
Samuel Huckins
fd2a12da43
Merge pull request #115 from rapid7/bug/MSP-10730/finish-login-status-move
...
Specs passing, no hits on Metasploit::Credential::Login::Status across all projects aside from coverage docs (3).
MSP-10730 #land
2014-07-17 10:55:46 -05:00
Tod Beardsley
feee142f32
Updating Gemfile lock so Travis doesn't fail.
2014-07-17 10:18:22 -05:00
Trevor Rosen
e789d5350b
No idea why this didn't fail before
...
MSP-10724
2014-07-17 10:15:22 -05:00
Vincent Herbulot
bea660ad4d
Added possibility to upload a custom WAR file
...
Added 2 options, one for uploading a custom WAR file. The other
to specify if you want or not to undeploy the war at the end of
the exploit.
The module as is does not allow to deploy a custom WAR file. It is
convenient when ports are blocked to be able to deploy a webshell
instead of just launching a payload.
2014-07-17 17:13:19 +02:00
jvazquez-r7
7e6e154a39
Fix null pointer dereference
2014-07-17 08:51:12 -05:00
David Bloom
0f92b73f1a
Update dbvis_add_db_admin.rb
2014-07-17 10:14:28 +02:00
David Bloom
561ef427cc
Update dbvis_query.rb
2014-07-17 10:13:58 +02:00
David Bloom
60c71b2681
Update dbvis_add_db_admin.rb
2014-07-17 10:11:13 +02:00
David Bloom
8f9a1e485c
Delete dbvis_query.rb
2014-07-17 08:05:18 +02:00
David Bloom
1c8cac359c
Added video link
2014-07-17 08:02:27 +02:00
David Bloom
7bee4db1d7
dbvis_query.rb add
2014-07-17 07:48:17 +02:00
Trevor Rosen
bebf11c969
Resolves some Login::Status migration issues
...
MSP-10730
2014-07-16 21:52:08 -05:00
root
ceff18de9d
Add modifiable UserAgent and translations to English
2014-07-16 20:44:20 -05:00
David Bloom
4a25bb4247
Update dbvis_add_db_admin.rb
2014-07-17 02:01:50 +02:00
William Vu
a07656fec6
Land #3536 , msftidy INFO messages aren't blockers
2014-07-16 17:57:48 -05:00
Sam
115b78ca29
Update .ruby-version
2014-07-17 00:15:38 +02:00
Sam
767dfae184
Update .ruby-version
2014-07-17 00:15:25 +02:00
Sam
8cabc753a9
Replace hpricot by nokogiri
2014-07-17 00:14:07 +02:00
Brandon Turner
ff017f83f7
Merge pull request #105 from rapid7/bug/MSP-10684-electro-installers
...
MSP-10684 Allow declaring root via env var in gemspecs
2014-07-16 16:51:46 -05:00
Lance Sanchez
9addfcede7
Merge branch 'bug/MSP-10728/invalidate-login' into staging/electro-release
2014-07-16 16:20:40 -05:00
Lance Sanchez
7e338aa828
updating Gemfile.lock
...
MSP-10728
2014-07-16 16:19:59 -05:00
David Maloney
0d3abf26e8
use latest metasploit-credential
2014-07-16 15:38:50 -05:00
Tod Beardsley
58558e8dfa
Allow INFO msftidy messages
...
INFO level messages should not block commits or be complained about on
merges. They should merely inform the user.
2014-07-16 15:29:23 -05:00
sinn3r
8733dcb2f8
Land #3531 - Windows 2008 Update for HP AutoPass License
2014-07-16 15:13:05 -05:00
William Vu
0ef1f56163
Land #3479 , this time for real
...
Missed a commit.
2014-07-16 15:06:46 -05:00
William Vu
ff6c8bd5de
Land #3479 , broken sock.get fix
2014-07-16 14:57:32 -05:00
William Vu
b6ded9813a
Remove EOL whitespace
2014-07-16 14:56:34 -05:00
William Vu
25f74b79b8
Land #3484 , bad pack/unpack specifier fix
2014-07-16 14:52:23 -05:00
Meatballs
7583ed4950
Merge remote-tracking branch 'upstream/master' into pr2075
2014-07-16 20:34:34 +01:00
Meatballs
b95a5ebe12
Land #3535 , Depreciate psh_web_delivery
2014-07-16 19:58:59 +01:00
sinn3r
4fb58202fa
Land #3529 - Handle Rex::AddressInUse exception
2014-07-16 13:57:41 -05:00
Tod Beardsley
5fa639c640
Land #3528 , add Rubocop from @jhart-r7
...
This adds the gem to the :development group in the Gemfile, as well as
wires up msftidy to use it.
2014-07-16 13:45:44 -05:00
Jay Smith
6d49f6ecdd
Update code to reflect hdmoore's code review.
2014-07-16 14:29:17 -04:00
cdoughty-r7
1ad04eb2d9
Merge pull request #111 from rapid7/bug/MSP-10714-gem-version
...
Fix gem version to support rubygems < 2.1
2014-07-16 13:23:33 -05:00
Spencer McIntyre
82abe49754
Mark windows/misc/psh_web_delivery as deprecated
2014-07-16 14:02:05 -04:00
David Maloney
8b9aa75c68
Merge branch 'staging/electro-release' of github.com:rapid7/metasploit-framework-private into staging/electro-release
2014-07-16 12:54:37 -05:00
David Maloney
5534599cfc
fix for jtr warnings
...
remmove include for Jtr mixin in deprecated jtr_unshadow module
remove deprecated postgres_crack module
2014-07-16 12:52:29 -05:00
Samuel Huckins
fc0c299db8
Merge pull request #113 from rapid7/bug/MSP-10721/gemspec-meterpreter-bins
...
Specs passing after bundle install, console starts up.
2014-07-16 12:36:50 -05:00
David Bloom
52bdc5364c
Update dbvis_query.rb
2014-07-16 18:52:27 +02:00
David Bloom
200c122ecd
Update dbvis_query.rb
2014-07-16 18:48:15 +02:00
David Bloom
31e38cee23
Update dbvis_add_db_admin.rb
2014-07-16 18:45:38 +02:00
Jon Hart
fa472c7752
Merge pull request #2 from todb-r7/rubocop-is-optional
...
Rubocop checks are optional and info only
2014-07-16 09:34:25 -07:00
David Bloom
5f38ad5e10
Update dbvis_add_db_admin.rb
2014-07-16 18:30:23 +02:00
David Bloom
c3b87e2e6c
Update rigth on dbviscmd check
2014-07-16 18:27:19 +02:00
Tod Beardsley
68980157c8
Just skip if info is suppressed.
2014-07-16 11:20:40 -05:00
Brandon Turner
e637237574
Use the Rubygems 2.2 version convention
...
Substitute version dashes with ".pre.".
MSP-10714
2014-07-16 11:13:14 -05:00
Tod Beardsley
81a98081d9
Rubocop checks are optional and info only
...
I like the change but it means that basically everything will fail
forever until we tweak up the config.
2014-07-16 10:26:35 -05:00
Lance Sanchez
1e2df81397
Attempting to fix a gemfile mergeconflict
...
MSP-10721
2014-07-16 10:22:27 -05:00
David Maloney
098054e902
gemfile.lock
2014-07-16 09:45:59 -05:00
David Maloney
52a29856b3
Merge branch 'master' into staging/electro-release
...
Conflicts:
Gemfile
Gemfile.lock
2014-07-16 09:38:44 -05:00
dmaloney-r7
c288e6625b
Merge pull request #112 from rapid7/bug/MSP-10718/metasploit-credential-constant-refactor
...
Fix bugs due to Metasploit::Model::Login::Status refactor
2014-07-16 09:23:31 -05:00
David Bloom
90932116f8
Update dbvis_query.rb
...
Minor changes
2014-07-16 15:44:48 +02:00
David Bloom
b4aca68406
Update dbvis_query.rb
2014-07-16 15:10:07 +02:00
David Bloom
17b2169b9d
Create dbvis_query.rb
...
Dbvisulaizer offers a command line functionality to execute SQL pre-configured databases (With GUI).
The remote database can be accessed from the command line without the need to authenticate.
The module abuses this functionality to query the remote database and store the result.
2014-07-16 14:51:24 +02:00
David Bloom
b602fc89a3
Update dbvis_add_db_admin.rb
...
Corrections
2014-07-16 13:42:58 +02:00
Samuel
fe72bac8c8
fix crawler hpricot
2014-07-16 13:23:40 +02:00
Jay Smith
cef2c257dc
Add CVE-2014-2477 local privilege escalation
2014-07-16 05:49:19 -04:00
Matt Buck
eff2defdde
Fix bug due to Metasploit::Model::Login::Status refactor
...
MSP-10718
2014-07-16 04:14:45 -05:00
Trevor Rosen
2f460f32c3
Fix Gemfile deps
2014-07-15 21:52:57 -05:00
Trevor Rosen
17c3e61322
Merge pull request #110 from rapid7/feature/MSP-10711/login-status
...
Feature/msp 10711/login status
MSP-10711
2014-07-15 21:47:37 -05:00
Brandon Turner
252c359f2a
Update Gemfile.lock with new framework version
2014-07-15 19:25:36 -05:00
Jon Hart
ab73c16d0d
Add Rubocop to msftidy. You now have 15 seconds to comply. You are in direct violation of Penal Code 1.13, Section 9.
2014-07-15 17:11:04 -07:00
Brandon Turner
044fdb8c55
Fix gem version to support rubygems < 2.1
...
MSP-10714
2014-07-15 19:02:39 -05:00
Jon Hart
7f860a7cdc
Add more sensible Rubocop defaults for line length. disable top-level class documentation requirement for modules and don't require big numbers like 12737341238 to be separated with _ -- who does that?
2014-07-15 16:58:11 -07:00
Jon Hart
9e5c24a97e
Address some Ruby style issues
2014-07-15 16:55:54 -07:00
jvazquez-r7
6d05a24653
Add target information
2014-07-15 17:45:45 -05:00
sinn3r
f8e47a5c61
Land #3524 - WPTouch fileupload exploit
2014-07-15 16:29:59 -05:00
David Maloney
ea57ad0126
fix connection error on base
...
missed a reference to connection_error on the
loginscanner base. this would prevent us from
bailing out early if we have too many connection errors
2014-07-15 16:21:13 -05:00
Spencer McIntyre
e58100fe85
Land #3419 , multi script delivery module by @jakxx
2014-07-15 17:07:51 -04:00
Spencer McIntyre
1a8d73fca8
Minor whitespace and grammar changes
2014-07-15 17:00:28 -04:00
HD Moore
b045e5b14a
Merge pull request #1 from wvu-r7/pr/3479
...
Fix @source and prefer &&
2014-07-15 17:00:13 -04:00
David Maloney
7c0633f0a7
gemfile fix
2014-07-15 15:38:02 -05:00
David Maloney
674447c891
final cleanup steps
2014-07-15 15:31:51 -05:00
David Maloney
7ac6640cfd
Merge branch 'staging/electro-release' into feature/MSP-10711/login-status
...
Conflicts:
Gemfile
Gemfile.lock
modules/auxiliary/scanner/smb/smb_login.rb
2014-07-15 15:12:33 -05:00
dmaloney-r7
4d3bfcf9d0
Merge pull request #109 from rapid7/bug/MSP-10713/smb-error-code
...
Move error_name to InvalidPacket and check for nil
2014-07-15 15:10:37 -05:00
jvazquez-r7
604a612393
Have into account differences between windows default installs
2014-07-15 15:03:07 -05:00
James Lee
51a9a763c0
Move error_name to InvalidPacket and check for nil
...
MSP-10713
2014-07-15 15:02:53 -05:00
David Maloney
34635ab968
module login status cleanup
...
cleanup several bruteforce module to
use the loginstatus constants for result status
2014-07-15 14:55:41 -05:00
David Bloom
875c024243
create dbvis_add_db_admin.rb
...
Dbvisulaizer offers a command line functionality to execute SQL pre-configured databases (With GUI).
The remote database can be accessed from the command line without the need to authenticate.
The module abuses this functionality to create an administrator in the database if DB user rights allow it.
2014-07-15 21:43:14 +02:00
David Maloney
9857bac6b1
add NO_AUTH_REQUIRED
2014-07-15 14:38:41 -05:00
Samuel Huckins
a4ff2fdd50
Merge pull request #108 from rapid7/feature/MSP-9948/update-db-import
...
Specs and functional now passing with latest update.
MSP-9948 #land
2014-07-15 13:36:43 -05:00
Trevor Rosen
6a1149c1ed
Add missing origin
...
MSP-9948
2014-07-15 13:27:08 -05:00
David Maloney
939e585658
refactor all loginscanners
...
loginscanners now use LoginStatus constants
for the result statuses
2014-07-15 13:17:56 -05:00
jvazquez-r7
4098979448
Add spec
2014-07-15 13:06:53 -05:00
Jon Hart
73736c70b6
Add Rubocop to the Metasploit project
...
This is a work in progress because the code base is old and the style
varies wildly, however .rubocop.yml can (and should) be tweaked over
time to change standards as we see fit. As it stands right now there
are few (if any) modules that pass Rubocop.
2014-07-15 10:43:08 -07:00
David Maloney
846679bef9
change Result status
...
result bojects now use Login::status constants
for their status
2014-07-15 11:39:38 -05:00
sinn3r
57b1023592
Land #3522 - Multi Gather Dbvis Connections Settings
2014-07-15 11:34:02 -05:00
sinn3r
1d6f088eab
Pass msftidy
2014-07-15 11:31:37 -05:00
jvazquez-r7
09619abe79
Catch AddressInUse when running commands from the meterpreter console
2014-07-15 11:15:10 -05:00
Tod Beardsley
1cac801158
Land #3527 from @wchen-r7, doc update
2014-07-15 10:50:36 -05:00
sinn3r
de4133a83a
Update link for The Metasploit Development Environment
...
The HACKING file still uses the old link, which redirects to this
one, why not just use this one?
2014-07-15 10:16:47 -05:00
David Bloom
526538ecd6
Added dbvis version find and print
2014-07-15 15:04:46 +02:00
David Bloom
97dcc56225
Update dbvis_enum.rb
2014-07-15 14:23:40 +02:00
David Bloom
400b0f4276
parse url to report host in old config
2014-07-15 14:21:09 +02:00
David Bloom
f3d953f829
Old config file update
...
Added functions to parse old and new config files.
2014-07-15 14:00:29 +02:00
David Bloom
ac3d453002
Update dbvis_enum.rb
2014-07-15 12:33:07 +02:00
David Bloom
a53341f520
Added compatibility with dbvis <= 6
...
Checking for "config" folder existence if "config70" is not found.
2014-07-15 12:14:38 +02:00
David Bloom
e66cc003ae
Merge branch 'wchen-r7-pr3522'
...
Changes ok
2014-07-15 09:18:40 +02:00
Christian Mehlmauer
29bb788d96
Better login detection for wordpress
2014-07-15 07:04:14 +02:00
Christian Mehlmauer
c1f612b82a
Use vprint_ instead of print_
2014-07-15 06:58:33 +02:00
OJ
77be5d3e0a
Land #3520 : Update Linux Meterpreter Binaries
...
Includes fixes for the sniffer which stop it breaking on x64 and make
it work with the `any` interface.
[FixRM #6355 ]
2014-07-15 09:27:30 +10:00
Trevor Rosen
8cafed956b
Remove cruft
...
MSP-9948
2014-07-14 18:26:18 -05:00
Trevor Rosen
c1e02d4539
Update deps again
...
MSP-9948
2014-07-14 18:16:12 -05:00
Trevor Rosen
0966949203
Merge branch 'staging/electro-release' into feature/MSP-9948/update-db-import
...
Upstream merge
Conflicts:
Gemfile
Gemfile.lock
2014-07-14 17:59:54 -05:00
Trevor Rosen
aca627489e
Pass workspace down in import of creds dump
...
MSP-9948
2014-07-14 16:40:41 -05:00
James Lee
de22aeba41
Land #3481 , meterpreter bins
2014-07-14 15:57:52 -05:00
sinn3r
cc1ba265cb
Change module name for consistency
2014-07-14 15:49:19 -05:00
sinn3r
4d7bffd713
Change header
2014-07-14 15:45:17 -05:00
sinn3r
5a821cea9d
Account for EOFError condition
2014-07-14 15:27:40 -05:00
sinn3r
89a877031f
I mean "unless", not "if"
2014-07-14 15:24:53 -05:00
sinn3r
bec32a01ab
For for missing an end
2014-07-14 15:17:54 -05:00
sinn3r
cecdcef2e2
+ not preferred
2014-07-14 15:14:54 -05:00
sinn3r
0737deb2a3
Remove the last exception handler
...
We're already checking the file path with file?(), so we don't need
to use exception handling for this task anymore.
2014-07-14 15:02:23 -05:00
sinn3r
8fe3f1a077
File should be checked for existence before reading
2014-07-14 15:01:03 -05:00
sinn3r
20e5803592
Author's Twitter handle should be a comment
...
msfconsole treats whatever is in <> as the author's email, not
twitter handle
2014-07-14 14:57:36 -05:00
sinn3r
3b6947c1d7
Use Rex to check IPv4 instead of using resolv
2014-07-14 14:56:38 -05:00
dmaloney-r7
f3ec386240
Merge pull request #106 from rapid7/feature/MSP-10686/stop-after-user-success
...
Feature/msp 10686/stop after user success
2014-07-14 14:56:23 -05:00
sinn3r
b5e556519b
Change = to ==
...
This is an if condition, not an assignment
2014-07-14 14:53:27 -05:00
sinn3r
8f51fd0e45
Retabbed and reformatted
2014-07-14 14:39:34 -05:00
William Vu
4904426164
Fix @source and prefer &&
2014-07-14 14:36:08 -05:00
Christian Mehlmauer
144c6aecba
Added WPTouch fileupload exploit
2014-07-14 21:35:18 +02:00
root
3becfff41e
Add Bruteforce Joomla
2014-07-14 14:07:23 -05:00
William Vu
72c0c597bb
Land #3523 , release fixes
...
I didn't misspell it this time. :)
2014-07-14 13:53:14 -05:00
William Vu
a6739718a5
Land #3521 , errant unit test removal
2014-07-14 13:49:07 -05:00
Tod Beardsley
6c595f28d7
Set up a proper peer method
2014-07-14 13:29:07 -05:00
dmaloney-r7
7184d2ed5e
Merge pull request #107 from rapid7/feature/MSP-9704/pop3-module-refactor
...
Refactor pop3_login
2014-07-14 13:27:11 -05:00
David Bloom
72d9587a50
DbVisualizer stores the user database configuration in dbvis.xml
...
This module retrieves the connections settings from this file
2014-07-14 20:08:48 +02:00
dmaloney-r7
a76fe5402b
Merge pull request #104 from rapid7/feature/MSP-10680/realm-key-fixes
...
Feature/msp 10680/realm key fixes
2014-07-14 12:21:00 -05:00
Tod Beardsley
96554a4967
Remove this errant test::unit test
2014-07-14 10:57:32 -05:00
Tod Beardsley
91ce942e41
Land #3285 , wiki plugin by @kn0
2014-07-14 10:38:16 -05:00
Luke Imhoff
dee6d9c106
Merge branch 'bug/MSP-10684-electro-installers' of rapid7.github.com:/rapid7/metasploit-framework-private into bug/MSP-10684-electro-installers
...
MSP-10684
2014-07-14 09:48:38 -05:00
Brandon Turner
20131781b4
Use realpath to resolve symlinks in MSF_ROOT
2014-07-14 09:42:49 -05:00
Luke Imhoff
73ee4ee870
Merge branch 'staging/electro-release' into bug/MSP-10684-electro-installers
...
MSP-10684
2014-07-14 09:33:11 -05:00
jvazquez-r7
31c447e217
Update binaries
2014-07-14 08:50:30 -05:00
David Bloom
667b1363f3
Delete dbvis_enum.rb
2014-07-14 10:57:53 +02:00
David Bloom
0ef0f6aae1
Update dbvis_enum.rb
2014-07-14 10:54:43 +02:00
David Bloom
bcbb0b4fde
dbvis connections gathering
...
DbVisualizer stores the user database configuration in dbvis.xml.
This module retrieves the connections settings from this file.
2014-07-14 10:49:20 +02:00
Trenton Ivey
68d69060fd
Merge pull request #1 from todb-r7/pr3285-wiki
...
Fix up #3285 (very minor changes)
2014-07-13 20:19:25 -05:00
jvazquez-r7
31a615c828
Land #3517 , @m-1-k-3's typo fix
2014-07-13 18:21:49 -05:00
midnitesnake
5c101794d6
Fix Solaris sadmind_exec.rb
2014-07-13 17:49:46 +01:00
Trevor Rosen
b05b2657bc
Now importing creds dumps inside msf zips
...
MSP-9948
2014-07-13 11:07:01 -05:00
Michael Messner
1b7008dafa
typo in name
2014-07-13 13:24:54 +02:00
midnitesnake
8814863a00
applied todbs snmp fixs for OSX https://dev.metasploit.com/redmine/issues/7480
...
added psProcessUsername MIB to snmp_enumusers - to enumerate users on Solaris Systems
2014-07-13 10:27:45 +01:00
James Lee
e68dcdbb06
Refactor pop3_login
...
Also adjusts timeout in the scanner class to account for Dovecot's
default "Authentication Penalty" delay.
See http://wiki2.dovecot.org/Authentication/Penalty
2014-07-11 17:26:49 -05:00
William Vu
2fd7bcf8bf
Land #3514 , report_note for scraper
2014-07-11 17:17:10 -05:00
William Vu
00bd540e41
Land #3512 , counter for report_note
2014-07-11 17:16:35 -05:00
nodeofgithub
5d833cbb16
http_header report_note remove to_s
2014-07-11 17:14:45 -05:00
nodeofgithub
7e9eb84531
http_header report_note remove brackets, move rport
2014-07-11 17:14:45 -05:00
nodeofgithub
a8ec733a3a
Interpolate all the things!
2014-07-11 17:14:09 -05:00
nodeofgithub
4abe856fc1
Rescue http_header notes from getting truncated
...
Seems that only one header line gets added to host notes, and the rest are thrown away. This adds the counter number to the type string, so that each header line entry is unique and correctly saved. I also added port in case you want headers from several ports on one host without the previous getting overwritten.
(scanning shodanhq.com)
----BEFORE----
msf auxiliary(http_header) > run -j
[*] Auxiliary module running as background job
msf auxiliary(http_header) >
[*] 162.159.245.38:80: requesting / via HEAD
[*] 162.159.245.38:80: deleted header Expires
[*] 162.159.245.38:80: CF-RAY: 1485d013ca880773-EWR
[*] 162.159.245.38:80: CACHE-CONTROL: max-age=15
[*] 162.159.245.38:80: CONNECTION: keep-alive
[*] 162.159.245.38:80: CONTENT-TYPE: text/html; charset=UTF-8
[*] 162.159.245.38:80: DATE: Fri, 11 Jul 2014 14:50:20 GMT
[*] 162.159.245.38:80: SERVER: cloudflare-nginx
[*] 162.159.245.38:80: SET-COOKIE: __cfduid=d3914e07fc681306bb53129adb3e6b1d41405090220122; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; HttpOnly
[+] 162.159.245.38:80: detected 7 headers
[*] Scanned 1 of 1 hosts (100% complete)
msf auxiliary(http_header) > notes
[*] Time: 2014-07-11 14:50:19 UTC Note: host=162.159.245.38 type=HTTP header data="SET-COOKIE: __cfduid=d3914e07fc681306bb53129adb3e6b1d41405090220122; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; HttpOnly"
msf auxiliary(http_header) >
----AFTER----
msf auxiliary(http_header) > run -j
[*] Auxiliary module running as background job
msf auxiliary(http_header) >
[*] 162.159.245.38:80: requesting / via HEAD
[*] 162.159.245.38:80: CF-RAY: 14869ad5c0970f57-FRA
[*] 162.159.245.38:80: CACHE-CONTROL: max-age=15
[*] 162.159.245.38:80: CONNECTION: keep-alive
[*] 162.159.245.38:80: CONTENT-TYPE: text/html; charset=UTF-8
[*] 162.159.245.38:80: DATE: Fri, 11 Jul 2014 17:08:45 GMT
[*] 162.159.245.38:80: EXPIRES: Fri, 11 Jul 2014 17:09:00 GMT
[*] 162.159.245.38:80: SERVER: cloudflare-nginx
[*] 162.159.245.38:80: SET-COOKIE: __cfduid=db2918126c4b49780b4669e88b72580521405098525082; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; HttpOnly
[+] 162.159.245.38:80: detected 8 headers
[*] Scanned 1 of 1 hosts (100% complete)
msf auxiliary(http_header) > notes
[*] Time: 2014-07-11 17:08:44 UTC Note: host=162.159.245.38 type=http.80.header.0 data="CF-RAY: 14869ad5c0970f57-FRA"
[*] Time: 2014-07-11 17:08:44 UTC Note: host=162.159.245.38 type=http.80.header.1 data="CACHE-CONTROL: max-age=15"
[*] Time: 2014-07-11 17:08:44 UTC Note: host=162.159.245.38 type=http.80.header.2 data="CONNECTION: keep-alive"
[*] Time: 2014-07-11 17:08:44 UTC Note: host=162.159.245.38 type=http.80.header.3 data="CONTENT-TYPE: text/html; charset=UTF-8"
[*] Time: 2014-07-11 17:08:44 UTC Note: host=162.159.245.38 type=http.80.header.4 data="DATE: Fri, 11 Jul 2014 17:08:45 GMT"
[*] Time: 2014-07-11 17:08:44 UTC Note: host=162.159.245.38 type=http.80.header.5 data="EXPIRES: Fri, 11 Jul 2014 17:09:00 GMT"
[*] Time: 2014-07-11 17:08:44 UTC Note: host=162.159.245.38 type=http.80.header.6 data="SERVER: cloudflare-nginx"
[*] Time: 2014-07-11 17:08:44 UTC Note: host=162.159.245.38 type=http.80.header.7 data="SET-COOKIE: __cfduid=db2918126c4b49780b4669e88b72580521405098525082; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; HttpOnly"
msf auxiliary(http_header) >
2014-07-11 17:14:09 -05:00
Tod Beardsley
2c24cc5c00
Add .plugins to yardoc'able directories.
2014-07-11 14:23:01 -05:00
Tod Beardsley
53d941d4a8
Parens for readability
2014-07-11 14:22:47 -05:00
nodeofgithub
6ef69b4014
scraper report_note, remove eol whitespace
2014-07-11 21:21:56 +02:00
Tod Beardsley
174429eada
Test #3285
2014-07-11 14:10:01 -05:00
nodeofgithub
ad46c37988
scraper report_note, remove unnecessary to_s
2014-07-11 21:08:35 +02:00
nodeofgithub
7a7d149dc5
scraper report_note, change note type string
2014-07-11 21:01:20 +02:00
Tod Beardsley
e5d7dae016
Land #3513 , Author name fixups from @jvazquez-r7
2014-07-11 13:58:38 -05:00
jvazquez-r7
867098827a
Land jvazquez-r7#17, @todb-r7's fix for one author address
2014-07-11 13:56:40 -05:00
Tod Beardsley
b09fab13f0
Fix one flubbed author address
2014-07-11 13:50:37 -05:00
nodeofgithub
8b302cd472
Add report_note to scraper.rb
...
Just a suggestion. I always personally modify this. I use it to scrape titles often, and i prefer it to be saved in notes rather than wmap results, because i find it easier to search and automatically add results to rhosts.
2014-07-11 20:31:46 +02:00
nodeofgithub
b834e7d3cb
Update scraper.rb
2014-07-11 20:20:40 +02:00
nodeofgithub
da67a63ad0
Add report_note to scraper.rb
...
Just a suggestion. I always personally modify this. I use it to scrape titles often, and i prefer it to be saved in notes rather than wmap results, because i find it easier to search and automatically add results to rhosts.
2014-07-11 20:07:48 +02:00
jvazquez-r7
8937fbb2f5
Fix email format
2014-07-11 12:45:23 -05:00
William Vu
79603c9a73
Land #3505 , a bunch o' Linux post module fixes
2014-07-11 12:39:31 -05:00
Tod Beardsley
ced16acf9f
Land #3511 , new Linux Meterpreter bins
2014-07-11 12:17:08 -05:00
jvazquez-r7
eb9d2f130c
Change title
2014-07-11 12:03:09 -05:00
James Lee
af2e29612b
Merge branch 'staging/electro-release' into feature/MSP-10680/realm-key-fixes
2014-07-11 12:02:40 -05:00
James Lee
30e3ae7459
Merge branch 'staging/electro-release' into feature/MSP-10686/stop-after-user-success
2014-07-11 12:02:02 -05:00
jvazquez-r7
6de2be6ba7
Land #3503 , @m-1-k-3's exploit for DLink info.cgi bof OSVDB-108249
2014-07-11 12:01:17 -05:00
jvazquez-r7
a356a0e818
Code cleanup
2014-07-11 12:00:31 -05:00
jvazquez-r7
6fd1ff6870
Merge master
2014-07-11 11:40:39 -05:00
jvazquez-r7
d637171ac0
Change module filename
2014-07-11 11:39:32 -05:00
jvazquez-r7
c55117d455
Some cleanup
2014-07-11 11:39:01 -05:00
Trevor Rosen
cc93dbbe29
Merge pull request #102 from rapid7/feature/MSP-9707/smb-bruteforce-refactor
...
Feature/msp 9707/smb bruteforce refactor
MSP-9707 #land
2014-07-11 11:33:12 -05:00
jvazquez-r7
a7a700c70d
Land #3502 , @m-1-k-3's DLink devices HNAP Buffer Overflow CVE-2014-3936
2014-07-11 11:25:03 -05:00
jvazquez-r7
b9cda5110c
Add target info to message
2014-07-11 11:24:33 -05:00
jvazquez-r7
dea68c66f4
Update title and description
2014-07-11 10:38:53 -05:00
jvazquez-r7
f238c2a93f
change module filename
2014-07-11 10:30:50 -05:00
jvazquez-r7
f7d60bebdc
Do clean up
2014-07-11 10:28:31 -05:00
William Vu
43f41de124
Land #3508 , CVE-2014-4671 Flash JSONP disclosure
2014-07-11 10:11:48 -05:00
jvazquez-r7
8f3197c192
Land #3496 , @m-1-k-3's switch to CmdStager on dlink_upnp_exec_noauth
2014-07-11 09:50:57 -05:00
jvazquez-r7
4ea2daa96a
Minor cleanup
2014-07-11 09:50:22 -05:00
jvazquez-r7
51cfa168b1
Fix deprecation information
2014-07-11 09:47:30 -05:00
jvazquez-r7
46f5282fd3
Land #3455 , @m-1-k-3's exploit for DLink UPNP M-Search Command Injection
2014-07-11 09:39:05 -05:00
jvazquez-r7
611b8a1b6d
Modify title and ranking
2014-07-11 09:35:21 -05:00
jvazquez-r7
a9b92ee581
Change module filename
2014-07-11 09:17:56 -05:00
jvazquez-r7
36c6e74221
Do minor fixes
2014-07-11 09:17:34 -05:00
Brandon Turner
f29050b6b2
Use MSF_ROOT instead of MSP_ROOT
2014-07-10 20:22:50 -05:00
James Lee
4b16985eb8
Stop trying more creds for a user after success
...
This is more like the behavior of the old AuthBrute mixin, where a
scanner module was expected to return :next_user in the block given to
each_user_pass when it successfully authenticated.
The advantage is a reduced number of attempts that are very unlikely to
be successful since we already know the password. However, note that
since we don't compare realms, this will cause a false negative in the
rare case where the same username exists with different realms on the
same service.
MSP-10686
2014-07-10 17:48:58 -05:00
jvazquez-r7
074632043f
Update meterpreter binaries
2014-07-10 16:36:48 -05:00
Joshua Smith
dbe9b47937
lands 3469, fixes handler deadlock in corner cases
...
May affect the following RM issues which need to be retested:
https://dev.metasploit.com/redmine/issues/8407
https://dev.metasploit.com/redmine/issues/4314
https://dev.metasploit.com/redmine/issues/6829
2014-07-10 16:20:33 -05:00
joev
b8225ae2dc
Remove unnecessary ||= and ivars.
2014-07-10 16:06:28 -05:00
Brandon Turner
e6e88ab4fe
Allow declaring root via env var in gemspecs
...
The bundle build tasks temporarily relocate Gemfile and gemspecs to
temporary directories when packing bundles. For this to work, we can't
depend on the Gemfile/gemspec exisiting in a specific location relative
to other code.
This allows specifying the project root via the MSP_ROOT environment
variable. If you do not specify MSP_ROOT, the behavior is unchanged.
MSP-10684
2014-07-10 15:04:33 -05:00
joev
e0389dfbc3
Update code as per @wvu's code review.
2014-07-10 15:03:40 -05:00
James Lee
097d5d68ce
Display 'realm\user' for AD instead of 'user@realm'
2014-07-10 14:31:42 -05:00
James Lee
62a2f1dc0a
Credential -> Model for realm key constants
2014-07-10 14:30:25 -05:00
William Vu
74c1bfe615
Land #3510 , grammar fix for module descriptions
2014-07-10 14:00:30 -05:00
James Lee
e4039c2382
Merge branch 'staging/electro-release' into feature/MSP-10679/refactor-invalidate-login
2014-07-10 14:00:28 -05:00
Tod Beardsley
688c31cc44
Switch to a space. It gets eaten anyway.
2014-07-10 13:59:30 -05:00
James Lee
147c6d8160
Merge branch 'feature/MSP-10660/realm_adjustments' into staging/electro-release
2014-07-10 13:52:21 -05:00
Michael Messner
109201a5da
little auto detect fix
2014-07-10 20:45:49 +02:00
Michael Messner
781149f13f
little auto detect fix
2014-07-10 20:40:39 +02:00
Tod Beardsley
5bb3c8a581
Make merged module descriptions more grammar.
2014-07-10 13:31:57 -05:00
jvennix-r7
e104f73d5d
Merge pull request #103 from rapid7/bug/MSP-10683/pnd-login-task-assoc
...
Filler task dropped, login results in task assoc
2014-07-10 13:30:56 -05:00
David Maloney
8833429987
make shared example usage more readable
...
this seems less obtuse
2014-07-10 12:58:13 -05:00
Meatballs1
bd05ad1457
Merge pull request #52 from scriptjunkie/gpp_again
...
Fix table printing.
2014-07-10 18:52:38 +01:00
David Maloney
818bd1946d
final tweak for the http case
...
the only scenario in our final else that
would have a realm in the credential is the
http case in which case we want the realm to be there
still. otherwise the credential in this case has no
realm anyways so there is no need to strip one off
2014-07-10 12:39:01 -05:00
William Vu
1cbcc71832
Land #3509 , Meterpreter PHP hop description fix
2014-07-10 12:36:04 -05:00
David Maloney
7dc58d060e
make only one each method
...
made the one true enumerator of credentials
for the login_scanner.
also covered the wierd http case where it can have a realm key
but no default realm.
2014-07-10 12:35:09 -05:00
Samuel Huckins
5b1dc39caf
Filler task dropped, login results in task assoc
...
MSP-10683
* Task constraint now optional, so no need for filler
* Task ID now in service_data so it's passed to the core and the login
creation methods
2014-07-10 12:32:40 -05:00
joev
dd439066ca
Patch rhost to display hostname of JSONP_URL.
2014-07-10 12:02:22 -05:00
Tod Beardsley
bcec2df0a4
Fix Meterpreter PHP hop description
2014-07-10 11:35:48 -05:00
David Maloney
a319d5270e
set default connection tiemouts
...
loginscanners should have a default connection timeout
2014-07-10 11:35:10 -05:00
joev
841cb6a590
STEAL_URL -> STEAL_URLS.
2014-07-10 09:14:32 -05:00
joev
fad30bc874
Add flash rosetta exploit module for stealing URLs.
2014-07-10 09:09:10 -05:00
David Maloney
87e6ede123
Merge branch 'master' into staging/electro-release
2014-07-10 08:44:12 -05:00
Rob Fuller
755dec1629
msftidy up splunk_upload_app_exec
2014-07-10 00:24:48 -04:00
scriptjunkie
2cd9577278
Fix table printing.
2014-07-09 21:46:34 -05:00
James Lee
0daa395007
Fix specs for LoginError cases
2014-07-09 18:11:20 -05:00
David Maloney
1a0200f711
one more strip
2014-07-09 17:50:28 -05:00
David Maloney
25ee278097
strip vestigial realms
...
in the cases where we don't want a realm we should be
stripping it from the credential so we can build accurate results
2014-07-09 17:46:56 -05:00
James Lee
c5226352de
Un-login-able should be print_status, not good
2014-07-09 17:45:41 -05:00
James Lee
bb3525419e
Rescue the right thing
...
MSP-9707
2014-07-09 17:44:53 -05:00
Tod Beardsley
038d1e210a
Merge upstream/master to deconflict.
...
Conflicts:
Gemfile.lock
2014-07-09 17:43:42 -05:00
David Maloney
9bbf9486c7
fix schema bleedover
...
i accidentally polluted the schema earlier,
this should be fixed now
2014-07-09 17:26:22 -05:00
Joshua Smith
3a41bd983e
changes 'module' back to 'script', makes more sense
2014-07-09 17:25:39 -05:00
Joshua Smith
c6d7c8890d
resolves upstream conflict
2014-07-09 17:23:45 -05:00
Joshua Smith
a9e43c308e
removes lingering debug lines, changes word script to module
2014-07-09 17:05:35 -05:00
Gary Blosser
c14b96f02e
Add #3463 commits from @ghost
2014-07-09 17:56:06 -04:00
Joshua Smith
8bbaecc726
adds some additional protection against capilization issues
2014-07-09 16:46:28 -05:00
Joshua Smith
172bc450b3
adds TARGET to 'to_neuter' list
2014-07-09 16:46:28 -05:00
Joshua Smith
f4942eccd4
cleans up comments, line lengths, dup/clone
2014-07-09 16:46:28 -05:00
Joshua Smith
51db859432
uses exploit_type vs category, thx egypt
2014-07-09 16:46:28 -05:00
linuxchuck
ee56828bf7
New updates to scriptable.rb for payload/target
...
Additional w00t for your pwning pleasure.
2014-07-09 16:46:27 -05:00
Joshua Smith
62785784c6
adds explicit TARGET setting
2014-07-09 16:46:27 -05:00
Joshua Smith
cf595d6a10
fixes alias_method call
2014-07-09 16:46:27 -05:00
Joshua Smith
13f5450e53
uses clone instead of dup
2014-07-09 16:46:27 -05:00
Joshua Smith
bb13590f02
first shot at letting scriptable.rb handle local exploits
2014-07-09 16:46:27 -05:00
Joshua Smith
c957d0a1e7
adds category to msf/core/module.rb
2014-07-09 16:46:27 -05:00
David Maloney
0c4e53ce5a
fix up specs
...
a whole bunch of spec changes needed for
these changes.
alos the axis2 spec was actually testing the winrm
class due to copypasta error.
2014-07-09 16:32:59 -05:00
David Maloney
c7b37743ef
working realm coercion
...
LoginScanners will now figure out
the right thing to do about Realms
based on attributes of the Scanner itself
2014-07-09 15:56:39 -05:00
David Maloney
24fced822e
coerce realm_key when it exists
...
if the cred has a realm and the loginscanner
has a realm_key, make the credential use the
scanner's realm key
2014-07-09 14:58:20 -05:00
Michael Messner
f068006f05
auto target
2014-07-09 21:53:11 +02:00
Michael Messner
6a765ae3b0
small cleanup
2014-07-09 21:16:29 +02:00
David Maloney
766b50b5e0
REALM_KEY not _TYPE
...
arg typos
2014-07-09 14:01:41 -05:00
Michael Messner
0674314c74
auto target included
2014-07-09 20:56:04 +02:00
Michael Messner
b4812c1b7d
auto target included
2014-07-09 20:53:24 +02:00
James Lee
7d9c0da691
Record correct creds with non-success status
2014-07-09 13:26:49 -05:00
James Lee
afe36ab6ad
Merge branch 'staging/electro-release' into feature/MSP-9707/smb-bruteforce-refactor
...
Conflicts:
lib/metasploit/framework/login_scanner/smb.rb
2014-07-09 12:50:24 -05:00
David Maloney
5b66f07f59
migration changes on schema.rb
2014-07-09 12:22:09 -05:00
David Maloney
59c90bba22
version lock rspec
...
rspec 3 will cause problems for us right now
2014-07-09 12:21:41 -05:00
David Maloney
7325cfec64
add default realm values
...
for the scanners that take a realm
we know what the default realm to try is
so the Scanner should hold that info
2014-07-09 11:19:25 -05:00
David Maloney
bc18ca5762
add REALM_KEY to each LoginScanner
...
each LoginScanner should now know
what kind of REALM it takes
2014-07-09 10:53:37 -05:00
David Maloney
e5abfea36a
require new metasploit-credential and -model
...
get the new Realm Key constants after the
move to -model
2014-07-09 10:43:57 -05:00
David Maloney
487cf325d5
Merge branch 'staging/electro-release' into feature/MSP-10660/realm_adjustments
2014-07-09 10:35:34 -05:00
jvazquez-r7
42823fe15e
Test download_exec with linux meterpreter
2014-07-09 09:41:10 -05:00
jvazquez-r7
f4c6505351
Test mount_cifs_creds on linux meterpreter
2014-07-09 09:20:30 -05:00
jvazquez-r7
14b218dce5
Make hashdump compatible with meterpreter
2014-07-09 08:48:20 -05:00
jvazquez-r7
73fdc06d1d
Fix enum_xchat to work with meterpreter
2014-07-09 08:37:17 -05:00
Luke Imhoff
467c686701
Merge branch 'bug/MSP-10663/core-opts-needs-a-task-id' into staging/electro-release
...
MSP-10663
2014-07-08 19:45:11 -05:00
Luke Imhoff
dd75c645c3
Update metasploit-credential
...
MSP-10663
2014-07-08 19:44:38 -05:00
Trevor Rosen
a27c1d7dcc
Importing old export, making new models
...
MSP-9948
2014-07-08 19:14:26 -05:00
Trevor Rosen
574f4356e8
Update deps
2014-07-08 18:20:20 -05:00
jvazquez-r7
b47650580a
Fix bugs
2014-07-08 16:51:39 -05:00
jvazquez-r7
a364172978
Add meterpreter as session type
2014-07-08 16:25:50 -05:00
jvazquez-r7
c19deddfb1
Delete debug messages
2014-07-08 16:24:45 -05:00
jvazquez-r7
c25c5f6806
Make linux gather post modules compatible with meterpreter
2014-07-08 16:23:57 -05:00
Michael Messner
f89f47c4d0
dlink_dspw215_info_cgi_rop
2014-07-08 22:29:57 +02:00
Michael Messner
6fbd6bb4a0
stager
2014-07-08 22:17:02 +02:00
Michael Messner
ac727dae89
dlink_dsp_w215_hnap_exploit
2014-07-08 22:13:13 +02:00
Michael Messner
579ce0a858
cleanup
2014-07-08 21:58:15 +02:00
Michael Messner
51001f9cb3
Merge branch 'master' of git://github.com/rapid7/metasploit-framework into dlink_upnp_msearch_command_injection
2014-07-08 21:39:53 +02:00
Michael Messner
84d6d56e15
cleanup, deprecated
2014-07-08 21:36:07 +02:00
Michael Messner
10bcef0c33
cleanup, deprecated
2014-07-08 21:34:28 +02:00
dmaloney-r7
b65989ff0c
Merge pull request #100 from rapid7/bug/MSP-10661/glob-rb-files
...
Use glob instead of entries
2014-07-08 14:29:24 -05:00
Trevor Rosen
79054fae20
Remove credentials exportation from XML
...
MSP-9948
2014-07-08 12:03:32 -05:00
Lance Sanchez
9d3caf9c2f
Merge branch 'feature/MSP-10658/to_credential' into staging/electro-release
2014-07-08 11:17:17 -05:00
Lance Sanchez
6e11a4f789
changing the private_type
...
chainging trys to show these may all come back nil.
MSP-10658
2014-07-08 11:07:39 -05:00
Lance Sanchez
e6f13f6607
reformatting the hash
...
MSP-10658
2014-07-08 11:07:25 -05:00
William Vu
4eeab66ebe
Land #3497 , comma-separated get_cookies
2014-07-08 11:00:40 -05:00
James Lee
567435f508
Use glob instead of entries
...
Fixes the case where a non-ruby file exists in the login_scanner/
directory
2014-07-08 11:00:33 -05:00
Ahmed Elhady Mohamed
6719aea332
The module has been updated again
2014-07-08 17:03:24 +02:00
Trevor Rosen
8436adb5f8
Make XML export work with new backend
...
MSP-9948
* XML data looks ok in spot check
2014-07-08 09:40:15 -05:00
AnwarMohamed
e908bb6819
formating
2014-07-08 11:02:41 +02:00
AnwarMohamed
a513f403ba
fixing bugs
2014-07-08 10:58:48 +02:00
AnwarMohamed
ead7b35aa9
formating
2014-07-08 10:48:24 +02:00
AnwarMohamed
6e0bc763ff
formating
2014-07-08 10:46:16 +02:00
AnwarMohamed
656da8a63b
android extension
2014-07-08 04:56:04 +02:00
AnwarMohamed
34dcb609e2
android extension
2014-07-08 04:52:06 +02:00
AnwarMohamed
cd0f258502
Merge remote-tracking branch 'upstream/master'
2014-07-08 04:25:32 +02:00
David Maloney
38419dae83
fix to_credential on core
...
the Metasploit::Credential::Core to_credential
method now seats private_type and realm_key correctly
2014-07-07 18:05:04 -05:00
Lance Sanchez
d178b1f788
Merge branch 'bug/MSP-10654/compatibility' into staging/electro-release
2014-07-07 17:13:16 -05:00
Lance Sanchez
d7450dcbdf
updating dependencies
...
metasploit-credential to pre.electro.pre.release
metasploit-data-models to 0.18.0
MSP-10654
2014-07-07 17:02:22 -05:00
David Maloney
aeda74f394
Merge branch 'master' into staging/electro-release
...
Conflicts:
Gemfile
Gemfile.lock
2014-07-07 16:41:23 -05:00
dmaloney-r7
80bee35b70
Merge pull request #97 from rapid7/feature/MSP-10656/unify-ssh-scanners
...
Feature/msp 10656/unify ssh scanners
2014-07-07 16:37:41 -05:00
David Maloney
2c13ff4038
Merge branch 'staging/electro-release' into feature/MSP-10656/unify-ssh-scanners
2014-07-07 16:32:39 -05:00
dmaloney-r7
db8b0c907b
Merge pull request #94 from rapid7/feature/MSP-10648/login-scanner-creation
...
Feature/msp 10648/login scanner creation
2014-07-07 16:04:09 -05:00
Trevor Rosen
1d7de8fef9
Mid-work commit
...
MSP-9848
2014-07-07 15:44:29 -05:00
dmaloney-r7
c4c7ff519f
Merge pull request #96 from rapid7/feature/MSP-10657/add-private-type
...
Add private_type and realm_key accessors to Framework::Credential
2014-07-07 15:43:18 -05:00
David Maloney
b52c13228c
make private_type validation conditional
...
there are times when this won't be filled in
but the credential is still valid
2014-07-07 15:40:52 -05:00
Luke Imhoff
271fae07cf
Update to compatible dependencies
...
MSP-10654
2014-07-07 14:41:03 -05:00
dmaloney-r7
eda7e7297e
Merge pull request #95 from rapid7/feature/MSP-10649/remove-successes
...
Remove successes and failures
2014-07-07 13:58:40 -05:00
cdoughty-r7
e5b5439e47
Merge pull request #3500 from todb-r7/fixup-release
...
Release fixup: Description/whitespace changes (minor)
2014-07-07 13:56:07 -05:00
James Lee
4d4b8078f8
Unify SSH specs as well
2014-07-07 13:41:08 -05:00
James Lee
2a9ac0a007
Axe SSHKey in favor of a unified SSH
2014-07-07 13:35:17 -05:00
James Lee
71cbbc5388
Merge branch 'feature/MSP-10648/login-scanner-creation' into feature/MSP-10656/unify-ssh-scanners
2014-07-07 13:19:34 -05:00
James Lee
b7cfc927c4
Add private_type and realm_key accessors
2014-07-07 13:07:28 -05:00
Tod Beardsley
9fef2ca0f3
Description/whitespace changes (minor)
...
Four modules updated for the weekly release with minor cosmetic fixes.
- [ ] See all affected modules still load.
- [ ] See all affected modules have expected `info`
2014-07-07 12:39:05 -05:00
James Lee
cff2e1a1c1
And remove specs referencing obsolete accessors
2014-07-07 12:37:14 -05:00
James Lee
5c406a2aa5
Remove successes and failures
...
No reason to store them and they could fill a ton of unnecessary memory.
2014-07-07 12:33:15 -05:00
James Lee
7035064f3d
Assignment alignment for Dave
2014-07-07 12:30:04 -05:00
jvazquez-r7
f1fcc23a08
Land #3499 , Yokogawa's CVE-2014-3888 module
2014-07-07 11:37:11 -05:00
jvazquez-r7
cd6b83858b
Add new Yokogawa SCADA exploit
2014-07-07 11:20:49 -05:00
HD Moore
f8d738d062
Fix QWORD usage, merges #3498
2014-07-07 10:43:48 -05:00
OJ
bdf27b1834
Fix up the TLVs that are now QWORD values in MSF
...
Various values were adjusted to become QWORD values in MSF an windows
meterpreter, but the changes were not ported over to python, php and
java. This commit fixes this inconsistency.
2014-07-07 10:42:58 -05:00
James Lee
8df3ada087
Better docs
2014-07-07 10:18:42 -05:00
James Lee
325d2d25b9
Fix requires and derp typos
2014-07-07 10:09:45 -05:00
HD Moore
8f39590f0f
Framework is currently pegged to 0.17.0. Closes #3495
2014-07-07 09:43:05 -05:00
Luke Imhoff
d7908e3050
Update schema.rb
...
MSP-10654
2014-07-07 09:41:46 -05:00
AnwarMohamed
999c305d38
Merge remote-tracking branch 'upstream/master'
2014-07-07 16:29:24 +02:00
OJ
ddfd912354
Fix up the TLVs that are now QWORD values in MSF
...
Various values were adjusted to become QWORD values in MSF an windows
meterpreter, but the changes were not ported over to python, php and
java. This commit fixes this inconsistency.
2014-07-07 19:46:54 +10:00
HD Moore
5961861c97
Merge #2809 into master
2014-07-06 23:46:10 -05:00
HD Moore
6f433db609
Minor typo fix
2014-07-06 23:44:17 -05:00
HD Moore
3ef35f19dc
Prefer strip over chomp
2014-07-06 23:17:09 -05:00
HD Moore
d76081bcef
Prefer strip over chomp
2014-07-06 23:16:56 -05:00
HD Moore
ab7848a895
Merge master for testing of #2809
2014-07-06 22:27:58 -05:00
jvazquez-r7
14b1ed5290
Add spec for comma separated cookies
2014-07-06 16:23:43 -05:00
Michael Messner
e7ade9f84d
migrate from wget to echo mechanism
2014-07-06 21:45:53 +02:00
jvazquez-r7
f51feb7f52
Modify get_cookies regular expression
2014-07-06 13:22:31 -05:00
jvazquez-r7
5e7f356f31
Land #3494 , @Firefart's update for Mailpoet's exploit
2014-07-06 11:27:18 -05:00
HD Moore
740f75d0bf
Match masters preferred MDM version
2014-07-06 09:52:04 -05:00
HD Moore
16af8b8c5c
Use MDM 0.17.0 stock as master branch is broken.
...
This resolves all issues I know of with the recog branch on
Metasploit Framework, but obviously most of the benefits of
this branch come from having a recog-aware MDM, something
that can't happen until MDM 0.17.6+ is supported by the
framework.
In short, this should be good to merge, but will not solve
the intended problems until MDM 0.17.6+ is fixed for MSF
2014-07-06 09:36:08 -05:00
HD Moore
b6b5435a3d
Fix service pack parsing
2014-07-06 09:24:36 -05:00
HD Moore
90f3916259
Remove duplicate packetfu inclusion after merge
2014-07-06 09:19:14 -05:00
HD Moore
43d65cc93a
Merge branch 'master' into feature/recog
...
Resolves conflicts:
Gemfile
data/js/detect/os.js
modules/exploits/android/browser/webview_addjavascriptinterface.rb
2014-07-06 09:17:44 -05:00
Christian Mehlmauer
d5843f8eaf
Updated Mailpoet exploit to work with another version
2014-07-06 10:53:40 +02:00
William Vu
cf5d29c53b
Add EOF newline to satisfy msftidy
2014-07-05 13:51:12 -05:00
William Vu
84a3b94679
Land #3493 , small fixes for WP MailPoet module
2014-07-05 13:50:09 -05:00
HD Moore
6d9bf83ded
Small fixes for the recent WP MailPoet module
...
Correct casing in the title
Anchor the use of ::File
Force body.to_s since it can be nil in corner cases
2014-07-05 13:17:23 -05:00
jvazquez-r7
98a82bd145
Land #3486 , @brandonprry's exploit for CVE-2014-4511 gitlist RCE
2014-07-04 16:41:04 -05:00
jvazquez-r7
59881323b9
Clean code
2014-07-04 16:40:16 -05:00
Brandon Perry
6c18ee884e
Create sqlmap.rb
2014-07-04 10:54:07 -05:00
Brandon Perry
68a0e7c16e
Create sqlmap_session.rb
2014-07-04 10:53:37 -05:00
Brandon Perry
88c44bf4f5
Create sqlmap_manager.rb
2014-07-04 10:53:14 -05:00
Tod Beardsley
a471f298a5
Merge #3476 into #3481 for meterpreter smilies
...
This incoporates @OJ's fixes as a result of gemification.
2014-07-03 22:54:56 -05:00
James Lee
311f43f1e4
Constpocalypse
2014-07-03 18:49:46 -05:00
jvazquez-r7
aedd347191
Land all the commits on #3491 , @jlee-r7's patch for php meterpreter
2014-07-03 18:14:52 -05:00
jvazquez-r7
20cf25da7e
Land #3491 , @jlee-r7's fix for php meterpreter on php 5.5.0
2014-07-03 18:11:20 -05:00
Brandon Perry
a33a6dc79d
add bash to requiredcmd
2014-07-03 16:52:52 -05:00
James Lee
41cd5527c8
Close the server socket in php bind stager
...
This was previously left dangling, which leaves the port open, but
doesn't do anything with subsequent connections.
2014-07-03 16:52:09 -05:00
Brandon Perry
806f26424c
&& not and
2014-07-03 16:50:21 -05:00
Brandon Perry
6fb2fc85a0
address @jvasquez-r7 review points
2014-07-03 16:43:01 -05:00
James Lee
9246f7a0ce
Strip the NULL that PHP no longer strips
...
As of PHP 5.5.0, unpack("a", ...) no longer strips the NULL byte from
the end of the string. A new format specifier, Z, was introduced to
perform the old behavior, but we don't have a good way to test for its
existence. Instead, just remove it with str_replace
2014-07-03 15:58:05 -05:00
Trevor Rosen
c1fc68e1b1
Replace to_pwdump internals
...
MSP-9948
2014-07-03 15:41:26 -05:00
jvazquez-r7
2efa3d6bc0
Land #3487 , @FireFart's exploit for WordPress MailPoet file upload
2014-07-03 14:34:58 -05:00
sinn3r
f1b7a9f421
Land #3488 - loot storage into the enum_services post module
2014-07-03 14:18:16 -05:00
sinn3r
79c433e7ea
Land #3480 - Oracle Event Processing FileUploadServlet Arbitrary File Upload
2014-07-03 14:09:12 -05:00
sinn3r
c207d14d1f
Update description
2014-07-03 14:08:31 -05:00
Trevor Rosen
45a1c6f0e6
Update deps
2014-07-03 13:55:10 -05:00
jvazquez-r7
97a6b298a8
Use print_warning
2014-07-03 13:38:20 -05:00
Chris
bb54fecdd1
Merge pull request #1 from wchen-r7/pr3488_fix
...
More cosmetic fixes for enum_services
2014-07-03 19:31:38 +01:00
Christian Mehlmauer
dcba357ec3
implement feedback
2014-07-03 20:27:08 +02:00
sinn3r
2c999d3099
Better describe the problem
2014-07-03 13:06:19 -05:00
sinn3r
9aa3c75234
Do something for the shut-everything-up event handling practice
2014-07-03 13:04:56 -05:00
sinn3r
8a513058f6
Fix comments
2014-07-03 12:59:10 -05:00
sinn3r
ebeb9880a6
Favor "unless" over "if" for negative conditions
...
Please refer to https://github.com/bbatsov/ruby-style-guide
2014-07-03 12:55:13 -05:00
sinn3r
1d828a951f
string interpolation is preferred over concatenation
...
Please refer to https://github.com/bbatsov/ruby-style-guide
2014-07-03 12:46:56 -05:00
sinn3r
b781b87d74
Avoid unnecessary "if not"
2014-07-03 12:44:17 -05:00
Brandon Perry
86a31b1896
Update gitlist_exec.rb
2014-07-03 12:40:37 -05:00
Christian Mehlmauer
aeb4fff796
Added FileDropper
2014-07-03 19:25:31 +02:00
jvazquez-r7
51695c4932
Land #2484 , @zeroSteiner's refactoring for CmdStager
2014-07-03 11:33:46 -05:00
Spencer McIntyre
c041682c9b
Land additional cmdstager specs from @jvazquez-r7
2014-07-03 11:46:56 -04:00
jvazquez-r7
405de05e4b
Add specs for module_flavors
2014-07-03 10:31:39 -05:00
Jon Hart
bc3ac1ee36
Correct private message format, update tests
2014-07-03 08:27:27 -07:00
jvazquez-r7
17da89927e
Merge @zeroSteiner's updates
2014-07-03 10:18:15 -05:00
Spencer McIntyre
d93bf55435
Add a module_flavors method for all available flavors
2014-07-03 11:01:21 -04:00
Jon Hart
1500f33e1b
Default to only fuzzing versions 2-4
2014-07-03 07:32:44 -07:00
Christian Mehlmauer
b15297eee0
Land #3490 , @Meatballs1 tns listener verbose output
2014-07-03 16:20:38 +02:00
jvazquez-r7
5e0211016d
Merge to solve conflicts
2014-07-03 09:16:04 -05:00
James Lee
b7a55d402d
Add likely service ports and names for HTTP
2014-07-02 23:41:31 -05:00
James Lee
9dde47a0bc
Add a simple classes_for_service method
2014-07-02 23:31:56 -05:00
Christian Mehlmauer
071f236946
Changed check method
2014-07-02 22:31:02 +02:00
Christian Mehlmauer
a58ff816c5
Changed check method
2014-07-02 22:29:00 +02:00
sinn3r
90df0f1bb5
Land #3489 - Add verbosity to Jenkins Enum
2014-07-02 14:40:25 -05:00
sinn3r
ecba95644d
Land #3473 - skype post module to extract password hash
2014-07-02 14:34:10 -05:00
Michael Messner
e5b441314c
removed wrong edit ...
2014-07-02 21:33:49 +02:00
Michael Messner
8f55af5f9d
UPnP check included
2014-07-02 21:28:39 +02:00
Michael Messner
ac2e84bfd6
check included
2014-07-02 21:24:50 +02:00
Rob Fuller
c6675a2900
Add verbosity to Jenkins Enum
2014-07-02 13:25:18 -04:00
Your Name
9981a60b27
Add loot storage into the enum_service post module
2014-07-02 17:56:16 +01:00
Your Name
83abf4b523
Add loot storage into the enum_service post module
2014-07-02 17:48:48 +01:00
Christian Mehlmauer
40175d3526
added check method
2014-07-02 11:07:58 +02:00
Christian Mehlmauer
54a28a103c
Updated description
2014-07-02 10:49:28 +02:00
Christian Mehlmauer
1ff549f9c1
Replaced Tab
2014-07-02 10:35:30 +02:00
Christian Mehlmauer
09131fec28
Added wysija file upload exploit
2014-07-02 10:24:27 +02:00
James Lee
e9436743e8
Merge branch 'feature/MSP-9749/oracle_hashdump' into staging/electro-release
2014-07-01 17:55:56 -05:00
William Vu
68ba79aa16
Remove access_level, since we don't have access
2014-07-01 17:53:18 -05:00
William Vu
5fa0981026
Add login and move print_status
2014-07-01 17:48:42 -05:00
jakxx
a735fd3c59
Update web_delivery.rb
2014-07-01 16:52:18 -04:00
Jon Hart
1830bdc7a5
Add rspec coverage for Rex::Proto::NTP
2014-07-01 12:29:47 -07:00
James Lee
f0cb235393
Merge branch 'feature/MSP-9735/gpp' into staging/electro-release
2014-07-01 14:28:15 -05:00
William Vu
864f0f1bbc
Update description, loot -> creds
2014-07-01 11:46:21 -05:00
William Vu
bfc6c87119
Land #3486 , release fixes
...
Now with more @wchen-r7!
2014-07-01 11:04:06 -05:00
sinn3r
21f6e7bf6c
Change description
2014-07-01 10:44:21 -05:00
sinn3r
449fde5e7c
Description update
2014-07-01 10:26:52 -05:00
sinn3r
c43006f820
Update cogent module description, fix msftidy warnings
2014-07-01 10:06:33 -05:00
Jon Hart
bc274b358f
Move NTP message code to Rex::Proto::NTP, simplify option handling
2014-06-30 23:57:47 -07:00
William Vu
3079c47d41
Refactor oracle_hashdump creds
2014-07-01 01:07:22 -05:00
Rob Fuller
d341fc20a8
switch to use file? instead of stat
2014-07-01 00:58:17 -04:00
Brandon Perry
db6524106e
one more typo, last one I swear
2014-06-30 22:33:19 -05:00
Brandon Perry
d7dfa67e94
typo
2014-06-30 20:15:25 -05:00
Brandon Perry
acedf5e847
Update gitlist_exec.rb
...
Fix EDB ref and no twitter handles.
2014-06-30 20:12:08 -05:00
Brandon Perry
ecc1b08994
Create gitlist_exec.rb
...
This adds a metasploit module for CVE-2014-4511
2014-06-30 20:10:24 -05:00
jvazquez-r7
bf9c64d3ee
Land #3483 , @hmoore-r7's title change for ipmi_cipher_zero
2014-06-30 17:31:12 -05:00
Trevor Rosen
2da890810a
Make db_import use Metasploit Credential
...
MSP-9948
* Special-case the pwdump file to be IO
* Had to use lotsa shims
2014-06-30 13:32:59 -05:00
HD Moore
4ff211ec8d
Fix the spec to allow for 1 or more spaces between
2014-06-30 13:18:43 -05:00
Meatballs
cf720a88e8
Be verbose about error codes
2014-06-30 19:10:03 +01:00
HD Moore
84c0504b1b
MSI sections actually need to be signed after all
2014-06-30 13:08:28 -05:00
Meatballs
f8ef6c50b4
Land #3470 , Cerberus SFTP User Enumeration
2014-06-30 19:01:15 +01:00
Meatballs
94c5a0b603
More verbose around connection errors
2014-06-30 18:56:30 +01:00
Meatballs
183d601aae
Small tidyup
2014-06-30 18:17:49 +01:00
jvennix-r7
52515c167a
Merge pull request #90 from rapid7/feature/MSP-9743/hashdump
...
Merge #90 , @wvu's refactor of post/osx/gather/hashdump to use the new creds model.
2014-06-30 12:11:45 -05:00
attackdebris
004afa6e0c
Clean commit of Cerberus FTP User Enumeration Module
2014-06-30 17:53:46 +01:00
William Vu
92963d4999
Fix broken NTLM hash format
2014-06-30 11:35:28 -05:00
Trevor Rosen
cf9c3caea3
Get the latest
...
Merge branch 'staging/electro-release' into feature/MSP-9848/db-export-refactor
2014-06-30 11:14:11 -05:00
HD Moore
c9b6c05eab
Fix improper use of host-endian or signed pack/unpack
...
Note that there are some cases of host-endian left, these
are intentional because they operate on host-local memory
or services.
When in doubt, please use:
```
ri pack
```
2014-06-30 02:50:10 -05:00
HD Moore
255e792ed3
Fix host-endian related pack errors. See below for details.
...
Ruby treats endianess in pack operators in the opposite way
of python. For example, using pack('<I') actually ignores the
endianess specifier. These need to be 'I<' or better yet, 'V'.
The endian specify must occur after the pack specifier and
multiple instances in meterpreter and exe generation were
broken in thier usage.
The summary:
Instead of I/L or I< use V
Instead of I/L or I> use N
For Q, you need to always use Q< (LE) or Q> (BE)
For c/s/l/i and other lowercase variants, you probably dont
need or want a *signed* value, so stick with vV nN and cC.
2014-06-30 02:46:36 -05:00
HD Moore
72d8d8a40c
RAKP defines auth, not cipher-0 bypass, see below.
...
Dan Farmer noted that the RAKP reference in the title was not correct
and that RAKP is a separate issue and protocol implementation than
the use of Cipher Zero to perform an authentication bypass.
Cosmetic only change
2014-06-30 00:52:40 -05:00
HD Moore
4bff68ff2b
Use the specified UA, dont duplicate ports
2014-06-30 00:49:21 -05:00
HD Moore
6e8415143c
Fix msftidy and tweak a few modules missing timeouts
2014-06-30 00:46:28 -05:00
HD Moore
a279db7710
Check for sock.get / udp_sock.get issues
2014-06-30 00:40:06 -05:00
Tod Beardsley
8b63d3d467
Revert the revert of #3446
...
This reverts commit 9b35b0e13a .
This should not land on master until the Metasploit Pro folks (@trosen-r7
and friends) get their Meterpreter path specifications working the
same way as Framework's does.
2014-06-29 17:22:21 -05:00
jvazquez-r7
1acd5e76cb
Add check code for event processing 12
2014-06-29 15:47:57 -05:00
jvazquez-r7
a94396867c
Add module for ZDI-14-106, Oracle Event Processing
2014-06-29 15:44:20 -05:00
Spencer McIntyre
faa9c11450
Dont deregister an option that is in use
2014-06-28 18:22:17 -04:00
Spencer McIntyre
748589f56a
Make cmdstager flavor explicit or from info
...
Every module that uses cmdstager either passes the flavor
as an option to the execute_cmdstager function or relies
on the module / target info now.
2014-06-28 17:40:49 -04:00
HD Moore
e806222512
Fix bad copypast, sock.get usage, HTTP mistakes
2014-06-28 16:18:16 -05:00
HD Moore
90eccefcc8
Fix sock.get use and some minor bugs
2014-06-28 16:17:15 -05:00
HD Moore
baa877ef17
Switch to get_once for consistency
2014-06-28 16:10:49 -05:00
HD Moore
c8e44c341c
Fix use of sock.get vs sock.get_once
2014-06-28 16:10:18 -05:00
HD Moore
7f06d10ba6
Dont blindly strip a possible nil return value
2014-06-28 16:08:06 -05:00
HD Moore
5e900a9f49
Correct sock.get() to sock.get_once() to prevent indefinite hangs/misuse
2014-06-28 16:06:46 -05:00
HD Moore
6e80481384
Fix bad use of sock.get() and check() implementations
...
Many of these modules uses sock.get() when they meant get_once()
and their HTTP-based checks were broken in some form. The response
to the sock.get() was not being checked against nil, which would
lead to stack traces when the service did not reply (a likely
case given how malformed the HTTP requests were).
2014-06-28 16:05:05 -05:00
HD Moore
3868348045
Fix incorrect use of sock.get that leads to indefinite hang
2014-06-28 15:48:58 -05:00
HD Moore
3ae91410f5
Fix incorrect use of sock.get(), remove rundant return values
2014-06-28 15:24:02 -05:00
HD Moore
6d0d8a911d
Fix incorrect use of sock.get() that could lead to indefinite hang
2014-06-28 15:22:16 -05:00
HD Moore
a9cd9c584a
Respect RPORT even if additional ports are specified
2014-06-28 15:21:54 -05:00
Spencer McIntyre
bd49d3b17b
Explicitly use the echo stager and deregister options
...
Certain modules will only work with the echo cmd stager so
specify that one as a parameter to execute_cmdstager and
remove the datastore options to change it.
2014-06-28 16:21:08 -04:00
HD Moore
43420aa984
Fix incorrect use of sock.get that can lead to an indefinite timeout
...
console1:
```
msf> use auxiliary/scanner/http/open_proxy
msf auxiliary(open_proxy) > set RHOSTS 192.168.0.4
msf auxiliary(open_proxy) > set RPORT 8888
msf auxiliary(open_proxy) > run
< the connection never times out >
```
console2:
```
$ nc -vlp 8888
Listening on [0.0.0.0] (family 0, port 8888)
Connection from [192.168.0.4] port 8888 [tcp/*] accepted (family 2, sport 43245)
GET http://209.85.148.147/ HTTP/1.1
Host: 209.85.148.147
Connection: close
User-Agent: user_agent
Accept-Encoding: *
Accept-Charset: ISO-8859-1,UTF-8;q=0.7,*;q=0.7
Cache-Control: no
Accept-Language: de,en;q=0.7,en-us;q=0.3
```
After the patch, requests timeout after 10 seconds:
```
msf auxiliary(open_proxy) > run
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
```
2014-06-28 15:18:11 -05:00
HD Moore
3e1ac3fee1
This module was broken due to a hardcoded IP address for google.com
2014-06-28 15:14:29 -05:00
William Vu
90fb07ba6d
Use downcase instead of upcase
2014-06-27 14:12:10 -05:00
David Maloney
b680674b95
Merge branch 'master' into staging/electro-release
2014-06-27 11:55:57 -05:00
dmaloney-r7
0a6a5a0a12
Merge pull request #92 from rapid7/feature/MSP-9912/metamodule-refactor-ssh-key
...
Feature/msp 9912/metamodule refactor ssh key
2014-06-27 11:48:57 -05:00
William Vu
aaeca5ce5b
Remove user field from PBKDF2 hash
2014-06-27 11:26:45 -05:00
Samuel Huckins
f9f9849c7f
Merge pull request #91 from rapid7/feature/MSP-9642/pcap_credential_creation
...
Specs passing, cred imported looks good
MSP-9642 #land
2014-06-27 11:17:24 -05:00
Lance Sanchez
c1877cfba2
fixing the broken to_credential test
...
MSP-9912
2014-06-27 10:06:38 -05:00
AnwarMohamed
fe34211c93
Merge remote-tracking branch 'upstream/master'
2014-06-27 16:43:13 +02:00
Spencer McIntyre
42ac3a32fe
Multi-fy two new linux/http/dlink exploits
2014-06-27 08:40:27 -04:00
Spencer McIntyre
41d721a861
Update two modules to use the new unified cmdstager
2014-06-27 08:34:57 -04:00
Spencer McIntyre
1b4b4fd1c0
Update the cmdstager spec ArgumentError text
2014-06-27 08:34:57 -04:00
Spencer McIntyre
ea077b2f12
Improve the guess_flavor logic to pull from module info
2014-06-27 08:34:57 -04:00
Spencer McIntyre
952c935730
Use a semi-intelligent OptEnum for CMDSTAGER::FLAVOR
2014-06-27 08:34:57 -04:00
Spencer McIntyre
219153c887
Raise NotImplementedError and let :flavor be guessed
2014-06-27 08:34:56 -04:00
Spencer McIntyre
4d4c5e5d6e
Update two modules to use the new cmd stager
2014-06-27 08:34:56 -04:00
jvazquez-r7
dcd0e77f9e
Change #compatible? method name because it's used by Module
2014-06-27 08:34:56 -04:00
jvazquez-r7
af568c856a
Add CMStager specs
2014-06-27 08:34:56 -04:00
jvazquez-r7
31acc4a528
Fix #compatible? method
2014-06-27 08:34:56 -04:00
jvazquez-r7
ddd1dd5155
The check for required decoder hasn't a lot of sense
2014-06-27 08:34:56 -04:00
jvazquez-r7
9c6a521b94
Fix select_decoder
2014-06-27 08:34:56 -04:00
jvazquez-r7
dad2c75592
Initialize opts arguments
2014-06-27 08:34:56 -04:00
jvazquez-r7
381dea94d0
Fix typo
2014-06-27 08:34:56 -04:00
jvazquez-r7
cbc1bd9966
Redesign constants
2014-06-27 08:34:56 -04:00
jvazquez-r7
160147b370
Make some methods not dependant of the instance flavor
2014-06-27 08:34:56 -04:00
jvazquez-r7
45248dcdec
Add YARD documentation for methods
2014-06-27 08:34:56 -04:00
jvazquez-r7
68938e3d7a
Add select_cmdstager
2014-06-27 08:34:56 -04:00
jvazquez-r7
35d035fa4e
Add YARD docu for execute_cmdstager
2014-06-27 08:34:56 -04:00
jvazquez-r7
e8f9dde50f
Allow datastore options and opts to use strings instead of sym
2014-06-27 08:34:56 -04:00
jvazquez-r7
870fa96bd4
Allow quotes in CmdStagerFlavor metadata
2014-06-27 08:34:56 -04:00
jvazquez-r7
37d0dd59e8
Clean up a little CMDStager methods
2014-06-27 08:34:56 -04:00
jvazquez-r7
8db7ec683f
Fix setup and teardown stager methods
2014-06-27 08:34:55 -04:00
jvazquez-r7
91e2e63f42
Add CmdStagerFlavor to metadata
2014-06-27 08:34:55 -04:00
jvazquez-r7
dd7b2fc541
Use constants
2014-06-27 08:34:55 -04:00
jvazquez-r7
9e413670e5
Include the CMDStager
2014-06-27 08:34:55 -04:00
jvazquez-r7
d47994e009
Update modules to use the new generic CMDstager mixin
2014-06-27 08:34:55 -04:00
jvazquez-r7
8bf36e5915
AutoDetection should work
2014-06-27 08:34:55 -04:00
jvazquez-r7
778f34bab6
Allow targets and modules to define compatible stagers
2014-06-27 08:34:55 -04:00
jvazquez-r7
74a6de828a
Cannot delete @cmd_list, is used at least by one module
2014-06-27 08:34:55 -04:00
jvazquez-r7
7ced5927d8
Use One CMDStagermixin
2014-06-27 08:34:55 -04:00
jvazquez-r7
0a99b549d6
Change filenames
2014-06-27 08:34:55 -04:00
jvazquez-r7
cff580162b
Move stagers
2014-06-27 08:34:55 -04:00
Spencer McIntyre
2a442aac1f
No long needs to extend bourne, and specify a flavor.
2014-06-27 08:34:55 -04:00
Spencer McIntyre
9991316ae6
Minor code cleanup and honor the datastore decoder.
2014-06-27 08:34:55 -04:00
Spencer McIntyre
1a392e2292
Multi-fy the hyperic_hq_script_console exploit.
2014-06-27 08:34:55 -04:00
Spencer McIntyre
80bdf750e9
Multi-fy the new printf stager and add to sshexec.
2014-06-27 08:34:55 -04:00
Spencer McIntyre
ae25c300e5
Initial attempt to unify the command stagers.
2014-06-27 08:34:55 -04:00
Trevor Rosen
a86610dad5
Gut and delegate import_msf_pwdump
...
MSP-9848
2014-06-26 16:47:42 -05:00
David Maloney
56b94fea4f
pcap import now creates creds
...
refactored cred creation to use Metasploit::Credential
for captured HTTP basic auth credentials gatehered on the wire
2014-06-26 15:34:40 -05:00
William Vu
6e1fa8ff5a
Refactor OS X hashdump creds
2014-06-26 15:10:35 -05:00
sinn3r
a60dfdaacb
Land #3471 - HP AutoPass License Server File Upload
2014-06-26 14:34:32 -05:00
sinn3r
ce5d3b12e7
Land #3403 - MS13-097 Registry Symlink IE Sandbox Escape
2014-06-26 13:48:28 -05:00
sinn3r
0b6f7e4483
Land #3404 - MS14-009 .NET Deployment Service IE Sandbox Escape
2014-06-26 11:45:47 -05:00
sinn3r
6075c795e9
Land #3467 - failure message for nil payload
2014-06-26 11:12:37 -05:00
Lance Sanchez
b5351eec2b
adding .to_credential
...
Metasploit::Framework::Credential and Metasploit::Credential::Core
need to be consumable by the login scanners. the easiest way to do this
was to create a shared to_credential method on both that return Metasploit::Framework::Credential
MSP-9912
2014-06-26 11:05:59 -05:00
David Maloney
9cec330f05
Merge branch 'master' into staging/electro-release
2014-06-26 10:22:30 -05:00
jakxx
4da28f1708
updated platform
2014-06-25 22:01:19 -04:00
James Lee
48e93b7fc2
Merge branch 'feature/MSP-9715/linux_hashcracker' into staging/electro-release
2014-06-25 16:15:44 -05:00
Matt Buck
27ef12bafe
Land #3478 , disallow port 0 for portspec
...
[Closes #3478 ]
2014-06-25 15:46:30 -05:00
jakxx
54ccc261d1
Updates
...
Updated spacing, ranking, php command, platform, and merged *nix and
windows cmds
2014-06-25 16:34:51 -04:00
David Maloney
34c57f51b1
Merge branch 'staging/electro-release' of github.com:rapid7/metasploit-framework-private into staging/electro-release
2014-06-25 15:02:35 -05:00
David Maloney
9f33be81e0
Merge branch 'feature/MSP-9718/deprectae_unshadow' into staging/electro-release
2014-06-25 15:02:13 -05:00
David Maloney
ac61a8fe4f
deprecate jtr_unshadow
2014-06-25 15:01:35 -05:00
James Lee
75be200b97
Merge branch 'feature/MSP-9714/jtr_aix' into staging/electro-release
2014-06-25 14:34:41 -05:00
Lance Sanchez
07d548caeb
dropping lib from shared examples
...
MSP-9912
2014-06-25 14:32:43 -05:00
James Lee
70fd3344fd
Merge branch 'feature/MSP-9713/jtr_crack_fast' into staging/electro-release
2014-06-25 14:15:50 -05:00
David Maloney
42bfe8ba4f
make portspec specs not insane
...
the specs for the portspec_to_portlist method
need a lot of work. this gives us some btter minimum coverage
2014-06-25 14:10:06 -05:00
Chris Doughty
9b35b0e13a
Revert "Land #3446 -- Meterpreter bins gem switch" due to build failures
...
This reverts commit bba8bd3498 , reversing
changes made to 002234993f .
2014-06-25 13:24:07 -05:00
David Maloney
97d08a081a
reverting port 0 behaviour in portspec
...
a change was made to protspec that allowed port 0
when we explicitly dissallowed port 0. This change caused
other code that depended on this behaviour to break
2014-06-25 13:07:22 -05:00
David Maloney
61d8597a00
missing require
2014-06-25 10:13:41 -05:00
David Maloney
5b0a356045
properly strip extra colons
2014-06-25 10:04:48 -05:00
James Lee
4e0bcc123d
More useful msg when domain is ignored
2014-06-25 10:01:07 -05:00
Trevor Rosen
f5ea6db604
Merge pull request #86 from rapid7/feature/MSP-9719/postgres_crack
...
Feature/msp 9719/postgres crack
MSP-9719 #land
2014-06-25 09:19:55 -05:00
Trevor Rosen
6696783b86
Merge pull request #85 from rapid7/feature/MSP-9717/mysql_crack
...
Feature/msp 9717/mysql crack
MSP-9717 #land
2014-06-25 08:55:35 -05:00
James Lee
db8692444f
Merge branch 'feature/MSP-9742/windows_autologin' into staging/electro-release
2014-06-25 04:31:57 -05:00
James Lee
f225ac92ab
Refactor smb_login
...
Maintains the new admin check functionality added in
rapid7/metasploit-framework#3330
2014-06-25 04:13:37 -05:00
Rob Fuller
920bd1132e
replace manual packing with rex version
2014-06-25 00:16:28 -04:00
Joshua Smith
3ed7050b67
Lands 3420 after wrapping most lines at 80
2014-06-24 17:37:43 -05:00
Joshua Smith
3fe162a8b1
wraps most lines at 80
2014-06-24 17:36:10 -05:00
OJ
769f2e4936
Change elevator to 'elevator'
...
This would have made lots of people uhnappy.
2014-06-25 07:47:47 +10:00
David Maloney
560fc93834
jtr_aix refactor
...
updated the aix cracker for jtr
2014-06-24 15:34:28 -05:00
David Maloney
b875a803d0
fix aix hashdump
...
aix hashdump now creates NonreplayableHash objects
2014-06-24 15:23:37 -05:00
OJ
ac03b7c96a
Use sorted sets extension lists
2014-06-25 03:26:25 +10:00
OJ
117cd8bf3a
Add wildcards to gitignore for extensions
2014-06-25 03:19:59 +10:00
OJ
0fc4d10813
Fix indentation for case statements
2014-06-25 03:18:37 +10:00
OJ
bba8bd3498
Land #3446 -- Meterpreter bins gem switch
2014-06-25 03:00:11 +10:00
James Lee
7615da7808
Merge branch 'staging/electro-release' into feature/MSP-9707/smb-bruteforce-refactor
2014-06-24 00:12:56 -05:00
James Lee
ffd05d9da9
Fix example Gemfile.local to work with existing
2014-06-24 00:00:47 -05:00
James Lee
85611702f9
Merge branch 'upstream-master' into feature/MSP-9707/smb-bruteforce-refactor
2014-06-23 23:58:47 -05:00
Jon Hart
b9925bb24c
Minor option cleanup
2014-06-23 18:38:47 -07:00
HD Moore
002234993f
SMB lib fixes, unattend.xml cred gathering
2014-06-23 20:08:42 -05:00
Meatballs
615aeb66a5
Dont use or
2014-06-23 23:11:04 +01:00
Meatballs
752007848b
Tidy up code
...
Dont rescue Exception
Remove eol spaces
Dont use and
More verbose path
2014-06-23 23:08:33 +01:00
David Maloney
6651af2d9b
refactor jtr_linux cracker
2014-06-23 16:27:28 -05:00
HD Moore
b872fa0f0d
Handle smb_recv corner case with a cache, clean up find_*, cosmetic
2014-06-23 16:14:18 -05:00
HD Moore
2772d84a18
Major rework of this module, please see the diff
2014-06-23 16:13:42 -05:00
Rob Fuller
86869f0a81
remove extra parenthesis
2014-06-23 17:10:31 -04:00
Rob Fuller
8e37aea7c2
remove use of Q in packing and unpacking
2014-06-23 16:52:53 -04:00
David Maloney
57c4ed51e9
fix mssql incremental modes
2014-06-23 15:37:37 -05:00
David Maloney
1cbc324774
fix up incremental modes
...
those incrmenetal rules don't exist
in all versions. All and Alnum are too long
for a 'fast-mode' crack. We wwill do Digits though
which does all digits 0-8 and gets us blank passwords
for free.
2014-06-23 15:36:17 -05:00
David Maloney
520c82d7fc
deal with blank password in ntlm
2014-06-23 15:32:50 -05:00
David Maloney
c5f2efda18
fixed up casing
2014-06-23 15:26:12 -05:00
David Maloney
b246e66eb8
successfully cracking ntlm hashes
...
still need to handle casing for lm
2014-06-23 14:40:32 -05:00
Rob Fuller
a7d00f8144
simplify SHA1 code
2014-06-23 15:39:06 -04:00
Rob Fuller
77620193a1
remove character restriction on aes.final call
2014-06-23 15:37:19 -04:00
Rob Fuller
2d0b4b96ee
remove verbose exit if no salt found
2014-06-23 15:34:07 -04:00
Rob Fuller
275d8826bd
skype post module to extract password hash
2014-06-23 15:16:50 -04:00
Jon Hart
050091d0dd
Fuzz all 255 possible mode 7 request codes
2014-06-23 11:38:30 -07:00
HD Moore
94388e3931
Fix typo in the constant name
2014-06-23 12:51:26 -05:00
David Maloney
57cc390681
fix how we save mssql hashes
...
since the 0x prefix is neccisary, just save the hash that way in the first place
2014-06-23 12:38:36 -05:00
David Maloney
c61f59d8a9
make sure to report the realm
2014-06-23 12:08:49 -05:00
David Maloney
dadd959c6a
refactor postgres hash cracking
...
refactored postgres_hashdump to report the creds
it logged in with. added a new jtr module for
dealing with postgres hashes instead of the
crappy old md5 one we had before
2014-06-23 12:02:39 -05:00
William Vu
a0aca251f5
Land #3472 , releae fixes
2014-06-23 11:41:35 -05:00
Tod Beardsley
ac60696247
Land #3468 , update for Chromecast wifi spying
2014-06-23 11:39:08 -05:00
Tod Beardsley
0219c4974a
Release fixups, word choice, refs, etc.
2014-06-23 11:17:00 -05:00
David Maloney
a0be142b33
Merge branch 'staging/electro-release' into feature/MSP-9717/mysql_crack
2014-06-23 11:03:29 -05:00
jvazquez-r7
267642aa4b
Fix description
2014-06-23 09:20:47 -05:00
jvazquez-r7
cc3c06440f
Add module for ZDI-14-195, HP AutoPass License Traversal
2014-06-23 09:19:56 -05:00
HD Moore
d6a263d538
Identify the hung host in the thread info
2014-06-22 16:01:03 -05:00
HD Moore
538a520445
Remove redundant option (threads are always used in reverse_tcp_double)
2014-06-22 16:00:44 -05:00
HD Moore
b3d83720ca
Add ReverseListenerThreaded option to prevent deadlocks
...
JodaZ reported that the handle_connection() sock.put call can
result in the entire reverse_tcp stager hanging if the client
stops receiving or is on a very slow link. The solution emulates
what ReverseTcpDouble already does, which is stage each connection
in a new thread. However, given that a high number of threads
can be a problem on some operating systems (*ahem* win32) this
option is not enabled by default.
We should look into thread pooling and handle_connection() timeouts
as well as event-based polling of multiple clients as alternatives,
but this option will improve the situation for our existing users.
2014-06-22 15:55:20 -05:00
HD Moore
6e5f528332
Prevent stager deadlock if inp/out detection hangs for some reason
...
Even though there are calls to has_read_data(), it doesn't prevent
the put() call from blocking in a dead client or slowaris-like
situation. By moving the inp/out detection into the thread, we
allow the main handler to keep processing connections even if
a single connection hangs.
2014-06-22 15:25:19 -05:00
Tod Beardsley
c71eb1aa4e
Add specs for changed object UI
2014-06-22 13:05:17 -05:00
Tod Beardsley
53d0aba305
Add some specs for changed object Priv
2014-06-22 12:54:10 -05:00
William Vu
40d1ec551e
Add WEP, PSK, and MGT
2014-06-21 23:15:20 -05:00
AnwarMohamed
118fc3450c
Merge remote-tracking branch 'upstream/master'
2014-06-22 01:22:25 +02:00
Spencer McIntyre
05d4a1ab2c
Land #3342 , Support negation in portspec
2014-06-21 18:14:50 -04:00
Spencer McIntyre
61f4c769eb
Land #3461 , Chromecast factory reset module
2014-06-21 17:43:31 -04:00
William Vu
79bf80e6bf
Add generic error handling
...
Just in case a factory reset happens to fail.
2014-06-21 15:35:03 -05:00
Tom Sellers
0822713f2e
Hide unneeded options
2014-06-21 11:39:52 -05:00
Tom Sellers
cec3ca1df6
Improve detection of failed uploads
...
leaving aborted = nil was causing unexpected behavior when the upload failed. Explicitly setting aborted = false by default corrects this issue.
2014-06-21 10:12:17 -05:00
jvazquez-r7
469fae7058
Land #3465 , @hmoore-r7's module for SMC IPMI Port 49152 file exposure vulnerability
2014-06-20 17:22:28 -05:00
jvazquez-r7
252d917bbb
Fix msftidy and favor && over and
2014-06-20 17:21:10 -05:00
David Maloney
8cfba5770a
missing require
2014-06-20 15:22:37 -05:00
David Maloney
d80f4d9e67
refactor jtr_mysql_fast and mysql_hashdump
...
have mysql_hashdump report the cred it logged in with
refactor jtr_mysql to use the new jtr cracker
2014-06-20 15:21:35 -05:00
James Lee
669779defb
SMB cred creation refactor
2014-06-20 15:17:40 -05:00
jvazquez-r7
e6e0de2b38
Land #3385 , @m-1-k-3's DLink authentication.cgi buffer overflow module
2014-06-20 14:33:42 -05:00
jvazquez-r7
e8b914a62f
Download rankings for reliable exploit, but depending on a specific version without autodetection
2014-06-20 14:33:02 -05:00
Luke Imhoff
78e6c3a65b
Fix merge error
...
While helping Dave Maloney port the changes from lib/msfenv.rb to
config/boot.rb for the Gemfile.local support, I failed to notice that
root was only defined in the unless block when it is needed no matter
what.
2014-06-20 14:32:29 -05:00
jvazquez-r7
191c871e9b
[SeeRM #8815 ] Dont try to exploit when generate_payload_exe fails
2014-06-20 14:07:49 -05:00
m-1-k-3
afa52072e8
Merge pull request #12 from jvazquez-r7/solve_3385
...
Solve conflicts in 3385
2014-06-20 20:58:17 +02:00
Tod Beardsley
f90e8f00e5
Add the first few specs
...
Coverage for meterpreter and client core, just the bits I'm changing. I
intend to make liberal use of doubles, since they're easier than mocks
and all I care about is the changed behavior. I refuse to fall into a
trap where I need to first spec out aaaaaalllll of Metepreter just to
make this one change.
2014-06-20 13:18:55 -05:00
James Lee
35c0ef0c68
Merge branch 'feature/MSP-9716/mssql_crack' into staging/electro-release
2014-06-20 12:39:07 -05:00
David Maloney
06da2d81e4
use fixed version of credential
2014-06-20 12:34:42 -05:00
Tod Beardsley
99d60b7d6c
Update .gitignore to avoid Meterpreter bins
2014-06-20 11:57:59 -05:00
Tod Beardsley
2626450c38
Fix indent per @jlee-r7'e eagle eye
2014-06-20 11:52:47 -05:00
David Maloney
99b1702559
Merge branch 'master' into staging/electro-release
...
Conflicts:
lib/msfenv.rb
2014-06-20 11:38:47 -05:00
jvazquez-r7
f0d04fe77e
Do some randomizations
2014-06-20 11:38:10 -05:00
jvazquez-r7
f26f8ae5db
Change module filename
2014-06-20 11:27:49 -05:00
jvazquez-r7
33eaf643aa
Fix usage of :concat_operator operator
2014-06-20 11:27:23 -05:00
jvazquez-r7
06974701cf
Use the old cmd_concat_operator
2014-06-20 11:26:22 -05:00
jvazquez-r7
5542f846d6
Merge to solve conflicts
2014-06-20 11:24:08 -05:00
dmaloney-r7
111f3ae136
Merge pull request #84 from rapid7/bug/MSP-10127/remove-should-receive-with-connection
...
Remove `should_receive(:with_connection)` from specs
2014-06-20 11:14:03 -05:00
David Maloney
a929a55404
fix show command parsing
...
this ius better than a regex and handles special charachters
in usernames and passwords far better than the previous way
2014-06-20 10:48:42 -05:00
jvazquez-r7
4203e75777
Land #3408 , @m-1-k-3's exploit for D-Link hedwig.cgi OSVDB 95950
2014-06-20 10:27:32 -05:00
jvazquez-r7
f74594c324
Order metadata
2014-06-20 10:26:50 -05:00
jvazquez-r7
a081beacc2
Use Gem::Version for string versions comparison
2014-06-20 09:44:29 -05:00
m-1-k-3
c64124a54c
Merge pull request #11 from jvazquez-r7/review_3408
...
Review 3408
2014-06-20 07:47:28 +02:00
jvazquez-r7
9da377c199
Merge specs to avoid errors when changing cmd_concat_operator
2014-06-20 00:10:50 -05:00
jvazquez-r7
330caa8c13
Fix specs
2014-06-20 00:08:55 -05:00
Tod Beardsley
5d6b582adc
Update modules to use new path.
2014-06-19 18:44:19 -05:00
jvazquez-r7
ee62428248
Add specs
2014-06-19 18:13:14 -05:00
Tod Beardsley
2a4ed0e651
Replace all the obvious path calls to Meterpreter
...
Unfortunately, though, there seems to be a stealthy set, somewhere, of
datastore['DLL']. Not sure where yet. The stack trace in the
framework.log is:
````
[06/19/2014 17:53:34] [i(0)] core: windows/meterpreter/reverse_http: iteration 1: Successfully encoded with encoder x86/fnstenv_mov (size is
366)
[06/19/2014 17:53:35] [e(0)] rex: Proc::on_request: Errno::ENOENT: No such file or directory -
/home/todb/git/rapid7/metasploit-framework/data/meterpreter/metsrv.x86.dll
/home/todb/git/rapid7/metasploit-framework/lib/msf/core/reflective_dll_loader.rb:26:in `initialize'
/home/todb/git/rapid7/metasploit-framework/lib/msf/core/reflective_dll_loader.rb:26:in `open'
/home/todb/git/rapid7/metasploit-framework/lib/msf/core/reflective_dll_loader.rb:26:in `load_rdi_dll'
/home/todb/git/rapid7/metasploit-framework/lib/msf/core/payload/windows/reflectivedllinject.rb:56:in `stage_payload'
/home/todb/git/rapid7/metasploit-framework/lib/msf/core/handler/reverse_http.rb:212:in `on_request'
/home/todb/git/rapid7/metasploit-framework/lib/msf/core/handler/reverse_http.rb:129:in `block in setup_handler'
/home/todb/git/rapid7/metasploit-framework/lib/rex/proto/http/handler/proc.rb:38:in `call'
/home/todb/git/rapid7/metasploit-framework/lib/rex/proto/http/handler/proc.rb:38:in `on_request'
/home/todb/git/rapid7/metasploit-framework/lib/rex/proto/http/server.rb:365:in `dispatch_request'
/home/todb/git/rapid7/metasploit-framework/lib/rex/proto/http/server.rb:299:in `on_client_data'
/home/todb/git/rapid7/metasploit-framework/lib/rex/proto/http/server.rb:158:in `block in start'
/home/todb/git/rapid7/metasploit-framework/lib/rex/io/stream_server.rb:48:in `call'
/home/todb/git/rapid7/metasploit-framework/lib/rex/io/stream_server.rb:48:in `on_client_data'
/home/todb/git/rapid7/metasploit-framework/lib/rex/io/stream_server.rb:192:in `block in monitor_clients'
/home/todb/git/rapid7/metasploit-framework/lib/rex/io/stream_server.rb:190:in `each'
/home/todb/git/rapid7/metasploit-framework/lib/rex/io/stream_server.rb:190:in `monitor_clients'
/home/todb/git/rapid7/metasploit-framework/lib/rex/io/stream_server.rb:73:in `block in start'
/home/todb/git/rapid7/metasploit-framework/lib/rex/thread_factory.rb:22:in `call'
/home/todb/git/rapid7/metasploit-framework/lib/rex/thread_factory.rb:22:in `block in spawn'
/home/todb/git/rapid7/metasploit-framework/lib/msf/core/thread_manager.rb:100:in `call'
/home/todb/git/rapid7/metasploit-framework/lib/msf/core/thread_manager.rb:100:in `block in spawn'
````
Still tracking this down.
2014-06-19 18:03:11 -05:00
David Maloney
3c85601426
not every version has dupe supression
2014-06-19 16:28:23 -05:00
Luke Imhoff
af99c0c01e
Remove should_receive(:with_connection) from specs
...
MSP-10127
Causes specs to randomly fail when with_connection calls from
before(:each) or after(:each) are intercepted by the should_receive
call.
2014-06-19 16:24:53 -05:00
David Maloney
93da4dc561
account for mssql12 format
...
mssql2012 and later uses a new format. some versions
of john support this and some do not yet
2014-06-19 16:11:14 -05:00
Tod Beardsley
fbb6808b1a
Re-add common.lib and ext_server_sniffer DLLs
...
These are not currently included in meterpreter_bins. Figure this out
with @cdoughty-r7 , probably just an oversight.
2014-06-19 16:10:22 -05:00
Tod Beardsley
88b482118d
Remove local Meterpreter Windows binaries
2014-06-19 16:05:53 -05:00
Tod Beardsley
1b9d24ad0c
Include the Meterpreter bins
2014-06-19 16:04:40 -05:00
Joshua Smith
45dc197827
Lands 3454, exploits/linux/ids/alienvault_centerd_soap_exec
2014-06-19 15:58:33 -05:00
jvazquez-r7
d28ced5b7b
change module filename
2014-06-19 15:56:55 -05:00
jvazquez-r7
a0386f0797
Fix cmd_concat_operator
2014-06-19 15:52:55 -05:00
dmaloney-r7
4f12c08456
Merge pull request #83 from rapid7/feature/MSP-9696/http-bruteforce-refactor
...
Refactor http_login
2014-06-19 15:46:16 -05:00
David Maloney
4453dcdc8e
some minor fixes
2014-06-19 15:45:24 -05:00
David Maloney
8de2109f97
Merge branch 'staging/electro-release' into feature/MSP-9696/http-bruteforce-refactor
2014-06-19 15:38:05 -05:00
HD Moore
fa5fc724eb
Fix the disclosure date
2014-06-19 15:36:17 -05:00
HD Moore
f7fd17106a
Add the final cari.net URL
2014-06-19 15:33:06 -05:00
David Maloney
aca532b994
making egypt happy
...
it's a full time job
2014-06-19 15:07:33 -05:00
William Vu
dbd0bc5fa2
Refactor windows_autologin creds
2014-06-19 14:38:31 -05:00
navs
5f19af67a8
amateur hour, forgot the X on ARCH_X64
2014-06-19 14:24:28 -05:00
navs
fe49393cf1
added ARCH_x64 case for Msf::Util::EXE.to_executable_fmt - failed CI #8173
2014-06-19 14:12:22 -05:00
James Lee
9421beedb3
Refactor http_login
2014-06-19 14:12:21 -05:00
David Maloney
d9b7a320ae
fix more broken specs
2014-06-19 14:07:39 -05:00
David Maloney
e34a3b5309
Merge branch 'staging/electro-release' of github.com:rapid7/metasploit-framework-private into staging/electro-release
2014-06-19 13:24:06 -05:00
David Maloney
2ac2dc9d7a
2 minor spec fixes
2014-06-19 13:23:37 -05:00
Jon Hart
6f03f6657f
Support only fuzzing specific mode 6 operations
2014-06-19 11:10:11 -07:00
David Maloney
0ff8708e6d
some minor fixes
2014-06-19 13:08:43 -05:00
Matt Buck
5815ec96df
Merge pull request #80 from rapid7/bug/MSP-10038/skip-ssh-passphrase
...
Backported net-ssh ask_passphrase functionality
MSP-10038
2014-06-19 12:53:43 -05:00
David Maloney
53352924d2
Merge branch 'staging/electro-release' into feature/MSP-9716/mssql_crack
...
Conflicts:
Gemfile
2014-06-19 12:45:53 -05:00
David Maloney
20f7cde9cc
add incremental and single modes
...
make sure we run single mode and incremnetal modes
during our runs through these hashes.
2014-06-19 12:38:01 -05:00
David Maloney
bb120fd1e2
report access level on mssql_hashdump
...
if we know we have admin access on mssql hashdumop
we should report that on the Login object.
2014-06-19 12:20:42 -05:00
David Maloney
d3c77b345c
report cracked credentials
...
also makes mssql_hashdump report the credentials it logged in with
2014-06-19 12:16:49 -05:00
navs
28872c7ea2
added suport to generate_payload_dll for x64 arch, linux platform
2014-06-19 11:46:05 -05:00
James Lee
b606448976
Merge branch 'feature/MSP-9689/jtr_cracker' into staging/electro-release
2014-06-19 10:14:57 -05:00
James Lee
2d9c6f832a
Moar parens!!1!!
2014-06-19 10:07:21 -05:00
navs
ccf967fdfe
added support to msfpayload to use elf so payload target
2014-06-19 00:59:49 -05:00
navs
1c5cfeebb3
adding template and src for elf 64 shared object payload target
2014-06-19 00:38:16 -05:00
James Lee
2683ec53e1
Add Gemfile.local.example
2014-06-18 14:55:03 -05:00
James Lee
594923c790
Don't overwrite ENV if it's set
2014-06-18 14:53:41 -05:00
David Maloney
62f4054858
startring refactor on jtr_mssql
...
started work on the mssql hash cracker
fixed some minor bugs with the underlying mixin
crackers now runs. still have to have the cred objects created
2014-06-18 14:50:08 -05:00
James Lee
5beb43d200
Land #3022 , support Gemfile.local
2014-06-18 14:28:57 -05:00
ikkini
6747ba91ed
change to .gitignore
2014-06-18 19:02:09 +02:00
David Maloney
641559ec12
put pry in gemfile
...
include pry in the development group of the framework
gemfile
2014-06-18 11:47:36 -05:00
dmaloney-r7
190923e9a7
Merge pull request #79 from rapid7/feature/MSP-9699/axis2-refactor
...
Refactor axis_login
2014-06-18 11:43:23 -05:00
David Maloney
fd0e24cdb2
moar docs!
2014-06-18 11:38:07 -05:00
David Maloney
4b4d9796c5
more minor cleanup
...
cleanup from code review
2014-06-18 11:24:55 -05:00
Fernando Arias
f24d665516
Backported net-ssh ask_passphrase functionality
...
MSP-10038
2014-06-18 11:21:17 -05:00
Michael Messner
86f523f00c
concator handling
2014-06-18 18:15:58 +02:00
David Maloney
9f11170c3b
some minor cleanup on jtr stuff
...
minor cleanup to code nstyling stuff
2014-06-18 10:57:41 -05:00
dmaloney-r7
8e58d0803f
Merge pull request #77 from rapid7/feature/MSP-9709/ssh-pubkey
...
Refactor ssh_login_pubkey
2014-06-18 10:53:08 -05:00
David Maloney
4c3cc793ba
fix missing .present?
2014-06-18 10:52:27 -05:00
David Maloney
58b016202b
Merge branch 'staging/electro-release' into feature/MSP-9709/ssh-pubkey
2014-06-18 10:50:29 -05:00
David Maloney
2b0bb608b1
Merge branch 'master' into staging/electro-release
2014-06-18 10:49:58 -05:00
William Vu
075eec39e1
Add Chromecast factory reset module
2014-06-18 10:04:17 -05:00
Joshua Smith
5e4a612351
Land missed commit from #3460 , typo fix
2014-06-18 00:08:01 -05:00
jvazquez-r7
8cae8d545e
Land jvazquez-r7/metasploit#15 , @kernelsmith's module cleanup
2014-06-17 23:40:46 -05:00
jvazquez-r7
45ea59050c
Fix the if cleanup
2014-06-17 23:40:00 -05:00
Joshua Smith
288430d813
wraps some long lines
2014-06-17 22:30:28 -05:00
Spencer McIntyre
c685e0d06e
Land #3444 , chromecast wifi enumeration
2014-06-17 22:09:58 -04:00
OJ
aca8fcb352
Land #3415 -- x86->x64 Payload Injection
2014-06-18 11:09:55 +10:00
Meatballs1
4cfeaa1649
Merge pull request #50 from OJ/meat-x64_injection
...
Update to include required bins
2014-06-18 02:00:19 +01:00
OJ
5879ca3340
Merge branch 'upstream/master' into meatballs x64_injection
2014-06-18 10:24:33 +10:00
Joshua Smith
bab1e30557
Land #3460 , Ericom AccessNow Server BOF exploit
2014-06-17 19:10:34 -05:00
Joshua Smith
9af9d2f5c2
slight cleanup
2014-06-17 19:08:31 -05:00
jvazquez-r7
f622a3a0e5
Fix typo
2014-06-17 17:56:26 -05:00
Joshua Smith
ab8270d1a4
adds some additional protection against capilization issues
2014-06-17 17:40:50 -05:00
James Lee
5f176a56cb
Fix typo
2014-06-17 17:16:46 -05:00
James Lee
d114dd1da2
Fix bugs. :fail != :failed
2014-06-17 17:12:50 -05:00
James Lee
d6de0da5a7
Refactor axis_login
2014-06-17 17:07:53 -05:00
David Maloney
34c0b00816
don't autload this mixin
...
causes laod order problems when we try to
autoload this mixin. We will just explicitly require
2014-06-17 16:10:09 -05:00
David Maloney
763f6f8d80
finish cleaning up jtr mixin
...
finish cleaning up the module mixin for jtr
2014-06-17 15:16:32 -05:00
jvazquez-r7
1133332702
Finish module
2014-06-17 15:01:35 -05:00
William Vu
1394ad1431
Break my double quote habit
...
Doesn't it feel better? C doesn't love me anymore.
2014-06-17 14:22:55 -05:00
jvazquez-r7
8f8af0e93a
Add draft version
2014-06-17 14:21:49 -05:00
William Vu
5e12675842
Land #3459 , newline fixes for msftidy
2014-06-17 14:21:11 -05:00
William Vu
56c71c7b85
Land #3457 , newline check for msftidy
2014-06-17 14:20:53 -05:00
Christian Mehlmauer
03fa858089
Added newline at EOF
2014-06-17 21:05:00 +02:00
Christian Mehlmauer
8e1949f3c8
Added newline at EOF
2014-06-17 21:03:18 +02:00
David Maloney
432b88680b
start fixing jtr module mixin
2014-06-17 13:27:11 -05:00
William Vu
8376b4aa2b
Map constants to readable values
...
Thanks, @zeroSteiner and @kernelsmith. :)
2014-06-17 13:10:08 -05:00
Joe Vennix
b8cedf14a8
Update gemfile dependencies. I have no idea if i need to tag this or wtf.
2014-06-17 12:14:17 -05:00
Luke Imhoff
99330ea40a
Update to use corrected v0.4.2-electro-release tag
2014-06-17 11:14:59 -05:00
David Maloney
d473d86ef0
use tr instead of gsub for mutation
...
this should be another slight performance
increase as straight up string replacement
should require less overhead then multiple
runs of regex replacement.
2014-06-17 10:29:09 -05:00
Christian Mehlmauer
3c00388f87
Add check for newline at end of file
2014-06-17 15:44:43 +02:00
OJ
b710014ece
Land #3435 -- Rocket Servergraph ZDI-14-161/162
2014-06-17 18:06:03 +10:00
Michael Messner
508998263b
removed wrong module file
2014-06-17 08:57:46 +02:00
Michael Messner
6f45eb13c7
moved module file
2014-06-17 08:56:07 +02:00
Michael Messner
a5eed71d50
renamed and other module removed
2014-06-17 08:50:09 +02:00
Michael Messner
e908b7bc25
renamed and other module removed
2014-06-17 08:49:46 +02:00
James Lee
6237d56398
Refactor ssh_login_pubkey
...
* Fix a bug in LoginScanner::SSHKey (which was copy-pasted from SSH)
where the ssh_socket accessor was not being set because of a
shadowing local var
* Fix a bug in the db command dispatcher where an extra column was
added to the table, causing an unhandled exception when running the
creds command
* Add a big, ugly, untested class for imitating
Metasploit::Framework::CredentialCollection for ssh keys. This class
continues the current behavoir of silently ignoring files that are a)
encrypted or b) not private keys.
* Remove unnecessary proof gathering in the module (it's already
handled by the LoginScanner class)
2014-06-16 18:38:20 -05:00
David Maloney
a81b0ed17b
rename method to_file
...
change method name from write to to_file
as it makes more sense for what it is is doing
and what it returns
2014-06-16 18:03:06 -05:00
David Maloney
95beaa4f7e
correct self-eating array nature
...
we never noticed we were modifying the array in place
because we were reculaculating. now with a memoized
version we would get decreasing results
2014-06-16 17:37:18 -05:00
David Maloney
a92a58417f
memoize the mutation keys
...
it was recalculating the mutation rules
everytime, and there is no reason to do this
2014-06-16 17:18:52 -05:00
Samuel Huckins
4a7ee57866
Merge pull request #76 from rapid7/bug/MSP-10006
...
PRs complete
MSP-10006 #land
2014-06-16 15:35:27 -05:00
Samuel Huckins
57c7d30bc4
Updated MC tag to 0.4.2
...
MSP-10006
2014-06-16 15:34:42 -05:00
Michael Messner
f464c5ee97
dlink msearch commmand injection
2014-06-16 22:12:15 +02:00
j0hnf
1a82a20c09
re-added incorrectly removed SMBSHARE option
2014-06-16 20:10:11 +01:00
Jon Hart
8fa81de3bb
Fuzz mode 7 more correctly. Cleanup.
...
Provide empty 188-byte payload for mode 7 messages, otherwise nothing
seems to response. Provide more useful defaults for versions/modes.
Allow control over what mode 7 stuff is fuzzed.
2014-06-16 11:56:27 -07:00
jvazquez-r7
d44d409ff2
Land #3407 , @julianvilas's exploit for Java JDWP RCE
2014-06-16 13:38:51 -05:00
jvazquez-r7
6a780987d5
Do minor cleanup
2014-06-16 13:37:44 -05:00
David Maloney
f1a39ef973
enumerators all done with specs
...
the enumeration chains are now all complete with specs
so we can enumerate all the words generated by the given options.
2014-06-16 13:31:30 -05:00
Jon Hart
0352a5305c
When fuzzing mode 6 (control) and 7 (private) messages, print out each version tested since these tend to take a long time
2014-06-16 10:31:08 -07:00
jvazquez-r7
f7b892e55b
Add module for AlienVault's ZDI-14-202
2014-06-16 12:10:30 -05:00
Jon Hart
28bf9f8d50
Correct order of mixins so RHOSTS works properly
2014-06-16 10:02:27 -07:00
Jon Hart
9e5281d0c6
Mixin Msf::Auxiliary::Scanner, switch to run_host to fix DNS lookup issues
2014-06-16 09:58:20 -07:00
William Vu
0bc3099acf
Land #3453 , release fixes
2014-06-16 11:48:37 -05:00
Tod Beardsley
19da7d551e
Kill newline (race @wvu-r7 on this)
...
See PR #3453
2014-06-16 11:46:08 -05:00
Tod Beardsley
2aa26fa290
Minor spacing and word choice fixups
2014-06-16 11:40:21 -05:00
jvennix-r7
2cedee1aef
Merge pull request #74 from rapid7/feature/MSP-9744/autologin_password
...
Land #74 , @wvu-r7's refactor of osx autologin_password module.
2014-06-16 11:29:49 -05:00
William Vu
29f5344d26
Drop merge of service_data, since it doesn't exist
2014-06-16 09:27:01 -05:00
William Vu
e02a134bf5
Land #3452 , addjsif regression fix
2014-06-16 00:03:17 -05:00
joev
461fba97d7
Update forgotten call to js() in webview exploit.
2014-06-15 23:43:05 -05:00
Jon Hart
c7c0528e44
Fuzz NTP private messages too
2014-06-15 20:23:33 -07:00
David Maloney
9af811a2ed
we need to pass in a workspace
2014-06-15 15:52:57 -05:00
scriptjunkie
fc8bb54eb7
Land #3330 check admin in smb_login
2014-06-15 14:51:25 -05:00
scriptjunkie
5fe8814af6
Land #3330 adding admin check to smb_login
2014-06-15 14:42:26 -05:00
scriptjunkie
121ab76d09
Merge branch 'nstarke-bugfixes/post-module-execution-causing-duplicate-search-results'
2014-06-15 14:14:50 -05:00
David Maloney
897b0b1ee5
wordlist enumerators with some specs
...
started the enumerators on the wordlist class
and began adding the specs for them
2014-06-15 13:37:50 -05:00
Julian Vilas
caa1e10370
Add feature for disabling Java Security Manager
2014-06-15 20:35:19 +02:00
scriptjunkie
d38a95a352
Merge branch 'bugfixes/post-module-execution-causing-duplicate-search-results' of github.com:nstarke/metasploit-framework into nstarke-bugfixes/post-module-execution-causing-duplicate-search-results
2014-06-15 13:15:57 -05:00
David Maloney
a00ff5aeef
yield custom_wordlist words
2014-06-15 12:16:21 -05:00
David Maloney
8ada0804bd
add valid! spec
2014-06-15 11:22:43 -05:00
David Maloney
41d6b326f2
specs for wordlist validations
...
added specs to cover the validations on
the JtR wordlist class.
2014-06-15 11:14:11 -05:00
David Maloney
a5fb898904
actually set max run time
...
make maxrutnime affect the crack command
2014-06-14 20:03:56 -05:00
David Maloney
33519b1fcd
cracker validations and specs
...
more validations and specs for the cracker class
2014-06-14 19:59:59 -05:00
David Maloney
529e5da00a
make sure laoder finds new validator
2014-06-14 18:02:51 -05:00
David Maloney
10f3531bbb
add exectuable validator
...
like the filepath validator but also checks
to see if the file is exectuable by the current
users.
2014-06-14 18:01:24 -05:00
David Maloney
21f29c4da9
more filepath validators
...
added filepath validations to cracker
also made them all conditional validations
2014-06-14 17:54:37 -05:00
David Maloney
1dd69a5228
wordlist validators
...
added custom fielpath vaidator and
added validations to the wordlist class
2014-06-14 17:49:47 -05:00
David Maloney
466576d03f
jtr wordlist validations started
...
start adding validations and exceptions for the
JtR Wordlist class.
2014-06-14 16:16:30 -05:00
David Maloney
19231b7c8f
starting skeleton on wordlist class
...
start framing out JtR wordlist class that
will generate Wordlists to be passed to our
JtR cracker.
2014-06-14 15:48:25 -05:00
David Maloney
41f7bc1372
add common root words wordlist
...
this adds a new wordlist to the data directory.
This wordlist is compiled from statistical analysis of
common Numeric passwords and Common rootwords across
6 years of colleted password breach dumps. Every word in
this list has been seen thousands of times in password
breaches
2014-06-14 14:13:59 -05:00
David Maloney
873d6e5b99
add all the specs
2014-06-14 12:28:17 -05:00
Michael Messner
12ec785bdb
clean up, echo stager, concator handling
2014-06-14 17:37:09 +02:00
Michael Messner
8eb21ded97
clean up
2014-06-14 17:02:55 +02:00
Tim Wright
9b43749916
Land #3418 - android adobe reader addjisf pdf exploit
...
Merge branch 'landing-3418' into upstream-master
2014-06-14 11:25:29 +01:00
AnwarMohamed
af49280199
Merge remote-tracking branch 'upstream/master'
2014-06-14 12:16:22 +02:00
jakxx
3abfa3e12e
change to case switch
2014-06-13 19:17:28 -04:00
David Maloney
300baa577c
moar specs!
2014-06-13 17:34:16 -05:00
James Lee
4b78f0ad7c
Merge branch 'feature/MSP-9723/glassfish_deployer' into staging/electro-release
2014-06-13 16:11:14 -05:00
David Maloney
b784bea48e
slow roll of specs for jtr cracker
...
slowly adding spec coverage for the JtR cracker
2014-06-13 16:08:56 -05:00
James Lee
07d8921b0b
Merge branch 'feature/MSP-9747/pgpass_creds' into staging/electro-release
2014-06-13 16:06:15 -05:00
James Lee
d246e28cb3
Merge branch 'feature/MSP-9733/ftpnavigator' into staging/electro-release
2014-06-13 16:03:06 -05:00
William Vu
2f1032d617
Add a missing comma and a comment
2014-06-13 15:48:14 -05:00
James Lee
da74777570
Merge branch 'feature/MSP-9729/enum_cred_store' into staging/electro-release
2014-06-13 15:46:08 -05:00
William Vu
72fdf6a607
Get rid of the rest of the service stuff
2014-06-13 15:45:13 -05:00
James Lee
8be602e487
Merge branch 'feature/MSP-9734/ftpx' into staging/electro-release
2014-06-13 15:36:43 -05:00
James Lee
1df7362774
Merge branch 'feature/MSP-9740/outlook' into staging/electro-release
2014-06-13 15:34:06 -05:00
James Lee
81d47c4eb3
Merge branch 'feature/MSP-9730/epo_sql' into staging/electro-release
2014-06-13 15:31:41 -05:00
James Lee
a3eea2f712
Add better handling of host and port
2014-06-13 15:22:09 -05:00
David Maloney
7187138134
start injecting sanity
2014-06-13 14:53:56 -05:00
David Maloney
a9bcb8b3bd
add skeleton for JtR Cracker
...
starting work on creating the JtR Cracker class
2014-06-13 11:10:12 -05:00
Samuel Huckins
fa8c9bc4f3
Merge pull request #75 from rapid7/feature/MSP-9692/afp_login
...
MSP-9692 #land
2014-06-13 10:51:26 -05:00
jvazquez-r7
2fe7593559
Land #3433 , @TecR0c's exploit for Easy File Management Web Server
2014-06-13 09:54:12 -05:00
AnwarMohamed
8b0e382ebf
Merge remote-tracking branch 'upstream/master'
2014-06-13 16:52:02 +02:00
joev
eddac55c37
Remove spaces at EOL.
2014-06-13 08:37:44 -05:00
Michael Messner
a3ae177347
echo stager, arch_cmd, echo module
2014-06-13 11:42:47 +02:00
Michael Messner
894af92b22
echo stager, arch_cmd
2014-06-13 11:40:50 +02:00
William Vu
4593c309f5
Fix a dummy because I can't read
2014-06-12 19:10:24 -05:00
William Vu
9d89730026
Use realm instead of private
2014-06-12 18:46:13 -05:00
Samuel Huckins
f452652f54
Merge pull request #61 from rapid7/feature/MSP-9708/ssh-bruteforce
...
Functional steps updated and passing, along with specs. Proof being maintained seemed off, but it's not persisted, just used for setting platform.
MSP-9708 #land
2014-06-12 18:37:44 -05:00
William Vu
277c9d68bc
Remove service_name, since it doesn't make sense
2014-06-12 18:37:00 -05:00
William Vu
5d19410294
Don't use getaddress with session.session_host
2014-06-12 18:30:51 -05:00
William Vu
3a1578bead
Don't use getaddress with session.session_host
2014-06-12 18:29:46 -05:00
William Vu
3ad3ca88e5
Use session.session_host
2014-06-12 18:26:01 -05:00
James Lee
a7416332e3
Merge branch 'feature/MSP-9732/flashfxp' into staging/electro-release
2014-06-12 18:02:20 -05:00
Samuel Huckins
d215b8e5b2
Merge pull request #47 from rapid7/feature/MSP-9712/winrm-bruteforce
...
45 merged, steps passing.
MSP-9712 #land
2014-06-12 16:04:17 -05:00
Samuel Huckins
df705c2edc
Gotta keep 'em sepArated.
...
MSP-9712
2014-06-12 16:03:02 -05:00
Samuel Huckins
52d63f51bb
Merge pull request #50 from rapid7/feature/MSP-9705/postgres_login
...
Verily verified.
MSP-9705 #land
2014-06-12 15:49:39 -05:00
Joe Vennix
eeef98d0e4
Update gemfile.
2014-06-12 15:43:44 -05:00
James Lee
1969c8f018
Merge branch 'feature/MSP-9727/bulletproof_ftp' into staging/electro-release
2014-06-12 15:41:57 -05:00
James Lee
ff2fc68d11
Fix busted vars
2014-06-12 15:37:06 -05:00
Tod Beardsley
537772e059
Land #3450 (techincally not mine but @Meatballs1)
...
This lands #3416 again as well, but now with the bins from
rapid7/meterpreter#76
Sorry for the mixup.
2014-06-12 15:16:06 -05:00
James Lee
18a2e0928c
Merge branch 'feature/MSP-9737/wsftp_client' into staging/electro-release
2014-06-12 15:08:26 -05:00
Tod Beardsley
cbedea222f
Land #3416 again, now that the bins are available
...
This reverts commit 3d73414530 .
2014-06-12 14:53:03 -05:00
Tod Beardsley
af9028e867
Add Meterpreter bins for PR76
...
These are the binaries generated for rapid7/meterpreter#76 , against
commit 2776adb8b91d9967983033c0e770c46a10a68002
These bins are need to make #3416 actually functional
2014-06-12 14:29:40 -05:00
Tod Beardsley
3d73414530
Revert #3416 , needs the correct bins first
...
This was a whoops on my part. I will reland this when I have the
Meterpreter bins all sorted.
This reverts commit 40b5405053 , reversing
changes made to 86e4eaaaed .
2014-06-12 14:20:06 -05:00
David Maloney
539f30e720
refactor afp_login
2014-06-12 14:16:05 -05:00
Tod Beardsley
1ab379a0fe
Land #3448 , ident =! indent
2014-06-12 14:15:06 -05:00
Tod Beardsley
e9783200f2
Land #3447 , fix variable typo
2014-06-12 14:07:34 -05:00
David Maloney
96e492f572
Merge branch 'master' into staging/electro-release
2014-06-12 14:02:27 -05:00
Tod Beardsley
40b5405053
Land #3416 , fix DWORD/QWORD bug
2014-06-12 13:59:34 -05:00
Tod Beardsley
86e4eaaaed
Land #3449 , constant spelling
2014-06-12 13:56:02 -05:00
William Vu
86671796b7
Refactor autologin_password creds
2014-06-12 13:54:52 -05:00
William Vu
7f2b173130
Fix misspelled constant in msftidy
2014-06-12 13:47:44 -05:00
William Vu
cb91b2b094
Fix broken table indent (s/Ident/Indent/ hash key)
2014-06-12 13:41:44 -05:00
Jon Cave
a647246148
Use correct variable name
2014-06-12 19:38:41 +01:00
William Vu
62a4991508
Land #3446 , some code cleanup from @todb-r7
2014-06-12 13:35:36 -05:00
William Vu
e795e3caad
Land #3445 , Scanner mixin fixes
2014-06-12 13:34:54 -05:00
William Vu
d9d16e436a
Refactor epo_sql creds
2014-06-12 13:23:11 -05:00
Tod Beardsley
3f5e50d18f
Aux modules don't have ranking.
...
msftidy should have defintely caught this. That it didn't catch on
Travis-CI concerns me. Need to research this.
2014-06-12 13:21:59 -05:00
Tod Beardsley
1aa029dbed
Avoid double quotes in the initialize/elewhere
...
There is no need to have double quotes there for uninterpolated strings,
and every other module uses single quotes.
2014-06-12 13:20:59 -05:00
William Vu
74cb5cd79e
Fix bad copypasta
2014-06-12 13:17:12 -05:00
William Vu
302e495451
Fix bad indent
2014-06-12 13:13:05 -05:00
William Vu
89434a75c3
Fix bad indent
2014-06-12 13:10:50 -05:00
William Vu
512395395b
Refactor pgpass_creds creds
2014-06-12 13:08:47 -05:00
William Vu
c7bb0f1eb8
Fix bad copypasta
2014-06-12 12:59:35 -05:00
William Vu
0d92ae08dd
Refactor enum_cred_store creds
2014-06-12 12:57:46 -05:00
Samuel Huckins
fe33444858
Merge pull request #58 from rapid7/feature/MSP-9693/db2_auth
...
Errors resolved, cred created
MSP-9693 #land
2014-06-12 12:49:54 -05:00
William Vu
429d85dc5d
Refactor flashfxp creds
2014-06-12 12:40:33 -05:00
David Maloney
5fd117a015
fix userpass file stack trace
...
if an improperly formated userpass file was
supplied it could cause a stack trace. add some guarding around it
2014-06-12 12:39:36 -05:00
William Vu
e96a70a0f5
Refactor outlook creds
2014-06-12 12:31:12 -05:00
dmaloney-r7
ed84336149
Merge pull request #60 from rapid7/feature/MSP-9992/creds-command
...
Refactor the creds command
2014-06-12 12:24:09 -05:00
jvazquez-r7
e85f829ee4
modules living inside scanner should include the Scanner mixin
2014-06-12 12:20:44 -05:00
HD Moore
fa4e835804
Fix up scanner mixin usage, actual test/bug fix
2014-06-12 11:52:34 -05:00
Samuel Huckins
430b3d181e
Merge pull request #67 from rapid7/feature/MSP-9695/ftp_login
...
Access level string clarified, specs passing, valid looking cores with proper info
MSP-9695 #land
2014-06-12 11:33:18 -05:00
Samuel Huckins
71a4f1ab33
Clarified RW access level
...
MSP-9695
2014-06-12 11:32:20 -05:00
jvazquez-r7
67d4097e1d
Land #3271 , @claudijd's Cisco ASA SSL VPN Bruteforce Aux Module
2014-06-12 11:27:23 -05:00
HD Moore
487bf219f0
Rename to match the title
2014-06-12 11:23:34 -05:00
jvazquez-r7
7650067b41
Fix metadata
2014-06-12 11:22:52 -05:00
jvazquez-r7
e76c85c5d1
Fix usage of print_*
2014-06-12 11:13:45 -05:00
David Maloney
e4ff07dfa8
Merge branch 'staging/electro-release' into feature/MSP-9693/db2_auth
2014-06-12 10:52:06 -05:00
David Maloney
88f8b585a3
Merge branch 'staging/electro-release' into feature/MSP-9705/postgres_login
...
Conflicts:
Gemfile
Gemfile.lock
2014-06-12 10:47:02 -05:00
Samuel Huckins
2c007846e4
Merge pull request #68 from rapid7/feature/MSP-9710/telnet_login
...
Specs and functional passing
MSP-9710 #land
2014-06-12 10:30:21 -05:00
Samuel Huckins
a5d88fd2ab
Space in arg list, because I don't hate feedom.
2014-06-12 10:29:14 -05:00
joev
289bae88de
Remove lie in comment.
2014-06-12 10:02:29 -05:00
sinn3r
2a7227f443
Land #3427 - Adds webcam module for firefox privileged sessions on OSX
2014-06-11 22:27:25 -05:00
joev
56efd82112
Correct the disclosure date.
2014-06-11 21:53:42 -05:00
joev
6bc37cca0c
Land #3430 , @brandonprry's generic MongoDB injection enum.
2014-06-11 21:41:23 -05:00
William Vu
23f7fe45ed
Add Chromecast wifi enumeration module
2014-06-11 21:00:47 -05:00
jakxx
88273f87db
Targets update
2014-06-11 21:50:16 -04:00
Julian Vilas
2296dea5ad
Clean and fix
2014-06-12 01:55:27 +02:00
Julian Vilas
4f67db60ed
Modify breakpoint approach by step into
2014-06-12 01:23:20 +02:00
David Maloney
c074ebda7b
refactor telnet_login
2014-06-11 17:46:42 -05:00
dmaloney-r7
85bee6ea12
Update ftp_login.rb
2014-06-11 17:29:23 -05:00
Spencer McIntyre
e6aba3ee35
Land #3438 , chromecast youtube video aux module
2014-06-11 18:21:12 -04:00
Brandon Perry
cca91dd7c5
Update mongodb_js_inject_collection_enum.rb
...
some @jvennix-r7 fixes
2014-06-11 17:07:57 -05:00
David Maloney
83a2dc250d
make ftp guest attempts optional
2014-06-11 16:37:59 -05:00
James Lee
c8e1fab6ec
Merge branch 'staging/electro-release' into feature/MSP-9708/ssh-bruteforce
...
Conflicts:
lib/metasploit/framework/credential.rb
2014-06-11 16:28:01 -05:00
James Lee
b756395eaa
Merge branch 'staging/electro-release' into feature/MSP-9712/winrm-bruteforce
...
Conflicts:
lib/metasploit/framework/credential_collection.rb
spec/lib/metasploit/framework/credential_collection_spec.rb
2014-06-11 16:21:59 -05:00
David Maloney
1164cf5363
refactor ftp_login
...
uses new cred goodness
2014-06-11 16:21:55 -05:00
Jon Hart
7ce9114a1e
Initial commit of an NTP fuzzer
2014-06-11 13:46:08 -07:00
Trevor Rosen
87a9ee9a69
Merge pull request #59 from rapid7/feature/MSP-9697/tomcat_login
...
Feature/msp 9697/tomcat login
MSP-9697 #land
2014-06-11 15:35:09 -05:00
Trevor Rosen
d36e82bef4
Update creds dep
2014-06-11 15:31:45 -05:00
William Vu
746a429b44
Land #3442 , platform fix from dracu on freenode
2014-06-11 15:25:04 -05:00
HD Moore
0bac24778e
Fix the case statements to match platform
2014-06-11 15:22:55 -05:00
HD Moore
d5b32e31f8
Fix a typo where platform was 'windows' not 'win'
...
This was reported by dracu on freenode
2014-06-11 15:10:33 -05:00
joev
8b35815ead
Move module to post/firefox/manage.
2014-06-11 15:10:22 -05:00
joev
bdd86bf863
Add check for windows bug (RM#8810).
2014-06-11 15:09:52 -05:00
HD Moore
81019ed850
Supermicro work
2014-06-11 15:03:54 -05:00
David Maloney
6269a9141b
Merge branch 'staging/electro-release' into feature/MSP-9695/ftp_login
2014-06-11 14:38:49 -05:00
dmaloney-r7
9affc753c0
Merge pull request #66 from rapid7/feature/cred-collection-prepend
...
Add ability to prepend creds to a collection
2014-06-11 14:34:54 -05:00
James Lee
3a8f6236ad
Add ability to prepend creds to a collection
2014-06-11 14:30:45 -05:00
Trevor Rosen
8d06cb7679
Creds version bump
2014-06-11 14:09:31 -05:00
Trevor Rosen
6c0d668f0a
Merge pull request #55 from rapid7/feature/MSP-9701/msssql_login
...
Feature/msp 9701/msssql login
MSP-9701 #land
2014-06-11 13:48:59 -05:00
Samuel Huckins
84aa0d42ed
Merge pull request #57 from rapid7/bug/MSP-10004/rubyzip
...
Trevor added a 0.4.1 tag right before this PR landed, making this unmergable. Pulled in staging/electro-release, specs passing.
2014-06-11 13:48:03 -05:00
Samuel Huckins
1903542683
Merge branch 'staging/electro-release' into bug/MSP-10004/rubyzip
...
Conflicts:
Gemfile
Gemfile.lock
2014-06-11 13:42:26 -05:00
Trevor Rosen
5440e3e150
Merge pull request #52 from rapid7/feature/MSP-9702/mysql_login
...
refactor mysql_login
MSP-9702 #land
2014-06-11 13:41:48 -05:00
Trevor Rosen
e8752f9c56
Point to correct creds version
2014-06-11 13:38:35 -05:00
Trevor Rosen
ad80ada86b
Merge pull request #51 from rapid7/feature/MSP-9711/vnc_login
...
refactor vnc_login
2014-06-11 13:35:26 -05:00
Trevor Rosen
651871bd7a
Resolve upstream conflict
2014-06-11 13:34:45 -05:00
Trevor Rosen
a92660376c
Update credentials tag
2014-06-11 13:29:09 -05:00
William Vu
ac94f8e861
Refactor bulletproof_ftp creds
2014-06-11 13:04:58 -05:00
William Vu
7147a88968
Refactor ftpnavigator creds
2014-06-11 12:57:45 -05:00
William Vu
676afe391a
Refactor gpp creds
2014-06-11 12:48:00 -05:00
William Vu
41ff4c3dce
Refactor ftpx creds
2014-06-11 12:35:15 -05:00
Samuel Huckins
b26a8fa76d
Updating with latest MC tag
...
MSP-10004
2014-06-11 11:36:49 -05:00
David Maloney
943a4285e4
update schema.rb
2014-06-11 10:57:13 -05:00
David Maloney
9593422f9c
Merge branch 'master' into staging/electro-release
2014-06-11 10:23:56 -05:00
Tod Beardsley
4b8961a464
Land #3428 , deprecation warns for payloads
2014-06-11 09:57:07 -05:00
TecR0c
278a53c3da
Merge pull request #1 from jvazquez-r7/land_3433
...
Do minor cleanup
2014-06-12 00:40:44 +10:00
jvazquez-r7
34f98ddc50
Do minor cleanup
2014-06-11 09:20:22 -05:00
AnwarMohamed
72ef4dc704
Merge remote-tracking branch 'upstream/master'
2014-06-11 15:54:27 +02:00
TecR0c
b27b00afbb
Added target 4.0 and cleaned up exploit
2014-06-11 06:22:47 -07:00
TecR0c
f1382af018
Added target 4.0 and cleaned up exploit
2014-06-11 06:20:49 -07:00
Meatballs1
165a65fdb4
Merge pull request #49 from todb-r7/fix-pr3428-deprecated
...
Avoid double-printing with setup and init_ui
2014-06-11 09:28:06 +01:00
William Vu
6ca5cf6c26
Add Chromecast YouTube remote control
2014-06-11 00:08:08 -05:00
Samuel Huckins
8e34b0b4bd
Updated metasploit-credential tag
...
MSP-10004
2014-06-10 19:51:50 -05:00
James Lee
fb8c1f4c4b
Refactor ssh_login to use LoginScanner stuffs
...
Also, Metasploit::Credential::Creation stuffs.
2014-06-10 17:30:06 -05:00
James Lee
c0c1bd40a9
Fix help spec
2014-06-10 17:28:55 -05:00
Trevor Rosen
73c3409133
Prayer
...
Merge branch 'staging/electro-release' into feature/MSP-9711/vnc_login
2014-06-10 16:01:24 -05:00
David Maloney
c06fd21fb1
refactor tomcat_mgr_login
...
uses the new Metasploit::Credential magic now
2014-06-10 15:59:00 -05:00
James Lee
82b2c1deae
Make creds command show Metasploit::Credentials
...
This attempts to change the output of the command as little as possible,
but removes the ability to add and delete for now. At some point, we'll
need to add that back in.
2014-06-10 15:03:03 -05:00
David Maloney
693c4aae66
make sure we capture realms
...
need to account for the possability of
realms in mssql_login
2014-06-10 14:41:45 -05:00
Luke Imhoff
b05e7fb9ac
Fix require
...
MSP-10004
Change 'zip/zip' to 'zip' to match >= 1.0.0 rubyzip API.
2014-06-10 13:58:07 -05:00
Tod Beardsley
b379dc014a
Avoid double-printing with setup and init_ui
2014-06-10 13:57:25 -05:00
Luke Imhoff
c79e51ea1d
Update db/schema.rb
...
MSP-10004
2014-06-10 13:46:12 -05:00
David Maloney
74d376e387
refactor db2_auth module
...
you know what it is
2014-06-10 13:43:07 -05:00
Luke Imhoff
4d923a4809
Update to Rubyzip 1.X API
...
MSP-10004
`require 'zip'` instead of `'zip/zip'` and rename all classes to remove
redundant Zip prefix inside the Zip namespace.
2014-06-10 13:41:42 -05:00
Luke Imhoff
f37ce795a1
Remove lib/zip
...
MSP-10004
2014-06-10 13:39:05 -05:00
Tod Beardsley
44540e6d00
Land #3437 , CSS Injection MITM scanner
2014-06-10 13:36:35 -05:00
jvazquez-r7
4aa1fee398
Land #3326 , @FireFart's Heartbleed - server response parsing
2014-06-10 13:27:28 -05:00
Luke Imhoff
b92e95ee7f
Add rubyzip 1.1.X
...
MSP-10004
2014-06-10 13:23:40 -05:00
David Maloney
6b52da2901
Merge branch 'staging/electro-release' into feature/MSP-9693/db2_auth
2014-06-10 13:17:10 -05:00
dmaloney-r7
9826a57429
Update coreftp.rb
2014-06-10 13:01:19 -05:00
William Vu
dffc9b6852
Use the new hash syntax for consistency
2014-06-10 12:56:15 -05:00
William Vu
af04d5dd05
Use the new hash syntax for consistency
2014-06-10 12:54:35 -05:00
William Vu
00fcdc25f2
Use getaddress on rhost
2014-06-10 12:50:53 -05:00
William Vu
d7fd7b8d1e
Refactor wsftp_client creds
2014-06-10 12:05:04 -05:00
David Maloney
0c89d6cdce
refactor mssql_login
...
now uses all the Metasploit::Credential goodness
2014-06-10 11:49:08 -05:00
David Maloney
15ceb1e826
put calls in right place it helps
2014-06-10 11:17:19 -05:00
David Maloney
63ec83ea90
missing public
...
missing the public in the invalidate_login call
now fixed
2014-06-10 11:12:17 -05:00
David Maloney
6362eac0b0
add invalidate_login call
2014-06-10 11:11:22 -05:00
David Maloney
e9d9806408
invalidate_login
...
added invalidate_login call
also made to_s on credential drop the @
if there is no realm present
2014-06-10 11:07:15 -05:00
David Maloney
dc590008a7
add invalidate_login call
...
add the new invalidate login call to make sure
we update the status on failed logins appropriately
2014-06-10 10:58:27 -05:00
jvennix-r7
92414d3688
Merge pull request #53 from rapid7/bug/MSP-9994/framework-db-driver
...
Set `framework.db.driver` when connection already established.
2014-06-10 10:49:00 -05:00
jvazquez-r7
9aa2978589
Land jvazquez-r7/metasploit-framework#14 , @todb-r7's fixes
2014-06-10 10:42:34 -05:00
Tod Beardsley
521284253f
Be more clear about the vuln and impact
2014-06-10 10:29:23 -05:00
jvazquez-r7
2c8a99143b
Land #3426 , @Meatballs1's Python v2.3.3 Compatible Command Shell payloads
2014-06-10 09:55:58 -05:00
jvazquez-r7
3ec15b6512
Land #3431 , @bcoles's new targets for efs_easychatserver_username
2014-06-10 09:52:16 -05:00
jvazquez-r7
a554b25855
Use EXITFUNC
2014-06-10 09:51:06 -05:00
Trevor Rosen
2c8c4f238c
Merge pull request #49 from rapid7/feature/MSP-9746/ssh_creds
...
refactor ssh_creds post module
MSP-9746 #land
2014-06-10 09:32:11 -05:00
Trevor Rosen
dcca5802e4
Merge pull request #48 from rapid7/feature/MSP-9745/linux_hashdump
...
refactor linux hashdump post module
MSP-9745 #land
2014-06-10 09:23:31 -05:00
jvazquez-r7
9b55f5143a
Add module for CVE-2014-0224
2014-06-09 17:38:11 -05:00
James Lee
e629fdb47d
Report the realm, too
...
derp
2014-06-09 17:06:56 -05:00
Meatballs
dc69afebb1
License and Require
2014-06-09 21:41:38 +01:00
William Vu
384b65b3ec
Refactor glassfish_deployer creds
2014-06-09 15:40:26 -05:00
Luke Imhoff
2cbbaad6b4
Set drivers and driver when connection already established
...
MSP-9994
3 database commands in msfconsole check for framework.db.driver to be
set, so driver must be set when the connection is already established by
the Rails initialization.
2014-06-09 14:26:59 -05:00
Luke Imhoff
1ee35ec68a
Handle unconnected config in connection_established?
...
MSP-9994
Rescue `ActiveRecord::ConnectionNotEstablished` in
`Msf::DBManager#connection_established?` in addition to
`PG::ConnectionBad` to handle when the connection has been removed.
2014-06-09 14:26:45 -05:00
Luke Imhoff
c7a43ecced
Update Gemfile.lock
...
MSP-9994
2014-06-09 14:24:44 -05:00
David Maloney
32f87b985c
refactor mysql_login
...
refactor mysql_login to use the new
Metasploit::Credential apradigm
2014-06-09 14:20:58 -05:00
David Maloney
61fd962331
refactor vnc_login
...
refactor for new credential usage
2014-06-09 13:55:24 -05:00
jvazquez-r7
e953fcbd97
Land #3436 , @todb-r7's cleanup for dtls_fragment_overflow
2014-06-09 13:47:27 -05:00
David Maloney
8e35f5fa12
username and password flipped
...
we reported the username as the password
and vice versa
2014-06-09 13:45:12 -05:00
Tod Beardsley
4103f2295b
Missing comma
2014-06-09 13:44:46 -05:00
Tod Beardsley
0e14d77dba
Minor fixup on DTLS module
2014-06-09 13:42:30 -05:00
jvazquez-r7
0e611b5d64
Land #3429 , @jhart-r7's auxiliary module for CVE-2014-0195
2014-06-09 13:34:38 -05:00
jvazquez-r7
ed5d83a41b
Add vulnerability discoverer
2014-06-09 13:25:33 -05:00
jvazquez-r7
daf662b3c0
Do minor cleanup
2014-06-09 13:23:56 -05:00
David Maloney
a4e96d8f59
Merge branch 'master' into staging/electro-release
2014-06-09 13:07:22 -05:00
David Maloney
f8f5691eee
refactor postgres_login module
...
postgres_login now uses all the new components
such as Metasploit::Credential and the LoginScanner
class
2014-06-09 12:59:05 -05:00
David Maloney
90c63efaeb
refactor ssh_creds post module
...
the sssh_ creds post module now stores
SSH Keys as Metasploit::Credential objects
2014-06-09 11:49:49 -05:00
jvazquez-r7
1f33566033
Land #3432 , @Meatballs1 sap_soap_rfc_brute_login's clean up
2014-06-09 11:39:52 -05:00
TecR0c
3d33a82c1c
Changed to unless
2014-06-09 09:31:14 -07:00
TecR0c
1252eea4b9
Changed to unless
2014-06-09 09:26:03 -07:00
jvazquez-r7
b39b41e29f
Land #3371 , @Meatballs1 fix for sap_mgmt_con_getprocessparameter
2014-06-09 11:25:01 -05:00
Jon Hart
06e45e8253
Clean up TLS fragment building
2014-06-09 08:39:30 -07:00
David Maloney
482aa2ea08
Merge branch 'master' into staging/electro-release
2014-06-09 10:27:22 -05:00
TecR0c
79bc2b9e80
Merge remote-tracking branch 'origin/module-efs-fmws-userid-bof' into module-efs-fmws-userid-bof
2014-06-09 03:34:43 -07:00
TecR0c
52d26f290f
Added check in exploit func
2014-06-09 03:23:14 -07:00
Meatballs
76b5297d3f
Land #3434 , Fix original psh payload VirtualAlloc call
2014-06-08 17:39:39 +01:00
Meatballs
d868294d5b
MEM_RESERVE too
2014-06-08 17:37:57 +01:00
jvazquez-r7
9d08ebe273
Fix VirtualAlloc call on PSH old template
2014-06-08 11:09:03 -05:00
jvazquez-r7
e4d14194bb
Add module for Rocket Servergraph ZDI-14-161 and ZDI-14-162
2014-06-08 11:07:10 -05:00
Meatballs
25ed68af6e
Land #3017 , Windows x86 Shell Hidden Bind
...
A bind shellcode that responds as 'closed' unless the client matches the
AHOST ip.
2014-06-08 13:49:49 +01:00
TecR0c
323ac17979
Update efs_fmws_userid_bof.rb
...
Removed test sploit line.
2014-06-08 21:29:12 +10:00
TecR0c
8ecafbc49e
Easy File Management Web Server v5.3 Stack Buffer Overflow
2014-06-08 04:21:14 -07:00
Christian Mehlmauer
099003708c
Land #3422 , SAP Bruterforcer datastore cleanup
2014-06-08 08:42:27 +02:00
Brandon Perry
4367e8ef0c
Update mongodb_js_inject_collection_enum.rb
...
Fix some logic bugs that caused incorrect results.
2014-06-07 21:03:28 -05:00
Brandon Perry
dc89621d5c
Update mongodb_js_inject_collection_enum.rb
...
No need to make extra requests. Off by one.
2014-06-07 20:09:00 -05:00
Brandon Perry
2663af986b
Update mongodb_js_inject_collection_enum.rb
...
This adds a bit more error handling, and better decision making in regards to false responses.
2014-06-07 19:58:12 -05:00
Julian Vilas
73536f2ac0
Add support Java 8
2014-06-07 22:43:14 +02:00
Brendan Coles
6bef6edb81
Update efs_easychatserver_username.rb
...
Add targets for versions 2.0 to 3.1.
Add install path detection for junk size calculation.
Add version detection for auto targeting.
2014-06-08 06:36:18 +10:00
Jon Hart
a7a1a2bf3b
Move dtls_fragment_overflow.rb under ssl where it belongs
2014-06-07 12:56:34 -07:00
Brandon Perry
4071fb332b
Create mongodb_js_inject_collection_enum.rb
...
This module was tested against a small php application I wrote interfacing with MongoDB 2.2.7
https://gist.github.com/brandonprry/c2de8ac2be825007c4de
2014-06-07 11:20:34 -05:00
Borja Merino
5881f9453f
Merge pull request #5 from Meatballs1/hidden_bind
...
Remove bind hidden handler
2014-06-07 17:43:25 +02:00
Meatballs
2be6b8befe
Remove bind hidden handler
2014-06-07 14:34:20 +01:00
Meatballs
bf1a665259
Land #2657 , Dynamic generation of windows service executable functions
...
Allows a user to specify non service executables as EXE::Template as
long as the file has enough size to store the payload.
2014-06-07 13:28:20 +01:00
Meatballs
897ad6f963
Some service yarddoc
2014-06-07 13:27:32 +01:00
Jon Hart
8637a1fff1
OpenSSL DTLS CVE-2014-0195 POC
2014-06-06 19:24:47 -07:00
Meatballs
fe20e6e1c4
Merge remote-tracking branch 'upstream/master' into soap_brute_fix
...
Conflicts:
modules/auxiliary/scanner/sap/sap_soap_rfc_brute_login.rb
2014-06-07 02:44:16 +01:00
Meatballs
8624ddfc3e
Clean up SAP SOAP RFC Brute Login
...
Honour the user supplied settings
Abort a host on connection error
Check a 200 response for some appropriate data
Let datastore validation handle things like options being present
Be more verbose if needed
Use the HTTPClient more appropriately
2014-06-07 02:34:49 +01:00
Meatballs
b997c2ac1f
Further tidies
2014-06-07 02:00:35 +01:00
Meatballs
5218ca4d89
Give warning on module load
2014-06-06 23:04:40 +01:00
joev
a33de66da4
Fix transparent background, add VISIBLE option.
2014-06-06 16:52:00 -05:00
joev
a45a5631f5
Make window invisible.
2014-06-06 16:40:55 -05:00
joev
496be5c336
Ensure command_shell_options is present.
2014-06-06 16:26:45 -05:00
joev
d990fb4999
Remove a number of stray edits and bs.
2014-06-06 16:24:45 -05:00
joev
4a9f50bb60
Clean up some dead code.
2014-06-06 16:20:40 -05:00
joev
7c762ad42c
Fix some minor bugs in webrtc stuff, inline API code.
2014-06-06 16:18:39 -05:00
David Maloney
534c20d5e6
refactor linux hashdump post module
...
linux hashdump now saves hashes as nonreplayable hash
credential objects
2014-06-06 15:21:47 -05:00
Meatballs
4a699c2852
Merge remote-tracking branch 'upstream/pr/3416' into x64_injection
2014-06-06 20:37:12 +01:00
James Lee
552899ef13
Add a couple more specs for CredentialCollection
...
Also fixes some typos in docs
2014-06-06 12:12:32 -05:00
David Maloney
4d53c18ac4
fix version
2014-06-06 12:07:22 -05:00
David Maloney
9b9de12a38
Merge branch 'master' into staging/electro-release
...
Conflicts:
lib/msf/core/framework.rb
2014-06-06 12:04:53 -05:00
dmaloney-r7
ff8e6d2c50
Merge pull request #45 from rapid7/feature/MSP-9988/credential-collection
...
Add a CredCollection class and refactor WinRM bruteforce module
2014-06-06 11:53:28 -05:00
David Maloney
90b52814b1
fix some spec issues for recent changes
2014-06-06 11:52:49 -05:00
jvennix-r7
f660f557e5
Merge pull request #38 from rapid7/feature/msp-9738/winscp
...
Feature/msp 9738/winscp
2014-06-06 11:43:50 -05:00
Samuel Huckins
984b77a4a6
Merge pull request #43 from rapid7/feature/MSP-9721/tomcat_deploy
...
Specs aside from known POP3 fail passing, functional steps passing.
MSP-9721 #land
MSP-9722 #land
2014-06-06 11:11:08 -05:00
jvennix-r7
4bc543715d
Merge pull request #40 from rapid7/feature/MSP-9748/postgres_hashdump
...
Feature/msp 9748/postgres hashdump
2014-06-06 10:51:19 -05:00
David Maloney
da09a2725b
we need the service data in the login!
...
ooopsie #2
2014-06-06 10:51:12 -05:00
Brandon Turner
acced15d11
Merge branch 'release'
2014-06-06 10:17:00 -05:00
Brandon Turner
82464bd6aa
Update version spec
2014-06-06 10:16:44 -05:00
Brandon Turner
bacf82acb1
Merge branch 'release' into 'master'
2014-06-06 09:59:00 -05:00
Brandon Turner
21be4f21a6
Bump version to 4.9.3
2014-06-06 09:52:01 -05:00
Brandon Turner
d9a5002bd3
Merge branch 'release'
...
Updates meterpreter bins and closes #3425 and #3423 .
2014-06-05 17:33:11 -05:00
Brandon Turner
17ccc132a4
Land #3425 from todb-r7:release-meterpreter-bins
2014-06-05 17:32:34 -05:00
Tod Beardsley
97a70e49c8
Roll back the jar/py changes
2014-06-05 17:31:02 -05:00
Tod Beardsley
737f06f600
Add Meterpreter bins for release branch.
...
This contains the same bins as #3423 , but it is targeted at the release
branch for rapid7/metasploit-framework.
2014-06-05 17:17:32 -05:00
Lance Sanchez
b6f049d41e
Merge branch 'feature/MSP-9653/use-metasploit-concern-in-pro' into staging/electro-release
2014-06-05 16:32:47 -05:00
Lance Sanchez
eead9f097a
updating creds to v0.3.0
...
MSP-9653
2014-06-05 16:31:17 -05:00
Luke Imhoff
f2a56c041b
Merge branch 'staging/electro-release' into feature/MSP-9653/use-metasploit-concern-in-pro
...
MSP-9653
Conflicts:
Gemfile
Gemfile.lock
2014-06-05 16:22:02 -05:00
David Maloney
c61b47063d
vnc add missing exception catch
...
linux throws a different exception than osx
when the vnc client fails to connect
this caused issues with the specs running. this now
catches that additional exception
2014-06-05 15:32:08 -05:00
jvennix-r7
2522f1f332
Merge pull request #39 from rapid7/feature/MSP-9751/mysql_hashdump
...
Feature/msp 9751/mysql hashdump
2014-06-05 14:39:48 -05:00
Lance Sanchez
d10867ea9e
updating the gemfile
...
metasploit-concern v0.1.0 has been released
metasploit-credential is now on the v0.2.0-electro-release tag
MSP-9653
2014-06-05 14:26:40 -05:00
James Lee
2ee408e9db
Refactor winrm_login with Credentials
2014-06-05 14:26:29 -05:00
David Maloney
a84980fa9d
login creation was missing!
2014-06-05 13:56:08 -05:00
Samuel Huckins
9d4ba8c981
Merge pull request #41 from rapid7/feature/MSP-9731/filezilla
...
Specs other than POP3 specs fixed on staging passing, functional passing
MSP-9731 #land
2014-06-05 13:19:10 -05:00
Luke Imhoff
5ae5448005
Join killed threads to ensure cleanup
...
MSP-9653
2014-06-05 12:40:24 -05:00
Samuel Huckins
75e4e81b7a
Merge pull request #37 from rapid7/feature/MSP-9750/MSSQL_hashdump
...
Specs and functional tests passing.
MSP-9750 #land
2014-06-05 12:20:40 -05:00
James Lee
33a9f8c43f
Add spec for userpass_file
2014-06-05 11:54:59 -05:00
James Lee
45c26343a1
Add spec for pass_file
2014-06-05 11:51:11 -05:00
James Lee
b1136752be
Add Credential#== to facilitate specs
2014-06-05 11:37:48 -05:00
Samuel Huckins
af20e8f56e
Merge pull request #44 from rapid7/bug/fixing-failing-specs-in-pop3
...
All specs passing. Much celebrations. Such happy. Wow.
2014-06-05 11:33:40 -05:00
Lance Sanchez
262deac155
Fixing the failing specs
...
for some reason on my box sock.closed? isnt being called. stubbing it out
Kernel.select is being called and cant cast a mock object to an IO object
ok to fix this I'm stubbing select on the scanner object then the call wont
get passed onto the Kernel module
2014-06-05 11:21:34 -05:00
William Vu
00511b2aeb
Land #3421 , new @trosen-r7 in .mailmap
2014-06-05 10:59:47 -05:00
Tod Beardsley
8747273b01
Add @trosen-r7's alias for commits
...
Just so quick counts of contributors is slightly more accurate and
@trosen-r7 doesn't accidentally get double counted.
2014-06-05 10:40:38 -05:00
AnwarMohamed
d0f43f1aba
Merge remote-tracking branch 'upstream/master'
2014-06-05 15:04:07 +02:00
Julian Vilas
e7957bf999
Change GET request by random text
2014-06-05 01:33:00 +02:00
James Lee
8b6e188ba8
Add support for realm in CredentialCollection
...
MSP-9988
2014-06-04 17:03:52 -05:00
Redsadic
934ba7394f
Merge pull request #2 from jvazquez-r7/clean_3407
...
Clean jdwp exploit
2014-06-04 23:57:17 +02:00
David Maloney
62866374b8
refactor tomcat_mgr_deploy
2014-06-04 16:22:22 -05:00
David Maloney
f22447f91e
refactor tomcat_mgr_upload
2014-06-04 16:07:57 -05:00
jvazquez-r7
c9bd0ca995
Add minor changes
2014-06-04 15:56:14 -05:00
David Maloney
ef8f237050
refactor filezilla_server
...
you know the score
2014-06-04 15:43:15 -05:00
jvazquez-r7
bb77327b09
Warn the user if the detected platform doesnt match target
2014-06-04 14:50:18 -05:00
James Lee
b1ff6b95b5
Better docs
2014-06-04 14:44:53 -05:00
jvazquez-r7
b76253f9ff
Add context to the socket
2014-06-04 14:25:01 -05:00
jvazquez-r7
77eeb5209a
Do small cleanups
2014-06-04 14:23:21 -05:00
jvazquez-r7
6c643f8837
Fix usage of Rex::Sockket::Tcp
2014-06-04 14:14:23 -05:00
David Maloney
4960503a59
fix jtr_format
...
use raw-md5 as that sort of works
2014-06-04 14:10:28 -05:00
jvazquez-r7
837668d083
use optiona argument for read_reply
2014-06-04 13:48:53 -05:00
jvazquez-r7
d184717e55
delete blank lines
2014-06-04 13:24:34 -05:00
jvazquez-r7
33a7bc64fa
Do some easy cleaning
2014-06-04 13:18:59 -05:00
James Lee
41644970bf
Add a CredentialCollection
...
Also moves Metasploit::Framework::LoginScanner::Credential to
Metasploit::Framework::Credential
2014-06-04 13:01:09 -05:00
jvazquez-r7
1ff539fc73
No sense to check two times
2014-06-04 12:48:20 -05:00
jvazquez-r7
7a5b5d31f9
Avoid messages inside check
2014-06-04 12:43:39 -05:00
jvazquez-r7
3869fcb438
common http breakpoint event
2014-06-04 12:41:23 -05:00
jvazquez-r7
9ffe8d80b4
Do some metadata cleaning
2014-06-04 12:33:57 -05:00
David Maloney
30c35907bf
refactor psotgres_hashdump
...
refactor psotgres_hashdump to now save
hashes as Metasploit::Credential objects
2014-06-04 12:21:49 -05:00
David Maloney
d1f7f93e4b
refactor mysql_hashdump
...
mysql_hashdump now uses Metasploit::Credential to
save hashes.
2014-06-04 11:59:47 -05:00
David Maloney
201e6e9866
Merge branch 'feature/MSP-9750/MSSQL_hashdump' into feature/MSP-9751/mysql_hashdump
2014-06-04 11:58:58 -05:00
jvazquez-r7
079fe8622a
Add module for ZDI-14-136
2014-06-04 10:29:33 -05:00
David Maloney
28bf29980e
Merge branch 'master' into staging/electro-release
2014-06-04 10:21:08 -05:00
OJ
a53955adb7
Updated more UINT TLVs to QWORDS
...
All with the goal of removing more pointer truncation issues.
2014-06-04 20:55:20 +10:00
Meatballs
c032b8ce8e
Compat
2014-06-04 02:27:06 +01:00
Julian Vilas
b9d8f75f59
Add breakpoint autohitting
2014-06-03 23:34:40 +02:00
Julian Vilas
6061e5e713
Fix suggestions
2014-06-03 23:13:14 +02:00
James Lee
f2e1732878
Resolve hostnames before trying to save
2014-06-03 15:19:30 -05:00
David Maloney
d3949b3d6c
refactor mssql_hashdump
...
refactor mssql_hashdump to use Metasploit:Credential
2014-06-03 15:02:59 -05:00
Trevor Rosen
0272593923
Merge pull request #32 from rapid7/feature/MSP-9736/vnc-post
...
refactor vnc post module
MSP-9736 #land
2014-06-03 13:53:42 -05:00
jakxx
62fe30798d
Tidy
2014-06-03 14:48:40 -04:00
jakxx
5ddbdb7dfd
Tidy
2014-06-03 14:23:04 -04:00
jakxx
fdfd7f410d
Tidy
2014-06-03 14:21:13 -04:00
jakxx
392b383c2c
Update
2014-06-03 14:07:04 -04:00
Trevor Rosen
ad15e6fe17
Merge pull request #35 from rapid7/feature/MSP-9678/pop3-login-scanner
...
Feature/msp 9678/pop3 login scanner
MSP-9678 #land
2014-06-03 12:11:17 -05:00
James Lee
8abed15c77
Switch to Credential::* things
2014-06-03 11:48:08 -05:00
William Vu
6c7fd3642a
Land #3411 , Python 3.[34] Meterpreter support
2014-06-03 11:34:22 -05:00
Meatballs
0e3549ebc4
mc brute tidy
2014-06-03 17:27:46 +01:00
Lance Sanchez
edc9f94d41
fixing issues raised in code review
...
MSP-9678
2014-06-03 11:15:26 -05:00
Spencer McIntyre
0e4177fb75
Pymeterpreter shorten stagers by 3 bytes
2014-06-03 12:03:20 -04:00
jakxx
166748a997
Add script_web_delivery
2014-06-03 11:53:32 -04:00
Trevor Rosen
9335495b30
Merge pull request #36 from rapid7/feature/MSP-9724/psexec
...
psexec credential refactor
MSP-9724 #land
2014-06-03 10:09:56 -05:00
Trevor Rosen
883976c6a8
Merge pull request #33 from rapid7/feature/MSP-9741/smartftp
...
refactor smartftp post module
MSP-9741 #land
2014-06-03 10:04:09 -05:00
jvazquez-r7
8d111caeb9
Use powershell instead of mshta
2014-06-03 10:00:32 -05:00
jvazquez-r7
443f9f175c
Update IE11Sandbox exploit source
2014-06-03 09:58:07 -05:00
jvazquez-r7
43699b1dfb
Don't clean env variable before using it
2014-06-03 09:56:19 -05:00
jvazquez-r7
b8a2cf776b
Do test
2014-06-03 09:52:01 -05:00
jvazquez-r7
05ed2340dc
Use powershell
2014-06-03 09:29:04 -05:00
Spencer McIntyre
95376bf6d3
Pymeterpreter update stager and stage descriptions
2014-06-03 10:17:27 -04:00
jvazquez-r7
372a12b966
Restore make.msbuild permissions
2014-06-03 09:07:34 -05:00
jvazquez-r7
98a06b3d72
Restore make.msbuild
2014-06-03 09:05:26 -05:00
jvazquez-r7
f918bcc631
Use powershell instead of mshta
2014-06-03 09:01:56 -05:00
AnwarMohamed
8898dd655c
Merge remote-tracking branch 'upstream/master'
2014-06-03 14:34:21 +02:00
joev
04ac07a216
Compress and base64 data to save bytes.
...
Reduced file size from 43kb to 12kb, yay.
2014-06-02 23:06:46 -05:00
joev
cf6b181959
Revert change to trailer(). Kill dead method.
...
* I verified that changes to PDF mixin do not affect any older modules that
generate PDF. I did this by (on each branch) running in irb, then
running the module and diffing the pdf's generated by each branch. There were
no changes.
2014-06-02 22:26:14 -05:00
joev
9f5dfab9ea
Add better interface for specifying custom #eol.
2014-06-02 22:26:11 -05:00
joev
09e965d54e
Remove extraneous method from pdf.rb
2014-06-02 22:26:03 -05:00
joev
feca6c4700
Add exploit for ajsif vuln in Adobe Reader.
...
* This refactors the logic of webview_addjavascriptinterface into a mixin (android.rb).
* Additionally, some behavior in pdf.rb had to be modified (in backwards-compatible ways).
Conflicts:
lib/msf/core/exploit/mixins.rb
2014-06-02 22:25:55 -05:00
James Lee
9d9f3b5a03
Refactor to prepare for replacing report_auth_info
2014-06-02 18:07:44 -05:00
jvazquez-r7
7f4702b65e
Update from rapid7 master
2014-06-02 17:41:41 -05:00
Tod Beardsley
d0d389598a
Land #3086 , Android Java Meterpreter updates
...
w00t.
2014-06-02 17:28:38 -05:00
jvazquez-r7
4840a05ada
Update from rapid7 master
2014-06-02 17:17:00 -05:00
jakxx
52c33b7e79
Merge branch 'master' of https://github.com/rapid7/metasploit-framework
2014-06-02 17:32:51 -04:00
Spencer McIntyre
76c3aaf743
Pymeterpreter get type encoder from dict instead
2014-06-02 17:32:08 -04:00
Spencer McIntyre
aeca455a10
Pymeterpreter update pystagers for version 3.1/3.2
2014-06-02 17:18:13 -04:00
Spencer McIntyre
b84297980d
Pymeterpreter use print_exc and not print_exception
2014-06-02 16:50:54 -04:00
Christian Mehlmauer
ff6607bd87
Correct documentation link
...
changed link from https://dev.metasploit.com/documents/api/ to https://dev.metasploit.com/api/
2014-06-02 22:37:20 +02:00
David Maloney
07093ada58
add realm handling to psexec
...
oops, forgot to create the realm when applicable
2014-06-02 14:53:40 -05:00
jvazquez-r7
9574a327f8
use the new check also in exploit()
2014-06-02 14:38:33 -05:00
jvazquez-r7
3c38c0d87c
Dont be confident about string comparision
2014-06-02 14:37:29 -05:00
William Vu
9063d3cf1f
Land #3417 , release fixes
2014-06-02 14:34:14 -05:00
Luke Imhoff
ca63d2201e
Update init_module_paths spec to match Rails::Engine behavior
...
MSP-9653
2014-06-02 14:26:35 -05:00
Tod Beardsley
b136765ef7
Nuke extra space at EOL
2014-06-02 14:22:01 -05:00
David Maloney
361b9a1616
psexec credential refactor
...
refactor psexec credential reporting
to use Metasploit::Credential
2014-06-02 14:20:54 -05:00
Luke Imhoff
1295028595
Remove unneeded MetasploitDataModels.require_models
...
MSP-9653
Models are loaded using railties features.
2014-06-02 13:54:38 -05:00
Luke Imhoff
fcd23545e8
Remove pro schema infection
...
MSP-9653
2014-06-02 13:54:11 -05:00
Lance Sanchez
15fffb1668
Adding in some tests
...
cleaning up the regex a bit
MSP-9678
2014-06-02 13:50:30 -05:00
Luke Imhoff
9e78509aac
Merge branch 'staging/electro-release' into feature/MSP-9653/use-metasploit-concern-in-pro
...
MSP-9653
Conflicts:
Gemfile
Gemfile.lock
2014-06-02 13:40:11 -05:00
Luke Imhoff
0b57ed9134
Update schema.rb
...
MSP-9653
2014-06-02 13:32:00 -05:00
Luke Imhoff
80a75e1e9c
Update Gemfile.lock
...
MSP-9653
Forgot to `bundle install` after changing the metasploit-credential
version.
2014-06-02 13:27:56 -05:00
Tod Beardsley
ea383b4139
Make print/descs/case consistent
2014-06-02 13:20:01 -05:00
Trevor Rosen
5c745c4b9c
Merge pull request #31 from rapid7/feature/MSP-9728/coreftp
...
refactor coreFTP post module
MSP-9728 #land
2014-06-02 13:19:11 -05:00
Tod Beardsley
b7dc89f569
I prefer "bruteforce" to "brute force" for search
...
Just makes it easier to search for, since it's an industry term of art.
2014-06-02 13:09:46 -05:00
Luke Imhoff
898b108863
Gemspec
...
MSP-9653
Add gemspec for metasploit-framework so that pro can declare it as a
proper dependency. DO NOT release metasploit-framework to rubygems: it
is 47 MB and would be not be nice to their servers.
2014-06-02 13:03:07 -05:00
Luke Imhoff
ebf61bef22
Metasploit::Framework::Engine
...
MSP-9653
Rails::Engine version of Metasploit::Framework::Application that can be
used by downstream projects, like Pro to get the shared behaviors, like
modules path adding, meterpreter extension merging, and binary default
encoding.
2014-06-02 13:00:22 -05:00
Luke Imhoff
9d326fcb24
Extra common engine and fix default encoding
...
MSP-9653
Extra config and initializers that can we shared between
Metasploit::Framework::Application and the future
Metasploit::Framework::Engine. Move the default encoding setup from
lib/msf/sanity.rb to a before_initialize callback for the shared config
so that gems, like gherkin that depend on the utf-8 default internal
encoding can be loaded.
2014-06-02 12:57:48 -05:00
Luke Imhoff
3ebe7dfbc8
Gem version
...
MSP-9653
Move version information to standard location for gems.
2014-06-02 12:54:46 -05:00
Luke Imhoff
21fad7163d
Msf::DBManager#connection_established?
...
MSP-9653
Calling `ActiveRecord::Base.establish_connection`, followed by
`ActiveRecord::Base.connected?` returns false unless some other code
requires a connection to be checked out first. The correct way to check
if the spec passed to `ActiveRecord::Base.establish_connection` is to
checkout a connection and then ask if it is active.
`Msf::DBManager#connection_established?` does the checkout, active check
and checkin, and should be used in place of
`ActiveRecord::Base.connected?` and
`ActiveRecord::Base.connection_pool.connected?`.
`Msf::DBManager#active` should still be used as it also checks for
adapter/driver usability and that migrations have run.
2014-06-02 12:49:09 -05:00
Luke Imhoff
b436aeff01
msfenv compatibility with Pro
...
MSP-9653
lib/msfenv.rb should only load the framework environment to initialize
Metasploit::Framework::Application if a Rails.application is not
defined, otherwise it will clash with the Rails application in prosvc.
2014-06-02 12:41:22 -05:00
Luke Imhoff
1055efbeaa
Add module paths from paths['modules'] from Rails app and engines
...
MSP-9653
Allow rails engines (and other applications, like
Metasploit::Pro::Engine::Application) to define their own module paths
using the paths['modules'] entry for Rails Applications/Engines.
2014-06-02 12:32:54 -05:00
Luke Imhoff
84f5a0d499
Explicitly require gem dependencies
...
MSP-9653
2014-06-02 12:27:15 -05:00
David Maloney
9eb42cb80f
refactor smartftp post module
...
refactor the smartftp credential post module to use
Metasploit::Credential
2014-06-02 11:48:45 -05:00
David Maloney
34004908bb
Merge branch 'master' into staging/electro-release
...
Conflicts:
.ruby-version
2014-06-02 11:10:33 -05:00
William Vu
8bd4e8d30a
Land #3406 , indeces_enum -> indices_enum
2014-06-02 11:06:33 -05:00
William Vu
bba741897e
Land #3413 , improved FileDropper cleanup message
2014-06-02 11:05:48 -05:00
Trevor Rosen
d9fd77fba7
Merge pull request #29 from rapid7/feature/MSP-9739/mremote_refactor
...
Feature/msp 9739/mremote refactor
MSP-9739 #land
2014-06-02 11:05:20 -05:00
Lance Sanchez
f2a2975bc1
Merge branch 'staging/electro-release' into feature/MSP-9678/pop3-login-scanner
2014-06-02 10:56:54 -05:00
Christian Mehlmauer
428df19739
Changed message
2014-06-02 17:28:09 +02:00
Trevor Rosen
90c8ade911
Merge pull request #28 from rapid7/feature/MSP-9726/smart_hashdump
...
Feature/msp 9726/smart hashdump
MSP-9726 #land
2014-06-02 08:31:16 -05:00
jvazquez-r7
d0241cf4c1
Add check method
2014-06-02 08:14:40 -05:00
jvazquez-r7
31af8ef07b
Check .NET version
2014-06-01 20:58:08 -05:00
Meatballs
e3a20ae073
Merge remote-tracking branch 'upstream/pr/3416' into x64_injection
2014-06-01 16:10:53 +01:00
OJ
8346e20bf1
Change memory types from DWORD to QWORD
...
This was causing memory allocations to fail on x64 in cases where
the higher bits were set in addresses.
2014-06-01 21:27:07 +10:00
Meatballs
f0e9a9010e
Return nil if fail
2014-06-01 11:55:40 +01:00
Meatballs
3c5fae3706
Use correct include
2014-06-01 11:51:06 +01:00
Meatballs
4801a7fca0
Allow x86->x64 injection
2014-06-01 11:50:13 +01:00
Meatballs
a4ecd8e02d
Should return the thread object
2014-06-01 11:49:56 +01:00
Meatballs
58ee2ccd6e
Land #3390 , Fix have_powershell
2014-06-01 10:43:35 +01:00
Christian Mehlmauer
03b4a29662
Clarify filedropper error message
2014-05-31 22:17:32 +02:00
OJ
823f31d8af
Land #3402 IE 11 sandbox source and updated bins
2014-05-31 11:34:51 +10:00
jvazquez-r7
f6862cd130
Land @OJ's updated meterpreter binaries
2014-05-30 20:27:28 -05:00
OJ
d2b8706bd6
Include meterpreter bins, add Sandbox builds
...
This commit contains the binaries that are needed for Juan's sandbox
escape functionality (ie. the updated old libloader code). It also
contains rebuilt binaries for all meterpreter plugins.
I've also added command line build scripts for the sandbox escapes
and added that to the "exploits" build.
2014-05-31 08:12:34 +10:00
Spencer McIntyre
77eac38b01
Pymeterpreter fix processes_via_proc for Python v3
2014-05-30 16:32:03 -04:00
William Vu
e9bce6641c
Land #3410 , 1.9.3-p547 for .ruby-version
2014-05-30 15:11:48 -05:00
Christian Mehlmauer
c0391edff7
Land #3409 , fix for http crawler
2014-05-30 21:51:33 +02:00
Tod Beardsley
730ca62089
Bump to p547 to fix a regression in p545
...
In my excitement of landing #3281 I didn't check to see if there was a
newer Ruby available. Turns out, p547 was released on May 16, and fixes
a regression regarding OpenSSL.
Announcement:
https://www.ruby-lang.org/en/news/2014/05/16/ruby-1-9-3-p547-released/
Sorry about the shuffle.
2014-05-30 14:27:54 -05:00
David Maloney
1e2ae16713
refactor vnc post module
...
this adds Metasploit::Credential functionality to
the post/windows/gather/credentials/vnc module
it also fixes a hostname resolution issue on windows
hashdump that could occur when the peerhost is an unresolved
hostname
2014-05-30 14:27:44 -05:00
David Maloney
86fec3a33f
refactor coreFTP post module
...
post/windows/gather/credentials/coreftp now uses
the new Metasploit::Credential methods
2014-05-30 14:06:31 -05:00
Trevor Rosen
dee4acdb2a
Merge pull request #27 from rapid7/feature/MSP-9725/windows_hashdump
...
Windows Hashdump post module refactor
MSP-9725 #land
2014-05-30 14:04:31 -05:00
Trevor Rosen
8bcd763039
Merge pull request #26 from rapid7/feature/MSP-9685/telnet_login_scanner
...
Feature/msp 9685/telnet login scanner
MSP-9685 #land
2014-05-30 13:40:18 -05:00
RageLtMan
74400549a1
Resolve undefined method `get_cookies'
...
Anemone::Page is not a Rex HTTP request/response, and uses the
:cookies method to return an array of cookies.
This resolves the method naming error, though it does break with
Rex naming convention since Anemone still uses a lot non-Rex
methods for working with pages/traffic.
2014-05-30 14:39:51 -04:00
Spencer McIntyre
4f5ab2c596
Pymeterpreter support process channels for Python v3
2014-05-30 14:35:47 -04:00
David Maloney
782c8bd172
Merge branch 'staging/electro-release' into feature/MSP-9725/windows_hashdump
2014-05-30 13:28:35 -05:00
David Maloney
5757c95fcb
Merge branch 'staging/electro-release' into feature/MSP-9739/mremote_refactor
2014-05-30 13:28:11 -05:00
David Maloney
bfc7ee8cdf
Merge branch 'staging/electro-release' into feature/MSP-9726/smart_hashdump
2014-05-30 13:27:15 -05:00
Trevor Rosen
661abe65c4
Merge pull request #30 from rapid7/feature/MSP-9971/cred-creation
...
Feature/msp 9971/cred creation
2014-05-30 13:13:03 -05:00
David Maloney
ba525c7b78
use metasploit-credential creation methods
2014-05-30 13:07:11 -05:00
Tod Beardsley
8f52133471
Land #3281 , require latest Ruby 1.9.3
...
Note, this will cause developer environments to complain until Ruby is
reinstalled. It's probably a good idea to reinstall anyway, though,
since people who haven't in a while may have been linked against a
Heartbleed-vulnerable openssl library.
2014-05-30 12:55:54 -05:00
jvazquez-r7
3ae4a16717
Clean environment variables
2014-05-30 12:21:23 -05:00
jvazquez-r7
b99b577705
Clean environment variable
2014-05-30 12:20:00 -05:00
jvazquez-r7
b27a95c008
Delete unused code
2014-05-30 12:08:55 -05:00
jvazquez-r7
e215bd6e39
Delete unnecessary code and use get_env
2014-05-30 12:07:59 -05:00
jvazquez-r7
4a1fea7abb
Land #2948 , @juushya's PocketPAD login bruteforce module
2014-05-30 11:47:16 -05:00
jvazquez-r7
b0bdfa7680
Clean up code
2014-05-30 11:44:42 -05:00
jvazquez-r7
fb59221189
Land #2494 , @juushya's etherpadduo login module
2014-05-30 11:35:28 -05:00
jvazquez-r7
d92a7adc68
change module filename
2014-05-30 11:31:49 -05:00
David Maloney
98a23881ee
remove cred creation methods
...
removed cred creation methods from framework
and include them from the metasploit-credential gem instead
2014-05-30 11:28:53 -05:00
jvazquez-r7
40a103967e
Minor code cleanup
2014-05-30 11:28:37 -05:00
Michael Messner
76ed9bcf86
hedwig.cgi - cookie bof - return to system
2014-05-30 17:49:37 +02:00
Michael Messner
1ddc2d4e87
hedwig.cgi - cookie bof - return to system
2014-05-30 17:32:49 +02:00
Spencer McIntyre
e2cc2fece0
Pymeterpreter update win reg functions for python v3
2014-05-30 10:51:36 -04:00
jvazquez-r7
c1368dbb4c
Use %windir%
2014-05-30 09:06:41 -05:00
jvazquez-r7
1dbd36a3dd
Check for the .NET dfsvc and use %windir%
2014-05-30 09:02:43 -05:00
Tom Sellers
af569449d9
Code cleanup
...
Fixes based on response from @timwr and @kernelsmith.
Retested with Ubuntu and Metasploitable 2 to validate proper payload. Also tested for port conflict detection after the change. Returning false on line 243 simplifies the if logic on line 251/252.
2014-05-29 18:27:17 -05:00
jvazquez-r7
ffbcbe8cc1
Use cmd_psh_payload
2014-05-29 18:12:18 -05:00
jvazquez-r7
03889ed31f
Use cmd_psh_payload
2014-05-29 18:11:22 -05:00
jvazquez-r7
6f330ea190
Add deprecation information
2014-05-29 17:38:01 -05:00
Julian Vilas
60c5307475
Fix msftidy
2014-05-30 00:14:59 +02:00
jvazquez-r7
0d07fb6c39
Land #2858 , @jiuweigui's post module to enumerate Enumerate MUICache
2014-05-29 17:08:50 -05:00
jvazquez-r7
a6229aedff
Rescue RequestError when downloading file
2014-05-29 17:07:22 -05:00
jvazquez-r7
f2a71a47ca
Use \&\& instead of and
2014-05-29 17:04:38 -05:00
jvazquez-r7
31c282153e
Avoid ntuser.dat md5 because is causing problems, even when data is extracted
2014-05-29 17:02:28 -05:00
Julian Vilas
9627bae98b
Add JDWP RCE for Windows and Linux
2014-05-29 23:45:44 +02:00
David Maloney
e012d55d73
refactor mremote
...
mremote post module now refactored to
use new metasploit credentials
2014-05-29 16:27:41 -05:00
William Vu
3a9f7fb7f9
Land #3405 , improved Nokogiri check for msftidy
2014-05-29 16:21:26 -05:00
jvazquez-r7
95b71dee00
Try to fix crash while file_remote_digest
2014-05-29 16:12:51 -05:00
David Maloney
a1131092b7
fix open rescue
...
rescuing all exceptions bad
bad past dave bad
2014-05-29 16:05:16 -05:00
jvazquez-r7
cbbd7bfdf4
Refacotor code
2014-05-29 15:55:44 -05:00
David Maloney
bf3bb63e4a
fix mremote to work on mremoteNG
...
fixed the mremote credential post module to work
against the newer mRemoteNG
2014-05-29 15:43:02 -05:00
Spencer McIntyre
04e94b0c07
Fix meterpreter and file tests for Python v3.4 on Win
2014-05-29 16:42:28 -04:00
Tod Beardsley
4b97418f07
Land todb-r7#8, better nested if
2014-05-29 15:19:04 -05:00
David Maloney
f61aeb818a
smart hashdump refactor
...
refactor the windows smart hashdump post module
to use the new cred creation methods
2014-05-29 15:06:42 -05:00
jvazquez-r7
cdabb71d23
Make code cleanup
2014-05-29 14:51:10 -05:00
Spencer McIntyre
15dc33591b
In pymeterpreter use a MeterpreterFile obj for Py v3
2014-05-29 15:09:09 -04:00
David Maloney
e3c4745879
Windows Hashdump post module refactor
...
refactor the Hashdump post module for window
to use the new cred creation methods.
Also some extra methods to do db safe checks
for record ids that we need
2014-05-29 13:20:32 -05:00
William Vu
17fb48eaa3
Refactor check_nokogiri in msftidy
2014-05-29 13:20:23 -05:00
Spencer McIntyre
d8dcfd8f41
Update pymeterpreter netlink to support python3
2014-05-29 13:48:15 -04:00
jvazquez-r7
aea0379451
Fix typos
2014-05-29 12:37:51 -05:00
David Maloney
696d2b7e6b
Merge branch 'master' into staging/electro-release
2014-05-29 12:30:32 -05:00
sinn3r
3a3d038904
Land #3397 - ElasticSearch Dynamic Script Arbitrary Java Execution
2014-05-29 12:21:21 -05:00
sinn3r
dfa61b316e
A bit of description change
2014-05-29 12:20:40 -05:00
Tod Beardsley
2ce6f325f5
Be more specific with Nokogiri check
...
There are still strong reservations about using Nokogiri to parse
untrusted XML data.
http://www.wireharbor.com/hidden-security-risks-of-xml-parsing-xxe-attack/
It is also believed that many desktop operating systems are still
shipping out-of-date and vulnerable libxml2 libraries, which become
exposed via Nokogiri. For example:
http://stackoverflow.com/questions/18627075/nokogiri-1-6-0-still-pulls-in-wrong-version-of-libxml-on-os-x
While this isn't a problem for binary builds of Metasploit (Metasploit
Community, Express, or Pro) it can be a problem for development
versions or Kali's / Backtrack's version.
So, the compromise here is to allow for modules that don't directly
expose XML parsing. I can't say for sure that the various libxml2
vulnerabilities (current and future) aren't also exposed via
`Nokogiri::HTML` but I also can't come up with a reasonable demo.
Metasploit committers should still look at any module that relies on
Nokogiri very carefully, and suggest alternatives if there are any. But,
it's sometimes going to be required for complex HTML parsing.
tl;dr: Use REXML for XML parsing, and Nokogiri for HTML parsing if you
absolutely must.
2014-05-29 11:52:17 -05:00
jvazquez-r7
e145298c13
Add module for CVE-2014-0257
2014-05-29 11:45:19 -05:00
jvazquez-r7
6e122e683a
Add module for CVE-2013-5045
2014-05-29 11:42:54 -05:00
jvazquez-r7
75777cb3f9
Add IE11SandboxEscapes source
2014-05-29 11:38:43 -05:00
dmaloney-r7
e669324366
Merge pull request #25 from rapid7/feature/MSP-9673/axis2-login-scanner
...
Add axis2 login scanner
2014-05-29 11:22:22 -05:00
David Maloney
2c6f89a58d
add sane default for connection timeout
2014-05-29 11:12:59 -05:00
David Maloney
d95b0497a7
add more specs
...
added more specs around telnet specific validations
2014-05-29 11:11:19 -05:00
William Vu
53ab2aefaa
Land #3386 , a few datastore msftidy error fixes
2014-05-29 10:44:37 -05:00
David Maloney
eb04a3774a
fixes for telnet wierdness
...
had to work around the way the old
Auxiliary::Login mixin worked. Scanner
now works properly
2014-05-29 10:43:00 -05:00
William Vu
325e75b72f
Land #3380 , datastore msftidy errors set to INFO
...
[SeeRM #8498 ]
2014-05-29 10:19:59 -05:00
Spencer McIntyre
145776db4d
Add a DEBUGGING option to the python meterpreter
2014-05-29 10:52:49 -04:00
Tom Sellers
2f811381dc
Update shell_to_meterpreter.rb
2014-05-29 06:17:31 -05:00
Tom Sellers
6a30a49bcf
Update shell_to_meterpreter.rb
2014-05-29 06:08:42 -05:00
Tom Sellers
427a353be4
Update core.rb
2014-05-29 06:07:50 -05:00
Tom Sellers
29fc2de39b
Update bourne.rb
2014-05-29 06:02:30 -05:00
Tom Sellers
aa85cb8195
Update powershell.rb
2014-05-29 05:46:32 -05:00
Christian Mehlmauer
21d5e630f4
Land #3400 , last msftody set-cookie warnings
2014-05-29 12:07:37 +02:00
William Vu
8a2236ecbb
Fix the last of the Set-Cookie msftidy warnings
2014-05-29 04:42:49 -05:00
James Lee
dcc4d25f15
Merge branch 'feature/MSP-9640/cred_creation' into staging/electro-release
2014-05-28 16:44:51 -05:00
James Lee
572e4f2bdf
Fix dumb missing options and add spec
2014-05-28 16:32:38 -05:00
Spencer McIntyre
15b1c79039
Adjust whitespace and set bytes to str for Python 2
2014-05-28 16:30:27 -04:00
William Vu
3f86aebabf
Land #3398 , CAPWAP DoS description cleanup
2014-05-28 14:55:22 -05:00
William Vu
785b53820e
Land #3399 , print_error instead of print_status
2014-05-28 14:53:00 -05:00
David Maloney
1bc2140fa6
Telnet LoginScanner basics
...
basic Telnet LoginScanner with shell
specs. Need to test functionality
and write additional specs
2014-05-28 14:47:58 -05:00
HD Moore
c7366b4361
Fix a small typo in the regex
2014-05-28 14:40:09 -05:00
HD Moore
583dab62b2
Introduce and use OS matching constants
2014-05-28 14:35:22 -05:00
Luke Imhoff
0e60f08e51
Don't re-establish connection
...
MSP-9653
If ActiveRecord::Base is already connected, then don't attempt to create
the database (as it involves establishing a new connection) or
establishing a new connection after the creation. Still run the
migrations as the normal Rails::Application.initialize! will result in
ActiveRecord::Base.connected? being true even if migrations are missing.
2014-05-28 14:34:36 -05:00
James Lee
05e24326a6
Style compliance
2014-05-28 14:31:34 -05:00
David Maloney
747395e383
create telnet clinet mixin
...
copy paste existing stuff repurposed for use
in a real class instead of a metasploit module
2014-05-28 13:53:50 -05:00
joev
c89cd24621
Rewire some snmp modules to use print_error instead of print_status.
2014-05-28 13:31:00 -05:00
Lance Sanchez
07a61ae696
adding in changes from before my vacation..
...
MSP-9678
2014-05-28 13:18:28 -05:00
Tod Beardsley
4b5c62ba8d
Dress up CAPWAP DoS desc a little.
2014-05-28 12:19:17 -05:00
David Maloney
821a62627a
final spec cleanup
2014-05-28 09:56:26 -05:00
David Maloney
d8adb3a814
fix gemfile
2014-05-28 09:42:05 -05:00
David Maloney
ca4c942ceb
Merge branch 'staging/electro-release' into feature/MSP-9640/cred_creation
2014-05-28 09:40:44 -05:00
David Maloney
967b0d49b1
Merge branch 'master' into staging/electro-release
...
Conflicts:
Gemfile
Gemfile.lock
2014-05-28 09:39:56 -05:00
David Maloney
deabd1c3b0
tidy the YARD
...
some more cleanup, in the YARD
docs this time.
2014-05-28 09:30:45 -05:00
David Maloney
c975d4dc49
some minor cleanup items
2014-05-28 09:26:19 -05:00
James Lee
3ac2182984
First stab at axis2 login scanner
2014-05-27 23:53:04 -05:00
William Vu
832d22cdb8
Land #3395 , sqlite3 gem for some post modules
2014-05-27 19:22:46 -05:00
jvazquez-r7
7a29ae5f36
Add module for CVE-2014-3120
2014-05-27 18:01:16 -05:00
jvazquez-r7
55ef5dd484
Land #3115 , @silascutler's module for elasticsearch indeces enumeration
2014-05-27 11:28:34 -05:00
jvazquez-r7
2271afc1a5
Change module filename
2014-05-27 11:25:39 -05:00
jvazquez-r7
3de8beb5fd
Clean code
2014-05-27 11:22:40 -05:00
James Lee
cc1e81ecb7
Add sqlite3 to Gemfile
...
Fixes all the post modules that require it to parse pilfered sqlite DB
files.
2014-05-27 10:29:55 -05:00
jvazquez-r7
69e8286838
Fix title
2014-05-27 10:29:32 -05:00
jvazquez-r7
1316365c2f
Fix description
2014-05-27 10:22:39 -05:00
jvazquez-r7
abe1d6ffc7
Land #3190 , @Karmanovskii's module to fingerprint MyBB database
2014-05-27 10:20:24 -05:00
jvazquez-r7
86221de10e
Fix message
2014-05-27 10:18:27 -05:00
jvazquez-r7
b96c2dd0ca
Change module filename
2014-05-27 10:15:39 -05:00
jvazquez-r7
1d8c46155b
Do last code cleaning
2014-05-27 10:14:55 -05:00
Tom Sellers
5e33de3e8f
Update bourne.rb
2014-05-27 06:14:12 -05:00
Tom Sellers
f956c8d94f
Create shell_to_meterpreter.rb
2014-05-27 06:12:09 -05:00
Tom Sellers
ae1b7e564b
Update powershell.rb
2014-05-27 05:18:00 -05:00
William Vu
704e4d78ca
Fix typo in client_request.rb comment
2014-05-26 23:55:48 -05:00
William Vu
0133e861f8
Fix typo
2014-05-26 23:55:20 -05:00
William Vu
352e14c21a
Land #3391 , all vars_get msftidy warning fixes
2014-05-26 23:41:46 -05:00
William Vu
936c29e69b
Land #3387 , some Set-Cookie msftidy warning fixes
2014-05-26 23:37:33 -05:00
Karmanovskii
eacf70af83
Update mybb_get_type_db.rb
...
26.05.2014 23:26
I deleted mimicking IE11
2014-05-26 23:26:28 +04:00
Meatballs
1914e0abd3
Land 3393, Add session and framework vars to irb
2014-05-26 18:50:20 +01:00
Rob Fuller
32ca70212c
Merge pull request #7 from jvazquez-r7/review_3388
...
make MSF_MODULES a constant
2014-05-25 21:40:30 -04:00
jvazquez-r7
994891e9c5
Land #3383 , @wchen-r7's [FixRM #8804 ] Fix / URIPATH for BrowserExploitServer
2014-05-25 19:51:30 -05:00
jvazquez-r7
e585d11499
make MSF_MODULES a constant
2014-05-25 19:36:40 -05:00
jvazquez-r7
217a14e4d7
Land #3366 , @jholgui's module for CVE-2013-4074
2014-05-25 18:53:30 -05:00
jvazquez-r7
33ba134147
Clean msftidy warnings and metadata
2014-05-25 18:52:01 -05:00
jvazquez-r7
d3c17d8e3e
Delete wireshark_capwap_dos
2014-05-25 18:39:53 -05:00
Spencer McIntyre
77e70d8bbe
Add 2 more variables for meterpreter irb
2014-05-25 16:28:40 -04:00
Spencer McIntyre
c559483176
Land #3392 , @TomSellers patch to use python constants
2014-05-25 16:18:42 -04:00
Tom Sellers
77f66f8510
Update reverse_tcp.rb
2014-05-25 14:04:54 -05:00
Tom Sellers
b5c567c462
Update bind_tcp.rb
2014-05-25 14:03:45 -05:00
Christian Mehlmauer
da0a9f66ea
Resolved all msftidy vars_get warnings
2014-05-25 19:29:39 +02:00
Rob Fuller
61603748bd
two more tweaks
2014-05-25 10:45:09 -04:00
Rob Fuller
6435b4370a
@Meatballs1 fixes
2014-05-25 10:40:23 -04:00
Tom Sellers
42a17cc085
Update powershell.rb
...
To be clear, the shell that was tested with was 'windows/shell_reverse_tcp' delivered via 'exploit/windows/smb/psexec'
Additional changes required to fix regex to support the multiline output. Also, InstanceId uses a lower case 'D' on the platforms I tested - PowerShell 2.0 on Windows 2003, Windows 7, Windows 2008 R2 as well as PowerShell 4.0 on Windows 2012 R2.
This method doesn't appear to be used anywhere in the Metasploit codebase currently.
2014-05-25 08:59:42 -05:00
Tom Sellers
76b9273f10
Improve reliability of have_powershell
...
I have a case where on a Windows 2008 R2 host with PowerShell 2.0 the 'have_powershell' method times out. When I interactively run the command I find that the output stops after the PowerShell command and the token from 'cmd_exec' is NOT displayed. When I hit return the shell then processes the '&echo <randomstring>' and generates the token that 'cmd_exec' was looking for. I tried various versions of the PowerShell command string such as 'Get-Host;Exit(0)', '$PSVErsionTable.PSVersion', and '-Command Get-Host' but was unable to change the behavior. I found that adding 'echo. | ' simulated pressing enter and did not disrupt the results on this host or on another host where the 'have_powershell' method functioned as expected.
There may be a better solution, but this was the only one that I could find.
2014-05-25 08:07:38 -05:00
Rob Fuller
e3a6782345
add post module based on @zeroSteiner idea
2014-05-24 23:37:17 -04:00
Lutz Wolf
2b75a53c93
Add basic rspec for portspec_to_portlist
2014-05-24 23:46:26 +02:00
Lutz Wolf
fc5436417b
Simplification
2014-05-24 23:45:21 +02:00
Lutz Wolf
4fc6e402dc
Allow port 0
2014-05-24 23:44:50 +02:00
JoseMi
9f166b87f6
Changed the description
2014-05-24 18:58:36 +01:00
JoseMi
71e2d19040
Adapted to auxiliary modules structure
2014-05-24 18:53:10 +01:00
Christian Mehlmauer
df97c66ff5
Fixed check
2014-05-24 00:37:52 +02:00
Christian Mehlmauer
8d4d40b8ba
Resolved some Set-Cookie warnings
2014-05-24 00:34:46 +02:00
Tod Beardsley
1aee0f3305
Warn if it's not UPPERCASE method (@wchen-r7)
...
See the discussion on f7bfab5a26 , PR #3386
2014-05-23 17:10:27 -05:00
Tod Beardsley
9f78bec457
Use normalize_uri (@wchen-r7)
...
Instead of editing the datastore['PATH'], use normalize_uri.
Since the purpose of this module is quite fuzz-like, I didn't want to
apply the normalize_uri to the whole uri -- the original code merely
applied to datastore['PATH'] (which seems like it should be
datastore['URI'] really) and then added on a bunch of other stuff to
test for traversals.
2014-05-23 15:43:50 -05:00
Tod Beardsley
f7bfab5a26
HTTP traversal shouldnt upcase METHOD (@wchen-r7)
...
If the user wants to use downcased or mixed case HTTP methods, heck,
more power to them. If it doesn't work, it doesn't work. No other HTTP
module makes this call.
2014-05-23 15:32:04 -05:00
Tod Beardsley
7f59cf5035
Ora XID HTTP needn't edit DBUSER (@cellabosm)
...
Looks like copypasta artifacts. DBUSER and DBPASS aren't ever set as
options in the module, and the module doesn't include MC's
Exploit::ORACLE mixin. It's also from four years ago and doesn't
report_auth or anything useful like that, but that's out of scope for
this branch.
2014-05-23 15:20:46 -05:00
Tod Beardsley
efffbf751a
PHP module shouldnt zap CMD option (@wchen-r7)
...
As far as I can tell, there is no purpose for this cleanup. No other CMD
exec module takes pains to clear out CMD after run, and it looks like a
bad idea -- what happens when you rexploit?
2014-05-23 15:09:18 -05:00
Tod Beardsley
f189033e8a
OWA bruteforce shouldnt edit datastore (@wchen-r7)
...
This module was written in an era where the defaults for bruteforcing
included a lot of lock-inducing behavior, thus, it was quite serious
about setting datastore options directly. Also, there was apparently a
bug in USER_AS_PASS that this module attempted to avoid by setting the
datastore directly, rather than fixing the bug directly. As far as I
know, this bug has been long since resolved.
2014-05-23 15:08:19 -05:00
Michael Messner
b85c0b7543
rop to system with telnetd
2014-05-23 20:51:25 +02:00
David Maloney
32b88c2db6
final fixes to login creation
2014-05-23 10:58:21 -05:00
Chris Hebert
99046ba12a
Update alienvault_newpolicyform_sqli.rb
...
Added EDB link - should be ready now.
2014-05-23 10:07:45 -04:00
joev
ae3c334232
Getting closer. Still something f'd with local answerer.html.
2014-05-22 17:14:35 -05:00
William Vu
dc7ec450da
Land #3384 , AIX ibstat exploit interface detection
2014-05-22 16:25:06 -05:00
mercd
28459299b2
Update ibstat_path.rb
...
Add interface detection, defaulting to en0.
2014-05-22 14:16:04 -07:00
dmaloney-r7
85737d1235
Merge pull request #22 from rapid7/feature/MSP-9646/afp-loginscanner
...
AFP login scanner
2014-05-22 15:05:24 -05:00
dmaloney-r7
e062e88081
Merge pull request #23 from rapid7/feature/MSP-9671/tomcat-loginscanner
...
Add Tomcat login scanner
2014-05-22 15:01:47 -05:00
David Maloney
fbacf80839
Merge branch 'staging/electro-release' into feature/MSP-9640/cred_creation
2014-05-22 14:39:17 -05:00
David Maloney
75d19e198b
Merge branch 'staging/electro-release' of github.com:rapid7/metasploit-framework-private into staging/electro-release
2014-05-22 14:38:53 -05:00
David Maloney
dcc6ed5351
Merge branch 'master' into staging/electro-release
2014-05-22 14:37:09 -05:00
David Maloney
ac9af000af
full cred creation rotuine done
...
creating Logins as a seperate method, both
methods are done and fully documented.
2014-05-22 13:53:26 -05:00
sinn3r
1dbe972377
Fix URIPATH / for BrowserExploitServer
...
[SeeRM #8804 ] Fix URIPATH / for BrowserExploitServer
2014-05-22 12:18:49 -05:00
William Vu
ebd70cbd8f
Land #3382 , references for IBM Sametime modules
2014-05-22 12:12:18 -05:00
William Vu
d31908b72e
Land #3374 , RPC deadlock fix
...
[FixRM #8794 ]
2014-05-22 12:07:23 -05:00
Tod Beardsley
fa353e6bd9
Add CVE, IBM ref for SameTime modules
2014-05-22 11:34:04 -05:00
David Maloney
19e36cccb3
Credential Core creation now complete
2014-05-21 16:37:13 -05:00
Tod Beardsley
d9fbf861d2
Add an environment option to suppress info msgs
...
It's often you want counts of just WARN and ERROR messages, and don't
want to spam yourself with INFO messages that you don't intend to
address anyway. This is most often the case with CI, such as with
https://travis-ci.org/todb-r7/metasploit-framework
2014-05-21 16:20:57 -05:00
Tod Beardsley
765419627b
Demote datastore edits to info status
...
SeeRM #8498
2014-05-21 16:18:36 -05:00
joev
14b796acbf
First stab at refactoring webrtc mixin.
2014-05-21 15:32:29 -05:00
James Lee
5d1a0397ed
Add Tomcat login scanner
2014-05-21 14:28:54 -05:00
David Maloney
3ea99a9d43
private creation w/ specs and docs
...
the private creation method is now done
with specs and YARD docs
2014-05-21 13:21:56 -05:00
David Maloney
2629549f6f
added realm creation
...
added method for creating credential realm
creation.
2014-05-21 11:22:22 -05:00
Spencer McIntyre
e3630278ce
Land #3379 , [FixRM #8803 ] - Improve fb_cnct_group check
2014-05-21 11:39:10 -04:00
jvazquez-r7
b9464e626e
Delete unnecessary line
2014-05-21 10:18:03 -05:00
sinn3r
a22c089aa0
Land #3378 - Add Reference for katello_satellite_priv_esc
2014-05-21 01:30:59 -05:00
jvazquez-r7
af415c941b
[SeeRM #8803 ] Avoid false positives when checking fb_cnct_group
2014-05-20 18:44:28 -05:00
James Lee
8be35b90f4
Add some more specs for AFP login scanner
2014-05-20 17:44:41 -05:00
jvazquez-r7
8a9c005f13
Add URL
2014-05-20 17:43:07 -05:00
James Lee
d061d36229
Merge branch 'staging/electro-release' into feature/MSP-9646/afp-loginscanner
2014-05-20 17:25:42 -05:00
James Lee
21de14ac3d
Initial stab at AFP login scanner
2014-05-20 17:08:12 -05:00
jvazquez-r7
727054df0b
Land #3375 , @bugch3ck's support for Safari
2014-05-20 16:38:55 -05:00
Meatballs
aeaff16f88
More legible output
2014-05-20 22:27:24 +01:00
Meatballs
92669cd4d6
Use parser
2014-05-20 22:26:13 +01:00
Meatballs
0a2b79ccd1
Tidyup parser
2014-05-20 22:04:59 +01:00
Meatballs
09af023a71
Merge in parser
2014-05-20 21:56:35 +01:00
Meatballs
15313a9ab1
Dont try to read 0 structs
2014-05-20 21:55:04 +01:00
Meatballs
fabaf52929
Tidyup of GPP
...
Add Security Bulletin Reference
ProgramData is symlink to AllUsers anyway
Use NetAPI
2014-05-20 21:53:53 +01:00
Samuel Huckins
62bae8e23b
Merge pull request #21 from rapid7/feature/MSP-9687/winrm-loginscanner
...
Specs and functional steps passing.
MSP-9687 #land
2014-05-20 11:32:37 -05:00
David Maloney
ce69f742a4
add yarddocs to origin methods
...
added YARD docs to the creation methods for
Credential::Origins
2014-05-20 11:16:19 -05:00
Luke Imhoff
38fbbdc1b5
Print tm_call one caller per line
...
MSP-9653
The inspect format was difficult to read so convert to standard
backtrace format of one caller per line.
2014-05-20 10:59:29 -05:00
David Maloney
8a2f05b7d2
Merge branch 'staging/electro-release' into feature/MSP-9640/cred_creation
2014-05-20 10:28:33 -05:00
David Maloney
0b1d9d8cd0
Merge branch 'master' into staging/electro-release
2014-05-20 10:27:55 -05:00
David Maloney
9cdddb08d9
origin specs for realsies
...
final specs and fixes for the origin creation
methods
2014-05-20 10:19:03 -05:00
Samuel Huckins
8f950f39be
Restoring ruby and gemset files
2014-05-20 10:17:00 -05:00
Samuel Huckins
021983089b
Removing ruby-version and -gemset from gitignore
...
These should not have been removed.
2014-05-20 10:14:21 -05:00
Samuel Huckins
9e53b795c3
Merge branch 'upstream-master' into staging/electro-release
2014-05-20 10:12:53 -05:00
David Maloney
b84aaaad19
specs and fixes for origin creation
2014-05-20 09:59:15 -05:00
Jonas Vestberg
7cabfacfa3
Test adobe_flash_pixel_bender_bof on Safari 5.1.7
...
Added browser-requirement for Safari after successful test using Safari 5.1.7 with Adobe Flash Player 13.0.0.182 running on Windows 7 SP1.
2014-05-20 01:43:19 +02:00
Meatballs
52b182d212
Add a small note to bypassuac_injection concerning EXE::Custom
2014-05-19 22:00:35 +01:00
Meatballs
b84379ab3b
Note about EXE::Custom
2014-05-19 22:00:09 +01:00
Meatballs
eeae071468
Land #3363 , Workstation Length Auth Bug
2014-05-19 21:46:57 +01:00
David Maloney
ddfa4f1ee7
some origin creation specs
...
started getting working specs
for the origin creation methods. feel
into the weeds for a bit, but making progress at last.
2014-05-19 15:16:02 -05:00
HD Moore
eda8a90cea
Fix merge issues with os.js
2014-05-19 13:04:36 -05:00
Karmanovskii
e26dee5e22
Update mybb_get_type_db.rb
...
19/05/2014
I deleted - #return Exploit::CheckCode::Unknown # necessary ????
2014-05-19 21:32:30 +04:00
HD Moore
ddc8a4f103
Merge branch 'master' of github.com:rapid7/metasploit-framework into feature/recog
2014-05-19 11:42:30 -05:00
HD Moore
81194684ae
Require MDM >= 0.17.2 for Recog support
2014-05-19 11:41:44 -05:00
David Maloney
9efb97d465
origin creation method
...
added base behaviour for creating generic
credential origin objects from report
2014-05-19 10:00:19 -05:00
William Vu
a30d6b1f2d
Quick cleanup for sap_icm_urlscan
2014-05-19 09:21:26 -05:00
William Vu
dc0e649a10
Clean up case statement
2014-05-19 09:21:07 -05:00
William Vu
bc64e47698
Land #3370 , cleanup for sap_icm_urlscan
2014-05-19 09:16:18 -05:00
William Vu
8235556cec
Land #3372 , release fixes
2014-05-19 09:10:38 -05:00
Tod Beardsley
0ef2e07012
Minor desc and status updates, cosmetic
2014-05-19 08:59:54 -05:00
Tod Beardsley
1ef16fb722
Land #3367 , new wordlists from unhash
...
Thanks @tkisason!
2014-05-19 08:44:54 -05:00
Meatballs
6b1e4c3a9d
Show loot and error code
2014-05-19 11:17:58 +01:00
Meatballs
848227e18a
401 should be a valid url
2014-05-19 10:59:38 +01:00
Meatballs
5d96f54410
Be verbose about 307
2014-05-19 10:52:06 +01:00
Meatballs
88b7dc3def
re-add content length
2014-05-19 10:46:47 +01:00
Meatballs
e59f104195
Use unless
2014-05-19 10:41:01 +01:00
sinn3r
bf52c0b888
Land #3364 - Symantec Workspace Streaming Arbitrary File Upload
2014-05-19 00:25:33 -05:00
jvazquez-r7
2fb0dbb7f8
Delete debug print_status
2014-05-18 23:34:04 -05:00
jvazquez-r7
d35ba208ed
Land #3369 @bugch3ck's support for plugin flash exploitation on adobe_flash_pixel_bender
2014-05-18 23:25:08 -05:00
jvazquez-r7
975cdcb537
Allow exploitation also on FF
2014-05-18 23:24:01 -05:00
Jonas Vestberg
033757812d
Updates to adobe_flash_pixel_bender_bof:
...
1. Added embed-element to work with IE11 (and Firefox). Removed browser-requirements for ActiveX (clsid and method).
2. Added Cache-Control header on SWF-download to avoid AV-detection (no disk caching = no antivirus-analysis :).
Testing performed:
Successfully tested with Adobe Flash Player 13.0.0.182 with IE9, IE10 and IE11 running on Windows 7SP1. (Exploit will trigger on FF29, although sandboxed.)
2014-05-18 22:43:51 +02:00
Tonimir Kisasondi
9b29c572a7
Comments dont work with auth_brute.rb
2014-05-18 21:14:17 +02:00
Tonimir Kisasondi
c9bb2d5165
Added headers to files
2014-05-18 20:55:50 +02:00
Tonimir Kisasondi
97b63d708c
Corrected naming to be in line with msf convention
2014-05-18 18:18:23 +02:00
Tonimir Kisasondi
7d79f8a4c2
Removed wrongly named list.
2014-05-18 18:15:17 +02:00
Tonimir Kisasondi
d7bf66973c
Fixed userpass delimiters.
2014-05-18 18:13:03 +02:00
HD Moore
1d205081cb
Merge Gemfile changes properly
2014-05-18 11:10:31 -05:00
HD Moore
a8bf53479d
Fix a merge error
2014-05-18 11:08:04 -05:00
HD Moore
a844b5c30a
Merge branch 'master' of github.com:hmoore-r7/metasploit-framework into feature/recog
...
Conflicts:
Gemfile
Gemfile.lock
data/js/detect/os.js
lib/msf/core/exploit/remote/browser_exploit_server.rb
2014-05-18 10:50:32 -05:00
Tonimir Kisasondi
6ec926b573
Added separate users/pass/userpass dictionaries
2014-05-18 10:18:07 +02:00
William Vu
a97d9ed54f
Land #3148 , check_urlprefixes for sap_icm_urlscan
2014-05-17 16:10:52 -05:00
sappirate
dd1a47f31f
Modified sap_icm_urlscan to check for authentication of custom URLs
...
Fixed ruby coding style
2014-05-17 22:47:49 +02:00
Karmanovskii
06912ac2b6
Update mybb_get_type_db.rb
...
1.Changed "Rex::Proto::Http::Client" to "Msf::Exploit::Remote::HttpClient"
2.changed the name of the variable "_Version_server".
2014-05-17 16:30:29 +04:00
JoseMi
21cf0a162c
Added module to crash capwap dissector in wireshark tool
2014-05-17 11:31:43 +01:00
JoseMi
74b491e715
Delete wireshark_capwap_dos module
2014-05-17 11:25:38 +01:00
Tonimir Kisasondi
af82ae262c
Added a large default password list for services.
2014-05-16 23:27:18 +02:00
James Lee
d2ebab09aa
Add timeout for SSL renegotiation after migrating
...
[SeeRM #8794 ]
2014-05-16 15:42:46 -05:00
Christian Mehlmauer
488c3e6b93
Land #3358 , @jvazquez-r7 Advantech WebAccess 7.1 SQLI module
2014-05-16 21:26:41 +02:00
jvazquez-r7
2012d41b3d
Add origin of the user, and mark web users
2014-05-16 13:51:42 -05:00
jvazquez-r7
4143474da9
Add support for web databases
2014-05-16 11:47:01 -05:00
Samuel Huckins
d9687d87f9
Merge pull request #20 from rapid7/feature/MSP-9667/db2_login
...
Specs passing post update.
MSP-9667 #land
2014-05-16 11:29:31 -05:00
David Maloney
ce761e5569
Merge branch 'staging/electro-release' into feature/MSP-9640/cred_creation
2014-05-16 11:25:37 -05:00
David Maloney
b5807b990a
Merge branch 'staging/electro-release' of github.com:rapid7/metasploit-framework-private into staging/electro-release
2014-05-16 11:24:51 -05:00
David Maloney
a4d85ad61b
Merge branch 'master' into staging/electro-release
2014-05-16 11:24:18 -05:00
David Maloney
02a9d7f15d
minor cleanup
...
minor style changes found in code review
2014-05-16 11:20:04 -05:00
jvazquez-r7
883d2f14b5
delete debug print_status
2014-05-16 11:13:03 -05:00
jvazquez-r7
ea38a2c6e5
Handle ISO-8859-1 special chars
2014-05-16 11:11:58 -05:00
Tod Beardsley
10e4204829
Land #3365 , SNMP info leak vulns
2014-05-16 09:05:42 -05:00
jvazquez-r7
c9465a8922
Rescue when the recovered info is in a format we can't understand
2014-05-16 08:57:59 -05:00
Tod Beardsley
3c1363b990
Add new SNMP enumeration modules
2014-05-16 08:32:46 -05:00
jvazquez-r7
7ec85c9d3a
Delete blank lines
2014-05-16 01:03:04 -05:00
jvazquez-r7
9091ce443a
Add suport to decode passwords
2014-05-16 00:59:27 -05:00
James Lee
9582d82fba
Merge remote-tracking branch 'private/staging/electro-release' into feature/MSP-9687/winrm-loginscanner
2014-05-15 13:59:48 -05:00
James Lee
efd0db9c39
Merge branch 'upstream-master' into HEAD
2014-05-15 13:53:16 -05:00
jvazquez-r7
1b68abe955
Add module for ZDI-14-127
2014-05-15 13:41:52 -05:00
James Lee
472f029576
Fix random bug when workstation_name is < 6 chars
...
When the local workstation name is less than 6 characters, remote
authentication against a Windows 2008r2 WinRM service always fails. This
doesn't seem to affect authentication against IIS's negotiate
implementation.
2014-05-15 13:27:37 -05:00
nstarke
048aebbdf2
Search Result Uniqueness
...
SeeRM #8754
Cast the results of the query to an array and perform the uniq
function passing a block which provides uniqueness based
on the return value, which in this instance is ‘fullname’
This was done because the uniq function in AREL cannot take
a specific field for uniqueness, and the sophistication of the query
make grouping nearly impossible. Initial testing showed negligible
speed difference to the user.
2014-05-15 17:52:11 +00:00
nstarke
b85403ab8f
Revert "POST module duplicate search results"
...
This reverts commit 0bca3a2d54 .
2014-05-15 16:05:47 +00:00
James Lee
8a9abb90c0
Add specs for connection error conditions
2014-05-15 10:06:17 -05:00
AnwarMohamed
96e99a61e4
Merge remote-tracking branch 'upstream/master'
2014-05-15 02:22:18 +02:00
Lance Sanchez
e9b3f10ba7
Drying up some of the status codes
...
MSP-9678
2014-05-14 17:02:26 -05:00
William Vu
773fd7a9cb
Fix up whitespace
2014-05-14 15:31:40 -05:00
William Vu
340956f294
Add a newline after DISCLOSURE_DATE_FORMAT
2014-05-14 15:28:07 -05:00
William Vu
f9982752f3
Land #3362 , ax rank for aux/dos mods
2014-05-14 15:20:07 -05:00
James Lee
59050d9bf1
Add specs for WinRM, improve those for HTTP
2014-05-14 15:13:29 -05:00
Tod Beardsley
dc57e31be1
Aux modules don't respect Rank anyway
2014-05-14 15:03:10 -05:00
James Lee
99f8fbbc9c
Add WinRM login scanner
...
* Genericizes HTTP a bit to make these kinds of HTTP-based scanners
simpler and easier
* Adds support for default ports to HTTP. This should probably be
rafactored up into Base
* Removes spec that complains about port being unset (which now fails
because defaults ensure it's always set)
2014-05-14 14:35:49 -05:00
Christian Mehlmauer
dc7a8d32d8
Land #3324 , msfconsole search timestamp fixes
2014-05-14 21:30:02 +02:00
Luke Imhoff
82d32e39cc
Merge branch 'feature/MSP-9686/vnc_login' into staging/electro-release
...
MSP-9686
2014-05-14 13:24:13 -05:00
Luke Imhoff
a32152ecaa
Merge branch 'staging/electro-release' into feature/MSP-9686/vnc_login
...
MSP-9686
2014-05-14 13:22:41 -05:00
David Maloney
9471e597b6
Merge branch 'staging/electro-release' into feature/MSP-9640/cred_creation
...
Conflicts:
Gemfile.lock
2014-05-14 13:03:48 -05:00
David Maloney
fb671c72a7
Merge branch 'master' into staging/electro-release
2014-05-14 13:00:37 -05:00
dmaloney-r7
acaf713229
Merge pull request #17 from rapid7/feature/MSP-9606/metasploit-credential
...
Run migrations from Metasploit::Credential and initialize its concerns which patch Mdm
2014-05-14 11:15:07 -05:00
nstarke
bb6201d66d
Fixing nil bug and making format constant
...
The date format has been moved into a constant variable.
Certain modules do not have a disclosure_date. For example,
‘checkvm’. This necessitated checking disclosure_date for nil
before attempting a format conversion. Also, there was an additional
location in core.rb that needed the formatting / nil check added. Specs
were also updated appropriately.
2014-05-14 15:51:42 +00:00
James Lee
08a7acef3f
Make sure fail case is correct
...
`rand(1000)` would return 0 one in a thousand times, causing this test to
randomly fail at that interval
2014-05-14 10:22:47 -05:00
Lance Sanchez
6a029bee02
Merge branch 'staging/electro-release' into feature/MSP-9678/pop3-login-scanner
2014-05-14 10:13:46 -05:00
David Maloney
f34090946e
derp
2014-05-14 10:10:57 -05:00
Lance Sanchez
06796fb27c
returning the result class
...
MSP-9678
2014-05-14 10:09:52 -05:00
David Maloney
2faa015bf3
some minor cleanup
...
minor edits requested by kronicdeth during
code review
2014-05-14 10:09:26 -05:00
James Lee
8a9027b21d
Add better #inspect for Credential and Result
2014-05-14 10:04:40 -05:00
Lance Sanchez
3c0625e393
hacking on the pop3 login scanner
...
MSP-9678
2014-05-14 09:44:23 -05:00
jvazquez-r7
5b3bb8fb3b
Fix @FireFart's review
2014-05-14 09:00:52 -05:00
Karmanovskii
cbb84e854c
Update mybb_get_type_db.rb
...
14.05.2014
Eliminated notes jvazquez-r7
2014-05-14 14:56:40 +04:00
William Vu
9fbda3eae0
Land #3183 , tab completion improvements
2014-05-14 02:20:12 -05:00
William Vu
fdbfaacdf6
Land #3313 , progress feedback for PASS_FILE
...
[FixRM #8704 ]
2014-05-14 02:03:39 -05:00
William Vu
1ada4831e0
Land #3293 , module deprecation constants
2014-05-14 01:37:29 -05:00
William Vu
de49241195
Land #3185 , regex option validation
2014-05-14 01:27:18 -05:00
William Vu
750b6fc218
Land #3348 , some Ruby warning fixes
2014-05-14 01:25:10 -05:00
William Vu
c421b8e512
Change if not to unless
2014-05-14 01:24:29 -05:00
William Vu
dfab26ea36
Land #3359 , more Set-Cookie fixes
2014-05-14 01:22:09 -05:00
Christian Mehlmauer
df4b832019
Resolved some more Set-Cookie warnings
2014-05-13 22:56:12 +02:00
David Maloney
72b3c4da35
working DB2 loginscanner
...
w00t
2014-05-13 14:41:15 -05:00
Samuel Huckins
162038bde4
Merge pull request #19 from rapid7/feature/login_scanner/smb
...
Specs all passing, functional steps working.
2014-05-13 14:37:13 -05:00
jvazquez-r7
a7075c7e08
Add module for ZDI-14-077
2014-05-13 14:17:59 -05:00
James Lee
2a13010bfb
Fix faulty spec
2014-05-13 14:15:00 -05:00
David Maloney
f5751d6a85
first pass at attempt_login for DB2
...
first pass through at the attempt_login method
for the DB2 LoginScanner. still adding specs
and possibly refactoring
2014-05-13 14:10:30 -05:00
James Lee
2d7e90d5df
Remove vestigal require
2014-05-13 13:39:40 -05:00
David Maloney
5dcf3efd1a
skeleton for DB2 loginscanner
...
add basic skeleton and specs for the DB2
LoginScanner class.
2014-05-13 13:16:56 -05:00
Luke Imhoff
91cc9dc2d6
Add missing Msf::DBManager#drivers initialization
...
MSP-9606
2014-05-13 13:01:59 -05:00
joev
827feaed9f
Land #3320 , @m-1-k-3's mips exec payload fixes to allow encoding.
2014-05-13 12:38:23 -05:00
Luke Imhoff
3448b601ee
Remove old, unused cucumber features
...
MSP-9606
2014-05-13 09:26:16 -05:00
Luke Imhoff
14cf51db91
Remove unused DatabaseCleaner
...
MSP-9606
DatabaseCleaner is no longer used in the specs since the use of railties
allowed the use of transactional fixtures.
2014-05-13 09:13:47 -05:00
agix
1a3b319262
rebase to use the mixin psexec
2014-05-13 16:04:40 +02:00
agix
d3f2414d09
Fix merging typo
2014-05-13 16:04:40 +02:00
agix
87be2e674a
Rebase on https://github.com/rapid7/metasploit-framework/pull/2831 and adapt to the new mixin
2014-05-13 16:04:40 +02:00
Florian Gaultier
808f87d213
SERVICE_DESCRIPTION doesn't concern this PR
2014-05-13 16:04:39 +02:00
Florian Gaultier
bb4e9e2d4d
correct error in block service_change_description
2014-05-13 16:04:39 +02:00
Florian Gaultier
6332957bd2
Try to add SERVICE_DESCRIPTION options to psexec, but it doesn't seem to work...
2014-05-13 16:04:39 +02:00
Florian Gaultier
bdbb70ab71
up block_service_stopped.asm
2014-05-13 16:04:39 +02:00
Florian Gaultier
94f97ab963
Prevent import table overwritting by shifting entry point
2014-05-13 16:04:39 +02:00
Florian Gaultier
e269c1e4f1
Improve service_block with service_stopped block to cleanly terminate service
2014-05-13 16:04:38 +02:00
Florian Gaultier
c43e3cf581
Improve block_create_remote_process to point on shellcode everytime
2014-05-13 16:04:38 +02:00
Florian Gaultier
25d48b7300
Add create_remote_process block, now used in exe_service generation
2014-05-13 16:04:38 +02:00
Florian Gaultier
0bdf7904ff
Change author of single_service_stuff.asm
2014-05-13 16:04:38 +02:00
Florian Gaultier
5ecebc3427
Add options SERVICE_NAME and SERVICE_DISPLAYNAME to psexec and correct service payload generation
2014-05-13 16:04:37 +02:00
Florian Gaultier
0b462ceea6
refactor to_winpe_only code to be used by to_win32pe_service
2014-05-13 16:04:37 +02:00
Florian Gaultier
914d15c285
fix typo
2014-05-13 16:04:37 +02:00
Florian Gaultier
ca7a2c7a36
Add string_to_pushes to use non fixed size service_name
2014-05-13 16:04:37 +02:00
Florian Gaultier
b3fd21b98d
Change to try to follow ruby guidelines
2014-05-13 16:04:37 +02:00
Florian Gaultier
72a3e49fbb
fix typo
2014-05-13 16:04:36 +02:00
Florian Gaultier
513f3de0f8
new service exe creation refreshed
2014-05-13 16:04:36 +02:00
William Vu
6b154b3f15
Land #3354 , a handful of Set-Cookie fixes
2014-05-12 15:59:55 -05:00
Luke Imhoff
b1598e83c3
Re-enable bundle install --without db support
...
MSP-9606
Catch LoadError in config/application.rb when trying to require
'active_record/railtie` so that end-users can run without any of the
database gems installed. NOTE: you can't run in the development or
test environment without the database because factory_girl needs
ActiveRecord.
2014-05-12 15:39:34 -05:00
Luke Imhoff
cea7b6cd77
Revert to production as default environment
...
MSP-9606
When switching to Rails.env to integrate better with railties for
Rails::Engines, I forgot that rails would default to development instead
of production.
2014-05-12 15:37:59 -05:00
Luke Imhoff
3370465d84
Use railties to load Metasploit::Credential correctly
...
MSP-9606
In order to support Metasploit::Credential correctly,
metasploit-framework needs to support Metasploit::Concern, which does
all its magic using a Rails::Engine initializer, so the easiest path is
to make metasploit-framework be able to use Rails::Engines. To make
Rails::Engine use Rails::Engine, make a dummy Rails::Application
subclass so that all the initializers will be run when anything requires
msfenv.
2014-05-12 15:03:51 -05:00
Christian Mehlmauer
3f3283ba06
Resolved some msftidy warnings (Set-Cookie)
2014-05-12 21:23:30 +02:00
William Vu
fb8fb11ab2
Land #3353 , this time for real
2014-05-12 13:29:28 -05:00
Christian Mehlmauer
2b5105b70a
Land #3353 , @jjarmoc's Rex::Text::uri_encode improvements
2014-05-12 20:16:58 +02:00
Jeff Jarmoc
2849a1bc0c
Update comment again
2014-05-12 13:10:20 -05:00
Jeff Jarmoc
a3cc499a17
Update comment w/ all modes
2014-05-12 13:02:54 -05:00
Jeff Jarmoc
d82bc11b7d
Add 'u-noslashes' and re-order cases for consistency.
2014-05-12 13:01:05 -05:00
Jeff Jarmoc
638ae477d9
Fix up spec. Rex::Proto::Http::ClientRequest handles & and = outside of Rex::Text::uri_encode, so mode doesn't affect them.
...
Fix erroneous typo char.
2014-05-12 12:10:30 -05:00
Jeff Jarmoc
cba39a9a04
Adds spec for 'hex-all' mode
2014-05-12 12:01:06 -05:00
David Maloney
57864cc6c9
Merge branch 'master' into staging/electro_release
2014-05-12 11:38:14 -05:00
David Maloney
7f98d1630e
specs for VNC Loginscanner
...
cover remaining behaviour for the
VNC LoginScanner class.
2014-05-12 11:29:27 -05:00
Jeff Jarmoc
5f523e8a04
Rex::Text::uri_encode - make 'hex-all' really mean all.
...
'hex-all' encoding was previously ignoring slashes.
This pull adds 'hex-noslashes' mode which carries forward the previous functionality, and replaces all existing references to 'hex-all' with 'hex-noslashes' It then adds a replacement 'hex-all' mode, which really encodes *ALL* characters.
2014-05-12 11:26:27 -05:00
David Maloney
f84d763382
refactoring conditional logic
...
the class works but the conditional logic needs
refactoring to be smoothed out more.
2014-05-12 11:10:36 -05:00
James Lee
fe3acf08f5
Handle exceptions without error_code
...
Also sets smb_direct in attempt_login, which makes this work correctly
when port wasn't set in the constructor.
2014-05-12 10:31:11 -05:00
Luke Imhoff
c70ef2afbd
Make fastlib compatible with Pathnames
...
MSP-9606
2014-05-12 10:16:39 -05:00
Luke Imhoff
f83e8a4a4f
Add missing requires
...
MSP-9606
require 'msf/base/config' when required directly was not working.
2014-05-12 10:16:10 -05:00
jvennix-r7
f6f9bb8edc
Merge pull request #11 from timwr/android-bins
...
better string replacement
2014-05-12 00:46:06 -05:00
jvazquez-r7
b5ba261ffe
Land #3347 , @FireFart's change to allow configurable landing dir on struts_code_exec_parameters
2014-05-11 18:43:41 -05:00
William Vu
bdea3cb454
Land #3350 , author fix for wlan_geolocate
2014-05-11 16:18:46 -05:00
Tom Sellers
2b8dd9139c
Fix cosmetic issue
...
Fix cosmetic issue /w email address when it is output via 'info' or the Rapid7 module page.
2014-05-11 16:14:51 -05:00
Chris Hebert
681e4194ea
Update alienvault_newpolicyform_sqli.rb
...
and the new variable as well.
2014-05-10 20:19:40 -04:00
Chris Hebert
3ae3c478bd
Update alienvault_newpolicyform_sqli.rb
...
enhanced as requested by Christian Mehlmauer
changed xnDa to a random string to make IDS harder to detect.
2014-05-10 20:17:30 -04:00
Chris Hebert
1affbfbe9d
Update alienvault_newpolicyform_sqli.rb
...
fixed reinitialize i=0, full = '' and filename .....
spotted by Spencer McIntyre - thanks.
2014-05-10 18:49:41 -04:00
Chris Hebert
8e79663001
Update alienvault_newpolicyform_sqli.rb
...
Added vendor advisory
2014-05-10 18:31:12 -04:00
Chris Hebert
ec1df58bf7
Update alienvault_newpolicyform_sqli.rb
...
Changed reference -- OSVDB # 106815
(waiting for EDB - no response yet)
2014-05-10 18:14:09 -04:00
Christian Mehlmauer
557cd56d92
fixed some ruby warnings
2014-05-10 23:31:02 +02:00
Chris Hebert
473efe1040
Update alienvault_newpolicyform_sqli.rb
2014-05-10 17:28:50 -04:00
Tim Wright
a60558061c
re-enable x86 stager
2014-05-10 19:58:19 +01:00
Tim Wright
ae0691c586
make string replacement more robust
2014-05-10 17:00:25 +01:00
James Lee
3831042dca
Add specs, validations for LoginScanner::SMB
2014-05-09 18:58:49 -05:00
William Vu
184ec08160
Fix EOL space warnings from msftidy
2014-05-09 18:36:15 -05:00
William Vu
92a9519fd9
Remove EOL spaces
2014-05-09 18:34:12 -05:00
James Lee
ee6a9f99b3
Add require for active_model
...
Having proper requires allows loading scanners in IRB without msfconsole
2014-05-09 18:16:19 -05:00
Joshua Smith
c5d1ad6a02
lands 3346, fix msf > prompt issues
2014-05-09 17:43:32 -05:00
Christian Mehlmauer
dee6b53175
fix java payload struts module
2014-05-10 00:19:40 +02:00
William Vu
453851277f
Fix missing space in prompt for back and grep
2014-05-09 17:08:45 -05:00
Joshua Smith
d69fbf0d66
adds TARGET to 'to_neuter' list
2014-05-09 15:57:36 -05:00
William Vu
4b47a9a297
Land #3339 , banner updates for Pro free trial
2014-05-09 15:25:09 -05:00
jvazquez-r7
6f837715f9
Land #3343 , @FireFart's new uri encoding for struts_code_exec_parameters
2014-05-09 14:37:58 -05:00
jvazquez-r7
38f3a19673
Try to beautify description
2014-05-09 14:35:06 -05:00
Christian Mehlmauer
43a85fc645
additional GET parameters
2014-05-09 21:21:04 +02:00
Christian Mehlmauer
ad83921a85
additional GET parameters
2014-05-09 21:15:28 +02:00
mvdevnull
117e0b839b
Add module - alienvault_newpolicyform_sqli
2014-05-09 15:10:58 -04:00
Luke Imhoff
cadc2dd81f
Order Gemfile
...
MSP-9606
2014-05-09 13:47:00 -05:00
David Maloney
4e76330643
Add skeleton for VNC lgoinscanner
...
Add skeleton and specs for the VNC Loginscanner
MSP-9686
2014-05-09 11:55:15 -05:00
David Maloney
8b937b7c35
Merge branch 'master' into staging/electro_release
2014-05-09 11:46:08 -05:00
Tod Beardsley
dba2473d10
Land #3344 , Yokogawa module, http://r-7.co/1noJXtc
2014-05-09 10:46:19 -05:00
jvazquez-r7
f56ea01988
Add module
2014-05-09 10:27:41 -05:00
nstarke
a71be33091
Adjusting status message to be based on time
...
Previously the status message timing was determined by the number of
pairs left to process. I have adjusted the code to rely on Time.now
in order to consistently print a message out every 60 seconds.
2014-05-09 14:39:34 +00:00
Christian Mehlmauer
53fde675e7
randomize meh parameter
2014-05-09 10:38:19 +02:00
sinn3r
c9e356116f
Land #3340 - Adobe Flash Player Shader Buffer Overflow
2014-05-08 20:55:38 -05:00
jvazquez-r7
58c46cc73d
Add compilation instructions for the AS
2014-05-08 16:48:42 -05:00
Christian Mehlmauer
a3fff5401f
more code cleanup
2014-05-08 23:05:41 +02:00
Joshua Smith
be06007f34
cleans up comments, line lengths, dup/clone
2014-05-08 16:04:18 -05:00
Christian Mehlmauer
e7b7af2f75
fixed apache struts module
2014-05-08 22:15:52 +02:00
David Maloney
b3a1840991
add metasploit-credential
...
added metaploit-credential to the Gemfile
2014-05-08 15:13:01 -05:00
Trevor Rosen
c77412d373
Merge pull request #13 from rapid7/feature/login_scanner/mysql
...
Add LoginScanner for MySQL
MSP-9676 #land
2014-05-08 15:05:24 -05:00
Tod Beardsley
718de77ec6
Land #3341 , db_import help update, more formats
2014-05-08 14:40:25 -05:00
Trevor Rosen
894ecaafb4
Merge pull request #12 from rapid7/feature/login_scanner/pg
...
Add Postgres LoginScanner class
MSP-9679 #land
2014-05-08 14:38:56 -05:00
Lutz Wolf
66252ba9e5
support negation in portspec
2014-05-08 21:35:35 +02:00
David Maloney
cace6581ce
Merge branch 'master' into staging/electro_release
2014-05-08 14:34:19 -05:00
David Maloney
42de1ab1f1
whitespace removal
2014-05-08 14:18:06 -05:00
David Maloney
d16a4a4c1d
add sane defaults to MySQl
...
MySQL LoginScanner now with sane defaults
for TCP evasion stuff
2014-05-08 13:57:58 -05:00
David Maloney
cfb13ed1bd
Merge branch 'staging/electro_release' into feature/login_scanner/mysql
2014-05-08 13:55:09 -05:00
Trevor Rosen
d0d9100802
Merge pull request #11 from rapid7/feature/login_scanner/mssql
...
Add the MSSQL LoginScanner class
MSP-9679 #land
2014-05-08 13:52:09 -05:00
James Lee
2d2b5ea9e4
Merge remote-tracking branch 'private/feature/login_scanner/mssql' into feature/login_scanner/smb
2014-05-08 13:45:06 -05:00
David Maloney
a9df810072
Merge branch 'feature/login_scanner/mssql' of github.com:rapid7/metasploit-framework-private into feature/login_scanner/mssql
2014-05-08 13:44:52 -05:00
David Maloney
e0c6e90ae8
trivial cleanup work
...
whitespace and alignment stuff
2014-05-08 13:42:52 -05:00
James Lee
13fe8c0869
Default Credential#paired to true
2014-05-08 13:34:31 -05:00
Trevor Rosen
cf58f214a9
New-style RVM stuff now in .gitignore
2014-05-08 13:26:08 -05:00
David Maloney
20edabb0f5
mySQL Loginscanner with specs to match
...
This season's colours for Loginscanner is MySQL
with Unit Test Coverage applied to match.
2014-05-08 13:16:12 -05:00
jvazquez-r7
8c55858eae
Land #3309 , @arnaudsoullie's changes for modblusclient
2014-05-08 10:45:19 -05:00
jvazquez-r7
25f13eac37
Clean a little response parsing
2014-05-08 10:44:53 -05:00
William Vu
ee303aa34e
Add missing formats in lib/msf/core/db.rb comment
...
Found outside big if block. Ugh.
2014-05-08 10:27:38 -05:00
Tod Beardsley
281b000805
Typo fix for #3339
2014-05-08 10:18:19 -05:00
William Vu
102eb85277
Update CommandDispatcher::Db spec
2014-05-08 03:05:49 -05:00
William Vu
b50b3820a0
Update core/db.rb comments 'n' stuff
2014-05-08 02:53:02 -05:00
William Vu
7da6a2c84c
Update db_import help with authoritative formats
...
Taken from import_filetype_detect in lib/msf/core/db.rb.
[SeeRM #8799 ]
2014-05-08 02:30:29 -05:00
David Maloney
b72f0f8ffc
try to fix bad push/revert mess
2014-05-07 18:43:37 -05:00
David Maloney
9919d54116
Revert "final touches and specs"
...
This reverts commit e025fa1791 .
2014-05-07 18:34:34 -05:00
David Maloney
e025fa1791
final touches and specs
...
add finishing touches to postgres
Loginscanner and add specs to cover
the behaviour
2014-05-07 18:32:36 -05:00
jvazquez-r7
6b41a4e2d9
Test Flash 13.0.0.182
2014-05-07 17:39:22 -05:00
jvazquez-r7
5fd732d24a
Add module for CVE-2014-0515
2014-05-07 17:13:16 -05:00
James Lee
338ed7bd18
First attempt at smb login scanner
2014-05-07 16:38:56 -05:00
Tod Beardsley
eecd05ec74
Fix banner language, padding.
2014-05-07 16:12:15 -05:00
David Maloney
acbff23c32
final wrap-up specs
...
successkid.jpg
2014-05-07 16:07:18 -05:00
Tod Beardsley
c50c929412
Treat apt and binary installs the same for banners
2014-05-07 15:59:50 -05:00
David Maloney
7a476dc21a
fully operational lgoinscanner
...
Now you will witness the power of this fully operational
LoginScanner. fire at will, Commander!
2014-05-07 15:57:06 -05:00
David Maloney
ec974535ac
create base object for mssql scanner
...
created skeleton for MSSQL Loginscanner
included concerns.
also added an NTLM concern and shared example group
2014-05-07 14:43:15 -05:00
David Maloney
234e129523
add NTLM concern for loginscanners
...
add a new concern for LoginScanners
that provides the basic accessors and validations
for anything requiring NTLM
2014-05-07 14:28:10 -05:00
David Maloney
e6b15541ff
replace datastore calls
...
replace datastore calls with stub
methods that will be implmeneted by the loginscanner
2014-05-07 11:41:49 -05:00
Joshua Smith
dfd9522e0d
Merge from remote (pr merged via github)
2014-05-07 11:31:03 -05:00
Joshua Smith
6c29bae86d
uses exploit_type vs category, thx egypt
2014-05-07 11:29:36 -05:00
Tod Beardsley
ab56583ce0
Remove dead oldwarn code, fix shortlink
2014-05-07 09:49:41 -05:00
Tod Beardsley
7ed943cead
Add new rotating banners for apt installs
2014-05-07 09:39:39 -05:00
Tod Beardsley
a55e2bcf19
Rework banner trailers in sprintf padding
2014-05-07 09:38:59 -05:00
Josh
d12412d5ab
Merge pull request #11 from linuxchuck/patch-1
...
updates scriptable.rb for explicit target opt and neuters LPORT
2014-05-06 15:40:17 -05:00
linuxchuck
7249191711
New updates to scriptable.rb for payload/target
...
Additional w00t for your pwning pleasure.
2014-05-06 15:33:51 -05:00
James Lee
9ad5ae44be
Add abstract attempt_login and cleanup some docs
2014-05-06 15:24:18 -05:00
Joshua Smith
4b351b4ae2
adds explicit TARGET setting
2014-05-06 14:17:31 -05:00
Joshua Smith
e981d6e286
fixes alias_method call
2014-05-06 13:03:36 -05:00
David Maloney
6077135782
extract login neccisary methods
...
create new mssql mixin. extract only the methods
required for mssql_login to work and copy them
into this mixin.
2014-05-06 11:59:21 -05:00
Joshua Smith
2c07f51ac5
uses clone instead of dup
2014-05-06 11:45:19 -05:00
David Maloney
507fe566a4
Merge branch 'master' into staging/electro_release
2014-05-06 11:36:19 -05:00
Joshua Smith
8fe8ee92d9
first shot at letting scriptable.rb handle local exploits
2014-05-06 01:21:11 -05:00
Joshua Smith
a270cc6e59
adds category to msf/core/module.rb
2014-05-06 00:46:49 -05:00
AnwarMohamed
57ce85013c
Merge remote-tracking branch 'upstream/master'
2014-05-06 01:59:10 +02:00
Arnaud SOULLIE
1f3466a3a3
Added Modbus error handling.
...
It now checks for error and displays the appropriate error message.
The only error simulated was "ILLEGAL ADDRESS", don't know how
to test for others.
2014-05-05 23:21:54 +02:00
Tod Beardsley
a8e7dc8ec5
Land #3338 for real (see 3542f85)
...
The other commit ended up having a changed hash. This is a nop for
mostly accounting purposes.
2014-05-05 16:07:42 -05:00
Christian Mehlmauer
7f9a460c20
Land #3338 , yardoc fixes
2014-05-05 22:46:17 +02:00
Meatballs
3542f851bf
Fix some yarddoc issues
2014-05-05 22:45:41 +02:00
Meatballs
57df34b54f
Fix some yarddoc issues
2014-05-05 21:18:48 +01:00
Meatballs
dc38212741
Fix function parsing
2014-05-05 20:53:36 +01:00
William Vu
e8bc89af30
Land #3337 , release fixes
2014-05-05 14:03:48 -05:00
Trevor Rosen
5fd4151004
Merge pull request #10 from rapid7/feature/login_scanners/mixin_refactor
...
LoginScanner refactor
2014-05-05 13:50:42 -05:00
Tod Beardsley
c97c827140
Adjust desc and ranking on ms13-053
...
Since it's likely to crash winlogin.exe in the normal use case
(eventually), I've kicked this down to Average ranking.
2014-05-05 13:46:19 -05:00
Tod Beardsley
3536ec9a74
Description update
2014-05-05 13:43:44 -05:00
jvazquez-r7
b81f94a229
Land #3336 , @todb-r7's CVEs addition
2014-05-05 13:43:04 -05:00
Tod Beardsley
c6affcd6d3
Fix caps, description on F5 module
...
The product name isn't "Load Balancer" as far as I can tell.
2014-05-05 13:38:53 -05:00
William Vu
353a50cdd0
Land #3316 , Content-Length fix for http_ntlmrelay
2014-05-05 13:38:36 -05:00
Tod Beardsley
3072c2f08a
Update CVEs for RootedCon Yokogawa modules
...
Noticed they were nicely documented at
http://chemical-facility-security-news.blogspot.com/2014/03/ics-cert-publishes-yokogawa-advisory.html
We apparently never updated with CVE numbers.
2014-05-05 13:25:55 -05:00
Meatballs
e946046de5
Add methods spec
2014-05-05 19:08:18 +01:00
Meatballs
0b886db406
Script specs and remove unknown method
2014-05-05 19:01:36 +01:00
Meatballs
0177e51148
Finish obfu specs and use rig
2014-05-05 18:47:25 +01:00
Meatballs
6ab85027a4
More spec
2014-05-05 17:47:30 +01:00
sinn3r
6bfc9a8aa0
Land #3333 - Adobe Flash Player Integer Underflow Remote Code Execution
2014-05-05 10:39:26 -05:00
Meatballs
162b6a8ab9
Add output spec
2014-05-05 14:48:18 +01:00
joev
b67418e7f1
Merge #3335 , @bcoles's fixes to FF JS payloads for single-line payloads.
2014-05-05 08:12:39 -05:00
Meatballs
589d235a80
Simple param spec
2014-05-05 13:46:52 +01:00
Meatballs
399928cf69
Remove unnecessary requires
2014-05-05 13:37:17 +01:00
Brendan Coles
cc8ab9bcba
Support one line js payload
...
Add missing ';' in `run_cmd_source`
2014-05-05 18:57:15 +10:00
William Vu
a8915f0ed8
Land #3310 , OpenSSH timing attack improvements
2014-05-04 19:47:51 -05:00
Tod Beardsley
8ae5dfea23
Land todb-r7#7, fix indents and grammar
2014-05-04 19:33:40 -05:00
William Vu
96a9bb6714
Land #3332 , superfluous return cleanup
2014-05-04 19:07:34 -05:00
Christian Mehlmauer
073adc759d
Land #3334 , fix author by @julianvilas
2014-05-04 21:30:53 +02:00
Julian Vilas
dd7705055b
Fix author
2014-05-04 19:31:53 +02:00
OJ
7e37939bf2
Land #3090 - Windows NTUserMessageCall Win32k Kernel Pool Overflow (Schlamperei)
2014-05-04 16:41:17 +10:00
jvazquez-r7
5b150a04c6
Add testing information to description
2014-05-03 20:08:00 -05:00
jvazquez-r7
b4c7c5ed1f
Add module for CVE-2014-0497
2014-05-03 20:04:46 -05:00
Joshua Smith
5b1a207377
cleans up numerous superfluous returns in msf/core/module
2014-05-02 19:52:58 -04:00
Tom Sellers
a47b883083
Remove redundant simple.connect
...
Remove redundant simple.connect. Thanks @jlee-r7
2014-05-02 12:46:50 -05:00
sinn3r
304bc9b6a8
Land #3331 - fix typo
2014-05-02 11:40:32 -05:00
julianvilas
36f9f342c1
Fix typo
2014-05-02 16:26:08 +02:00
kyuz0
34d6875ad9
Merge pull request #4 from Meatballs1/pr3090
...
Include signed binary
2014-05-02 14:48:27 +01:00
Meatballs
06c8082187
Use signed binary
2014-05-02 14:45:14 +01:00
kyuz0
faaf0787a5
Merge pull request #3 from Meatballs1/pr3090
...
Pr3090
2014-05-02 14:20:00 +01:00
Meatballs
56c5eac823
Message correction
2014-05-02 14:18:18 +01:00
Meatballs
69915c0de5
Message correction
2014-05-02 14:17:27 +01:00
kyuz0
d9ad78e3c8
Merge pull request #2 from Meatballs1/pr3090
...
Address OJ's comments
2014-05-02 13:54:40 +01:00
Meatballs
850f6b0276
Address OJ's comments
2014-05-02 13:33:55 +01:00
Tom Sellers
b2eeaef475
Add admin check to smb_login
...
The attached updates changes smb_login to detect if the newly discovered user is an administrator. It is based on code from Brandon McCann "zeknox" submitted in PR #1373 , the associated changes, and the newer PR #2656 .
The changes should correct a few issues with PR #1373 and #2656 and address Redmine bug #8773 .
Specifically it:
- Fixes the admin detection code by using simple.disconnect(<share>) instead of disconnect()
- Adds support for detecting if the remote host will allow connects using any domain name when one of the new status codes is returned
- Dealt with the issue in PR #2656 where the username was prefixed with a '\'
Verification
Be connected to a database
Run this against a machine with a known user and admin user
See that the admin user is reported correctly
See that the non-admin user is reported correctly
Check the output of creds
Select a target that requires a domain in order to authenticate
In the stored credentials, with CHECK_ADMIN enabled, see that the domain name is, in fact, preserved in the reporting
To validate that the remote domain ignores domain value use the following command from a windows system:
net use \\<hostip>\admin$ /user:<random_value>\<username> <password>
2014-05-02 06:16:21 -05:00
jvazquez-r7
150b89e290
Land #3314 , @julianvilas's exploit for Struts CVE-2014-0094
2014-05-01 18:09:10 -05:00
jvazquez-r7
3dd3ceb3a9
Refactor code
2014-05-01 18:04:37 -05:00
jvazquez-r7
b7ecf829d3
Do first refactor
2014-05-01 16:39:53 -05:00
jvazquez-r7
195005dd83
Do minor style changes
2014-05-01 15:25:55 -05:00
jvazquez-r7
140c8587e7
Fix metadata
2014-05-01 15:24:16 -05:00
Christian Mehlmauer
f7d8a5e3a3
rework the openssl_heartbleed module
2014-05-01 21:43:58 +02:00
Julian Vilas
e0ee31b388
Modify print_error by fail_with
2014-05-01 20:19:31 +02:00
Julian Vilas
3374af83ab
Fix typos
2014-05-01 19:44:07 +02:00
David Maloney
5e6f57f711
fix up some more specs
...
some spec cleanup and added basic specs
to the HTTP LoginScanner
2014-05-01 12:10:51 -05:00
jvazquez-r7
d3045814a2
Add print_status messages
2014-05-01 11:05:55 -05:00
jvazquez-r7
cc2e680724
Refactor
2014-05-01 11:04:29 -05:00
jvazquez-r7
28e9057113
Refactor make_payload
2014-05-01 10:23:33 -05:00
David Maloney
1a5abc49d1
Merge branch 'staging/electro_release' into feature/login_scanners/mixin_refactor
...
Conflicts:
lib/metasploit/framework/login_scanner/ftp.rb
lib/metasploit/framework/login_scanner/ssh.rb
lib/metasploit/framework/login_scanner/ssh_key.rb
2014-05-01 10:19:00 -05:00
jvazquez-r7
bd124c85cb
Use metadata format for actions
2014-05-01 09:52:55 -05:00
jvazquez-r7
1483f02f83
Land #3306 , @xistence's alienvault's exploit
2014-05-01 09:25:07 -05:00
jvazquez-r7
1b39712b73
Redo response check
2014-05-01 09:10:16 -05:00
jvazquez-r7
78cefae607
Use WfsDelay
2014-05-01 09:07:26 -05:00
nstarke
f0a8f40acd
Omitting timestamp from msfconsole search output
...
SeeRM #8795
The disclosure date field in the results from the search command
where returning with a timestamp that was almost always 00:00:00 UTC. I added a bit of date time formatting to only
include the year (4 digit), month (2 digit), and day (2 digit)
in the following format: Y-m-d. This date time formatting
applies to both searches conducted through the database instance
as well as searches performed without a database (slow search).
2014-05-01 13:41:15 +00:00
xistence
5db24b8351
Fixes/Stability AlienVault module
2014-05-01 14:53:55 +07:00
xistence
c12d72b58c
Changes to alienvault module
2014-05-01 10:39:11 +07:00
xistence
9bcf5eadb7
Changes to alienvault module
2014-05-01 10:10:15 +07:00
Julian Vilas
bd39af3965
Fix target ARCH_JAVA and remove calls to sleep
2014-05-01 00:51:52 +02:00
David Maloney
0dd22395eb
use credential objects inside results
...
altered results to just hold a credential
object instead of duplicating attributes
2014-04-30 17:17:57 -05:00
James Lee
e33b88ccf0
Land #3322 , fix persistence cleanup script
2014-04-30 16:41:05 -05:00
William Vu
8b138b2d37
Fix unquoted path in cleanup script
2014-04-30 16:34:33 -05:00
Lance Sanchez
3d94a1f77d
Merge branch 'feature/http_login_scanner' into staging/electro_release
2014-04-30 16:30:46 -05:00
William Vu
9b32ed4004
Land #3321 , PATH for windows/local/persistence
2014-04-30 16:30:34 -05:00
kaospunk
6b740b727b
Changes PATH to proper case
...
This changes PATH to Path
2014-04-30 17:26:36 -04:00
David Maloney
4995fcdced
Shared Examples for RexSocket mixin
...
shared example group for the Loginscanner RexSocket
mixin. Pretty simple stuff, just trying to keep it
DRY.
2014-04-30 15:47:52 -05:00
David Maloney
2483a37c04
Rexsocket mixin for LoginScanners
...
add a mixin for Rex Socket dependent behaviour
in certain Loginscanners to DRY up code more
2014-04-30 15:43:28 -05:00
kaospunk
fdc81b198f
Adds the ability to specify path
...
This update allows an explicit path to be set rather
than purely relying on the TEMP environment variable.
2014-04-30 16:08:48 -04:00
James Lee
6a41697955
Add require
2014-04-30 15:03:49 -05:00
David Maloney
1cd3f3f0da
finished first shared example group
...
base behaviour is now defined in shared
example group and the specs all use that
shared example group
2014-04-30 14:40:37 -05:00
David Maloney
a4cc311106
test base behaviour in shared examples
...
start moving specs to a shared example group
for all behaviour defined by the LoginScanner
Base
2014-04-30 14:35:29 -05:00
David Maloney
f1e303d400
add connection error handling
...
if we get too many connection errors
or too many errors in a row, we bail on
the host
2014-04-30 14:06:18 -05:00
David Maloney
a08421b30f
apply reasonable defaults
...
give each lgoinscanner the ability to select
reasonable defaults for certain attributes
2014-04-30 13:56:29 -05:00
Michael Messner
111160147f
MIPS exec payload fixes for encoder
2014-04-30 20:37:54 +02:00
James Lee
ea8dc4db5d
Handle connection errors
...
Also fix up some yardoc issues
2014-04-30 13:33:39 -05:00
James Lee
b617be3dda
Move doc to the right place
2014-04-30 13:30:42 -05:00
David Maloney
ad264cb031
remove dead variable
...
dead variable left in a method from
a previous code iteration. removed
2014-04-30 13:30:09 -05:00
David Maloney
90882f803b
use base mixin in scanners
...
refactor the LoginScanner classes to use the
new Base mixin. Still some more cleanup to be done
2014-04-30 13:29:14 -05:00
David Maloney
7978587428
add lgoinscanner base mixin
...
start moving common behaviour for
all LoginScanners into a mixin
2014-04-30 13:11:48 -05:00
William Vu
7777202045
Deconflict #3310 and correct the description
2014-04-30 12:02:57 -05:00
AnwarMohamed
3340b1af5e
Merge remote-tracking branch 'upstream/master'
2014-04-30 18:34:38 +02:00
Lance Sanchez
7097cd7311
Merge branch 'feature/login_scanner/snmp' into staging/electro_release
...
MSP-9682 #land
2014-04-30 10:46:45 -05:00
David Maloney
f61ede7fd2
fix merge wonkiness
2014-04-30 10:23:20 -05:00
David Maloney
e5276d111d
Merge branch 'staging/electro_release' into feature/login_scanner/snmp
...
Conflicts:
lib/metasploit/framework/login_scanner/result.rb
2014-04-30 10:21:35 -05:00
jvazquez-r7
9cd6c5ef2b
Land #3297 , @Th4nat0s's F6 backends disclosure module
2014-04-30 09:31:37 -05:00
jvazquez-r7
4e80e1c239
Clean up pull request code
2014-04-30 09:31:07 -05:00
James Lee
e8e5a7f72b
Add initial stab at LoginScanner::HTTP
2014-04-30 00:55:45 -05:00
William Vu
4990469bf3
Land #3317 , cleanup for Kiwi Meterpreter extension
2014-04-29 22:21:43 -05:00
Rob Fuller
c3fb5bf614
fix a few clarical errors and typos
2014-04-29 22:42:26 -04:00
James Lee
4bd2dabfcd
Land #3121 , new kiwi extension, with compiled bins
...
See also rapid7/meterpreter#79
2014-04-29 17:53:37 -05:00
nstarke
ace9e797e1
Adding count-based print message
...
This commit removes the creation of a separate, timed
thread for printing out status messages to the user
in the case of large PASS_FILEs. This adjustment eliminates
the overheard of context switching associated with
spinning off separate threads, as well as the dangers
associated with the Thread#kill method.
2014-04-29 22:10:08 +00:00
JoseMi
b0da032136
Modified the metadatas
2014-04-29 23:06:30 +01:00
JoseMi
55d8be8238
Add cve-2013-4074 module to crash dissector capwap
2014-04-29 22:55:14 +01:00
Lance Sanchez
ddee401e27
Merge branch 'feature/MSP-9684/sshkey_loginscanner' into staging/electro_release
...
MSP-9684 #land
2014-04-29 15:21:56 -05:00
Lance Sanchez
53a212a790
Merge branch 'feature/login_scanner/ftp' into staging/electro_release
...
MSP-9669 #land
2014-04-29 15:04:26 -05:00
David Maloney
e8ea6a86b5
add specs for snmp
...
add specs for the snmp loginscanner
and modify the specs to Result class
to account for the access_level attribute
2014-04-29 14:49:35 -05:00
David Maloney
5c24eab526
add snmp specific behaviour
...
add the snmp specific attempt_login behaviour
to gear this login scanner to the right protocol.
2014-04-29 14:08:30 -05:00
julianvilas
8e8fbfe583
Fix msf-staff comments
2014-04-29 17:36:04 +02:00
Tod Beardsley
a5983b5f57
Light touchup on FP checker
2014-04-29 16:14:41 +01:00
David Maloney
f1105ebe48
basic template copypasta
...
copy the ssh scanner as a template to
start the SNMP scanner from
2014-04-29 10:14:23 -05:00
David Maloney
00b9c99c89
fix class documentation copypasta
2014-04-29 10:13:11 -05:00
David Maloney
08b2974454
fix class documentation
2014-04-29 10:12:26 -05:00
Tod Beardsley
88efeea378
Add a false positive check
2014-04-29 16:07:42 +01:00
Arnaud SOULLIE
e386855e0e
Add ACTIONS descriptions
2014-04-29 16:55:05 +02:00
Tod Beardsley
c9d3e94209
Merge from an upstream deconflict
...
This is probably a stupid way to do it; it'd be easier to rebase but
whatevs.
2014-04-29 15:35:16 +01:00
Tod Beardsley
94055fb981
Maybe deconflict #3310 for real?
...
Hmm i kinda suck at this.
2014-04-29 15:34:43 +01:00
Tod Beardsley
4d76128937
Merge upstream and deconflict #3310 whitespace
2014-04-29 15:32:32 +01:00
Arnaud SOULLIE
04f2632972
Implement jvazquez-r7 comments
2014-04-29 16:09:47 +02:00
julianvilas
b2c2245aff
Add comments
2014-04-29 11:24:17 +02:00
Julian Vilas
a78aae08cf
Add CVE-2014-0094 RCE for Struts 2
2014-04-29 03:58:04 +02:00
Julian Vilas
17a508af34
Add CVE-2014-0094 RCE for Struts 2
2014-04-29 03:50:45 +02:00
Rich Lundeen
60b9f855b4
Bug with HTTP POST requests (content type sent twice)
2014-04-28 18:44:02 -07:00
sinn3r
4c0a692678
Land #3312 - Update ms14-012
2014-04-28 18:48:20 -05:00
sinn3r
b1ac0cbdc7
Land #3239 - Added target 6.1 to module
2014-04-28 18:28:14 -05:00
AnwarMohamed
57ea35a19a
Merge remote-tracking branch 'upstream/master'
2014-04-29 00:40:22 +02:00
jvazquez-r7
2b4006089b
Land #3298 , @wvu-r7's fix for db_import and its spec
2014-04-28 17:29:52 -05:00
jvazquez-r7
4caf03b92f
Land #3301 , @nodeofgithub's patch for sercomm module
2014-04-28 17:19:47 -05:00
nstarke
eb98ea2d31
Large pass_file hangs login modules
...
SeeRM #8704
When running a *_login module that contains a large PASS_FILE
the module appears to hang while it is creating the combinations over
such a large dataset. The solution proposed in the Redmine task
requested that the user be alerted with some sort of progress feedback
if the process takes an excessive amount of time.
I have added a message that logs to the console that contains the
number of pairs left to be constructed before the module will continue.
The verbiage is fairly arbitrary and should probably be updated to
something that might be more descriptive. Likewise, the sleep
interval may need to be adjusted.
2014-04-28 21:45:14 +00:00
Thanat0s
70314494ca
test nil of port & host
2014-04-28 23:33:01 +02:00
Thanat0s
fe3f7fd76a
Obey to reviewer.. code fix
2014-04-28 23:26:29 +02:00
jvazquez-r7
1c88dea7d6
Exploitation also works with flash 13
2014-04-28 16:23:05 -05:00
sinn3r
8a4c7b22ed
Land #3296 - Refactors firefox js usage into a mixin
2014-04-28 15:22:55 -05:00
sinn3r
d530c9c128
Land #3304 - Adobe Flash Player Type Confusion Remote Code Execution
2014-04-28 15:06:50 -05:00
sinn3r
fd0183c414
Land #3311 - Fixup release
2014-04-28 14:04:02 -05:00
Tod Beardsley
1b4fe90003
Fix msftidy warnings on wireshark exploits
2014-04-28 19:51:38 +01:00
Tod Beardsley
3bfdfb5cab
Grammar
2014-04-28 19:49:56 +01:00
Tod Beardsley
a5baea1a8e
Touch up print_ statements
2014-04-28 19:49:23 +01:00
Tod Beardsley
a6edd94c7f
Just fix refs and desc for release
2014-04-28 19:47:15 +01:00
Tod Beardsley
a7e110be9e
Add a peer method, elaborate desc and prints
2014-04-28 19:41:44 +01:00
Tod Beardsley
cb247dfe67
Land #3291 , accept zip or jar for jar files
2014-04-28 19:12:18 +01:00
sinn3r
829b9ff4ff
Land #3308 - Fix smb_login using error_reason
2014-04-28 12:33:24 -05:00
jvazquez-r7
9a1b216fdb
Move module to new location
2014-04-28 11:55:26 -05:00
jvazquez-r7
51a5a901a8
Fix typo
2014-04-28 11:55:06 -05:00
jvazquez-r7
887dfc5f40
Fix RequiredCmd
2014-04-28 11:54:56 -05:00
jvazquez-r7
245b591247
Do module clean up
2014-04-28 11:45:40 -05:00
David Maloney
cea12c9d0c
remove metasploit-credential dep
...
remove from the Gemfile for now. we don't need it
just yet, and there are dependency resolution issues
2014-04-28 11:09:31 -05:00
Samuel Huckins
7fad215f3e
Merge branch 'bug/9582-metasploit-imports-and-tasks' into upstream-master
...
Land #3299
2014-04-28 10:47:23 -05:00
Samuel Huckins
5841756bf1
Merge branch 'bug/9582-metasploit-imports-and-tasks'
...
Land #3299
2014-04-28 10:28:25 -05:00
William Vu
891118a3ef
Land #3307 , typo in oracle_demantra_file_retrieval
2014-04-28 10:12:15 -05:00
Arnaud SOULLIE
a0add34a7d
Removed warning message and changed default unit number to 1
2014-04-28 15:47:10 +02:00
Pedro Laguna
ab913a533e
Update oracle_demantra_file_retrieval.rb
...
Fixed typo
2014-04-28 14:36:48 +01:00
Arnaud SOULLIE
a2ccbf9833
Add read/write capabilities to modbusclient
2014-04-28 15:29:55 +02:00
Zinterax
fb39e422aa
Fix smb_login calling nonexistent method
...
When a Rex::Proto::SMB::Exceptions::InvalidWordCount exception is thrown by this module, it attempts to call the nonexistent method error_reason and throws a NoMethodError:
Auxiliary failed: NoMethodError undefined method `error_reason' for #<Rex::Proto::SMB::Exceptions::InvalidWordCount:0x007f48fcda0e48>
This changes uses the built in method get_error to return an error code.
[-] x.x.x.x:445 SMB - [1/1] - \\Domain - FAILED LOGIN (xxxxxxxx) xxxx : xxxxx [STATUS_WAIT_0]
2014-04-28 09:28:29 -04:00
Meatballs
b860cecad6
Function spec (doesnt pass)
2014-04-28 14:09:39 +01:00
Thanat0s
2396d497d8
move scanner to gather
2014-04-28 12:57:54 +02:00
Thanat0s
3bfa8ea707
Pass msftidy
2014-04-28 12:53:49 +02:00
Thanat0s
f34cfefb8f
Change hash to array
2014-04-28 12:52:46 +02:00
Thanat0s
6610977e86
add cookie.match and alway return
2014-04-28 12:39:32 +02:00
Thanat0s
d5fe8471ed
unless id
2014-04-28 12:16:49 +02:00
Thanat0s
328acc44fa
Start cleaning as requested
2014-04-28 11:32:46 +02:00
xistence
2e04bc9e4e
AlienVault OSSIM 4.3.1 unauthenticated SQLi RCE
2014-04-28 10:59:15 +07:00
jvazquez-r7
9ce5545034
Fix comments
2014-04-27 20:13:46 -05:00
nstarke
0bca3a2d54
POST module duplicate search results
...
Running a POST module in meterpreter was causing duplicate search
results for the executed module. For example, running
post/windows/gather/checkvm would produce duplicate results for that
module when executing “search checkvm” in msf.
Debugging revealed that the cmd_exec function in meterpreter’s ui
command_dispatcher core was creating the specified module, and then
promptly reloading it. The reload function was causing the duplicate
module_detail record to be written to the msg postgres database
instance. Further analysis revealed that the “original_mod” could be
used for running the post module, so the “reloaded_mod” was removed
and the “original_mod” used in it’s place to run the post module.
SeeRM #8754
2014-04-27 20:31:32 +00:00
jvazquez-r7
60e7e9f515
Add module for CVE-2013-5331
2014-04-27 10:40:46 -05:00
nodeofgithub
b80d366bb7
Add filter to output WPA-PSK password on Netgear DG834GT
2014-04-26 15:52:31 +02:00
David Maloney
c02fb21c3b
Finalized specs for sshkey
...
shkey loginscanner now compelte along
with specs
2014-04-25 15:20:33 -05:00
William Vu
9964548b41
Amend spec for db_import help
2014-04-25 14:28:29 -05:00
William Vu
696eee1ada
Add Outpost24 to db_import help
2014-04-25 14:27:44 -05:00
David Maloney
e2d6a57db1
fix spec filename
...
had an extra underscore
2014-04-25 14:27:10 -05:00
David Maloney
8430851a98
Add metasploit-credential to gemfile
...
add a temp reference to the metasploit-credential
gem to the gemfile. Need this for access to ssh key
factories for tests
2014-04-25 14:22:52 -05:00
David Maloney
0fcfb9d655
add proxies to ssh scanner
...
allow the SSH LoginScanner
to accept a proxy directive
2014-04-25 14:22:21 -05:00
David Maloney
35a039848c
add sshkey loginscanner
...
added the loginscanner class for SSHKey and
the base specs
2014-04-25 14:21:08 -05:00
Meatballs
3ae8c3ff46
Basic specs
2014-04-25 18:14:39 +01:00
Meatballs
8031e50d35
Make Exploitation::Powershell testable
...
Example test
2014-04-26 13:27:25 +01:00
Meatballs
98d2b2293b
Unnecessary return
2014-04-26 13:05:47 +01:00
Meatballs
be10c8e4ac
Split Rex::Exploitation::Powershell::* into individual files
2014-04-26 12:59:43 +01:00
Meatballs
318ae46085
Remove puts
2014-04-26 12:59:19 +01:00
David Maloney
19ba4cc859
Merge branch 'master' into staging/electro_release
2014-04-25 11:38:36 -05:00
lsanchez-r7
8f43c229b1
Passing the Mdm::Task down the chain
...
when reporting hosts from an Mdm::Task we need to pass the task all
the way down. this wasnt done for the metasploit import format.
2014-04-25 11:15:39 -05:00
Meatballs
3f5cc13bf8
Better eof test
2014-04-25 17:15:12 +01:00
David Maloney
2346d583ed
touchups and specsfor FTP Scanner
...
add some final touchups and specs to the FTP
Loginscanner object. now fully working.
2014-04-25 11:02:15 -05:00
David Maloney
838a444b23
first pass of FTP LoginScanner
...
made the first pass at the ftp
LoginScanner, with base specs.
Need to still tierate, add more new
specs and clean it up
2014-04-25 10:14:48 -05:00
Meatballs
d85e4b1313
Error if encode_inner and encode_final
2014-04-25 15:47:36 +01:00
Meatballs
ae574bec2b
Correct spec
2014-04-25 15:42:48 +01:00
Meatballs
5b9ec72395
Remove read_script spec
2014-04-25 15:40:52 +01:00
Meatballs
19dd21abaf
Remove duplicate methods
2014-04-25 15:40:03 +01:00
Meatballs
206184007f
Move methods and rename file so it is run by rspec
2014-04-25 15:16:15 +01:00
William Vu
c2bb26590c
Land #3250 , version handling for Heartbleed server
2014-04-25 00:17:26 -05:00
Ramon de C Valle
fd232b1acd
Use the protocol version from the handshake
...
I used the protocol version from the record layer thinking I was using
the protocol version from the handshake. This commit fix this and uses
the protocol version from the handshake instead of from the record layer
as in https://gist.github.com/rcvalle/10335282 , which is how it should
have been initially.
Thanks to @wvu-r7 for finding this out!
2014-04-25 01:48:17 -03:00
joev
f94d1f6546
Refactors firefox js usage into a mixin.
2014-04-24 15:09:48 -05:00
Tod Beardsley
fb3b6f577d
Land #3279 , upper bound check for AR
2014-04-24 15:09:07 -05:00
sinn3r
1353c62967
Land #3295 - Fix NoMethodError undefined method `body' for nil:NilClass
2014-04-24 13:53:58 -05:00
sinn3r
ba4b507cc7
Land #3280 - Multiplatform WLAN Enumeration and Geolocation
2014-04-24 13:52:32 -05:00
sinn3r
5c0664fb3b
Land #3292 - Mac OS X NFS Mount Privilege Escalation Exploit
2014-04-24 13:43:20 -05:00
David Maloney
1f9cf8c68f
add the mixins for tcp and ftp
...
skimmed down, non-module dependent mixins
for TCP client and Ftp client. neccesary for
loginscanner work
2014-04-24 13:39:04 -05:00
sinn3r
656e60c35c
Land #3254 - Wireshark <= 1.8.12/1.10.5 wiretap/mpeg.c Stack BoF
2014-04-24 13:20:50 -05:00
sinn3r
cde9080a6a
Move module to fileformat
2014-04-24 13:17:08 -05:00
sinn3r
a39855e20d
Works for XP SP3 too
2014-04-24 13:16:24 -05:00
sinn3r
ba8d7801f4
Remove default target because there is no auto-select
2014-04-24 13:15:49 -05:00
sinn3r
2e76db01d7
Try to stick to the 100 columns per line rule
2014-04-24 13:15:12 -05:00
Tom Sellers
8f47edb899
JBoss_Maindeployer: improve feedback against CVE-2010-0738
...
The exploit against CVE-2010-0738 won't work when using GET or POST. In the existing code the request would fail and the function would return a nil. This would be passed to detect_platform without being checked and cause the module to crash ungracefully with the error:
Exploit failed: NoMethodError undefined method `body' for nil:NilClass
The first changes detect a 401 authentication message and provide useful feedback. Given that if, in any case, 'res' is not a valid or useful response the second change just terminates processing.
I've stayed with the module's coding style for consistency.
2014-04-24 12:37:14 -05:00
Christian Mehlmauer
ef815ca992
Land #3288 , Postgres support for Heartbleed scanner
2014-04-24 18:03:13 +02:00
David Maloney
087bcbdce1
Merge branch 'master' into staging/electro_release
2014-04-24 09:50:18 -05:00
David Maloney
83a9f37241
Merge branch 'feature/ssh_login_scanner' into staging/electro_release
2014-04-24 09:48:09 -05:00
David Maloney
3a66723741
nake scan! more generic
...
scan! can now be reused for each scanner and
only attempt_login is specific for each thing.
2014-04-24 09:43:39 -05:00
Trevor Rosen
5904aa45e6
Merge pull request #1 from rapid7/feature/ssh_login_scanner
...
SSH LoginScanner class
2014-04-24 09:39:28 -05:00
Trevor Rosen
e556997bf7
Land #3269 (Pro) fix report import issue
2014-04-24 08:27:06 -05:00
Tom Sellers
d4c0d015c1
Update wlan_geolocate.rb
...
Updated based on feedback. Also added enumeration only support for BSD and Solaris.
2014-04-24 07:04:50 -05:00
Spencer McIntyre
ec1f7d644c
Support deprecation information from constants
2014-04-23 23:03:02 -04:00
Spencer McIntyre
9ccb9397e3
Land #3264 , throttl and csv output support for module
2014-04-23 19:00:28 -04:00
Spencer McIntyre
e2b92a824f
Change white space for authors in dns_reverse_lookup
2014-04-23 18:56:27 -04:00
David Maloney
ed8f87d3cf
allow scan! to take a blcok
...
by allowing scan! to take block
and yield the result of each attempt
we can do things like have a module print out
status messages
2014-04-23 12:41:10 -05:00
JoseMi
fd95d9ef38
Added english windows xp sp2 target
2014-04-23 17:32:56 +01:00
William Vu
15bd92dd50
Fix OpenSSH timing attack module
2014-04-23 10:10:37 -05:00
William Vu
0a108acea3
Fix missing comma
...
Commas will be the death of me.
2014-04-23 10:10:12 -05:00
William Vu
6d7fde4302
Land #3157 , OpenSSH user enumeration timing attack
2014-04-23 10:01:10 -05:00
William Vu
1a2899d57b
Fix up whitespace 'n' stuff
2014-04-23 10:00:34 -05:00
Thanat0s
457c48b89b
Error on sleep
2014-04-23 11:38:23 +02:00
Joe Vennix
143aede19c
Add osx nfs_mount module.
2014-04-23 02:32:42 -05:00
Meatballs
72a2849bf1
Better specs
...
90.6% line coverage in Exploit::Powershell
77.32% in Rex::Exploitation::Powershell and haven't even started
writing those specs...
2014-04-23 08:07:42 +01:00
Meatballs
0137fdb690
Prepend sleep should be an int
2014-04-23 07:29:51 +01:00
Meatballs
61b8fb7921
Remove puts
2014-04-23 06:15:28 +01:00
Meatballs
58c3bf0e59
Further speccage
2014-04-23 06:08:39 +01:00
Meatballs
32fa8748a8
Fix up decompress
2014-04-23 05:20:54 +01:00
Meatballs
11526b59a6
Boolean datastore options should always be present
...
Dont evaluate true/false as 'true'/'false'!
2014-04-23 05:03:16 +01:00
Jonathan Claudius
d70aa4cdbb
Fix MSFTidy complaints
2014-04-22 22:07:25 -04:00
Jonathan Claudius
b3cabaaa28
Clean up some formatting concerns
2014-04-22 21:58:14 -04:00
Jonathan Claudius
f71ad111da
Change return values from nil to false
2014-04-22 21:48:16 -04:00
Jonathan Claudius
3d793fc6f1
Add default VPN group fall back
2014-04-22 21:45:04 -04:00
Meatballs
c4cfa42e5b
More specs
2014-04-23 02:37:19 +01:00
Meatballs
1347649a47
Remove unused EOFs
2014-04-23 02:37:07 +01:00
Jonathan Claudius
4d9ece2f9a
Add hyphens and digits to group regex
2014-04-22 21:34:08 -04:00
Meatballs
01bfad3489
Correct datastore values
2014-04-23 02:08:57 +01:00
Meatballs
e774411b63
Revert Enum removal
...
.NET 4.5 has two constructors with 2 args so this becomes ambiguous
2014-04-23 02:06:14 +01:00
Meatballs
d2e8e07cfe
Fix old powershell generation
2014-04-23 01:58:02 +01:00
Meatballs
dd38a81dfc
Fix a @parma
2014-04-23 01:10:13 +01:00
Meatballs
647936e291
Add more yarddoc to Rex::Exploitation::Powershell
...
encode_code doesn't use eof
no need to unicode encode in gzip as this is handled by encode_code
2014-04-23 01:07:54 +01:00
Meatballs
88fe619c48
Yarddoc exploit::powershell
2014-04-23 00:15:55 +01:00
AnwarMohamed
fc5262c878
Merge remote-tracking branch 'upstream/master'
2014-04-22 22:56:42 +02:00
David Maloney
d25f0d8f6c
cash host resolution
...
if we successfuly resolve the host during
the validation, then alter host to the resolved
address to avoid the overhead of subsequent
DNS requests.
2014-04-22 15:34:16 -05:00
kenkeiras
96f042110f
return is not needed when it's the last lifunction line
2014-04-22 22:33:47 +02:00
kenkeiras
c9d8da991a
Use Rex.sleep instead of select
2014-04-22 22:33:19 +02:00
kenkeiras
d2a558dc85
Removed unused code
2014-04-22 22:33:02 +02:00
William Vu
39a7a049c4
Land #3283 , msftidy vars_get check update
...
Now with more cyan.
2014-04-22 12:27:44 -05:00
Christian Mehlmauer
3f4e9ab18d
msftidy: only check send_request_cgi for vars_get
2014-04-22 19:24:06 +02:00
David Maloney
0439569ffb
more documentation work
...
added some more YARD docs
2014-04-22 11:48:14 -05:00
David Maloney
a613d044f5
more cleanup work
...
some code and documentation DRY work
2014-04-22 11:38:24 -05:00
David Maloney
36dd10e1c2
add the renamed spec
...
renamed spec for credential class
forgot to add it
2014-04-22 11:05:58 -05:00
David Maloney
bc092af855
Fix credential docs
...
expanded return types for the Credential
object to be more accurate
2014-04-22 11:05:12 -05:00
David Maloney
b731889c79
add class level documentation
...
add some comments for YARD to have class
level documentation for each class
2014-04-22 10:59:28 -05:00
Wiesław Kielas
8f6567967d
Heartbleed PostgreSQL TLS support improvements
2014-04-22 17:36:06 +02:00
David Maloney
526bb4989a
more explicit requires
...
LoginScanner module brings in all the deps
while the individual classes require
the module then to get their deps.
2014-04-22 10:28:01 -05:00
David Maloney
645eef51b7
Rename CredDetail to Credential
...
it was felt this was better naming
for the class. Refactored all occurence
2014-04-22 10:25:36 -05:00
Meatballs
86cfecdd95
Shave some chars off compression code
2014-04-22 14:52:30 +01:00
Meatballs
4c66e86f73
Dont add extra space in args
2014-04-22 14:44:01 +01:00
Meatballs
354311d191
No need to out-null if no windows is shown
2014-04-22 14:42:03 +01:00
Meatballs
cec12edd99
Use enum integer values
2014-04-22 14:40:32 +01:00
Meatballs
71b43d392b
Dont need to specify ASCII mode
2014-04-22 14:36:02 +01:00
Meatballs
d73854ff17
Fix wmi and add automatic target
2014-04-22 14:28:27 +01:00
Rick Farina (Zero_Chaos)
f35314b9f0
adjust Msf::Util::EXE for newer file output
...
Newer releases of File have a much different output when given a jar
file. Adjust regex per egyp7's suggestion to close bug 8792 on redmine.
Failure/Error: verify_bin_fingerprint(format_hash, bin)
expected: /zip/i
got: "/dev/stdin: Java archive data (JAR)\n" (using =~)
Tested and confirmed working with file 5.17 on Gentoo Linux.
2014-04-22 02:21:09 -05:00
David Maloney
7d05de935e
Merge branch 'staging/electro_release' into feature/ssh_login_scanner
2014-04-21 19:26:49 -05:00
David Maloney
f079d3f3a9
move requires into module
...
move all the requires into the LoginScanner
module area to clean up requires
2014-04-21 19:14:50 -05:00
David Maloney
9c6528f13f
use the CredDetail class
...
now that we have the new CredDetail
class, use it instead of hashes
2014-04-21 18:58:23 -05:00
David Maloney
1a6ef8dced
allow for balnk passwords
...
have to alter validation slightly
to allow for blank passwords
2014-04-21 18:57:28 -05:00
David Maloney
fd1777a79f
add CredDetail class
...
rather than passing dumb hashes around
added a CredDetail class that comes
with it's own conditional validations
2014-04-21 18:26:38 -05:00
David Maloney
de2bb7d66c
dd tests for #scan!
...
the scan! method is mostly done
and has unit tests
2014-04-21 17:59:50 -05:00
Wiesław Kielas
fbe392a896
Add PostgreSQL TLS support to the Heartbleed scanner
2014-04-21 23:27:40 +02:00
David Maloney
2e11f80a98
refactor to use Result class
...
we now use a Result class to handle
all result codes from the login attempt
2014-04-21 15:35:16 -05:00
David Maloney
d313047532
add loginscanner result class
...
add a result class to have more
tightly defined return values from
the loginscanner classes
2014-04-21 15:11:56 -05:00
William Vu
284b474591
Land #3286 , release fixes
2014-04-21 14:03:00 -05:00
Tod Beardsley
e514ff3607
Description and print_status fixes for release
...
@cdoughty-r7, I choose you! Or @wvu-r7.
2014-04-21 14:00:03 -05:00
Ken Smith
66b1c79da9
Update rop chain for versions 6.2 and 6.1
2014-04-21 13:27:14 -04:00
Trenton Ivey
c56182a978
Removed an old comment about an added method. Data validation for each wiki type is attempted inline instead of through Rex
2014-04-21 12:26:28 -05:00
JoseMi
e25ca64641
It's solved the crash when double-click on the pcap file
2014-04-21 17:49:40 +01:00
David Maloney
aa1d1be786
do not create sessions with scanner
...
the session creation behaviour is
currently inextricably linked to module
behaviour. We will have our scanner class
only return success status. The calling module
will be responsible for opening sessions afterwards.
2014-04-21 11:38:48 -05:00
David Maloney
7571fe1f68
fix host validation
...
host validation was buggy, fixed it
2014-04-21 11:34:40 -05:00
Christian Mehlmauer
b864c4619d
msftidy - added info messages
...
this commit adds info messages to msftidy to show some info,
but stil exit with status 0 if there are not errors.
2014-04-21 18:04:14 +02:00
Trenton Ivey
0b7a2b9cef
Added plugin to provide formatted wiki output from the framework database
2014-04-21 11:03:52 -05:00
OJ
d8a00603b2
Land #8 - Fix style and yardoc from @jlee-r7
2014-04-21 19:29:09 +10:00
James Lee
49bd86f077
Clean up yardocs and a few style issues
2014-04-21 03:12:23 -05:00
William Vu
1faf069130
Land #3284 , deprecated module cleanup
2014-04-20 23:10:55 -05:00
James Lee
ee413ac385
Remove previously deprecated modules
2014-04-20 22:15:44 -05:00
Christian Mehlmauer
fc803ae277
Changed msftidy check
...
send_request_raw does not support vars_get so change
the message to switch to send_request_cgi.
See #3272 for more info
2014-04-20 22:41:32 +02:00
AnwarMohamed
c586649e01
Merge remote-tracking branch 'upstream/master'
2014-04-20 16:53:02 +02:00
Christian Mehlmauer
1634909975
Bumped ruby version to newest 1.9.3
...
Otherwise this message is always displayed when entering the folder
ruby-1.9.3-p484 is not installed.
To install do: 'rvm install ruby-1.9.3-p484'
And running up to date software is never a failure (even when
1.9.3 is no longer maintained)
2014-04-20 00:44:48 +02:00
Tom Sellers
2fd004b69e
New module: Multiplatform Wireless LAN Geolocation
...
This is a new POST module that allows Windows, Linux, and OSX targets to be geolocated using Google services if the target has an active and functional wireless adapter.
2014-04-19 17:31:48 -05:00
Meatballs
5d9bc71e97
Update hp_dataprotector
2014-04-19 19:16:17 +01:00
Meatballs
3019cb99c1
Update cmd_upgrade module
2014-04-19 19:13:48 +01:00
Meatballs
00234aeec3
Remove powershell remoting
2014-04-19 19:03:18 +01:00
Meatballs
0f942d8c3d
Still :shorten command args
2014-04-19 18:58:26 +01:00
Meatballs
c936dc963c
Shorten compression
2014-04-19 18:55:45 +01:00
Meatballs
270b4b9728
Catch first arg with shorten
2014-04-19 18:54:42 +01:00
Meatballs
67f44072ca
Merge remote-tracking branch 'upstream/master' into pr2075
2014-04-19 18:45:55 +01:00
Meatballs1
ad414b7458
Merge pull request #47 from sempervictus/merge_psh_0414
...
Merge psh 0414
2014-04-22 13:07:09 +01:00
JoseMi
3861541204
Add more rand_text_alpha functions
2014-04-19 18:37:58 +01:00
JoseMi
7bc546e69a
Add rand_text_alpha function
2014-04-19 17:45:28 +01:00
David Maloney
9a15a2be04
basic login attempt functionality
...
groundowkr now layed for trying
authentication attempts on the
SSH LoginScanner, with test coverage
2014-04-18 20:08:28 -05:00
David Maloney
85349ccec4
SSH connection exception handling
...
added in the exception handling
around the Net::SSH conenction
in attempt_login
2014-04-18 18:13:05 -05:00
Brandon Turner
97ef53a1d1
Add upper bound for active-* gems
...
We do not yet support ActiveRecord and ActiveSupport 4.x, so ensure our
Gemfile declares this.
2014-04-18 16:45:07 -05:00
Brandon Turner
fda6ed39f2
Land #3278 , use renamed bcrypt gem instead of bcrypt-ruby
2014-04-18 16:33:51 -05:00
David Maloney
17b4d4a416
Add more attributes and validations
...
Added some more attributes neccesary
for the actual running of the login scan
as well as accompanying validations and
specs
2014-04-18 16:23:35 -05:00
Tod Beardsley
af19efbd71
Use the new bcrypt gem, not bcrypt-ruby
...
See the change upstream at:
https://github.com/codahale/bcrypt-ruby/commit/273946f2ba549b9119868331388e8cf30d2af37c
Reported by @ZeroChaos
2014-04-18 15:02:42 -05:00
kenkeiras
b8e0187647
Use OptPath for file path options
2014-04-18 21:56:17 +02:00
kenkeiras
fb0af8a799
Remove unnecesary ssh_socket variable
2014-04-18 21:50:54 +02:00
kenkeiras
c875bdadf5
Change THRESHOLD into a datastore option
2014-04-18 21:18:48 +02:00
kenkeiras
8a3329c891
Password made pseudo-random instead of a bunnch of A's
2014-04-18 21:10:34 +02:00
kenkeiras
47ff820a83
Remove unnecesary 'RHOST' deregister
2014-04-18 21:06:46 +02:00
kenkeiras
cc2d4f9ed7
Remove unnecesary @good_credentials
2014-04-18 21:03:22 +02:00
JoseMi
feea4c1fa6
ROP chain changed
2014-04-18 19:05:53 +01:00
William Vu
7d801e3acc
Land #3200 , goodbye LORCON modules :(
2014-04-18 12:32:22 -05:00
David Maloney
613612eecb
Merge branch 'master' into feature/ssh_login_scanner
2014-04-18 11:16:18 -05:00
sinn3r
32293dfdab
Land #3277 - Be very clear about Redmine's existence
2014-04-18 10:31:16 -05:00
Tod Beardsley
fe86886c29
Be very clear about Redmine's existence.
2014-04-18 10:01:54 -05:00
jvazquez-r7
c4d4af031c
Land #3276 , @todb-r7's "make msftidy happy"'s fix
2014-04-18 09:54:52 -05:00
jvazquez-r7
5083143971
Land #3238 , @Zinterax's timeout addition in openssl_heartbleed
2014-04-18 09:28:04 -05:00
Tod Beardsley
2a729c84f6
Fix disclosure date
2014-04-18 09:27:41 -05:00
jvazquez-r7
8a011ec9f6
Land #3197 , @0x3fcoma's module for CVE-2013-5795 and CVE-2013-5880
2014-04-18 08:58:54 -05:00
jvazquez-r7
f3299e3ced
Do minor code cleanup
2014-04-18 08:58:11 -05:00
Zinterax
c68b7aa18f
Merge pull request #1 from jvazquez-r7/review_3238
...
Clean timeout handling code
2014-04-18 09:50:33 -04:00
jvazquez-r7
2366f77226
Clean timeout handling code
2014-04-18 08:16:28 -05:00
Zinterax
e38f4cbfa0
Apply response_timeout to get_once, code cleanup
...
Add response_timeout to get_once
Change timeout output in establish_connect()
Add disconnect ater timeout output
Made establish_connect timeout check more readable
2014-04-18 07:57:33 -04:00
Zinterax
fab091ca88
Fix Action => DUMP
...
Fix for when Action is set to DUMP. Modifed the check to use action.name.
Console output:
msf auxiliary(openssl_heartbleed) > set action DUMP
action => DUMP
msf auxiliary(openssl_heartbleed) > run
[*] 192.168.1.3:443 - Sending Client Hello...
[*] 192.168.1.3:443 - Sending Heartbeat...
[*] 192.168.1.3:443 - Heartbeat response, 17403 bytes
[+] 192.168.1.3:443 - Heartbeat response with leak
[*] 192.168.1.3:443 - Heartbeat data stored in /root/.msf4/loot/20140418070745_default_192.168.1.3_openssl.heartble_135938.bin
[*] 192.168.1.3:443 - Printable info leaked: STUFF STUFF STUFF
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
2014-04-18 07:08:12 -04:00
Zinterax
1cf1616341
Rebase. Add timeout option support
...
Rebase to account for the KEYS merge.
Modify bleed() to work with timeout option.
Modify establish_connect() to work with timeout option.
Modify loot_and_report() to work with timeout option.
---Test Console Output---
Client Hello Timeout:
msf auxiliary(openssl_heartbleed) > run
[*] 127.0.0.1:443 - Sending Client Hello...
[-] 127.0.0.1:443 - No Client Hello response after 10 seconds...
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
Patched Apache:
msf auxiliary(openssl_heartbleed) > run
[*] 127.0.0.1:443 - Sending Client Hello...
[*] 127.0.0.1:443 - Sending Heartbeat...
[-] 127.0.0.1:443 - No Heartbeat response...
[-] 127.0.0.1:443 - Looks like there isn't leaked information...
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
Vulnerable Server:
msf auxiliary(openssl_heartbleed) > run
[*] 192.168.1.3:443 - Sending Client Hello...
[*] 192.168.1.3:443 - Sending Heartbeat...
[*] 192.168.1.3:443 - Heartbeat response, 17403 bytes
[+] 192.168.1.3:443 - Heartbeat response with leak
[*] 192.168.1.3:443 - Printable info leaked: STUFF STUFF STUFF
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
2014-04-18 07:04:05 -04:00
Zinterax
021ac53911
remove me
2014-04-18 07:03:36 -04:00
Christian Mehlmauer
bbed9f4c66
Land #3274 , @jjarmoc heartbleed private key extraction
2014-04-18 06:59:10 +02:00
jvazquez-r7
b0e4648d66
Land #2895 , @dukebarman's exploit for Flash CVE-2013-0634
2014-04-17 23:35:05 -05:00
jvazquez-r7
acb12a8bef
Beautify and fix both ruby an AS
2014-04-17 23:32:29 -05:00
RageLtMan
9f05760c50
Merge with Meatballs' initial changes
...
Clean up arch detection code and dedup Msf/Rex
Reduce generated payload size
2014-04-18 00:28:48 -04:00
RageLtMan
5c3289bbc6
merge fix
2014-04-17 21:26:04 -04:00
Jonathan Claudius
01d843f78f
Handle certificate auth nuances
2014-04-17 20:24:19 -04:00
Jeff Jarmoc
94618455b7
Merge pull request #1 from todb-r7/land-3274-rsa-keydump
...
Deconflict after #3252
2014-04-17 18:53:42 -05:00
Jonathan Claudius
6daae961cb
Add parameterized requests for detection/enumeration
2014-04-17 19:40:27 -04:00
Tod Beardsley
845108acf6
Looks like an autocorrect ran wild on TLS_CALLBACK
...
Whoops.
2014-04-17 17:47:47 -05:00
Tod Beardsley
2aa2cb17f3
Reimplement a check.
2014-04-17 17:10:54 -05:00
Tod Beardsley
d40ab039e4
Clean up whitespace. Protip: use commit hooks
2014-04-17 16:28:07 -05:00
Tod Beardsley
c34d548e50
First, undo #3252 . Sorry about that.
...
undo #3252 completely. This means a reimplementation of @dchan's work,
but his intent was simply to implement a check_host() that doesn't
actually pull memory, so that should be pretty straight forward with the
new structure of the module.
2014-04-17 16:25:15 -05:00
Jeff Jarmoc
e3daf6daf7
Singular 'TLS_CALLBACK' option
2014-04-17 15:51:37 -05:00
Jeff Jarmoc
6c832e22d6
rename scan to loot_and_report
2014-04-17 15:47:57 -05:00
Jeff Jarmoc
c12eae66b3
Error and return if public key wasn't retrieved.
2014-04-17 15:44:40 -05:00
Jeff Jarmoc
578002e016
KEYS action gets it's own function
2014-04-17 15:39:05 -05:00
Tod Beardsley
5b0b5d9476
Land #3252 , check() functionality for Heartbleed
2014-04-17 15:34:35 -05:00
Tod Beardsley
a2d6c58374
Changing << to + per @jlee-r7
2014-04-17 15:34:13 -05:00
jvazquez-r7
91d9f9ea7f
Update from master
2014-04-17 15:32:49 -05:00
jvazquez-r7
749e141fc8
Do first clean up
2014-04-17 15:31:56 -05:00
Jeff Jarmoc
9f30976b83
Heartbleed RSA Keydump
...
Flattened, merge conflicts resolved, etc.
2014-04-17 14:30:47 -05:00
Jonathan Claudius
7ddd93cf5d
Add redirect support to #is_app_ssl_vpn?
2014-04-17 12:06:29 -04:00
Jonathan Claudius
0c5fb8c0c2
Fix bug in group enumeration regex
2014-04-17 10:31:05 -04:00
Christian Mehlmauer
71a650fe6e
Land #3259 , XMPP Hostname autodetect by @TomSellers
2014-04-17 08:54:15 +02:00
Tom Sellers
1f452aab48
Code cleanup
...
Changes requested by wvu-R7
2014-04-17 12:46:25 -05:00
Tom Sellers
9e2285619e
Additional cleanup
...
Whitespace cleanup
2014-04-17 10:46:33 -05:00
Joe Vennix
8920e0cc80
Use octal encoding and -e, so that echo always works.
2014-04-17 01:17:46 -05:00
Jonathan Claudius
f53e7f84b8
Adds Cisco SSL VPN Bruteforce Aux Mod
2014-04-16 22:47:58 -04:00
James Lee
af899254a3
Missed file
2014-04-16 19:14:17 -05:00
James Lee
549e306572
Remove superfluous v6 http{,s} payload and handler
2014-04-16 18:32:35 -05:00
Tom Sellers
ee0d30a1f3
Whitespace fix
...
Removing extra line feeds
2014-04-16 17:27:39 -05:00
Tom Sellers
92eab6c54b
Attribution addition
...
Per comment from Firefart
2014-04-16 17:26:09 -05:00
Samuel Huckins
2ed7a739c3
New reports in new exports can now import
...
MSP-9783
* Extracted import_report from monstrous import_msf_collateral;
simplified and clarified approach
* Updated report_report: includes all attrs provided vs subset, provides
more helpful error message
* Added report_artifact: adds child artifact for reports, handles
various troublesome cases
* Tested on all report types with a legion of option variants
2014-04-16 15:15:47 -05:00
David Maloney
756488b581
last of the validations
...
finalized validation for SSH lgoinscanner
2014-04-16 13:34:23 -05:00
David Maloney
bf20ed5812
add validations for cred_details
...
Adds validator for the cred_details
attribute on the SSH Login Scanner.
Makes sure propper input is always supplied
for the scanner.
2014-04-16 13:20:14 -05:00
David Maloney
434391c308
add host validations to ssh scanner
...
add validations to the :host attribute
on the SSH LoginScanner
2014-04-16 10:26:00 -05:00
Tom Sellers
1f3ec46b8a
Heartbleed - Add autodetection of XMPP hostname (round 2)
...
Add the ability to scrape the hostname from the XMPP error message when connecting to an XMPP (Jabber) server. This allows the connection to get far enough to negotiate a TLS tunnel with STARTTLS. The manually specified domain, if present, will be used first and then the hostname autodetection will kick in if that fails.
This version addresses issues that FireFart (Thanks!) brought up about code quality and connection reliability.
2014-04-16 08:49:45 -05:00
sinn3r
54346f3f92
Land #3265 - Windows Post Manage Change Password
2014-04-15 18:45:48 -05:00
sinn3r
d7a63003a3
Land #3266 - MS14-012 Microsoft Internet Explorer CMarkup Use-After-Free
2014-04-15 18:35:18 -05:00
sinn3r
23c2a071cd
Small name change
2014-04-15 18:35:00 -05:00
sinn3r
7a4e12976c
First little bit at Bug 8498
...
[FixRM #8489 ] rhost/rport modification
2014-04-15 18:20:16 -05:00
sinn3r
d7513b0eb2
Handle nil properly when no results are found
2014-04-15 18:19:29 -05:00
jvazquez-r7
abd76c5000
Add module for CVE-2014-0322
2014-04-15 17:55:24 -05:00
David Maloney
60c879c824
specs for port validation
...
created specs for port validation
MSP-9683
2014-04-15 17:25:55 -05:00
David Maloney
02a17b8612
namespace change to Metasploit
...
chaning the code to live in the namespace of
Metasploit::Framework instead of Msf::Auxiliary
MSP-9683
2014-04-15 17:11:25 -05:00
Meatballs
38d8df4040
Merge remote-tracking branch 'upstream/master' into pr2075
...
Conflicts:
modules/exploits/windows/local/wmi.rb
2014-04-15 22:06:45 +01:00
Meatballs
5bd9721d95
Redundant include
2014-04-15 21:34:21 +01:00
Meatballs
02b11afddc
Merge remote-tracking branch 'upstream/master' into netapi_change_passwd
...
Conflicts:
lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_netapi32.rb
2014-04-15 21:23:45 +01:00
Meatballs
bd9b5add49
Dont report creds
...
We dont know if a DOMAIN or IP is specified etc.
2014-04-15 21:14:49 +01:00
Meatballs
fc018eb32e
Initial commit
2014-04-15 21:05:06 +01:00
Christian Mehlmauer
56b165d4bd
Land #3263 , updated vars_get msftidy regex by @wvu-r7
2014-04-15 21:53:10 +02:00
William Vu
aeedad262d
Remove unnecessary charclass escapes
2014-04-15 14:14:51 -05:00
David Maloney
3c9507c30c
Adds invalid exception class
...
adds an invalid exception class to the
LoginScanner namespace.
MSP-9683
2014-04-15 13:23:24 -05:00
William Vu
261572158b
Add paren to list of exclusion chars
2014-04-15 11:20:11 -05:00
William Vu
14c7eb19e6
Make the hash brace optional
2014-04-15 10:06:43 -05:00
Tod Beardsley
f46b4ab8f3
Land #3258 , undoing the aggressive vars_post check
2014-04-14 22:30:04 -05:00
Tod Beardsley
0b2737da7c
Two more java payloads that wanted to write RHOST
...
There are three total, and they're all copy-pasted from the original
module from 2009. I suspect this idiom isn't used at all any more -- I
can't detect a difference in the payload if I just declare a host being
cli.peerhost, rather than rewriting RHOST to be cli.peerhost.
[SeeRM #8498 ]
2014-04-14 22:22:30 -05:00
Tod Beardsley
775b0de3c0
Replace RHOST reassing with just host
...
This looks okay from debug (the host looks like it's generating okay)
but there may be some subtle thing I'm not seeing here. @wchen-r7 can
you glance at this please?
[SeeRM #8498 ]
2014-04-14 22:17:31 -05:00
Tod Beardsley
9db01770ec
Add custom rhost/rport, remove editorializing desc
...
Verification:
````
resource (./a.rc)> run
[*] Connecting to FTP server ....
[*] FTP recv: "220 ProFTPD 1.3.3a Server (My FTP server)
[*] Connected to target FTP server.
[*] Authenticating as anonymous with password mozilla@example.com ...
[*] FTP send: "USER anonymous\r\n"
[*] FTP recv: "331 Anonymous login ok, send your complete email address
as your password\r\n"
````
...etc.
2014-04-14 21:46:05 -05:00
Tod Beardsley
40a359f312
Include a vhost for Shodan or else it complains
...
Works now. The rhost option was not keeping the custom vhost option.
````
msf auxiliary(shodan_search) > rexploit
[*] Reloading module...
[*] Total: 13443 on 269 pages. Showing: 1
[*] Country Statistics:
[*] United States (US): 2006
[*] Germany (DE): 1787
[*] Korea, Republic of (KR): 1061
[*] Italy (IT): 916
[*] Hungary (HU): 604
[*] Collecting data, please WaitUntilAuthEmptyt...
IP Results
==========
````
2014-04-14 21:23:27 -05:00
Tod Beardsley
1436f68955
Fix shodan to not muck with datastore
2014-04-14 21:21:11 -05:00
Tod Beardsley
9035d1523d
Update wol.rb to specify rhost/rport directly
...
- [ ] Fire up tcpdump on the listening interface
- [ ] Run the module and see the pcap:
listening on vmnet8, link-type EN10MB (Ethernet), capture size 65535
bytes
20:56:02.592331 IP 192.168.145.1.41547 > 255.255.255.255.9: UDP, length
102
2014-04-14 20:57:20 -05:00
Tom Sellers
0360d1177f
Heartbleed - Add autodetection of XMPP hostname
...
Add the ability to scrape the hostname from the XMPP error message when connecting to an XMPP (Jabber) server. This allows the connection to get far enough to negotiate a TLS tunnel with STARTTLS. The manually specified domain, if present, will be used first and then the hostname autodetection will kick in if that fails.
2014-04-14 20:09:21 -05:00
Thanat0s
07ed8d832a
Update db
2014-04-15 02:48:55 +02:00
David Chan
1a73206034
Add detection for GnuTLS with with multiple records
2014-04-14 17:09:25 -07:00
Thanat0s
fecdbd1781
F5 bigip cookie module
2014-04-15 01:11:17 +02:00
Tod Beardsley
e4a61e2730
Fix Module.new bug and test for vhost
2014-04-14 18:01:13 -05:00
William Vu
66cc050876
Land #3256 , SMTP RFC compliance for Heartbleed
2014-04-14 17:52:56 -05:00
William Vu
f3f31005d8
Revert inadvertent fix for vars_get in msftidy
2014-04-14 14:51:52 -05:00
William Vu
0a4c10876d
Land #3257 , errant whitespace fix
2014-04-14 14:33:04 -05:00
Thanat0s
176204d62d
With implemented remarks
2014-04-14 21:11:04 +02:00
Tod Beardsley
66a50b33fd
Errant whitespace
2014-04-14 13:34:39 -05:00
Tom Sellers
634a03a852
Update to openssl_heartbleed to deal with SMTP RFC
...
Added CR character in order to have the commands match SMTP RFC 5321 2.3.8 for line termination. Some SMTP services, such as the Symantec Mail Gateway, require strict compliance or the connection will be dropped with the response '550 esmtp: protocol deviation'
Reference:
http://www.symantec.com/business/support/index?page=content&id=TECH96829
http://tools.ietf.org/html/rfc5321#section-2.3.8
2014-04-14 13:27:33 -05:00
sinn3r
1f5f697037
Land #3255 - Adds history collection module for FF privileged JS
2014-04-14 12:45:03 -05:00
joev
5f0d723588
Adds history collection module for FF privileged JS.
2014-04-14 12:27:18 -05:00
sinn3r
61196b4793
Land #3246 - Firefox Gather Passwords from Privileged Javascript Shell
2014-04-14 11:37:55 -05:00
David Maloney
c537aebf0f
Land #3228 , JtR colon Seperation
2014-04-14 11:19:16 -05:00
David Maloney
5074529647
Land #3253 , Fix to exe-only format
...
Lands pull request to fix nil issue with
the to_winpe_only method call in Msf::Util::EXE
2014-04-14 11:04:03 -05:00
Tod Beardsley
2aecab89bb
14-day free trial banner for non-binary installs
2014-04-14 11:00:41 -05:00
JoseMi
e811e169dc
Cambios en el exploit
2014-04-14 16:31:54 +01:00
JoseMi
da26a39634
Add CVE-2014-2219 exploit for windows XP SP3
2014-04-14 16:16:10 +01:00
agix
ac63e84d02
Fix little bug when using msfencode and exe-only
...
When arch is not defined, arch is null so it crashs.
It should be 'x86' by default
2014-04-14 01:02:31 +02:00
Thanat0s
dd7bceee56
fix threaded issues
2014-04-12 17:43:39 +02:00
Thanat0s
d493c48cc6
add thottling,notes insert and output to dns_rev_lookup
2014-04-12 16:36:18 +02:00
Ramon de C Valle
039946e8d1
Use the first cipher suite sent by the client
...
If encrypted, use the TLS_RSA_WITH_AES_128_CBC_SHA; otherwise, use the
first cipher suite sent by the client. This complements the last commit
and makes this module work with SSLv3, TLSv1.0, TLSv1.1, and TLSv1.2
when NEGOTIATE_TLS is not enabled (see
https://gist.github.com/rcvalle/10335282 ).
2014-04-12 05:05:14 -03:00
Ramon de C Valle
b95fcb9610
Use the protocol version sent by the client
...
Use the protocol version sent by the client. This should be the latest
version supported by the client, which may also be the only acceptable.
This makes this module work with SSLv3, TLSv1.0, TLSv1.1, and TLSv1.2
when NEGOTIATE_TLS is not enabled (see
https://gist.github.com/rcvalle/10335282 ).
2014-04-12 04:21:35 -03:00
David Chan
6fafc10184
Add HeartBleed check functionality
2014-04-12 00:07:00 -07:00
sinn3r
7b6b94acd5
Land #3247 - Revert #3224 jsobfu string size fixes
2014-04-12 00:58:27 -05:00
joev
1715cf4650
Add base64 to prevent potential encoding issues.
2014-04-11 17:30:04 -05:00
joev
e09f887c4c
Revert "Fixes large-string expansion in JSObfu."
...
This reverts commit 14fed8c610 .
2014-04-11 16:51:47 -05:00
joev
4cb04b6b9a
Revert "Use implicit return for assignment."
...
This reverts commit 49139cc07f .
2014-04-11 16:51:40 -05:00
joev
21b2697b95
Revert "Use tiny var names by default."
...
This reverts commit 52432ef482 .
2014-04-11 16:51:34 -05:00
joev
0b23fc2c40
Revert "Use actual vars so that jsobfu can randomize."
...
This reverts commit b9284c5635 .
2014-04-11 16:51:29 -05:00
joev
d41b3467f8
Revert "Re-add the #random_string(len) method to pass specs."
...
This reverts commit bd8918e4e1 .
2014-04-11 16:51:21 -05:00
joev
65d267032d
Fix wrong DisclosureDate.
2014-04-11 16:17:22 -05:00
joev
197a7e556b
Add password colletion post module for Firefox shells.
2014-04-11 16:15:48 -05:00
David Maloney
3742d9b687
tabassassin to the rescue
...
because we pulled in the new metasm repo,
retabbed everything to avoid whitespace conflicts
2014-04-11 15:19:16 -05:00
William Vu
6599999b8a
Land #3232 , Heartbleed memory dump filtering
2014-04-11 12:46:01 -05:00
Sebastiano Di Paola
a63f020a68
Fixing coding style
2014-04-11 19:39:57 +02:00
Sebastiano Di Paola
3a41819b1f
Merge branch 'master' of https://github.com/abes975/metasploit-framework into heartbleed
2014-04-11 19:34:45 +02:00
Sebastiano Di Paola
4acacb005d
Fixed a bug...referring to wrong variable after filtering with regexp
2014-04-11 19:33:23 +02:00
Sebastiano Di Paola
9cbb86a815
fixed conflict while merging from heartbleed branch
2014-04-11 19:28:32 +02:00
Sebastiano Di Paola
83fe1cec65
Cleaned up Array.join call
2014-04-11 19:24:32 +02:00
Sebastiano Di Paola
55ec969bd9
Renamed FILTER -> DUMPFILTER, more intuitive and coherent
2014-04-11 19:07:57 +02:00
Sebastiano Di Paola
8268009b36
Renamed PATTERN_FILTER -> FILTER
2014-04-11 19:03:25 +02:00
Sebastiano Di Paola
c378fe95c1
Added missing space in comment
2014-04-11 19:01:01 +02:00
Sebastiano Di Paola
f8f710547c
Fixed call to String.match with regexp pattern
2014-04-11 18:59:59 +02:00
Sebastiano Di Paola
638cb41a3f
Remove Spaces at EOL, fixed if test on pattern variable
2014-04-11 18:58:05 +02:00
Sebastiano Di Paola
5f973558ce
Merge branch 'master' of https://github.com/abes975/metasploit-framework
...
Conflicts:
modules/auxiliary/scanner/ssl/openssl_heartbleed.rb
2014-04-11 18:38:59 +02:00
Sebastiano Di Paola
ea70abe98d
Conflicts resolution should be ok now
2014-04-11 18:33:03 +02:00
Sebastiano Di Paola
cc836c0496
Restored FTP option
2014-04-11 18:31:30 +02:00
Sebastiano Di Paola
39320f12a7
- Rubbish that was left dangling here around
2014-04-11 18:31:30 +02:00
Sebastiano Di Paola
139358dc8a
fixed conflicts, used OptRegexp for pattern
2014-04-11 18:31:29 +02:00
Sebastiano Di Paola
9331f88dd8
Added feature to dump to file leaked memory
2014-04-11 18:31:29 +02:00
Sebastiano Di Paola
34fa4e29d9
Restored FTP option
2014-04-11 18:16:19 +02:00
Sebastiano Di Paola
eb0e35bf25
Fixed store on file option
2014-04-11 18:07:14 +02:00
sinn3r
b69662fa42
Land #3233 - eScan Password Command Injection
2014-04-11 11:05:48 -05:00
sinn3r
e54a348bd4
Land #3237 - Reconcile test_old_rubies with the other checks
2014-04-11 10:49:23 -05:00
sinn3r
eb8e9523ff
Land #3236 - Correct check_vars_get to check_request_vars
2014-04-11 10:47:59 -05:00
jvazquez-r7
0c8f5e9b7d
Add @Firefart's feedback
2014-04-11 10:21:33 -05:00
Sebastiano Di Paola
c4029ea582
- Rubbish that was left dangling here around
2014-04-11 17:20:54 +02:00
Sebastiano Di Paola
1808fe470a
fixed conflicts, used OptRegexp for pattern
2014-04-11 17:16:06 +02:00
Sebastiano Di Paola
4315ad2987
Fixed conflict and used OptRegexp type for pattern
2014-04-11 17:15:39 +02:00
jvazquez-r7
813e0eab89
Land #3233 , @wvu-r7's improvements fort heartbleed modules
2014-04-11 09:33:57 -05:00
jvazquez-r7
e2ec53272e
Fix also negative numbers
2014-04-11 09:33:27 -05:00
Ken Smith
c99f6654e8
Added target 6.1 to module
2014-04-11 09:59:11 -04:00
jvazquez-r7
fb5881d8e2
Land #2324 , @sensepost and @Firefart's sftp support for heartbleed
2014-04-11 08:47:22 -05:00
jvazquez-r7
1cb1d4d5ff
Land #3230 , @Firefart's improve for jabber's starttls
2014-04-11 08:21:41 -05:00
jvazquez-r7
2134d676b4
Use verbose by default
2014-04-11 07:58:56 -05:00
William Vu
8919e21379
Reconcile test_old_rubies with the other checks
...
It is now check_old_rubies.
2014-04-10 21:44:00 -05:00
William Vu
df29578036
Correct check_vars_get to check_request_vars
...
Since check_vars_get also checked for POSTs.
2014-04-10 21:37:59 -05:00
Spencer McIntyre
1f6bdabfe6
Land #3231 , link exploit requirement details
2014-04-10 22:27:42 -04:00
Tod Beardsley
56662bd89b
Correct corpwatch_lookup_name datastore usage
...
[SeeRM #8498 ]
2014-04-10 16:56:55 -05:00
Tod Beardsley
06dedeec8f
Update corpwatch_lookup_id to run correctly
...
[SeeRM #8498 ]
2014-04-10 16:52:34 -05:00
Tod Beardsley
91293fd0db
Allow vhost to be maybe opts['rhost']
...
This enables passing rhost and rport directly to send_request_cgi
without having to monkey with the datastore.
See #8498
2014-04-10 16:47:49 -05:00
William Vu
6675464c20
Fix a few things in the Heartbleed modules
2014-04-10 16:06:40 -05:00
Sebastiano Di Paola
9adf629ee7
Added feature to dump to file leaked memory
2014-04-10 22:51:07 +02:00
David Maloney
c000e418ab
Pull in more 64bit compiler fixes
...
this fixes issues with comparison operations
when compilnig C in metasm for 64bit
2014-04-10 14:46:46 -05:00
sinn3r
80faaf86d8
Add a link to explain about unmet exploit requirements
2014-04-10 14:01:16 -05:00
sinn3r
a6a6ad2217
Land #3227 - Remove bundled rkelly, to Gemfile
2014-04-10 12:31:59 -05:00
sinn3r
68a50e3663
Land #3224 - Fixes large-string expansion in JSObfu
2014-04-10 12:09:22 -05:00
Tod Beardsley
bc5f87b01a
Land #3195 , check() fix
2014-04-10 08:59:53 -05:00
Brandon Turner
9ca3d95980
Merge branch release into master
...
This resync's release and master after cherry-picking the
openssl_heartbleed module for release.
Conflicts:
modules/auxiliary/scanner/ssl/openssl_heartbleed.rb
2014-04-10 06:32:58 -07:00
jvazquez-r7
fe066ae944
Land #3207 , @7a69 MIPS BE support for Fritz Box's exploit
2014-04-09 23:20:45 -05:00
jvazquez-r7
fdda69d434
Align things
2014-04-09 23:19:41 -05:00
jvazquez-r7
386e2e3d29
Do final / minor cleanup
2014-04-09 23:19:12 -05:00
Christian Mehlmauer
43a4f41513
Land #3242 , SSLv3 support
2014-04-10 02:53:09 +02:00
William Vu
3e04fd7ec2
Land #3245 , installers are for users
2014-04-11 16:29:30 -05:00
Tod Beardsley
5e1e84db03
Encourage use of the installer for users.
2014-04-11 15:55:18 -05:00
Brandon Turner
fbd84f16e1
Land #3243 , merge release back into master
2014-04-11 15:16:59 -05:00
Tod Beardsley
ea8c15ba47
Land #3241 back into master
2014-04-11 15:08:01 -05:00
Tod Beardsley
3109f42a55
Merge release back into master
2014-04-11 15:07:16 -05:00
Tod Beardsley
bbc72c3e1c
Update spec to reflect the correct version.
2014-04-11 12:29:26 -05:00
Christian Mehlmauer
f115a7f6e1
Fix intendation
2014-04-10 02:52:05 +02:00
gigstorm
f1443c039e
Updated hash value to SSLv3
...
Tested and working on server that has SSLv3 only enabled
2014-04-11 14:01:28 -07:00
gigstorm
6ab3478c7e
Update to include SSL Version 3 protocol
...
SSL Version 3 will also respond to this and a server configured to respond to SSL version 3 but not TLS will show false negative without this option (proven). May need to update cipher suites to include this option.
2014-04-11 12:41:17 -07:00
James Lee
f54654a326
More refactor on jtr_linux
...
Reducing complexity in `run` makes modules easier to read
2014-04-09 19:26:34 -05:00
James Lee
7f900c2628
Micro optimizations for jtr_linux
2014-04-09 19:26:23 -05:00
James Lee
46038d58b7
Refactor jtr_linux copy pasta
...
Move it to a nifty method
2014-04-09 19:26:11 -05:00
James Lee
95399b0de7
Don't try to be too helpful
...
John cares not one whit how many colons are in a hash line, only that
there are enough for the format (at least 2 for regular /etc/passwd, at
least 3 for NTLM, etc). So there is no simple way to programmatically
determine whether a password had a colon or there was just an extra on
the end of the original hash line.
[MSP-9778]
See #2515
2014-04-09 19:24:26 -05:00
Christian Mehlmauer
4fc272c0e9
Fix merge error
2014-04-10 00:53:14 +02:00
jvazquez-r7
f398924280
Land @Firefart's new fix for the jabber case
2014-04-09 17:52:53 -05:00
Christian Mehlmauer
98816c3a01
Added @sensepost FTP implemenation
2014-04-10 00:48:09 +02:00
singe
ccfcf2cedb
Added FTP STARTTLS support to heartbleed scanner.
2014-04-10 00:45:59 +02:00
Joe Vennix
bd8918e4e1
Re-add the #random_string(len) method to pass specs.
2014-04-09 17:44:48 -05:00
jvazquez-r7
c0e682b518
Land #3225 , @wvu-r7's and @hmoore-r7's improvements for openssl_heartbeat_client_memory
2014-04-09 17:39:04 -05:00
jvazquez-r7
ccdc5bd281
Switch to get since @wvu-r7 also tested successfully with get
2014-04-09 17:30:00 -05:00
Joe Vennix
5170b7230b
Tweak Gemfile comment.
2014-04-09 17:24:45 -05:00
Joe Vennix
57aa1eec11
Kick rkelly out to a gem, add rkelly-remixed.
...
rkelly-remixed is a faster fork of rkelly that is more frequently updated
nowadays. With the new gem, jsobfu obfuscates os.js about twice as fast on
my dev environment.
2014-04-09 17:21:22 -05:00
William Vu
b905aece38
Fix job not backgrounding
2014-04-09 17:03:57 -05:00
HD Moore
ed247498b6
Make TLS negotiation optional
2014-04-09 17:03:38 -05:00
jvazquez-r7
b0b979ce62
Meterpreter sessions won't get root in this way
2014-04-09 16:59:12 -05:00
Joe Vennix
b9284c5635
Use actual vars so that jsobfu can randomize.
2014-04-09 16:56:10 -05:00
Joe Vennix
52432ef482
Use tiny var names by default.
2014-04-09 16:54:02 -05:00
jvazquez-r7
a2ce2bfa56
Fix disclosure date
2014-04-09 16:41:49 -05:00
jvazquez-r7
ff232167a6
Add module for eScan command injection
2014-04-09 16:39:06 -05:00
sinn3r
2de210f1c3
Land #3216 - Update @Meatballs1 and @FireFart in authors.rb
2014-04-09 16:38:10 -05:00
Joe Vennix
49139cc07f
Use implicit return for assignment.
2014-04-09 15:48:07 -05:00
Joe Vennix
14fed8c610
Fixes large-string expansion in JSObfu.
2014-04-09 15:45:48 -05:00
William Vu
f56f34fb69
Land #3212 , @hmoore-r7's client-side Heartbleed
2014-04-09 15:42:36 -05:00
Christian Mehlmauer
a86a8fed05
Changed heartbleed jabber implementation to match openssl s_client
...
see here for example implementation:
https://github.com/openssl/openssl/blob/master/apps/s_client.c#L1719
2014-04-09 22:20:32 +02:00
jvazquez-r7
38a2614fbe
Land @wvu-r7's new vprint message
2014-04-09 15:19:10 -05:00
William Vu
2f9a400efa
vprint_status the other message message
2014-04-09 15:11:02 -05:00
jvazquez-r7
479bef8770
Land @wvu-r7 verbosity changes
2014-04-09 15:10:33 -05:00
William Vu
84ce72367b
Make the output less verbose
2014-04-09 14:57:51 -05:00
Christian Mehlmauer
856ad7e83d
heartbleed - Better output on wrong jabber domain and add. nil? check
2014-04-09 21:53:17 +02:00
jvazquez-r7
85536077f7
Land #3222 , @jjarmoc's switch for TLS default version
2014-04-09 14:04:29 -05:00
Jeff Jarmoc
7a424784f8
Change default TLS Version to 1.0
...
Canonical testing shows this to be more widely supported, and yielding far more vulnerable hosts. Changing default to reflect that.
Experience of others in #metasploit seems similar.
2014-04-09 13:45:00 -05:00
Christian Mehlmauer
fec089d88d
Land #3219 , openssl_heartbleed XMPP fix from @natronkeltner
2014-04-09 20:42:55 +02:00
Christian Mehlmauer
e2b50d3709
fix openssl_heardbleed
...
-) XMPP Domain now configurable
-) Missing get_once to initiate the TLS connection
2014-04-09 20:39:33 +02:00
jvazquez-r7
5696e52fac
Fix jabber to field
2014-04-09 13:48:45 -05:00
jvazquez-r7
28a471e446
Land #3221 , @Firefart's fix for pop3 starttls
2014-04-09 13:31:45 -05:00
jvazquez-r7
bea810b5d6
Add jabber fix from @natronkeltner
2014-04-09 13:11:45 -05:00
jvazquez-r7
fdf4776142
Land #3217 , @todb-r7's title fix for Hearbleed module
2014-04-09 12:10:13 -05:00
jvazquez-r7
157fb5a905
Make title more searchable
2014-04-09 12:08:35 -05:00
jvazquez-r7
58f4a1c085
Usee loop do instead or while true
2014-04-09 11:48:45 -05:00
sinn3r
eb9d3520be
Land #3208 - Sophos Web Protection Appliance Interface Authenticated Exec
2014-04-09 11:30:59 -05:00
Tod Beardsley
76a9381b2a
Make the title of the Heartbleed module searchable
...
Right now, the title does not actually tie the Heartbeat check to the
Heartbleed attack, so people searching strictly on module title are not
going to get a hit for this module.
2014-04-09 11:03:01 -05:00
jvazquez-r7
bc36b9ebd6
Delete server side PoCs as referecences because don\'t apply here
2014-04-09 10:58:59 -05:00
jvazquez-r7
fd90203120
Change some variable names to make code reading easier
2014-04-09 10:56:50 -05:00
Christian Mehlmauer
899a7c9ea4
heartbleed bugfix for pop3
2014-04-09 17:51:44 +02:00
Tod Beardsley
062175128b
Update @Meatballs and @FireFart in authors.rb
2014-04-09 10:46:10 -05:00
jvazquez-r7
315ca54d5a
Land #3213 , @todb-r7's fix
2014-04-09 10:01:13 -05:00
Tod Beardsley
3849d1517f
Restore author credit
2014-04-09 09:42:39 -05:00
jvazquez-r7
e154d175e8
Add @hmoore-r7's heartbeat client side module
2014-04-09 09:38:11 -05:00
jvazquez-r7
1aa8e35551
Land #3211 , @Firefart's heartbleed comment reference
2014-04-09 09:13:25 -05:00
jvazquez-r7
8d38087a10
Fix case / when indention
2014-04-09 09:12:55 -05:00
Christian Mehlmauer
0e0fd20f88
Added RFC link
2014-04-09 15:19:29 +02:00
Christian Mehlmauer
a0a5b9faa1
Fix heartbleed module
...
-) incorrect length read
-) Parse TLS errors
2014-04-09 15:08:24 +02:00
kyuz0
8126fd1cc3
Merge pull request #1 from OJ/schlamperei
...
Bring build tools up to date, change some project settings
2014-04-09 13:46:04 +01:00
Brandon Perry
8428b37e59
move file to .rb ext
2014-04-09 05:17:14 -07:00
jvazquez-r7
a93e22b5c0
Land #3209 , @Firefart's heartbleed's module fix
2014-04-09 06:38:06 -05:00
AnwarMohamed
96bb3ce561
Merge remote-tracking branch 'upstream/master'
2014-04-09 10:33:06 +02:00
Christian Mehlmauer
9c159f0aa3
Land #3210 , typo in openssl_heartbleed
2014-04-09 09:53:06 +02:00
Meatballs
ae3ead6ef9
Land #2107 Post Enum Domain Users
2014-04-09 11:32:12 +01:00
julianvilas
4e7c675f3c
Fix typo, extraquote in message
2014-04-09 10:22:15 +02:00
Christian Mehlmauer
cdfe333572
updated heartbleed module
...
-) Heartbeat length was added twice
-) Use the current date for the TLS client_hello
2014-04-09 09:19:05 +02:00
joev
b4f5784ba2
Land #3147 , @m-1-k-3's mipsbe exec payload.
2014-04-08 22:32:21 -05:00
Brandon Perry
82c9b539ac
Fix disclosure date, earlier than I thought
2014-04-08 21:43:49 -05:00
Brandon Perry
3013704c75
Create sophos_wpa_iface_exec
...
This module exploits both bugs in http://www.zerodayinitiative.com/advisories/ZDI-14-069/
2014-04-08 21:21:43 -05:00
William Vu
dd69a9e5dd
Land #3206 , OpenSSL Heartbleed infoleak
2014-04-08 20:12:00 -05:00
William Vu
5e314f2a7c
Fix outstanding issues
2014-04-08 20:11:28 -05:00
sinn3r
f3086085b6
Land #3204 - MS14-017 Microsoft Word RTF Object Confusion
2014-04-08 18:47:53 -05:00
jvazquez-r7
a4e1d866e1
Favor nil?
2014-04-08 18:21:49 -05:00
jvazquez-r7
153e003e23
Do small fixes
2014-04-08 18:21:09 -05:00
Joe Vennix
fc841331d2
Add a test on echo to check for hex support.
...
* This is much nicer than checking version on userAgent, which
is often changed when rendered in an embedded webview.
2014-04-08 17:58:31 -05:00
jvazquez-r7
39aecb140a
Use the datastore option
2014-04-08 16:55:08 -05:00
jvazquez-r7
496dd944e6
Add support for datastore TLSVERSION
2014-04-08 16:51:50 -05:00
jvazquez-r7
d51aa34437
Use Random generation Time as pointed by @Firefart
2014-04-08 16:46:15 -05:00
jvazquez-r7
d964243cc4
Move heartbeat length to a variable
2014-04-08 16:33:05 -05:00
jvazquez-r7
3d6c553efd
Fix endianess
2014-04-08 16:29:31 -05:00
jvazquez-r7
373b05c5aa
Minimize extensions in the Hello
2014-04-08 16:21:38 -05:00
jvazquez-r7
3254cce832
Align comment
2014-04-08 16:04:38 -05:00
jvazquez-r7
c20b71e7b6
Switch to vprint unless success
2014-04-08 16:03:38 -05:00
jvazquez-r7
7dbd690c99
Add new references
2014-04-08 16:01:06 -05:00
jvazquez-r7
a55579dd4a
Fix references
2014-04-08 15:56:56 -05:00
jvazquez-r7
4004cd8f9a
Allow hello data to grow dinamically
2014-04-08 15:52:39 -05:00
jvazquez-r7
b8e2c9fe42
Clean and fix @Firefart's code
2014-04-08 15:32:13 -05:00
jvazquez-r7
80bdbbed92
Solve conflict
2014-04-08 15:18:38 -05:00
Christian Mehlmauer
8c7debb81d
Added some comments and modified JABBER
2014-04-08 22:13:02 +02:00
jvazquez-r7
021da84459
Add authors and switch and's format
2014-04-08 15:10:27 -05:00
sinn3r
a2b709b20e
Land #3189 - Vtiger Install Unauthenticated Remote Command Execution
2014-04-08 14:58:34 -05:00
sinn3r
4012dd0acc
Fix everything that needs to be fixed
2014-04-08 14:57:42 -05:00
Christian Mehlmauer
9c053a5b91
Added additional protocols
2014-04-08 21:56:05 +02:00
Fabian Bräunlein
8dce80fd30
Added Big Endianess, improved check()-Function
...
Some Fritz!Box devices also run in Big Endianess mode. However, since
"uname -a" always returns "mips" and the "file"-command is not
available, autodetection is not an easy task.
The check()-function now checks, whether the device is really
vulnerable.
Furthemore, it's possible to send 92 bytes.
2014-04-08 21:32:36 +02:00
William Vu
69ab46e8cd
Land #3205 , prevent Travis autofails on msftidy
2014-04-08 14:15:59 -05:00
jvazquez-r7
5f29026cb2
Complete @Firefart's module
2014-04-08 14:13:56 -05:00
Tod Beardsley
2d0ff4b9fb
Travis shouldn't autofail msftidy fails... yet
...
[SeeRM #8498 ]
2014-04-08 14:05:42 -05:00
Spencer McIntyre
3f6c8afbe3
Fix typo of MSCOMCTL not MCCOMCTL
2014-04-08 14:52:18 -04:00
Spencer McIntyre
85197dffe6
MS14-017 Word RTF listoverridecount memory corruption
2014-04-08 14:44:20 -04:00
Tod Beardsley
eab938c7b4
Get rid of requires, too
2014-04-07 16:39:19 -05:00
Tod Beardsley
17ddbccc34
Remove the broken lorcon module set
...
None of the lorcon / lorcon2 modules have been functional for a long
time, due to the lack of a "Lorcon" gem. It's unclear where it went.
I'm happy to include it and get these working again, but until someone
comes up with some functional code (hint: 'gem install' doesn't work) I
don't see any reason to keep shipping these.
Is there some trick people are doing to make these work? As far as I can
see, they are broken by default.
````
msf auxiliary(wifun) > show options
Module options (auxiliary/dos/wifi/wifun):
Name Current Setting Required Description
---- --------------- -------- -----------
CHANNEL 11 yes The initial channel
DRIVER autodetect yes The name of the wireless driver
for lorcon
INTERFACE wlan0 yes The name of the wireless
interface
msf auxiliary(wifun) > run
[*] The Lorcon2 module is not available: cannot load such file --
Lorcon2
[-] Auxiliary failed: RuntimeError Lorcon2 not available
[-] Call stack:
[-]
/home/todb/git/rapid7/metasploit-framework/lib/msf/core/exploit/lorcon2.rb:67:in
`open_wifi'
[-]
/home/todb/git/rapid7/metasploit-framework/modules/auxiliary/dos/wifi/wifun.rb:29:in
`run'
[*] Auxiliary module execution completed
````
2014-04-07 16:37:10 -05:00
Christian Mehlmauer
ac0cafcca6
Initial commit for openssl Heartbleed bug
2014-04-07 21:15:54 +02:00
coma
44640b126c
Add Oracle Demantra 2013-5795 (Database Credentials Retrieval)
2014-04-07 11:42:47 -07:00
silascutler
7b9b20a07e
Corrected Spaces Issues
...
Removed extra spaces on line 23&24
2014-04-07 14:30:52 -04:00
sinn3r
d385c5ad4b
Fix undefined method `rport' for the check command
2014-04-07 11:48:28 -05:00
joev
2e4c2b1637
Disable Android 4.0, add arch detection.
...
Android 4.0, it turns out, has a different echo builtin than the other androids.
Until we can figure out how to drop a payload on a 4.0 shell, we cannot support it.
Arch detection allows mips/x86/arm ndkstagers to work, unfortunately
x86 ndkstager was not working, so it is disabled for now.
2014-04-07 09:44:43 -05:00
dummys
ca7dcc0781
cleanup with msftidy
2014-04-06 12:41:58 +02:00
Karmanovskii
5dbd124ef9
Update mybb_get_type_db.rb
2014-04-05 02:53:43 -07:00
Karmanovskii
c035715a71
Update mybb_get_type_db.rb
...
Changed the name of the variable _Version_server on _version_server according to the recommendation of jvazquez-r7
2014-04-05 02:50:53 -07:00
dummys
c90c49e319
Add vtiger install rce 0 day
2014-04-04 10:16:55 +02:00
HD Moore
231138da1b
Fix a typo in the nexpose raw importer
2014-04-03 07:12:45 -07:00
Spencer McIntyre
aecd13d314
Tab complete the same case
2014-04-03 09:54:48 -04:00
Spencer McIntyre
1c57c0092c
Tab complete case insensitive module options too
2014-04-02 23:27:11 -04:00
Joe Vennix
55500ea2f3
Avoid the nullchar.
2014-04-02 21:53:12 -05:00
Spencer McIntyre
7d93d28f1d
Support more tab completion features
2014-04-02 21:57:17 -04:00
Joe Vennix
176cc84865
Remove BES and calculate the pid manually.
2014-04-02 17:21:13 -05:00
Christian Mehlmauer
4bf6481242
Added regex option to validate options
2014-04-02 23:51:33 +02:00
OJ
e06ed601cf
Merge branch 'upstream/master' into ext_server_kiwi
2014-04-03 07:19:36 +10:00
HD Moore
9b025347a9
Use a string match vs regex for Android as the OS
2014-04-02 07:52:20 -07:00
HD Moore
b8c5e5ddb7
Refactor host/note reporting for the jenkins module
...
This prevents this module from blindly overwriting the host
fields and instead reports the information as a note that can
be used by the fingerprinting engine. Additionally, consolidate
all jenkins data bits into a single note vs a dozen.
2014-04-02 07:49:39 -07:00
HD Moore
4caeec81f0
Do not blindly overwrite host fields, report fingerprint.match instead
2014-04-02 07:49:10 -07:00
HD Moore
fbec434ab2
Fix up host.os* field usage in the enum_ad_computers module
2014-04-02 07:30:37 -07:00
HD Moore
c6013b8514
Fix use of os_flavor for targeting
2014-04-02 07:24:03 -07:00
HD Moore
a7a0a306f9
Fix usage of os_flavor for target matching
2014-04-02 07:23:30 -07:00
HD Moore
55d9928186
Fix use of os_flavor to ensure correct target matching
2014-04-02 07:21:54 -07:00
HD Moore
be4a366eab
Fix up two modules using the old os_flavor definition
2014-04-02 07:19:47 -07:00
HD Moore
749bcf2473
Report fingerprint.match notes, various cleanups
2014-04-02 07:08:23 -07:00
OJ
670a0c8e0f
Merge branch 'upstream/master' into ext_server_kiwi
2014-04-02 19:36:42 +10:00
OJ
e61e532223
Add support for extraction of wifi profile creds
2014-04-02 17:16:40 +10:00
OJ
1d46e65897
Update to match meterpreter changes
...
This also includes the ability to specify id and groups for the
golden ticket feature.
2014-04-02 12:29:35 +10:00
HD Moore
2bc6668312
Point gemfile to the dependent git repos in github vs local
2014-04-01 08:55:10 -07:00
silascutler
3788f136d9
Update es_enum.rb
...
Updated based on comments.
2014-04-01 11:43:15 -04:00
HD Moore
7e227581a7
Rework OS fingerprinting to match Recog changes
...
This commit changes how os_name and os_flavor are handled
for client-side exploits, matching recent changes to the
server-side exploits and scanner fingerprints.
This commit also updates the client-side fingerprinting to
take into account Windows 8.1 and IE 9, 10, and 11.
2014-04-01 08:14:58 -07:00
HD Moore
b5561cc9ec
Report a fingerprint instead of overwriting host.os_name
2014-03-30 06:32:38 -07:00
HD Moore
76720e9cf8
Small tweaks, see 4611d0a8d0
2014-03-30 06:27:48 -07:00
HD Moore
4611d0a8d0
Update report_host() to match os_* field changes
...
This is part of a bigger change to normalize what os_name, os_flavor, and
os_sp actually mean. To summarize the changes happening in Mdm:
1) The vendor name is being removed from os_name
* "Microsoft Windows" -> "Windows 7"
2) The os_flavor field is being used for the edition of the os_name product
* "7" -> "Enterprise"
3) The os_sp field specifies a version if known and nothing if not
* "SP0" -> "", "Service Pack 2" -> "SP2", etc
2014-03-30 06:23:47 -07:00
HD Moore
dbb192532e
Remove obsolete call to update_host_via_sysinfo()
2014-03-30 06:23:07 -07:00
HD Moore
20bbf7837c
Refactor and integrate smb_fingerprint() for Recog support
2014-03-30 05:52:23 -07:00
Karmanovskii
b11df0eaf0
Update and rename myBB_GetTypeDB.rb to mybb_get_type_db.rb
2014-03-28 16:47:49 -07:00
kenkeiras
3a4f983a6f
Add CVE 2006-5229 reference
2014-03-28 22:35:19 +01:00
kenkeiras
bca0d603ef
SSH user enumeration script
2014-03-28 16:23:52 +01:00
OJ
86ddd24d26
Update to use Rex::Text and change handling a bit
...
This change also outputs blank creds so that users know which
accounts have blank passwords
2014-03-28 16:12:51 +10:00
OJ
65e204e834
Modify the menu item descriptions
2014-03-28 11:03:38 +10:00
OJ
3a42cb8a46
Fix typo in kiwi help
2014-03-28 11:03:03 +10:00
Michael Messner
657b096be3
make msftidy happy
2014-03-27 19:24:25 +01:00
Michael Messner
ad94653fc0
feedback included
2014-03-27 16:12:34 +01:00
Michael Messner
3fc114e265
exec payload - new try
2014-03-26 19:48:14 +01:00
joe
46f7e6060f
Add the updated bins from timwr.
2014-03-25 09:39:53 -07:00
b00stfr3ak
03ad810cf8
Merge pull request #1 from Meatballs1/land_2551
...
Some changes and cleanup.
2014-03-25 09:37:47 -07:00
joe
c71d52e769
Merge branch 'pr-android-bins' of https://github.com/jvennix-r7/metasploit-framework into new-android-bins
2014-03-25 09:35:25 -07:00
jvennix-r7
8d9630a405
Merge pull request #10 from timwr/ndkstager-fix
...
randomize payload filename
2014-03-25 10:59:56 -05:00
Karmanovskii
0b51e7459c
Update myBB_GetTypeDB.rb
...
I have added detection MyBB forum.
2014-03-24 12:19:51 -07:00
Karn Ganeshen
d60b477f50
Adding module description
...
This module scans for PocketPAD login portal, and performs a login brute force attack to identify valid credentials.
2014-03-24 00:25:22 +05:30
Karn Ganeshen
fb659dd434
Adding module description
...
This module scans for EtherPAD Duo login portal, and performs a login brute force attack to identify valid credentials.
2014-03-24 00:21:15 +05:30
HD Moore
903af02e08
Store at most one http.fingerprint per host/port, revert http_version
2014-03-23 10:42:20 -07:00
Tim
25ca0552e0
cleanup files after exploit
2014-03-23 17:00:29 +00:00
HD Moore
f80b9d50f0
Prevent duplicate signatures by using http_fingerprint() without args
2014-03-23 09:59:34 -07:00
Tim
f9972239cf
randomize payload filename
2014-03-23 16:36:26 +00:00
HD Moore
f349f85a70
Reimplement HTTP fingerprinting, backwards compatible
...
This commit changes the internals of HTTP fingerprinting to store
a whole trove of data about the HTTP response using a hash. The
current API is backwards compatible and has been tested with a
number of modules that depend on HttpFingerprint being sent.
In addition, this change paves the way for advanced fingerprints
that take advantage of the HTTP body and other headers. This is
a requested addition documented across various module comments.
Finally, this commit completes the closed loop for OS identification
by connecting MSF to MDM to Recog and applying Recog databases for
HTTP Servers, HTTP Cookies, and HTTP Authentication headers to the
results of HTTP fingerprinting runs.
For example, with the appropriate version of MDM/Recog in place,
a http_version scan of Microsoft-IIS/7.0 server will update the
host.os_name field to 'Windows 2008'.
2014-03-23 07:26:11 -07:00
Meatballs
d53b56c161
Tidy up
2014-03-22 18:38:58 +00:00
Meatballs
b524507e4e
Merge remote-tracking branch 'upstream/master' into land_2551
...
Conflicts:
modules/exploits/windows/local/ask.rb
2014-03-22 18:14:45 +00:00
Meatballs
7b2f0a64fc
Tidy up
2014-03-22 18:07:57 +00:00
Meatballs
04506d76f3
Dont check for admin
2014-03-22 17:57:27 +00:00
OJ
11f9bfadb1
Final bits of documentation and code tweaking
2014-03-19 18:40:53 +10:00
OJ
84728c9fc9
Code tidying and defaulting to empty strings for table format
2014-03-19 16:19:23 +10:00
OJ
959cedb9b1
Bit more code tidying
2014-03-19 16:19:05 +10:00
OJ
f80c7b7b51
Fix silly typo
2014-03-19 15:55:12 +10:00
OJ
0dcf992781
Add comments to the kiwi source
2014-03-19 15:45:53 +10:00
OJ
3635fff98e
Add support for kerberos ticket enumeration
...
Fix up a bunch of other issues and do some code tidies too.
2014-03-19 14:25:11 +10:00
silascutler
d361597104
Update es_enum.rb
2014-03-18 09:20:04 -04:00
OJ
91e198fd63
Add SAM key dump in LSA dumping output
2014-03-18 09:45:31 +10:00
OJ
dfb4b22015
Merge branch 'upstream/master' into ext_server_kiwi
2014-03-18 08:08:45 +10:00
silascutler
ad4c354460
Update es_enum.rb
...
Corrected changes from dev module
2014-03-17 13:38:33 -04:00
Silas Cutler
975c2adbad
Fixed spaces issues
2014-03-17 13:34:45 -04:00
Silas Cutler
b032f2c270
Added Elastic Search Enum
2014-03-17 13:31:24 -04:00
OJ
409787346e
Bring build tools up to date, change some project settings
...
This commit brings the source into line with the general format/settings
that are used in other exploits.
2014-03-14 22:57:16 +10:00
OJ
a9758413c0
Add lsa secret dumps plus other tweaks
2014-03-14 19:50:01 +10:00
kyuzo
41720428e4
Refactoring exploit and adding build files for dll.
2014-03-12 10:25:52 +00:00
Joe Vennix
facd743f1f
Oops. Add missing dir to dalvikstager path.
2014-03-11 19:48:39 -05:00
Joe Vennix
679cb03ac3
Yank armeabi-v7a bins.
2014-03-11 13:09:50 -05:00
Joe Vennix
15b1a5931c
Remove extra resources from android reverse_http(s).
2014-03-11 11:56:05 -05:00
Joe Vennix
5c2168513a
Update path in #dalvikstager.
2014-03-11 11:03:36 -05:00
Joe Vennix
aa500f1ac2
Merge branch 'new-android-bins' into pr-android-bins
2014-03-10 21:52:24 -05:00
Tim
c76924e946
native jni stager
2014-03-10 21:50:00 -05:00
Tim
4f31eba7f4
android payload golf
2014-03-10 21:50:00 -05:00
AnwarMohamed
ad8b0ef3d1
using http(s)://LHOST:LPORT
2014-03-10 21:50:00 -05:00
AnwarMohamed
b45524ecdd
generate cert @ payload/dalvik.rb
2014-03-10 21:50:00 -05:00
AnwarMohamed
99cc94e6fc
moving string_sub() to payload/dalvik.rb
2014-03-10 21:49:59 -05:00
AnwarMohamed
dc8992924f
android reverse_http/s
2014-03-10 21:49:59 -05:00
joe
66ff5998a5
New multi-arch stagers.
2014-03-10 21:49:56 -05:00
joe
60b5191873
New meterpreter bins for testing.
2014-03-10 21:49:14 -05:00
joe
667bed8905
New multi-arch stagers.
2014-03-10 18:50:27 -07:00
root
3c95c021d0
Reference added
2014-03-10 12:17:20 +01:00
root
1fda6b86a1
Changed cmp eax by inc eax. Saved one byte
2014-03-10 12:13:10 +01:00
joe
6616d36d63
New meterpreter bins for testing.
2014-03-07 13:21:30 -08:00
Karmanovskii
6d748f49d3
Update myBB_GetTypeDB.rb
...
1.I added comment header;
2.I made a link to your account as a comment;
3.I added a link https://github.com/rapid7/metasploit-framework/pull/3070
Items 2 and 3 on the advice wchen-r7
2014-03-07 10:49:30 -08:00
kyuzo
257c121c75
Adding MS013-058 for Windows7 x86
2014-03-06 20:34:01 +00:00
kyuzo
2a1e96165c
Adding MS013-058 for Windows7 x86
2014-03-06 18:39:34 +00:00
Karmanovskii
162527c0e4
Update and rename modules/auxiliary/analyze/myBB_GetTypeDB.rb to modules/auxiliary/gather/myBB_GetTypeDB.rb
...
Minor changes and bug: "Msf :: Auxiliary" - forgot to change
2014-03-06 09:43:23 -08:00
Tim
1e14ec7f6c
native jni stager
2014-03-04 11:28:45 +00:00
Etienne Stalmans
e452b81fb1
style changes as suggested by @jlee-r7
2014-03-04 08:49:52 +02:00
OJ
e0438f570b
Merge branch 'upstream/master' into ext_server_kiwi
2014-03-03 17:28:44 +10:00
Meatballs
8dee9b22c3
Reinstate to_byte_array
2014-03-02 22:07:47 +00:00
Meatballs
2acd0a1b1e
Reinstance encode_code
2014-03-02 21:03:31 +00:00
Meatballs
2885ebcb40
Merge remote-tracking branch 'upstream/master' into pr2075
2014-03-02 20:57:02 +00:00
Meatballs
0956ae5789
Fix payload selection
2014-03-02 20:56:55 +00:00
Meatballs
1ca690eccf
Do some rspec
2014-03-02 20:37:08 +00:00
Meatballs
c9a2135959
Merge in semperv
2014-03-02 19:07:13 +00:00
AnwarMohamed
b14f3cab46
Revert "android reverse_http/s"
...
This reverts commit 65ada24d9e .
2014-02-26 04:32:18 +02:00
AnwarMohamed
65ada24d9e
android reverse_http/s
2014-02-26 01:44:09 +02:00
Tim
255d2c4db9
android payload golf
2014-02-25 23:28:00 +00:00
staaldraad
0dfa53840a
Add @Meatballs1 to authors
...
Add @Meatballs1 to author list, awesome changes and fixes to the code (almost complete rewrite)
2014-02-22 12:24:56 +02:00
kn0
4ac8e23e48
Changed to clearner solution proposed by @limhoff-r7.
2014-02-21 15:31:12 -06:00
kn0
fcfb48fda1
Added support for Gemfile.local
2014-02-21 13:37:31 -06:00
jakxx
c8940c37f5
Updating References
2014-02-21 09:23:08 -05:00
jakxx
ef51de3826
Updating References
2014-02-21 09:21:08 -05:00
jakxx
b5bc3dd4fc
Added py_web_delivery
2014-02-20 21:53:00 -05:00
jakxx
1834784b93
Added php_web_delivery
2014-02-20 13:41:26 -05:00
jakxx
45d554e6d9
Delete powershell_psexec.rb
2014-02-20 12:01:04 -05:00
jakxx
0a63b40572
Merge remote-tracking branch 'upstream/master'
2014-02-20 11:48:41 -05:00
root
b4a22aa25d
hidden bind shell payload
2014-02-20 16:19:40 +01:00
j0hnf
c62fa83a70
msf recommended changes + tweaked exception handling
2014-02-19 22:20:24 +00:00
Karmanovskii
396ff8adaa
Rename modules/auxiliary/analyse/myBB_GetTypeDB.rb to modules/auxiliary/analyze/myBB_GetTypeDB.rb
...
Sorry again :(
2014-02-19 11:33:57 -08:00
Karmanovskii
81e89eadba
Rename modules/exploits/multi/http/myBB_GetTypeDB to modules/auxiliary/analyse/myBB_GetTypeDB.rb
...
On the advice of "wvu-r7" moved module.
2014-02-19 10:21:05 -08:00
staaldraad
fa3ba44ad5
Merge pull request #4 from Meatballs1/enum_domain_users_update
...
Enum domain users update
2014-02-18 23:15:10 -05:00
Meatballs
ff4e91bb1b
Check domain return value
2014-02-18 23:34:17 +00:00
Meatballs
e4aedfad43
Fixup netapi call
2014-02-18 23:30:29 +00:00
Meatballs
c06f86cc2b
Updates
2014-02-18 20:31:31 +00:00
Meatballs
6f988209ab
Merge remote-tracking branch 'upstream/master' into enum_domain_users_update
2014-02-18 20:02:39 +00:00
j0hnf
4b247e2b9f
altered check_dir_file.rb so that it can check for the presence of a list of files/directories supplied using file:/ format rather than being limited to just the one file, handy for checking for indicators of compromise
2014-02-16 03:22:11 +00:00
scriptjunkie
022c52d087
Added bundling to handle many sessions at once.
2014-02-15 15:37:22 -06:00
scriptjunkie
c0983138a0
Fix wrapping errors on long domains.
2014-02-15 15:21:16 -06:00
scriptjunkie
b0d2949f9a
Ensure no race conditions on handlers
...
Configurable WfsDelay
2014-02-15 15:21:16 -06:00
scriptjunkie
a83ca2b8d6
Ghost sessions fix, fewer selfies, cleaner code
2014-02-15 15:21:16 -06:00
scriptjunkie
9c8c16d238
Allow multiple handlers to use same hop.
2014-02-15 15:21:16 -06:00
scriptjunkie
16e1280b8d
Style guide fixes.
2014-02-15 15:21:16 -06:00
scriptjunkie
a6a731c8ee
Keep stage until replaced, nil check, prettify.
2014-02-15 15:21:16 -06:00
scriptjunkie
62f42c57a9
Add instructions for uploading hop.php
2014-02-15 15:21:16 -06:00
scriptjunkie
85ae32775a
Fix to make migrate work; use the full URL.
2014-02-15 15:21:16 -06:00
scriptjunkie
5f7a0e162c
Add reverse_hop_http stager and handler
2014-02-15 15:21:16 -06:00
Meatballs
b8b36ef528
Merge remote-tracking branch 'upstream/master' into pr2075
2014-02-14 22:52:55 +00:00
Karmanovskii
f9f2c401ca
Create myBB_GetTypeDB
...
This exploit allows you to specify the type of database forum Mybb.
Works by the operator wrongly used REGEXP. Which is not supported in postgreSQL and SQLite databases.
2014-02-14 13:12:43 -08:00
RageLtMan
0056c26047
import msf exploit
2014-02-12 22:06:18 -05:00
RageLtMan
29bf296b61
import rex powershell
2014-02-12 16:45:57 -05:00
RageLtMan
b453362a52
Merge remote-tracking branch 'upstream/pr/2966' into integrate_with_meatballs
2014-02-12 16:43:30 -05:00
Meatballs
a4b451dbc0
Ensure we start in a new conhost/process
2014-02-09 23:36:25 +00:00
Meatballs
aa93299931
Sleep instead of noexit
2014-02-09 23:19:14 +00:00
Meatballs
b79bb4726d
Go for background approach
2014-02-09 19:41:24 +00:00
Meatballs
038aae5adb
Run as jobs
2014-02-09 19:30:16 +00:00
Meatballs
1c169e2935
Uniq results
2014-02-09 17:52:06 +00:00
Meatballs
6972b8eb7b
Merge branch 'pr2075' into powershell_remoting
2014-02-09 17:46:08 +00:00
Meatballs
c76341c82d
Dont dsub Invoke-Command etc...
2014-02-09 17:45:30 +00:00
Meatballs
2cea90f931
Working remoting
2014-02-09 17:43:44 +00:00
Meatballs
151e45d8d1
Better exception descriptions
2014-02-09 12:52:56 +00:00
Meatballs
77dda5dc67
Give option to remove badchars
2014-02-09 12:34:25 +00:00
Meatballs
0379dc128c
Raise exception on known issues
2014-02-09 12:15:02 +00:00
Meatballs
a00481beb4
Auto target psexec/psh_web
2014-02-09 11:47:15 +00:00
Meatballs
1f9b452425
Dont tidy up template yet
2014-02-09 11:23:39 +00:00
Meatballs
f1959f5313
Fixup WMI
2014-02-09 11:18:15 +00:00
Meatballs
02f1ff27ee
Add option to encode inner payload
2014-02-09 00:55:26 +00:00
Meatballs
f398c982e3
Include option to ensure payload is fully encoded
2014-02-08 23:51:13 +00:00
Meatballs
ad308efc05
Really minimize commandline size
2014-02-08 22:53:47 +00:00
Meatballs
c37cb5075c
Merge remote-tracking branch 'upstream/master' into pr2075
2014-02-08 22:11:31 +00:00
Meatballs
c76862b391
Reduce payload size
2014-02-08 22:11:17 +00:00
Meatballs
b10df54dbb
Dont need to encode the compress payload
2014-02-08 21:34:51 +00:00
Meatballs
09c48358f4
Retab rex powershell
2014-02-08 20:43:04 +00:00
Karn Ganeshen
4c01420f38
msftidy done
2014-02-06 16:52:39 +02:00
Karn Ganeshen
036ae2fd80
msftidy done
2014-02-06 16:25:41 +02:00
Karn Ganeshen
2c0ce2dffc
PocketPAD login
2014-02-05 20:22:52 +02:00
Karn Ganeshen
32e46c00d3
Rename ehterpadduo_login.rb to etherpadduo_login.rb
2014-02-05 20:21:16 +02:00
Karn Ganeshen
73418a975a
Rename ehterpadduo_login to ehterpadduo_login.rb
2014-02-05 20:20:30 +02:00
Karn Ganeshen
88b2e6b1c3
EtherPAD Duo Login
...
I've run it through retab. Msfpro loads the module fine. msftidy seems broken though. Gives this on run:
msftidy.rb:444: undefined (?...) sequence: /(?<!\.)datastore\[["'][^"']+["']\]\s*=(?![=~>])/
BR
2014-02-05 20:17:11 +02:00
Ahmed Elhady Mohamed
003c1276cd
The module has been updated
2014-01-28 00:31:02 +02:00
dukeBarman
88c283880a
Fix bugs
2014-01-18 17:04:46 -05:00
dukeBarman
766c408d86
Add CVE-2013-0634: Adobe Flash Player 11.5 memory corruption
2014-01-18 11:07:11 -05:00
Ahmed Elhady Mohamed
c6c37fe7b5
arbitrary file upload vulnerability found in GetSimple CMS by abusing
2014-01-17 06:35:33 +02:00
OJ
524bbceb1a
Merge branch 'upstream/master' into ext_server_kiwi
2014-01-17 11:53:07 +10:00
jiuweigui
5f5ca1c011
Minor fix based on suggestions
2014-01-14 20:56:14 +02:00
jiuweigui
9a81420e90
Enumerate WinXP/7 MUICache registry key
2014-01-10 13:21:47 +02:00
OJ
0f722cbe6d
Add ext_server_kiwi, which is Mimikatz v2
...
This is a separate extension because the new version doesn't support
as many operating systems as the old version, but it does have more
new features which are really funky.
2014-01-10 16:51:01 +10:00
Meatballs1
c6d1f3bbc8
Merge pull request #31 from todb-r7/pr1421-unconflict
...
Unconflict rapid7/metasploit-framework#1421
2014-01-01 07:37:20 -08:00
Tod Beardsley
feaf6c23cf
Merge and Unconflict client.rb, new module splat
...
The only conflict was the regex option for no encoding, which was added
after @Meatballs1's original PR for rapid7/metasploit-framework#1421
Also fixes the module with the new license splat.
Conflicts:
lib/rex/proto/smb/client.rb
2013-12-30 16:53:13 -06:00
Meatballs
435cc9b93f
Add single quote encapsulation
...
For WMI and psh_web_delivery
2013-12-16 15:13:13 +00:00
Meatballs
b252e7873b
Merge remote-tracking branch 'upstream/master' into pr2075
2013-12-16 14:29:05 +00:00
b00stfr3ak
0cf1b7fece
add original ask.rb
2013-12-09 14:35:31 -07:00
b00stfr3ak
1d07b2bbfa
Revert "removed ask file, already in pull request 2551"
...
This reverts commit 5ceda7c042 .
2013-12-09 14:31:43 -07:00
Meatballs
cd68b10bcf
Broadcast needs a decent WfsDelay.
...
Due to the multi railgun changes. Because they return quickly but
the process is still broadcasting them the exploit thinks work has
finished...
2013-11-23 19:18:13 +00:00
Meatballs
6c83109422
Really fix wmi
2013-11-23 16:44:44 +00:00
Meatballs
259d5a2dba
Backout Set-Variable as it is 3.0 only
2013-11-23 01:15:13 +00:00
Meatballs
1c60373f68
Reinstate %COMSPEC%
2013-11-23 00:45:04 +00:00
Meatballs
c194fdc67e
Fixup WMI
...
-c doesn't like $var assignments
2013-11-23 00:31:11 +00:00
Meatballs
ec36cebeb4
Update cmd_psh_payloads to send the architecture.
2013-11-22 23:31:33 +00:00
Meatballs
622a1dccda
Update wmi to use generated powershell command line
2013-11-22 23:18:22 +00:00
Meatballs
9835649858
Update hwnd_broadcast to use generated powershell command line.
2013-11-22 23:04:44 +00:00
Meatballs
c5007f67ab
Retab psexec_psh
2013-11-22 23:00:36 +00:00
Meatballs
3cbf768d16
Small size reductions
2013-11-22 22:58:42 +00:00
Meatballs
20b76602a1
Merge remote-tracking branch 'upstream/master' into pr2075
...
Conflicts:
lib/msf/core/exploit/powershell.rb
2013-11-22 22:41:08 +00:00
Rich Lundeen
c3113f796e
Incorporating a few more cleanup items from jvazquez
2013-10-31 21:32:58 -07:00
Rich Lundeen
cbfef6ec7a
incoporating jvazquez feedback
2013-10-31 00:17:50 -07:00
b00stfr3ak
5ceda7c042
removed ask file, already in pull request 2551
2013-10-25 14:46:50 -07:00
b00stfr3ak
a476595ddb
Added require to post/windows
2013-10-25 14:42:22 -07:00
b00stfr3ak
84999115d7
Added PSH option if UAC is turned off
...
This will give the option to drop an exe or use psh if uac is turned
off. The lib can be used for post exploitation to drop an exe or use
powershell and then execute it with the runas command. I have used the
lib for both bypassuac and ask.
2013-10-25 14:37:12 -07:00
b00stfr3ak
868b70c9ed
Added priv lib and runas lib
...
Cleaned up code with using the new lib files
2013-10-25 14:05:33 -07:00
b00stfr3ak
c2a69239ee
Merge remote-tracking branch 'upstream/master'
2013-10-23 12:08:05 -07:00
b00stfr3ak
a5eb61c6f9
Merge remote-tracking branch 'upstream/master'
2013-10-23 09:54:30 -07:00
b00stfr3ak
a06c0a9575
Merge branch 'local/ask'
2013-10-22 16:06:16 -07:00
b00stfr3ak
69131323af
Merge remote-tracking branch 'upstream/master'
2013-10-22 16:05:19 -07:00
Meatballs
4fc8bb2b4b
Auto arch detection
2013-10-22 00:42:59 +01:00
b00stfr3ak
9695b2d662
Added check method
...
The method checks to see if the user is a part of the admin group. If
the user is the exploit continues, if not the exploit stops because it
will prompt the user for a password instead of just clicking ok.
2013-10-21 11:57:50 -07:00
b00stfr3ak
6881774c03
Updated with comments from jlee-r7 and Meatballs1
...
Added fail_with instead of just print_error
figured a way to execute the cmd_psh_payload with out using gsub
added case statment for datastore['TECHNIQUE']
2013-10-20 01:15:51 -07:00
b00stfr3ak
6de279733c
Merge branch 'local/ask'
2013-10-19 10:51:55 -07:00
b00stfr3ak
a5dc75a82e
Added PSH option to windows/local/ask exploit
...
Gives you the ability to use powershell to 'ask' for admin rights if the
user has them. Using powershell makes the pop up blue instead of orange
and states that the company is Microsoft, it also doesn't drop an exe
on the system. Looks like 32 bit https works but if you migrate out you
loose priv and if you run cachedump the session hangs.
2013-10-19 00:15:38 -07:00
Meatballs
971d0b7536
Generate args
2013-09-27 12:48:10 +01:00
Meatballs
5add142789
Choose smallest smallest
2013-09-20 13:47:51 +01:00
Meatballs
9aca98a9d4
Dont need to bypass
2013-09-17 19:12:49 +01:00
Meatballs
d6f2da690a
Fix web delivery
2013-09-13 21:27:59 +01:00
Meatballs
60328d5b2a
Bypass no profile and hidden by default
2013-09-13 21:22:15 +01:00
Meatballs
b4d1fd6ff8
Fixup rex text
2013-09-13 21:15:28 +01:00
Meatballs
5a5b67b393
Get lastest exe
2013-09-13 21:01:04 +01:00
Meatballs
2b6445385c
Merge
2013-09-13 20:46:54 +01:00
Meatballs
df19d69e62
Merge branch 'master' of github.com:rapid7/metasploit-framework into pr2075
2013-09-13 20:43:49 +01:00
Meatballs
9ade4cb671
Refactor
2013-09-13 20:43:09 +01:00
Meatballs
aa4ad2b005
Change to ' and remove "
2013-09-13 20:23:18 +01:00
Meatballs
243d3d6ebd
Apply comments
2013-09-13 19:19:54 +01:00
Meatballs
b241b5a894
Apply comments
2013-09-13 19:15:39 +01:00
Meatballs1
7c7b571392
Merge pull request #24 from tabassassin/retab/pr/1421
...
Retab/pr/1421
2013-09-05 14:45:15 -07:00
Tab Assassin
785c2eeb95
Retab changes for PR #1421
2013-09-05 16:20:04 -05:00
Tab Assassin
a5cf67a9af
Merge for retab
2013-09-05 16:19:51 -05:00
staaldraad
b72f42552d
Merge pull request #3 from tabassassin/retab/pr/2107
...
Retab/pr/2107
2013-09-05 13:06:40 -07:00
Tab Assassin
874ed2ac17
Retab changes for PR #2107
2013-09-05 14:30:08 -05:00
Tab Assassin
27564b2de2
Merge for retab
2013-09-05 14:30:03 -05:00
Tab Assassin
6b330ad39f
Retab changes for PR #2134
2013-09-05 14:24:37 -05:00
Tab Assassin
52ce6afd99
Merge for retab
2013-09-05 14:24:31 -05:00
staaldraad
79a127788a
Merge pull request #2 from Meatballs1/pr2107
...
Spacing and bugfixes
2013-09-02 21:22:47 -07:00
Meatballs
13244efecf
Spacing and bugfixes
2013-09-02 21:57:11 +01:00
staaldraad
3e1efbfa2d
Merge pull request #1 from Meatballs1/pr2107
...
Refactor to common post module
2013-09-02 13:17:40 -07:00
Meatballs
051ef0bdfa
Refactor to common post module
2013-09-02 20:24:54 +01:00
RageLtMan
2c850d8f8b
Merge branch 'powershell_import' of github.com:sempervictus/metasploit-framework into powershell_import
2013-07-31 18:39:46 -04:00
RageLtMan
7c46e95e8f
Merge branch 'master' of https://github.com/rapid7/metasploit-framework into powershell_import
2013-07-31 18:34:57 -04:00
RageLtMan
976c058941
Merge pull request #5 from Meatballs1/psh_merge
...
Looks good from here, though we may want to address the all caps opt names.
2013-07-29 23:17:55 -07:00
Meatballs
d2e57eaf4e
Merge remote-tracking branch 'origin/psh_merge' into psh_merge
2013-07-29 15:33:14 +01:00
Meatballs
e1cfe7cfe2
Update datastore changes
2013-07-29 15:31:59 +01:00
Meatballs
59a2c7e940
Merge Upstream Exploit::Powershell
2013-07-29 15:24:29 +01:00
Meatballs
eb3f83f26f
Merge remote-tracking branch 'remotes/semperv/powershell_import' into psh_merge
...
Conflicts:
modules/exploits/windows/smb/psexec_psh.rb
2013-07-29 15:17:52 +01:00
Meatballs
176de5a380
Selective psexec_psh merge.
2013-07-29 15:13:59 +01:00
RageLtMan
b3fab9a342
Fix git branch mauling - reintroduce psexec_psh
...
Replace powershell lib which snuck in as psexec_psh.
Introduce psexec_psh module which uses the Rex and Msf PSH
methods provided in the lib import.
2013-07-28 19:23:37 -04:00
jakxx
6b64819ddc
Updated Description
2013-07-25 16:50:21 -04:00
jakxx
b26c24954f
Merge remote-tracking branch 'upstream/master'
2013-07-22 12:35:39 -04:00
RageLtMan
4df3b0215c
replace lib/msf/core/exploit/powershell.rb, thanks @Meatballs1
2013-07-20 19:55:01 -04:00
RageLtMan
9d93891395
Import old powershell post lib from master
...
This is temporary and rather messy. Since the internals for
dealing with PSH code have moved to Rex there may be a hiccup or
two here. This was my original attempt at basic PSH integration
and does not make use of the new libraries and namespaces in
this PR.
Will introduce the updated modules and libraries in separate PR.
2013-07-20 19:33:19 -04:00
RageLtMan
eb185375f7
Trim to core requirements
...
Remove .NET compiler, post lib and modules.
2013-07-20 19:31:26 -04:00
RageLtMan
dc15c5b505
Merge branch 'master' into powershell_import
...
Resolve conflicts from old code being pulled into master.
Conflicts:
lib/msf/core/exploit/powershell.rb
modules/exploits/windows/smb/psexec_psh.rb
2013-07-20 19:29:55 -04:00
RageLtMan
cd14569dcf
Revert "post/local_admin_search_enum~Regex fails,module 2"
...
@g0tm1lk: no clue, you must've pwned me in your sl33p. :)
2013-07-20 19:26:03 -04:00
Rich Lundeen
12e48e252f
one more logdir fix, tested
2013-07-20 10:40:06 -07:00
Rich Lundeen
5fd8d53378
fixed bug with default logdir
2013-07-20 10:35:25 -07:00
Rich Lundeen
183cd7337d
added ability to execute larger scripts
2013-07-19 15:24:51 -07:00
jakxx
ba45e4e60c
Removed Revision
2013-07-19 11:09:48 -04:00
jakxx
f402e00a15
Added powershell psexec module
2013-07-19 10:04:49 -04:00
staaldraad
d3903aaeac
changed to use already defined netapi32.NetServerEnum - tested
2013-07-16 06:49:05 +02:00
staaldraad
dfa8c86408
updated enum_domain_users with Meatballs1 suggestions
2013-07-16 06:41:58 +02:00
staaldraad
7c48441d53
added enum_domain_users post module
2013-07-15 22:02:46 +02:00
RageLtMan
4554cc6e51
Import Powershell libs and modules (again)
...
Add Rex powershell parser:
reads PSH, determines functions, variables, blocks
compresses and cleans up the code it's read, obfuscates
handles string literals and reserved variable names
extracts code blocks and functions for reuse
turns powersploit into a useful sub-component for MSF
Rewire Msf powershell modules
Make use of Rex parser
Handles payload generation, substituions
Brings convenience methods - byte array generation and download
Re-add .NET compiler
Compiles .NET code (C#/VB.NET) in memory
Can generate binary output file (dynamic persistence)
Handles code-signing (steal cert with mimikatz, sign your bin)
Not detected by AV (still...)
Update payload generation
GZip compression and decompression (see Rex module as well)
msftidy violations for space efficiency - each char counts
Re-submit psexec-psh
Makes use of updated Msf and Rex modules
Runs shellcode in-memory (in a hidden PSH window)
Completely bypasses all AVs tested for the last year...
2013-07-04 14:04:19 -04:00
g0tmi1k
595e538783
post/local_admin_search_enum~Regex fails,module 2
...
If the regex fails then the entire moudle would too
2013-07-04 13:27:07 -04:00
Meatballs
739204b86d
Build upon A.Maloteaux's SMB fixes
2013-01-31 20:17:25 +00:00
Meatballs
1e60817ec9
Remember the SMB Changes
2013-01-31 20:07:48 +00:00
Meatballs
edc61a1986
Repull
2013-01-31 20:02:10 +00:00